That’s what seems to be one effect of the newly enacted California Reader Privacy Act. Much of the Act, which mostly covers the procedures required for the government to subpoena bookstore records, might well be quite sensible. But parts of it seem to be drafted strikingly broadly, in a way that interferes with the way people normally report crimes to the police.
Consider, for instance, Bob, who owns and runs a small bookstore. Carl, a customer, goes into the store; while in the store, he commits a crime against Victoria, who is another customer -– snatches her purse, beats her up, or whatever else. Bob knows Carl, and calls the police, telling them that Carl has committed a crime.
Bob has, I think, violated the statute. Selling books is a “book service,” under the definition in the statute. Carl is a “user” of the store, and his name –- or even his appearance, if that’s all the bookstore owner knows -– is “personal information.” The bookstore is a “provider,” a “commercial entity offering a book service to the public.” Bob is calling from work, based on what he observed at work; his action is thus likely to be considered the action of a “provider” as well.
I suppose one could argue that only the bookstore is the provider, and Bob is just a person and not himself a “commercial entity”; but if that’s so, then the entire section I describe, and perhaps the entire statute, could be avoided the same way, since ultimately any disclosure to the government would be done by a person and not the entire entity. Plus if the bookstore is a sole proprietorship — something that would qualify as a “commercial entity,” I think, see, e.g., Cal. Civil Code § sec. 1799, a nearby section that defines “business entity” to include “a sole proprietorship” — then it’s hard to see how Bob the owner is different from the bookstore as commercial entity. And subsections (c)(4) and (c)(5), which discuss what “the provider in good faith believes,” suggest that an employee of the provider and at least the owner of the provider would himself qualify as a “provider,” since it’s individual human beings who “in good faith believe[]” things.
Given that Bob is a provider, under the law he “shall not knowingly disclose to any government entity … any personal information of a user” (subsection (c)), unless he “in good faith believes that the personal information is evidence directly related and relevant to a crime against the provider or that user.” But the crime wasn’t committed against the bookstore or Bob, or against Carl; it was committed against Victoria. So Bob can reveal Victoria’s identifying information to the government, but not Carl’s (since the crime wasn’t committed against “that” user).
This means, under subsection (e), that Carl can sue Bob and get a civil penalty of up to $500. To be sure, the penalty is not huge, and I would imagine that a court would rarely assess much of a penalty at all (even if Bob proves to be mistaken about whether Carl was culpable). But the action would still be a violation of the law — and the message the law is sending to the law-abiding bookstore owners seems to be, “don’t report crimes in your bookstore, unless they are against you.”
And this doesn’t just apply to crimes in the bookstore; it also applies when a bookstore owner –- or a bookstore-plus-coffee-house owner -– overhears incriminating conversations among customers, or (less likely) a crazy or foolish customer asks the bookstore owner questions that suggest something bad is being planned. All of that, it seems to me, would be covered by the statute. (Subsection (c)(4) wouldn’t apply even if there’s “imminent danger of death or serious physical injury,” because that seems to apply only to government-initiated demands; but in any case, it wouldn’t apply to cases where the danger isn’t imminent, or the planned crime is a property crime, or where the information deals with a past crime rather than a future one.)
There are a few existing rules that do limit reports to the police, for instance by lawyers. But those limitations, to my knowledge, are not nearly as broad as this one. A lawyer, for instance, is bound by confidentiality only with regard to confidential communications he receives, not with regard to crimes that he himself observes, even when the client is committing the crime. And a lawyer may report to the police when a client has revealed plans to commit a serious crime, even when the crime isn’t one against the lawyer. So even if bookstore owners should be subjected to confidentiality rules that are similar to those that bind lawyers (which I doubt), this statute goes considerably beyond those rules in the respect given above. Or am I misunderstanding some aspect of the statute here?
Eric Goldman (Law & Technology Marketing Blog) and Paul Alan Levy (Public Citizen’s Consumer Law & Policy Blog) have more on other aspects of the law, though I have some disagreements with some parts of their analyses.