We recently wrote about the California law prohibiting retailers from asking for their customers' ZIP codes in credit card purchases. In one of the most striking examples of the fractured, decentralized approach to consumer privacy existing in the U.S., we note that another state, New Jersey, has a law requiring business to collect customers ZIP codes in certain transactions.
New Jersey's controversial gift card law requires gift card issuers to "obtain the name and address of the purchaser or owner of each ... card issued or sold and shall, at a minimum, maintain a record of the zip code of the owner or purchaser." New Jersey is the only state to impose such a requirement. The data collection component of the law supports a revenue-generating purpose. New Jersey's gift card law allows the state to claim, or "escheat," abandoned balances on gift cards as unclaimed property. The data collection requirement makes it easier for New Jersey to escheat the unused balance because it will enable the state to identify which unused balances exist on cards purchased or owned by New Jersey residents.
The law's existence has caused some unexpected problems. For one, an important aspect of the data collection requirement is that it is imposed on "issuers" of gift cards, who are often not the sellers of gift cards. For example, a gift card may be "issued" by and redeemable at a restaurant chain, but it is actually sold at a supermarket. In that case, the issuer is responsible for assuring that the gift card purchaser's address is collected by the supermarket, and that the purchaser's ZIP code information is maintained. This presents some obvious challenges for issuers. In fact, this past spring, several major gift card providers announced that they intended to stop selling gift cards in New Jersey, rather than comply with the burdensome data collection requirement. The possibility that New Jersey residents soon might not be able to buy the gift cards that have become so common in recent years prompted legislative amendments in June 2012. Although the amendments did not eliminate the data collection requirement, the requirement's effective date was postponed until 2016 so that the state will have more time to prepare specific guidance on how businesses are supposed to comply.
Revenue-starved states are exploring all kinds of ideas for filling budget coffers. New Jersey's approach to gift cards represents the only example we're aware of in which a state has gone the route of imposing a data collection requirement on private businesses. The New Jersey gift card example, especially when juxtaposed to California's diametrically opposite restrictions on ZIP code collection, points out that there are many legitimate reasons to collect consumer data, and lawmakers and policy advocates should be thinking about striking the right balance between the legitimate data needs of organizations and data security requirements that will actually protect the legitimate privacy rights of individuals.
For more information, please contact Eric Unis or John Hutchins.
About Troutman Sanders
Troutman Sanders is an international law firm with offices in North America, Europe and Asia. Founded in 1897, the firm's heritage of extensive experience, exceptional responsiveness and an unwavering commitment to service has garnered strong, long-standing relationships with clients across the globe. These clients range from multinational corporations to individual entrepreneurs, federal and state agencies to foreign governments, and non-profit organizations to businesses representing virtually every sector and industry.
Troutman Sanders lawyers provide counsel and advice in practically every aspect of civil and commercial law related to the firm's core practice areas: Corporate, Finance, Litigation, Public Law and Real Estate. With more than 50 practice groups focused on specific aspects of these areas, the firm is defined by its considerable knowledge base and proactive approach to addressing legal and business challenges.
For more information about LexisNexis products and solutions, connect with us through our corporate site.