City and County of San Francisco v. HomeAway.com, Inc.

Citation: Not availableDocket: A150385

Court: California Court of Appeal; March 28, 2018; California; State Appellate Court

Original Court Document: View Document

SummaryOriginalCytator Case TreatmentBackward CitatorAnalysis

EnglishEspañolSimplified EnglishEspañol Fácil

The City and County of San Francisco, along with its tax collector and treasurer, successfully petitioned the superior court to enforce an administrative subpoena requiring HomeAway.com, Inc. to disclose data on rental transactions involving San Francisco accommodations arranged through its website. HomeAway challenged the subpoena on several grounds, arguing it violates the Stored Communications Act (SCA), infringes on customers' constitutional rights, and is unenforceable under local or state law. The appellate court reviewed the enforcement standards de novo and ultimately affirmed the superior court's order.

In the trial court, HomeAway presented a declaration from its chief digital and cloud officer, Steve Davis, detailing the company's operations. HomeAway functions as an online platform connecting property owners with renters, facilitating short-term rentals without being a direct party to the transactions. Owners create accounts requiring personal information to list properties, while communications between owners and travelers occur through HomeAway’s secured messaging system or via direct contact. The company also provides an online reservation service, although the data on transactions may not reflect completed bookings due to cancellations and reliance on third-party payment processors. Davis noted that over 10,000 properties in San Francisco have been listed on HomeAway in the past five years, with most transactions resulting from direct owner-traveler communications, leaving HomeAway with limited data on completed rentals.

Davis estimated that there are hundreds of thousands of messages related to San Francisco listings over the past four and a half years, indicating that searching these messages for specific data would be highly burdensome. He noted that property owners using HomeAway are responsible for complying with all relevant laws and regulations, including tax requirements, which is outlined in the HomeAway Terms and Conditions. These terms indicate that users accept the terms and the associated Privacy Policy when utilizing HomeAway’s services. Users acknowledge a limited license to access the site and recognize HomeAway's proprietary rights over its content, along with the company's right to use personal information provided by users.

The HomeAway Privacy Policy allows for the use of personal information for purposes like data mining and permits disclosure to third parties, including governmental entities under legal requests. On April 5, 2016, the City’s tax collector issued a subpoena to HomeAway under the San Francisco Business and Tax Regulations Code to produce relevant records for compliance enforcement. The City has requested judicial notice of the HomeAway Privacy Policy, which HomeAway contests, arguing that judicial notice should only pertain to the existence of the website, not its content. However, the document notes that judicial notice may be taken of the existence of the policy to show that users were informed of certain policies when sharing their information. The request for judicial notice is thus granted, but not for the substantive truth of the policy's content.

The 2016 subpoena directed HomeAway to produce data and documents specified in Exhibit A, which included two primary requests. The first request sought information identifying all hosts offering accommodations in the City from January 1, 2012, until HomeAway's response, including the hosts' locations, contact information, and any identifying details retained by HomeAway. The second request demanded data on all bookings for rental transactions involving accommodations in the City during the same period, regardless of whether the transactions were completed, with similar requirements for location, host contact information, and identifying details.

The City filed a petition on June 21, 2016, to enforce compliance with the subpoena, citing key allegations: HomeAway is registered and operating in California, facilitating property rentals to tourists in San Francisco; the Business and Tax Regulations (B&TR) Code mandates that property owners obtain a business registration certificate and pay a transient occupancy tax (TOT) for short-term rentals; the tax collector has a duty to collect taxes and can investigate noncompliance, issuing subpoenas as necessary; and prior informal requests and a 2015 subpoena for this information had been denied by HomeAway, prompting the issuance of the updated 2016 subpoena. Despite attempts to address HomeAway's objections regarding the scope of the request, the company continued to refuse compliance.

The City asserted that the tax collector had valid reasons to seek information from HomeAway, citing a policy analysis indicating non-compliance with short-term rental regulations. The City requested the superior court to enforce a 2016 subpoena against HomeAway. In response, HomeAway opposed the petition, claiming the subpoena was invalid due to: 1) the City’s attempt to collect an invalid tax, 2) its overbreadth and burdensomeness, 3) potential violations of First Amendment rights of its customers, and 4) infringements of the Stored Communications Act (SCA), which limits government access to electronic data held by Internet service providers. During the August 25, 2016 hearing, the court focused on whether the SCA applied and if the City met the necessary statutory requirements. The court invited further submissions regarding the SCA and deferred its decision. On September 20, 2016, the court granted the City’s petition but stayed the ruling for HomeAway to seek appellate review. The formal order, signed on September 28 and filed on October 4, 2016, concluded that: HomeAway did not qualify as an Electronic Communications Service or Remote Computing Service under the SCA; the subpoena was not shown to be burdensome or overbroad; it did not violate First Amendment rights; and the court did not need to address the City’s authority under the hotel tax, as the subpoena was sufficiently related to tax ordinances for enforcement. HomeAway’s principal argument for reversing the order was based on the City’s alleged non-compliance with SCA requirements. The SCA, part of the Electronic Communications Privacy Act of 1986, was designed to protect access to stored electronic communications and limit government access to customer information held by ISPs, reflecting a legislative judgment on the confidentiality interests of users.

Trespass laws protect renters of commercial storage spaces for sensitive documents, while the Stored Communications Act (SCA) safeguards users’ electronic communications stored with Internet Service Providers (ISPs) or similar facilities. The SCA is specifically designed to offer Fourth Amendment-like protections, rather than serving as a broad privacy statute. Key sections include 2702, which restricts ISPs from voluntarily disclosing customer information to the government, and 2703, which regulates government access to stored electronic communications and subscriber information. Section 2703 differentiates procedures for disclosing two types of evidence: the content of communications and subscriber records. Access to the most protected communications requires a warrant, while other communications can be disclosed if a government entity obtains a warrant or provides prior notice to the subscriber, followed by a specific legal order.

HomeAway contends that the 2016 subpoena breaches the SCA on multiple grounds: it is classified as both an Electronic Communication Service (ECS) and a Remote Computing Service (RCS), the City failed to secure a warrant or notify subscribers, and the subpoena was not issued under proper state or federal law. The classification of HomeAway as an ECS or RCS depends on the context of the information disclosed. Ultimately, even if HomeAway qualifies under the SCA, a violation cannot be claimed without showing that the City did not follow authorized procedures for compelling disclosure. The 2016 subpoena does not require HomeAway to disclose electronic communications, and the City's method of compelling disclosure was authorized by the SCA.

The City clarifies that the 2016 subpoena does not request electronic communications from HomeAway, despite HomeAway's claims in its opening brief. The subpoena seeks specific information regarding hosts and rental bookings in San Francisco but does not require the production of electronic communications from users. During the subpoena's issuance, the City communicated that it was not seeking users' login details or forum posts, and in court, emphasized it was not compelling disclosure of electronic communications. HomeAway's argument that the subpoena implicitly demands such disclosures is rejected. The court confirmed that HomeAway cannot withhold any information it possesses that is relevant to the subpoena, even if it overlaps with content from electronic communications. 

Additionally, the stipulation affirms that the subpoena does not necessitate revealing any communications generated by HomeAway users. The relevant legal framework under the Stored Communications Act (SCA) distinguishes between two categories of customer records. The first allows government entities to use an administrative subpoena for certain records, such as subscriber identification and service usage, under section 2703(c)(2). The second category requires alternative procedures for other records. HomeAway's assertion that the subpoena seeks information beyond basic customer identification is not accepted, as the court interprets section 2703(c)(2) as broader, allowing for various types of records related to the subscriber, including personal details and payment information.

The 2016 subpoena is deemed reasonable in requesting customer identification evidence and transaction records as specified in section 2703(c)(2). It seeks detailed identifying information about HomeAway customers who utilized its services in San Francisco, including booking data with names, dates, addresses, and payment details. Despite the potential volume of data, the information is specific to customer usage and payment methods. HomeAway's argument that the subpoena is unenforceable due to vague language is countered by evidence showing the City’s willingness to clarify concerns about the subpoena's scope. HomeAway's claim that the subpoena is invalid because it was issued under local law rather than state or federal statute is rejected; the SCA requires that the subpoena be authorized by such statutes, which is satisfied in this case. The California Constitution allows local enforcement of ordinances, including taxation, supporting the subpoena's validity. Consequently, the enforcement order does not violate the privacy protections under the SCA. Additionally, HomeAway's argument that the order infringes on the constitutional rights of its customers is undermined by its failure to demonstrate standing to assert these claims, as exemplified by the NAACP case, which emphasizes the necessity of the appropriate party representing individual rights.

HomeAway lacks the standing to assert the constitutional rights of its subscribers, as it functions as a commercial entity rather than a political association, unlike the NAACP. Even if standing were established, HomeAway's claims are without merit. It argues that the Fourth Amendment prohibits the City from accessing subscriber information without a warrant; however, information voluntarily shared with third parties is not protected under this amendment. The Stored Communications Act (SCA) provides specific protections for customer information with Internet Service Providers (ISPs), and the City has not breached these protections by compelling HomeAway to reveal customer records. HomeAway's reliance on United States v. Warshak is misplaced, as the subpoena does not require the disclosure of private emails or communications. Furthermore, HomeAway contends that revealing customer identities would infringe upon First Amendment rights to private association. While the Constitution protects the freedom of intimate and expressive associations, the use of HomeAway’s services for short-term rentals is characterized as a commercial transaction rather than intimate or expressive association. HomeAway acknowledges that users engage in commercial speech, but it suggests that online interactions may involve personal disclosures. The court finds it unnecessary to explore this, as the subpoena does not demand the release of electronic communications between users.

HomeAway challenges the validity of a 2016 subpoena issued by the tax collector, arguing it lacks authorization under local and state law. The relevant local law, B&TR Code, article 6, section 6.4-1, mandates taxpayers to maintain business records for five years and to comply with the tax collector's requests for these records. The tax collector is authorized to issue subpoenas to enforce compliance with tax ordinances. The subpoena is linked to an investigation into potential noncompliance with two tax ordinances: the Tax on Transient Occupancy of Hotel Rooms and the Business Registration ordinance.

HomeAway claims the subpoena is unauthorized because the TOT ordinance's hotel tax cannot apply to its users and many may qualify for exemptions under the Business Registration ordinance. However, the court determines these issues are beyond the scope of the appeal and does not need resolution at this stage. It reiterates that the tax collector's broad investigative authority allows for inquiries based on suspicion of law violations without the need for a case or controversy.

HomeAway also argues a due process right to challenge the tax collector's interpretation of the TOT ordinance, but the court finds this argument unsupported and states that tax challenges typically arise only after payment. Furthermore, HomeAway's argument that the subpoena is overbroad is refuted by referencing Union Pacific R.R. Co. v. State Bd. Of Equalization, which does not apply here since no tax has been assessed against HomeAway. The requested information is deemed relevant to the investigation.

The court affirms the order granting the City’s petition, allowing the City to recover appeal costs. The opinion has been certified for publication.