By Troutman Sanders LLP
"....And can I have your ZIP code, please?"
Over a year after the Supreme Court of California ruled that a retailer could not ask this question to store customers paying by credit card, retailers are still waiting to learn for certain whether California is the only state with this prohibition. The highest court in another state may soon help answer this question.
Retailers might want to know a shopper's ZIP code for various reasons. Often, it is for identity verification purposes. Sometimes, a retailer simply wants to know where its customers are coming from, information that can be helpful when researching potential new store locations. But many retailers also try to obtain customers' ZIP codes so they can engage in a marketing practice called "reverse appending," by which they can cross-reference the ZIP code with information in other databases to obtain the customer's full address. Having the customer's full address, of course, allows the retailer to send marketing materials directly to the customer. But is this practice a legally actionable violation of consumer privacy?
California is one of several states with laws addressing the collection of personal identification in connection with credit card transactions. In February 2011, in Pineda v. Williams-Sonoma, the California Supreme Court found that the retailer violated California's Song-Beverly Act by requesting and recording a ZIP code from a consumer who paid for her purchase by credit card. The Court analyzed the language in the statute and considered whether a ZIP code, without the rest of the consumer's address, was "personal identification information." The statute defines "personal identification information" as "information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder's address and telephone number" and states that retailers cannot, "request, or require as a condition to accepting the credit card as payment in full or in part for goods or services, the cardholder provide personal identification information, which [the business] writes, causes to be written, or otherwise records upon the credit card transaction form or otherwise." Reversing a lower court's decision, the California Supreme Court found that ZIP codes were "personal identification information" and took the broad view that the statutory prohibition on collecting addresses also applied to "components" of the address.
Pineda came as somewhat of a surprise and quickly led to hundreds of class action lawsuits in California in which plaintiffs sued retailers who had requested ZIP codes (and many who had not). In addition to potential penalties of up to $1000 per transaction, part of the reason for this litigation boom was the fact that Pineda applied retroactively. Thus, retailers who had collected ZIP codes in reliance on lower court decisions faced exposure for past practices. The question remained, however, would retailers need to amend their practices in states other than California going forward as well.
Almost immediately after Pineda, the plaintiffs class action bar began looking at other states whose laws might allow them to sue retailers for collecting ZIP codes. Massachusetts, having a statute with some similar language to California's Song-Beverly Act and a provision for a private right of action, was a particularly inviting forum. Explicitly relying on Pineda, a Massachusetts woman filed a proposed class action in federal court last May alleging that Michaels Stores requested and recorded her ZIP code in an electronic database at the time she made a credit card purchase, allegedly in violation of Mass. Gen. Laws ch. 93 § 105(a). Michaels promptly moved to dismiss the complaint for failure to state a claim.
In January, the district court granted Michaels' motion and dismissed the complaint. The decision, however, did not put all of the issues to rest. The district court declared that ZIP codes are personal identification information under the Massachusetts statute. The court analogized ZIP codes to PIN numbers, and concluded that they are personal identification information because, like a PIN number, knowing an individual's ZIP code could assist someone in assuming the identity of that individual. Like the Pineda court's reasoning that a ZIP code is akin to an address because it is a "component" of an address, this reasoning shows that courts may frequently give an expansive interpretation of what is personal identification information.
Michaels also argued that the Massachusetts statute did not apply to information entered into a database, because the statute prohibits recording the personal identification information on a "credit card transaction form," a phrase that appears in some of the parallel statutes in other states (such as New York and New Jersey), and that the database was not such a form. The court disagreed, and found that the statute did not only apply to information recorded on the paper forms that were more frequently in use at the time the statute was enacted, but also to information directly entered into a database.
Despite these findings, the court granted the motion to dismiss because it found that the plaintiff had not suffered any cognizable injury. All she had alleged was that Michaels had used her ZIP code to locate her full address to send her marketing material. While this was "irritating," the court did see it as being actionable. The court examined the statute's legislative history and found that the Massachusetts statute had a much narrower scope than the California statute and that the intent of the Massachusetts statute was solely to police possible identity fraud and not to prevent unwanted marketing. Despite finding that there was a violation of the statute, without the allegation that Michaels' actions had caused her to suffer identity theft, the court did not see any harm under the Massachusetts statute.
While issuing an extensive decision, the district court was not sure that it should be the last word on what were questions of Massachusetts law and encouraged the parties to present certain issues to the Massachusetts Supreme Judicial Court. In February, the district court certified three questions of law to the Massachusetts Supreme Judicial Court, asking it to answer: (1) Whether ZIP codes are personal identification information; (2) whether a plaintiff may bring an action for this privacy right absent identity fraud; and (3) whether the words "credit card transaction form" refer equally to an electronic or a paper transaction form.
Briefs in this matter are being submitted this spring. Another statement from a state's highest court will certainly provide guidance to retailers on these issues and help determine whether California is truly an outlier on the question of whether it is permissible for a retailer to collect a customer's ZIP code.
For more information, please contact Eric Unis or John Hutchins.
For more information about LexisNexis products and solutions, connect with us through our corporate site.