California Supreme Court Issues ZIP Code Prohibition Ruling With Potential National Impact

Cox Smith Privacy / Data Security E-Alert

California Supreme Court Issues ZIP Code Prohibition Ruling With Potential National Impact

In a landmark ruling, the California Supreme Court ruled last week that ZIP codes are "personal identification information" under California’s Song-Beverly Credit Card Act of 1971 (the "Credit Card Act"). The decision in Pineda v. Williams-Sonoma Stores, Inc. reversed two lower court decisions that reached the opposite conclusion. The Court’s decision effectively prohibits any business operating in California from requesting and recording cardholders’ ZIP codes during credit card transactions at the physical point-of-sale.

The plaintiff used her credit card to buy items at a Williams-Sonoma store and was asked to provide her ZIP code. She provided it because she believed it necessary to complete the sales transaction. The plaintiff alleged the store then used her name and ZIP code in a "reverse look-up" process to locate her home address, and then allegedly added her to a marketing database.

The Credit Card Act prohibits retailers from asking customers for their personal identification information and recording it during credit card transaction. The Court first looked to statutory construction, and noted that the Credit Card Act defines "personal identification information" as "information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number."

The Court stated that the word "address" should be construed as encompassing not only a complete address, but also its individual components. The Court rejected the lower court’s conclusion (affirmed by the Appeals Court) that a ZIP code is not personal identification information because it pertains to a group, rather than a specific individual, and found that that ZIP codes are like addresses or telephone numbers in that such information is "unnecessary to the sales transaction" and "alone or together with other data such as a cardholder’s name or credit card number, can be used for the retailer’s business purposes."

The Court’s ruling does not specify how other uses of ZIP codes, such as delivery or security purposes, would be affected; it merely states that its objection is not over a business seeing a person’s ZIP code, but rather recording it and using it for marketing purposes. The Court does acknowledge that the Credit Card Act does contain some exceptions to the prohibition on recording personal identification information, such as when: a credit card is used as a deposit for cash advances; the entity accepting the card is contractually required to provide the information to complete the transaction; the entity accepting the card is obligated to record the information under federal law or regulation; or when the information is required for a purpose incidental but related to the transaction (i.e. shipping, delivery, servicing or installation).

Thus the ruling does allow a business to request and record ZIP codes for delivery by mail, for example, or anti-fraud purposes (which are contractually required by credit card association networks). An online sale a company can still ask a California resident for their ZIP code to ship goods, and a gas station in California can still demand the customer enter their ZIP code into a pay-at-the-pump device that information is used to verify that the customer is the legitimate credit card holder.

Any retailer or business with physical point-of-sale terminals in California should carefully review their internal policies and procedures, and employee training, for collecting ZIP codes during credit card transactions in light of the Pineda decision. The Court’s ruling did not limit violations to prospective ZIP code requests only, and the Credit Card Act provides for penalties of up to $250 for the first violation and $1,000 for each subsequent violation, and does not require any allegations of harm to the consumer. California has already large numbers of class action lawsuits based upon other alleged violations of the Credit Card Act. The Court’s interpretation of "personal identification information" as including ZIP codes may spark a new round of class action suits. This is an issue that should be addressed on an extremely urgent basis as any request for a ZIP code that is not otherwise within one of the statute’s enumerated exceptions is a potential violation.

With national retailers operating in California, the ruling has potential impact outside the state as businesses reevaluate their training and equipment. Businesses will need to evaluate whether it is more practical, cost effective, and compliant, to single out their California locations verses changing procedures on ZIP code collection across the board.