Sanchez v. L. A. Dep't of Transp.

39 F.4th 548

Justin SANCHEZ, Plaintiff-Appellant,

v.LOS ANGELES DEPARTMENT OF TRANSPORTATION; City of Los Angeles, Defendants-Appellees.

No. 21-55285

United States Court of Appeals, Ninth Circuit.

Argued and Submitted March 8, 2022 Pasadena, California

Filed May 23, 2022

Amended July 8, 2022

Mohammad Tajsar (argued), ACLU Foundation of Southern California, Los Angeles, California; Jacob A. Snow, ACLU Foundation of Northern California, San Francisco, California; Jennifer Lynch and Hannah Zhao, Electronic Frontier Foundation, San Francisco, California; Douglas E. Mirell and Timothy J. Toohey, Greenberg Glusker Fields Claman & Machtinger LLP, Los Angeles, California; for Plaintiff-Appellant.

Jonathan H. Eisenman (argued) and Jeffrey L. Goss, Deputy City Attorneys; Blithe S. Bock, Managing Assistant City Attorney; Scott Marcus, Chief Assistant City Attorney; Kathleen A. Kenealy, Chief Deputy City Attorney; Michael N. Feuer, City Attorney; Office of the City Attorney, Los Angeles, California; for Defendants-Appellees.

Kendra K. Albert and Mason A. Kortz, Cyberlaw Clinic, Harvard Law School, Cambridge, Massachusetts, for Amici Curiae Seven Data Privacy and Urban Planning Experts.

Brian E. Klein and Melissa A. Meister, Waymaker LLP, Los Angeles, California; Samir Jain and Gregory T. Nojeim, Center for Democracy & Technology, Washington, D.C.; Alan Buter, Megan Iorio, and Melodi Dincer, Electronic Privacy and Information Center; for Amici Curiae Center for Democracy & Technology, and Electronic Privacy Information Center.

Jordan R. Jaffe, Quinn Emanuel Urquhart & Sullivan LLP, San Francisco, California, for Amicus Curiae Kevin Webb. Alana H. Rotter and Nadia A. Sarkis, Greines Martin Stein & Richland LLP, Los Angeles, California, for Amicus Curiae Open Mobility Foundation.

Before: Kim McLane Wardlaw and Andrew D. Hurwitz, Circuit Judges, and Lee H. Rosenthal,^* District Judge.

ORDER

The opinion is amended as follows:

1. At opinion page 559, replace < We decline the invitation to conclude that LADOT's collection of anonymous data about traffic movements is somehow rendered a search because it may be used in the future (in connection with other non-private material) to reveal an individual's previous locations. Even accepting Sanchez's contention that anonymous MDS data can be used in the future to draw inferences about who was using a scooter at a particular time, "an inference is not a search." Kyllo, 533 U.S. at 37 n., 121 S.Ct. 2038> with < Although the Supreme Court has "rejected the proposition that ‘inference insulates a search,’ " Carpenter, 138 S. Ct. at 2218 (quoting Kyllo, 533 U.S. at 36, 121 S.Ct. 2038 )), there is no allegation that the MDS data was in fact used to infer the identity of any individual rider.>.

2. At opinion page 560, after < does not violate the Fourth Amendment or the California Constitution.> include < We caution that our "decision today is a narrow one." Carpenter, 138 S. Ct. at 220. We "express no view on matters not before us," id., including the result if the MDS data were alleged to have been shared with law enforcement or used to infer individual riders' identities or locations. See Naperville Smart Meter Awareness v. City of Naperville, 900 F.3d 521, 528 (7th Cir. 2018) (privacy interests are "lessened" where there is "no prosecutorial intent" (citing Camara v. Mun. Ct. of San Francisco, 387 U.S. 523, 530, 87 S.Ct. 1727, 18 L.Ed.2d 930 (1967) ).>

AMENDED OPINION

HURWITZ, Circuit Judge:

Faced with a near-overnight invasion of motorized electric scooters ("e-scooters"), which cluttered sidewalks and interfered with street access, the City of Los Angeles adopted a permitting program and required e-scooter companies to disclose real-time location data for every device.¹ In this action, an e-scooter user claims that the location disclosure requirement violates the Fourth Amendment and California law. The district court dismissed the complaint for failure to state a claim. We affirm.

I.

Companies such as Bird, Lime, and Lyft began offering e-scooters for rent to the public in Los Angeles in 2017. The e-scooters are dockless, meaning they can be left anywhere after use and picked up by the next rider. They are also internet-connected, and are rented through the companies' smartphone applications, which charge riders based on the distance and duration of the trip taken.

In 2018, Los Angeles enacted a "Shared Mobility Device Pilot Program" to regulate the fledgling industry. L.A. Ord. 185,785 (Sept. 13, 2018). The program required companies to obtain a permit from the Los Angeles Department of Transportation ("LADOT") to offer e-scooters for rent and mandated that permittees "comply with all Department permit rules, regulations, indemnification, insurance and fee requirements." Id. As a condition of getting a permit, LADOT required e-scooter operators to provide vehicle location data through an application programming interface ("API")² called Mobility Data Specification ("MDS"). Used in conjunction with the operators' smartphone applications, MDS automatically compiles real-time data on each e-scooter's location by collecting the start and end points and times of each ride taken.³ Because LADOT obtains data directly from the companies in real time, it can manage the public right-of-way actively and "communicate directly with product companies in real time using code."⁴

Plaintiff Justin Sanchez uses e-scooters to travel from his home to work, visit friends, frequent local businesses, and access places of leisure. His complaint asserts that the collection of MDS location data by LADOT violates the Fourth Amendment to the United States Constitution; Article I, Section 13 of the California Constitution ; and the California Electronic Communications Privacy Act ("CalECPA"), Cal. Penal Code § 1546 et seq.

The complaint alleges that the MDS protocols provide the location of e-scooters with Orwellian precision, to within 1.11 centimeters of their exact location. It acknowledges that "MDS does not collect any information directly identifying the rider of a particular vehicle." But, Sanchez alleges that government actors could subsequently "match users' trajectories in anonymized data from one dataset, with deanonymized data in another," and research indicates programmers "could identify 50% of people from only two randomly chosen data points in a dataset that contained only time and location data." The City therefore can "easily," he alleges, use MDS data in conjunction with other information to identify trips by individuals to sensitive locations. And, because the location data may be preserved in accordance with LADOT data-retention policies, Sanchez alleges that the City can travel back in time to retrace a rider's whereabouts.

The district court granted LADOT's motion to dismiss the complaint without leave to amend. Sanchez v. L.A. Dep't of Transp. , No. CV-20-5044-DMG, 2021 WL 1220690 (C.D. Cal. Feb. 23, 2021). It found that the LADOT program is not a search under the Fourth Amendment because Sanchez has no reasonable expectation of privacy over anonymous MDS location data. Id. at *4. It alternatively concluded that, even if the collection of MDS data were a search, it is a reasonable administrative one and thus constitutional. Id. at *5–6. Because "the right to be free from unreasonable searches under Art. I § 13 of the California Constitution parallels the Fourth Amendment inquiry," Sanchez v. Cnty. of San Diego , 464 F.3d 916, 928–29 (9th Cir. 2006), the district court also dismissed Sanchez's state constitutional claim. Id. at *2. And it rejected the CalECPA claim, finding that the statute did not provide Sanchez a private right of action. Id. at *6.

Finding any amendment futile, the district court dismissed the complaint with prejudice. Id. This timely appeal followed.

II.

LADOT first argues that we must dismiss Sanchez's claims because he lacks Article III standing. See In re Apple iPhone Antitrust Litig. , 846 F.3d 313, 319 (9th Cir. 2017) (noting that Article III standing is a jurisdictional requirement that may be raised "at any time"). LADOT argues that this complaint is beyond our constitutional purview because it is premised on a hypothetical future invasion of privacy that may never occur.

To establish Article III standing, "a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief." TransUnion LLC v. Ramirez , ––– U.S. ––––, 141 S. Ct. 2190, 2203, 210 L.Ed.2d 568 (2021). We must "assess whether the alleged injury to the plaintiff has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts." Id. at 2204 (quoting Spokeo, Inc. v. Robins , 578 U.S. 330, 341, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016) ). "[T]hose traditional harms may also include harms specified by the Constitution itself." Id. (citing Spokeo , 578 U.S. at 340, 136 S.Ct. 1540 ; Pleasant Grove City v. Summum , 555 U.S. 460, 129 S.Ct. 1125, 172 L.Ed.2d 853 (2009) (abridgment of free speech); Church of Lukumi Babalu Aye, Inc. v. Hialeah , 508 U.S. 520, 113 S.Ct. 2217, 124 L.Ed.2d 472 (1993) (infringement of free exercise)). And, although "traditional tangible harms, such as physical harms and monetary harms," most "readily qualify as concrete injuries," "intangible harms can also be concrete." Id.

Applying this settled doctrine, we conclude that Sanchez's complaint alleges facts giving rise to Article III standing. The harm alleged is one "specified by the Constitution itself," id. —the violation of the Fourth Amendment guarantee against unreasonable searches and seizures. Moreover, the alleged injury has a close nexus to those traditionally providing a "basis for a lawsuit in English or American courts," Spokeo , 578 U.S. at 341, 136 S.Ct. 1540, such as "disclosure of private information" and ...