A federal judge has resurrected a privacy class action lawsuit against Salesforce, a cloud-based software company that boasts of its ability to connect clients to customers online, saying plaintiffs have done enough to show that Salesforce does collect and store, and potentially use, information about people using some of its online chat products.
On Aug. 16, U.S. District Judge Jon S. Tigar rejected a bid from Salesforce to dismiss a revised version of the action accusing the company of violating California's law governing online privacy and data collection.
The lawsuit was first brought in 2022 by attorneys with the firm of Bursor & Fisher, of Walnut Creek and New York. The lawsuit was filed on behalf of named plaintiff Patrick Yockey, identified as a resident of New Kensington, Pennsylvania.
Jon S. Tigar
| cand.uscourts.gov
The plaintiffs seek to expand the action to include a class of additional plaintiffs numbering in the thousands.
The lawsuit centers on claims that San Francisco-based Salesforce violated the Pennsylvania Wiretap Act and the California Invasion Privacy Act by allegedly improperly intercepting and storing data and communications from people using a Salesforce-created and -supported chat function to communicate with businesses who are Salesforce clients.
The lawsuit singles out chat communications between customers and the Rite Aid pharmacy chain and hospital and health services provider Kaiser Permanente, both of which allegedly use products created and supported by Salesforce to communicate with customers online.
According to the complaint, those communications are routed through Salesforce servers where the communications are allegedly "used by Salesforce to ... secretly observe, record, and analyze Website visitors' electronic communications in real time." Such storage and analysis allegedly allows Salesforce to glean so-called Personally Identifiable Information and health information that would otherwise be protected by the privacy laws, according to the lawsuit.
Rite Aid and Kaiser are not named as defendants in this action.
The lawsuit was initially dismissed by Tigar, after the judge agreed that the plaintiffs had not sufficiently demonstrated that Salesforce actually retains their information, and doesn't just pass it on to the client using the chat feature.
However, the plaintiffs filed a revised version of the lawsuit, which allegedly demonstrates that Salesforce does, in fact, glean and retain the information, allegedly sending customer chats to "Salesforce's Einstein data intelligence platform" to "train the AI models that form the basis of some of its services."
The plaintiffs assert this allows Salesforce to improve its products and bolster its business.
And since customers did not intend for Salesforce to obtain their otherwise confidential communications with Rite Aid and Kaiser, the judge said that is enough to support plaintiffs' claims that the Salesforce "intercepted" the communications improperly.
Further, the judge rejected Salesforce's contention that the California privacy law cannot be extended to apply to Yockey, particularly. Even though Yockey lives in Pennsylvania, the judge said his communications with Kaiser, through Salesforce, essentially occurred in California, since both companies are based there.
The ruling means plaintiffs will have the opportunity, for now, to press their claims against Salesforce in court.
Plaintiffs are represented by attorneys L. Timothy Fisher, Joseph I. Marchese and Max S. Roberts, of Bursor & Fisher.
Salesforce is represented by attorneys Tiffany Cheung, Emani N. Oakley, Peter M. Skinner, Elisabeth Hutchinson and Erik Manukyan, of the firm of Morrison & Foerster, of San Francisco, New York, Denver and Los Angeles.