U.D. Registry, Inc. Topples California Security Freeze Act

California's Freeze Act, like so many across the United States, allows consumers to place a notice in their consumer credit report that prohibits the consumer credit reporting agency from releasing the consumer's credit report or any information from it without the express authorization of the consumer. If a security freeze is in place, information from a consumer's credit report may not be released to a third party without prior express authorization from the consumer. The Security Freeze Act is meant to protect consumers against identity theft.

UDR's Lawsuit

UDR commenced its declaratory and injunctive relief action against the California attorney general, seeking a declaration that the freeze law violated the First and 14th Amendments of the U.S. Constitution, as well as similar provisions of the California Constitution. The trial court ruled in favor of UDR, issuing an injunction to the extent that the Freeze Act sought to prevent the dissemination and reporting by consumer-credit reporting agencies of any information contained in and/or obtained from matters of public record, and to the extent that it sought to preclude UDR from disseminating and reporting information contained in the public record. It found that the Freeze Act was overbroad and violated both the First Amendment of the Constitution, and similar provisions of the California Constitution.

In challenging the law, UDR argued that a security freeze was a content-based regulation that violated a plaintiff's First Amendment freedom of speech ' which provides that 'Congress shall make no law abridging the freedom of speech' rights, made applicable to the states through the 14th Amendment's due process clause. California's comparable provision, Article I, '2, Subdivision (a) of the California Constitution, states that 'every person may freely speak, write and publish his or her sentiments on all subjects, being responsible for the abuse of this right. A law may not restrain or abridge liberty of speech or press.' UDR's challenge, therefore, was a facial one ' that the text of the measure itself was unconstitutional, not merely its application. And the trial court agreed.

Appellate Review

In reviewing the trial court's decision, the appellate court noted that the mere fact that UDR sells information does not transform its speech into a 'commercial speech, any more than the fact that a magazine or a newspaper sold makes its contents commercial speech.' Nonetheless, because it ultimately believed the law to be unconstitutional, it would apply the more stringent commercial speech standard.

It then applied the four-part intermediate scrutiny analysis developed by the U.S. Supreme Court in Central Hudson Gas & Elec. Corp. v. Public Serv. Comm'n, 447 U.S. at 557 (1980), to determine whether the Act violated UDR's freedom of speech. The analysis asks: 1) does the dispute concern unlawful activity; 2) is it misleading; 3) is the asserted governmental interest substantial; and 4) does the regulation directly advance the governmental interest asserted, or is it more extensive than necessary.

Addressing the factors in the case of UDR, the court first noted that the reports were neither unlawful nor misleading, but were culled from public sources, which, in the case of court records, are presumptively open for public examination. Second, the trial court found, and all the parties conceded, that protecting consumers from identity theft is a substantial governmental interest. Third, although expressing some doubt, the appellate court agreed to accept that the government's interest in protecting consumers does directly and materially advance the asserted governmental interest.

Finally, the fourth Central Hudson factor requires that the restriction not be excessive, and, if the governmental interest could be served as well by a more limited restriction of commercial speech, the excessive restriction cannot survive. It was on this last factor that the law floundered. The Freeze Act included a bar on plaintiff's truthful reporting of lawfully available and obtained public record information, including the disclosure of data contained in court records that are constitutionally, presumptively available to journalists and the public. For this reason, the Freeze Act violated the First Amendment.

Further, the appellate court found, as did the trial court, that the Freeze Act could not be judicially reformed so as to permit the statute to apply to UDR and others. In effect, the court was unwilling to reform the Freeze Act to allow the dissemination of publicly available information, as that in no way appeared to have been the legislature's intent in passing this provision.

But because there was no underlying evidence presented as to the manner or content of credit reports produced by other businesses, the appellate court held that a facial challenge could not be sustained as to every potentially affected party. Thus, it remanded with directions that the injunction as to the enforcement of the Freeze Act be limited to the plaintiff, UDR.

Conclusion

The California court's holding will likely have repercussions throughout the United States, as the Security Freeze Acts enacted in most states contain similar provisions. To the extent a reporting agency relies upon public documentation that could be freely reported on by the press and the public at large, the Acts are subject to a constitutional challenge.

Luis Salazar is a shareholder with Greenberg Traurig, and a member of the firm's Privacy and Data Security Task Force. He can be reached at [email protected].

In a decision that may have repercussions throughout the United States, a California Court of Appeal has ruled that California's Security Freeze Act violates the First Amendment because it precludes the reporting of information contained in public records. The challenge to the Freeze Act was brought by U.D. Registry, Inc. ('UDR'), a company that maintains information on tens of millions of people in California and elsewhere, providing landlords and property managers with reports about prospective tenants. UDR had challenged California's freeze law, Cal. Civil Code '1785.11.2, as unconstitutional. The appellate court, however, also reversed an injunction that had completely barred the state from enforcing the law, and directed a new injunction be issued barring enforcement against UDR only.

Background

UDR collects credit-related background information about individuals, including unlawful detainer, foreclosure, bankruptcy, and tax lien data. It then sells these consumer credit reports to its members, including landowners, property managers, and others similarly situated. Obviously, UDR's members consider these reports in determining whether to lease real property to a prospective tenant, but the members agree in advance not to use the report for any other purpose or to disclose the information contained therein to others. UDR's reports may also include a record of all inquiries (all who have asked for the consumer's report in the last several years), a summary of the information containing credit reports obtained by U.D. Registry from the better-known consumer reporting agencies (Trans Union, Experian, and/or Equifax), and an unabridged report on all reported credit activities.

California's Freeze Act, like so many across the United States, allows consumers to place a notice in their consumer credit report that prohibits the consumer credit reporting agency from releasing the consumer's credit report or any information from it without the express authorization of the consumer. If a security freeze is in place, information from a consumer's credit report may not be released to a third party without prior express authorization from the consumer. The Security Freeze Act is meant to protect consumers against identity theft.

UDR's Lawsuit

UDR commenced its declaratory and injunctive relief action against the California attorney general, seeking a declaration that the freeze law violated the First and 14th Amendments of the U.S. Constitution, as well as similar provisions of the California Constitution. The trial court ruled in favor of UDR, issuing an injunction to the extent that the Freeze Act sought to prevent the dissemination and reporting by consumer-credit reporting agencies of any information contained in and/or obtained from matters of public record, and to the extent that it sought to preclude UDR from disseminating and reporting information contained in the public record. It found that the Freeze Act was overbroad and violated both the First Amendment of the Constitution, and similar provisions of the California Constitution.

In challenging the law, UDR argued that a security freeze was a content-based regulation that violated a plaintiff's First Amendment freedom of speech ' which provides that 'Congress shall make no law abridging the freedom of speech' rights, made applicable to the states through the 14th Amendment's due process clause. California's comparable provision, Article I, '2, Subdivision (a) of the California Constitution, states that 'every person may freely speak, write and publish his or her sentiments on all subjects, being responsible for the abuse of this right. A law may not restrain or abridge liberty of speech or press.' UDR's challenge, therefore, was a facial one ' that the text of the measure itself was unconstitutional, not merely its application. And the trial court agreed.

Appellate Review

In reviewing the trial court's decision, the appellate court noted that the mere fact that UDR sells information does not transform its speech into a 'commercial speech, any more than the fact that a magazine or a newspaper sold makes its contents commercial speech.' Nonetheless, because it ultimately believed the law to be unconstitutional, it would apply the more stringent commercial speech standard.

It then applied the four-part intermediate scrutiny analysis developed by the U.S. Supreme Court in Central Hudson Gas & Elec. Corp. v. Public Serv. Comm'n , 447 U.S. at 557 (1980), to determine whether the Act violated UDR's freedom of speech. The analysis asks: 1) does the dispute concern unlawful activity; 2) is it misleading; 3) is the asserted governmental interest substantial; and 4) does the regulation directly advance the governmental interest asserted, or is it more extensive than necessary.

Addressing the factors in the case of UDR, the court first noted that the reports were neither unlawful nor misleading, but were culled from public sources, which, in the case of court records, are presumptively open for public examination. Second, the trial court found, and all the parties conceded, that protecting consumers from identity theft is a substantial governmental interest. Third, although expressing some doubt, the appellate court agreed to accept that the government's interest in protecting consumers does directly and materially advance the asserted governmental interest.

Finally, the fourth Central Hudson factor requires that the restriction not be excessive, and, if the governmental interest could be served as well by a more limited restriction of commercial speech, the excessive restriction cannot survive. It was on this last factor that the law floundered. The Freeze Act included a bar on plaintiff's truthful reporting of lawfully available and obtained public record information, including the disclosure of data contained in court records that are constitutionally, presumptively available to journalists and the public. For this reason, the Freeze Act violated the First Amendment.

Further, the appellate court found, as did the trial court, that the Freeze Act could not be judicially reformed so as to permit the statute to apply to UDR and others. In effect, the court was unwilling to reform the Freeze Act to allow the dissemination of publicly available information, as that in no way appeared to have been the legislature's intent in passing this provision.

But because there was no underlying evidence presented as to the manner or content of credit reports produced by other businesses, the appellate court held that a facial challenge could not be sustained as to every potentially affected party. Thus, it remanded with directions that the injunction as to the enforcement of the Freeze Act be limited to the plaintiff, UDR.

Conclusion

The California court's holding will likely have repercussions throughout the United States, as the Security Freeze Acts enacted in most states contain similar provisions. To the extent a reporting agency relies upon public documentation that could be freely reported on by the press and the public at large, the Acts are subject to a constitutional challenge.

Luis Salazar is a shareholder with Greenberg Traurig, and a member of the firm's Privacy and Data Security Task Force. He can be reached at [email protected].