LOS ANGELES, CA—The Ninth Circuit has granted en banc review in Briskin v. Shopify of the three-judge panel’s earlier decision dismissing a California resident’s digital privacy claims against a foreign company.

Briskin’s Claims and Essential Facts

Briskin is a California resident who sued Shopify, Inc., a Canadian company, and two of its USA affiliates, both organized under the laws of Delaware and principal places of business located outside of California. Shopify is an e-commerce platform that provides online payment processing solutions to various merchants in the USA. The heart of Briskin’s claims centered on allegations that Shopify extracted and retained consumer data and tracked consumers in violation of California law. Specifically, Briskin alleged violations of the California Invasion of Privacy Act (CIPA) (Cal. Pen. Code §§ 631, 635); the California Computer Data Access and Fraud Act (CDAFA) (Cal. Penal Code § 502); Invasion of Privacy Under California’s Constitution; Intrusion Upon Seclusion); and the California Unfair Competition Law (UCL) (Cal. Bus. & Prof. Code § 17200, et seq).

The District Court Dismiss for Lack of Personal Jurisdiction

The threshold question presented before the District Court, the United States District Court for the Northern District of California, Case No. 21-cv-06269 (Judge Phyllis J. Hamilton) was whether the Court could exercise jurisdiction over the foreign and out-of-state defendants given their limited contacts with the forum state in question, California, ultimately concluding that the Court lacked jurisdiction over the defendants and dismissed the complaint in its entirety.

Ninth Circuit Panel Affirms District Court’s Dismissal A three-judge panel of the Ninth Circutit affirmed the dismissal.

Judge Daniel A. Bress, writing for the unanimous panel (Judges Consuelo M. Callahan, Bridget S. Bade, and Daniel A. Bress) noted that the case was one of first impression. Here is how the panel articulated the issue: “In this case of first impression, we are asked to decide whether defendants' extracting and retaining of consumer data and their tracking of customers exposes them to personal jurisdiction in California, where a consumer made his online purchase. We hold that the defendants are not subject to specific jurisdiction in California because they did not expressly aim their suit-related conduct at the forum state.” The panel examined the relevant precedent and found a dearth of case law addressing the issue of “expressly aiming” fact patterns in the case of online payment platforms. As a result, the panel focused on cases analyzing interactive websites to distill principles for analyzing the express aiming inquiry for personal jurisdiction purposes in the context of “consumer data collection and retention.” Ultimately, the panel determined that the District Court properly dismissed Briskin’s complaint against Shopify on personal jurisdiction grounds.

The Ninth Circuit Grants Review of the Panel’s Decision

But, on May 14, 2024, the Ninth Circuit granted en banc review of the panel’s decision via order signed by Chief Judge Mary H. Murguia, signaling doubt on either the outcome or the analysis applicable to personal jurisdiction issues related to online data collection and retention.

Why It Matters

California is a leader in the field of data privacy laws and regulations, which impact emerging technologies ranging from artificial intelligence (AI), advanced machine learning systems (AML), and pre-existing industries related to data aggregation, data use and monetization, advertising, e-commerce, and others. As the Ninth Circuit examines jurisdictional issues, even foreign businesses may find themselves regulated by legal developments at the state level in California, particularly with respect to tracing, tracking, recording, and other electronic surveillance claims under CIPA.