Last week, the U.S. Court of Appeals for the Ninth Circuit affirmed lower-court dismissals of two lawsuits under California’s “Shine the Light” law.  Shine the Light (or “STL”) requires businesses that disclose customers’ personal information to third parties for those parties’ direct marketing purposes to respond to customer requests for information about such disclosures.  The law also requires businesses to notify customers about the procedure for submitting a request for this information (e.g., by including the business’s contact information in a website privacy policy). 

In late 2011 and early 2012, plaintiffs filed a number of lawsuits alleging that companies violated STL by failing to provide a compliant procedure for making an STL request (i.e., a request for information about the company’s disclosure of the plaintiff’s personal information to third parties).  The suits were dismissed by lower courts, which reasoned that a company’s failure to provide contact information for submitting an STL request is not enough to give plaintiffs a right to sue the company under STL; a plaintiff must actually have made, or attempted to make, an STL request. 

Plaintiffs have fared no better before appellate courts.  Late last year, the California Court of Appeal affirmed the dismissal of an STL suit against CBS Interactive.  And last week, in two brief, unpublished opinions, the Ninth Circuit affirmed dismissals of suits against Conde Nast and Hearst.  The court held that because the plaintiffs “failed to allege [they] submitted a request to [the defendants], or that they would have, had accurate information been provided, [they] lack[ed] standing to sue under the STL law.”