Below is a summary of recent developments for the Food, Beverage and Hospitality industry in terms of Internet laws and regulations. To learn more about these issues and how they affect the industry, join us on October 28, 2020 for our Industry Debrief on the CCPA, CPRA, Data Security and Other Risks.

Consumer Privacy and the CCPA

In June 2018, California enacted one of the most comprehensive privacy laws in the country, the California Consumer Privacy Act of 2018 (the “CCPA”). The CCPA went into effect on January 1, 2020, and started to be enforced by the California Attorney General on July 1, 2020.

The CCPA applies to certain for-profit legal entities doing business in California that collect, transfer or sell personal information of California residents and determine the purpose and means of processing such personal information. A company may be physically located outside the State of California and still capable of “doing business in California” if they sell goods or services to California residents.

Personal information is broadly defined under the CCPA to include any information about California residents that is capable of being linked with a particular California resident (including identifiers, commercial information, Internet information, and employment or education among others).

California voters are also considering Proposition 24, the Consumer Privacy Rights and Enforcement Act of 2020 (“CPRA”).  CPRA would build on the underlying principles of the CCPA by permitting consumers to: (1) prevent businesses from sharing personal information; (2) correct inaccurate personal information; and (3) limit businesses’ use of “sensitive personal information”—such as precise geolocation; race; ethnicity; religion; genetic data; union membership; private communications; and certain sexual orientation, health and biometric information. The CPRA changes the criteria that certain businesses must meet in order to be required to comply with these privacy laws. The new Act would also prohibit businesses’ retention of personal information for longer than reasonably necessary; triples the maximum penalties for violations of privacy rights concerning consumers under age 16; and establishes a brand new state agency, the California Privacy Protection Agency, to enforce and implement consumer privacy laws and impose fines.

Industry Data Breaches

Several hospitality chains, restaurant groups and delivery services have announced data breaches. International companies have already been penalized for violating the GDPR, which could foretell a similar trend under the CCPA. Restaurant Dive reported that 62% of restaurant customers surveyed were concerned about a data breach.

• Marriott Fined for GDPR Violations: On November 30, 2018, Marriott International announced a breach of its Starwood guest reservation database. Marriott was fined over £99 million by the UK Information Commissioner’s Office for this breach, based on violations under the GDPR. The ICO stated in a press release that its “investigation found that Marriott failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its systems.”
• Breach at Dickey’s BBQ Compromises 3 Million Credit Cards: On October 16, 2020, Dickey’s Barbeque Pit confirmed that 3 million payment cards, used between July 2019 and August 2020, had been released on an underground market place. This breach involved 156 restaurant locations across 30 states.
• Chowbus Users Receive Leaked Data After Breach: Chicago-based delivery app Chowbus reported on October 5, 2020 that it had suffered a data breach and had customer records stolen. The stolen data included customer names, email addresses, phone numbers and email addresses, but not credit card data. Chowbus customers received a link to a CSV file with over 800,000 customer records.

ADA Concerns about Industry Websites and Apps

Because restaurants, hotels and wineries are places of public accommodation that must meet certain standards for accessibility under the federal Americans with Disabilities Act (“ADA”), the food, beverage and hospitality industry has long been aware of the need to closely follow physical accessibility standards. 

However, in recent years, courts have extended the ADA to apply to websites and apps. In some cases, companies have been sued and fined for failure to meet Web Content Accessibility Guidelines (WCAG). WCAG are designed to make Internet content accessible to people with disabilities, who may rely on aids such as screen readers. Additionally, California courts have found that the state’s Unruh Civil Rights Act also creates an obligation for businesses that are places of public accommodation to comply with the WCAG.

Recent court decisions have found that because restaurants and hotels are places of public accommodation under the ADA, their websites and apps must meet WCAG standards. This creates a need for business owners to design their apps and websites in compliance with these standards or risk ADA lawsuits.

• Domino’s Loses Suit Over Site Accessibility to Visually Impaired: On January 15, 2019, in Robles v. Domino’s Pizza, LLC, judges on the Ninth Circuit found that Domino’s website and mobile app were subject to the ADA because the restaurant was a place of public accommodation. The Court found that the website and app-connected customers to the goods and services of Domino’s physical restaurants and was therefore required to comply with the ADA. Domino’s argued in that case that it did not have fair notice of an obligation to comply with the WCAG. It also argued that the DOJ had primary jurisdiction to regulate the ADA. The Court rejected both arguments. In October 2019, the Supreme Court denied a petition from Domino’s to hear an appeal of the case, leaving the Ninth Circuit’s decision in place.
• California Applies Its State Accessibility Requirements to Out-of-State Companies: In August 2020, the California Court of Appeals applied California accessibility laws under the Unruh Act to a Georgia company, even though that company had no physical presence in California and did not direct any marketing specifically to California customers. The Court held that the company could be required to meet California accessibility and CCPA requirements because California consumers accounted for 10% of its customer base, and its sales from California were over $300,000 a year. The ruling suggests that any websites used by California residents may be subject to the website accessibility requirements of the CCPA and the Unruh Act.