California Penal Code § 530.5(a) provides that it is a crime to “willfully obtain personal identifying information … of another person” and use it “for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or medical information without the consent of that person.” “Personal identifying information” means “any name, address, telephone number” or one of many other identifying items (such as Social Security number, bank account number, and the like). And “person” covers not just individuals but also “any other legal entity,” including corporations.
Now you might think that this is a statute aimed at identity theft — i.e., impersonating someone to get credit, goods or services. And the statute is even called the California “identity theft” statute. But it is, oh, so much more! As California courts have read its terms, the statute
- reinvents criminal libel law (California’s criminal libel was repealed in 1986)
- makes it a crime to commit the tort of disclosure of private facts, so long as the disclosure uses a person’s name,
- makes it a crime to commit the tort of interference with contract, so long as the defendant’s actions used a person’s or business’s name,
- makes it a crime to infringe a person’s right of publicity,
- and likely much more.
Pretty surprising — it surprised me. But that’s the logical implementation of how California courts have read the statute.
1. California courts have held that the statute is not limited to behavior that is generally viewed as “identity theft,” such as impersonation, or intent to defraud. “[T]he statute itself does not use [the] phrase [‘identity theft’], nor does it require that a defendant portray himself as someone else…. [T]he statute does not, in fact, require that a defendant have personated another in using another individual’s personal identifying information in order to be convicted under its terms.” People v. Barba (Cal. Ct. App. 2012). “[Section 530.5(a)] clearly and unambiguously does not require an intent to defraud.” People v. Hagedorn (Cal. Ct. App. 2005).
2. California courts have also held that the “unlawful purpose” could be a purpose to commit a merely civil actionable tort, even if that tort is not itself a crime. They have said so as to libel. In re Rolando S. (Cal. Ct. App. 2011) and People v. Casco (Cal. Ct. App. 2015) (nonprecedential). They said so just last month as to disclosure of private facts. People v. Bollaert (Cal. Ct. App. 2016). But this logic would equally apply to using a person’s name or other attributes in other torts (at least intentional torts), such as interference with contract, violation of the right of publicity and the like.
3. And the statute applies even when the identifying information was acquired lawfully (neither criminally nor tortiously), and without any intention of committing a crime. Rolando S. The crime is committed when this information, however properly acquired, is used in (among other things) the commission of a tort.
So let’s look at the most recent of these decisions, Bollaert. Bollaert was a revenge porn extortionist: He urged people to post “private, intimate photographs of others along with that person’s name, location and social media profile links” on one of his sites, and then had another site on which victims could pay to get the information removed. This behavior was criminal extortion (a form of blackmail) quite apart from a violation of the identity theft statute, and indeed Bollaert was convicted of extortion.
But he was also convicted of violating § 530.5:
[T]he term “unlawful” as used in section 530.5 includes intentional civil torts, including those relied upon by the People here: invasion of privacy by means of intrusion into private affairs and public disclosure of private facts.
And by revealing people’s “identifying information” — “full names, locations, and Facebook links, as well as the nude photographs themselves” — with the purpose of committing a tort, Bollaert was committing a crime.
4. Now I have argued that narrowly and clearly written revenge porn bans are constitutional (pp. 1405-06). But nothing in Bollaert’s § 530.5 discussion was limited to revenge porn, or to extortion.
Say, for instance, that Kendra Schmollaert, Kevin Bollaert’s second cousin, has a blog with a couple of thousand readers. She publishes a blog post that mentioned an acquaintance’s formerly private sex scandal (or medical problem) and gives the acquaintance’s name. That may well constitute the tort of disclosure of private facts, and maybe Schmollaert should be liable for that. (I think the tort is too broad and vague to be constitutional, but most courts disagree with me on that.) But, to her surprise — and, I suspect, to the surprise of most media lawyers — a prosecutor decides to charge Schmollaert criminally. Guilty!
- Schmollaert willfully published the aquaintance’s “identifying information” — the full name, and possibly some indication of location (e.g., if Schmollaert says the acquaintance is Schmollaert’s neighbor).
- Schmollaert did so with the purpose of committing a tort, namely the disclosure of private facts. (True, Schmollaert wasn’t doing this just for the sake of committing a tort, but neither was Bollaert — Schmollaert wanted to tell an interesting story, or maybe expose an acquaintance whom Schmollaert disliked, while Bollaert wanted to make money, and both purposefully used people’s identifying information as a means of accomplishing that goal.)
- Schmollaert didn’t reveal any nude photographs — but nothing in § 530.5(a) says anything whatever about nudity, or about photographs; as the courts have interpreted the statute, tortious disclosure of private facts is enough.
- Schmollaert also wasn’t impersonating anyone — but neither was Bollaert.
Or say that Schmollaert instead starts selling T-shirts that depict photographs of celebrities, with captions that give the celebrities’ names. Under California law, that’s a tort, both statutory and common-law, and might lead to liability. But again Schmollaert also turns out to be guilty of a crime:
- She willfully published the celebrities’ “personal identifying information” (“full names, … as well as the … photographs themselves.”
- She did so with the purpose of infringing the celebrities’ right of publicity.
5. So we thus have a broad criminalization of a wide range of communicative torts. Criminal libel is back, to my knowledge without any real legislative deliberation about whether to revive this crime. For the first time in California (and in nearly all the other states), the disclosure-of- private-facts tort is now a crime. So is the right of publicity. So is the interference with contract. So is trademark infringement that uses a corporation’s name.
As a First Amendment matter, the general rule is that speech that can be made tortious can generally be criminalized (at least so long as the government must show at least recklessness or knowledge as to the facts on the speaker’s part, and so long as the elements of the speech restriction are sufficiently clearly defined). But there is good reason for legislatures not to push their power to the maximum, especially when the underlying tort is pretty vague (consider the disclosure-of-private-facts tort, with its focus on relatively subjective concepts, such as “newsworthiness”). I don’t think the California Legislature was trying, with § 530.5, to so broadly criminalize tortious speech. But that’s how California courts have interpreted the statute.
And this also helps show why many commentators — myself included — criticize proposed statutes based on the possible scope of their broad and vague language, rather than just focusing on the particular problem that led to the proposal. Once a statute is enacted, prosecutors will often push them to the limits of the language, especially when the defendants are bad people doing bad things (e.g., Bollaert’s revenge porn blackmail racket). And courts will often (not always, but often) read the language broadly. The story of § 530.5 is a classic example.