Meditations On the Consumer Class Action: Statutory Penalties

To know the consumer class action is to fear it. Any online marketer or other retailer that has gone through a class action lawsuit – even if it prevails in the end – no doubt has scars and legal bills to show for it. Because the stakes are so high, even winning a class action case at trial may leave retailers limping and still in great peril. Numerous class actions have settled after the appeal from a defendant’s successful summary judgment motion because, even if the odds of winning on appeal were good, the downside risk of losing was large enough to make the gamble unthinkable.  And the range of potential consumer class action lawsuits often seems overwhelmingly diverse. Is your “sale price” really a “sale price”? Is there enough fruit in your fruit roll-ups? Did you collect customer zip codes in credit card transactions?

While it is impossible for online and direct marketers to insulate themselves fully from an increasingly litigious world, there are rational steps you can take to help prevent your company from becoming "low hanging fruit" for class action lawyers. This is the first in a series of articles on just that subject, and it focuses on state consumer protection, marketing, and privacy laws that have per violation penalties.  The recent Michaels Stores case in Massachusetts involved just such a law.

Not So Simple–Recent Developments in Taxing the Cloud

We write frequently about developments surrounding federal tax legislation such as the Marketplace Fairness Act, which is up for a vote before the Senate on May 6. One of the major issues critics have with the Act is that despite proponents’ claims, it fails to provide for real simplification of state and local tax regimes, such as a uniform tax base among the states. Without a uniform tax base, compliance is incredibly complex for even the savviest of retailers.  The problem is much worse with respect to computing services and digital products delivered over the Internet.

For instance, cloud computing has some of the murkiest tax rules – some states have issued clear statements regarding taxability of IaaS, SaaS, or PaaS, but few have addressed all types of cloud services and many have failed to address the issue at all. Retailers are left guessing at the proper tax treatment of their sales and hoping their interpretation of tax rules is the correct one. That tax rules are ever-changing does not help matters. A uniform tax base would lessen this problem. Instead, retailers must monitor developments in myriad jurisdictions to find some clarity, although tax treatment still varies from state to state.

Idaho, for instance, recently exempted SaaS from sales and use tax by amending its statute to exclude “software accessed over the internet or through wireless media” from the definition of tangible personal property. See Idaho Code § 63-3616(b). Previously, the statute included as taxable tangible personal property any non-custom computer program “regardless of the method by which the title, possession or right to use the software is transferred.” The Idaho State Tax Commission interpreted this language as imposing tax on SaaS, although it noted in its opinion that “Due to the complexity of the business models, it is not possible to provide an all inclusive list of taxable sales transactions or taxable uses. As this technology advances, it may introduce more rather than less certainty.” Cloud Computing and Related Software Sales and Use Tax Issues (10/22/2012) (emphasis added). Even when providing some now-moot clarity to the taxability of SaaS, the state had to admit that its interpretations could not be considered definitive or final.

Beyond California and Massachusetts: Will Collecting Zip Codes Invite Class Actions Across the United States?

Although California and Massachusetts have stolen the spotlight with high profile cases banning zip code collection in connection with credit card purchases, thirteen other states and the District of Columbia have similar laws. With voracious class action attorneys circling, it is critical for retailers to know their legal obligations in these jurisdictions and, if necessary, adjust their privacy practices and policies.

Yet, because these statutes are to varying degrees vague, untested, and archaic, compliance can be difficult. At the same time, the risks could scarcely be higher. Hundreds of companies have already been ensnared in consumer class action lawsuits in California and Massachusetts, and the litigation floodgates may now open in other states as well.  And the math is simple. With penalties as high as $1,000 every single time a zip code, address, or telephone number is collected illegally--for periods going back as far as six years--even a relatively small company could face a liability in the millions or tens of millions of dollars.  You're also likely to be required to pay the plaintiffs' legal fees if you lose, which are often as much as one-third of the penalty calculation.

The Perils of Zip Code Collection Reach Massachusetts

On March 11, 2013, the Supreme Court of Massachusetts joined California in prohibiting the collection and retention of customer zip codes by retailers in connection with credit card transactions. In Tyler v. Michaels Stores, Inc., the Court based its decision on Massachusetts General Law ch. 93, § 105(a), which provides that retailers cannot “write, cause to be written, or require that a credit card holder write personal identification information not required by the credit card issuer, on the credit card transaction form.”  Like California, the Massachusetts court interpreted "personal identification information" so broadly as to include mere zip codes.

Background.  In 2011, the Supreme Court of California sent shock waves through the retail industry when it ruled in Pineda v. Williams Sonoma Stores, Inc. that zip codes constituted “personal identification information” under California Civil Code § 1747.08 that could not be collected and retained in connection with credit card transactions except in very limited instances. The prohibition against collection of personal identification information applied even if zip codes were requested, but not required, to complete a purchase. As a result of the decision, retailers selling to California consumers have faced costly class action lawsuits (with claims for as much as $1,000 per violation) even if no actual damages or injury could be shown. And while the Supreme Court of California recently held in Apple, Inc. v. Superior Court, that this prohibition did not apply to online transactions involving digitally downloaded products, the Court was careful to state that it was reserving judgment as to whether it applied to “any other transactions that do not involve in-person, face-to-face interaction between the customer and retailer”—explaining that “we express no view on whether the statute governs mail order or telephone order transactions...”

Additional States Introduce Affiliate-Nexus Legislation

On March 2, an Internet-affiliate nexus bill was introduced in the Arkansas State Senate (SB 738). Arkansas joins Arizona, California, Connecticut, Hawaii, Illinois, Massachusetts, Minnesota, Mississippi, New Mexico, Tennessee, Texas, and Vermont, as the thirteenth state this legislative season to consider such a measure. Nearly all of the bills -- with the exception of Illinois’s HB 3659, which was passed by the Illinois legislature and is now awaiting signature or veto by Governor Quinn, and Connecticut’s SB 5545 -- are patterned directly upon the New York affiliate nexus law enacted in 2008 and challenged in court, so far unsuccessfully, by Amazon.com. In other words, 11 of the 13 proposed laws create a rebuttable presumption that an out-of-state Internet retailer is obligated to collect and remit the state’s sales and use taxes if the retailer enters into an agreement with an in-state resident (an “affiliate”) pursuant to which the affiliate places a link from the affiliate’s website to the retailer’s site, and the retailer realizes at least $10,000 in sales to customers referred to it by the affiliate’s links. The presumption can be negated by proof that the in-state affiliates did not engage in any in-state solicitation on behalf of the retailer.

In its November 2010 ruling, the Appellate Division of the New York Supreme Court found that the ability of a retailer to rebut the presumption of solicitation was an important factor in determining that the New York law is not unconstitutional on its face. The Court, however, remanded the case for further proceedings on the issue of whether the law violates the Commerce Clause and Due Process Clause as applied to specifically to Amazon. As the ongoing proceedings in the New York case make clear, the constitutionality of such “New York-style” affiliate-nexus legislation is far from resolved.

At the same time, it is worth noting that the Illinois and Connecticut bills differ from the New York law in that neither bill provides that the presumption that a retailer must collect sales and use tax as a result of having in-state Internet affiliates may be rebutted. Imposing an irrebuttable presumption of nexus is highly suspect under both the Commerce Clause and Due Process Clause. Without a rebuttable presumption in place to protect retailers, Illinois and Connecticut would subject Internet retailers to burdensome state tax collection obligations when the retailers are effectively doing nothing more than advertising. For that reason, the progress of each of these bills bears watching. Stay tuned.

A Reminder About The State Tax Implications of Passive Partnership Interests: U.S. Supreme Court Declines To Review State Court Ruling That Mere Partnership Interest Creates Income Tax Nexus

E-commerce companies that have affiliates doing business as (or even just investment interests in) partnerships or other pass-through entities in states in which the e-commerce company has no direct presence should be aware that such partnership interests may be deemed to create income tax nexus for the company.  A number of state laws and regulations provide that ownership in a pass-through entity establishes nexus for the owner.  See, e.g., 34 TAC Sec. 3.586(c)(13) [Texas]; 830 CMR 63.39.1(8) [Massachusetts]. To date, state tax tribunals have agreed. See, e.g., Shell Gas Gathering Corp. #2, N.Y. Tax Appeals Tribunal, DTA Nos. 821569 and 921570 (Sept. 23, 2010).

Colorado Enacts Law on Gift Cards; Update on Other States’ Cash Redemption Rules

Amidst the hullaballoo over Colorado’s recently enacted affiliate nexus and out-of-state vendor reporting requirements and its recent economic nexus regulation, Colorado also passed a new law regarding gift cards.

Under the new law, signed by Governor Ritter on April 29, issuers of gift cards, including actual cards and electronic cards, must redeem the remaining value of a gift card for cash if there is $5 or less remaining on the card and the holder of the card so requests. Additionally, sellers may not sell gift cards which contain a service fee, dormancy fee, inactivity fee, maintenance fee, or any other type of fee. The new law does not apply to gift cards which are useable with multiple sellers, unless the multiple sellers are affiliated sellers. Violations of the new statute are deemed deceptive trade practices under Colorado law.

Other states have similar laws and/or pending legislation regarding cash refunds for low balances on gift cards and certificates:

The WISP Has (Finally) Landed: MA's Data Protection Law Now In Effect

After a seemingly unending series of delays and modifications, Massachusetts's data protection regulation finally went into effect on March 1, 2010. A copy of the regulation can be obtained here. Unlike the data protection laws of most states, the Massachusetts regulation requires holders of data to put in place a comprehensive set of written measures to protect confidential information (also known as a "WISP," or “written information security policy”), and to update their WISPs on an annual basis. The required contents of the WISP are outlined in the regulation, and cover topics ranging from encryption to vendor agreements.

Thumbnail: The new regulation applies to all persons and companies who either own or license personal information about residents of Massachusetts, and applies both to electronic and paper records. While the opening clause of the regulation appears to limit its coverage to "customer information" and "consumers," the balance of the regulation does not distinguish between information about customers, consumers, employees, or other categories of persons. If past experience with the administrative process in Massachusetts is any guide, it will be a long and winding road before we get any formal guidance as to the regulation’s scope.