In a decision released February 10, 2011 in Pineda v. Williams-Sonoma, the California Supreme Court held that ZIP codes are “personal information” and, therefore, retailers may not request or require that a cardholder provide a ZIP code during a credit card transaction and then record the ZIP code.
Concerns with the Decision
Most concerning in this decision for future collection of information with credit card transactions in California was the Court’s conclusion that the Song-Beverly Credit Card Act is “intended to provide robust consumer protections by prohibiting retailers from soliciting and recording information about the cardholder that is unnecessary to the credit card transaction.” (emphasis added)1 Not only should retailers immediately stop requesting ZIP code information for marketing purposes in credit card transactions in California, they must seriously consider how this language can be used in future class action lawsuits. 2
The Song-Beverly Credit Card Act does allow collection of personal identification information for a special purpose incidental but related to the credit card transaction, such as shipping, delivery, servicing or installation or special orders, but the question after Pineda will be what would be other “special purposes” and if the collection is not a special purpose, is it “necessary” for the credit card transaction. Another consideration, based on both state and federal court rulings in California, is whether the Song-Beverly Credit Card Act applies to return transactions.3 These prior rulings reviewed section 1747.08(a) (3) and determined that the Song- Beverly Credit Card Act did not apply to return transactions. The Court was not considering this particular issue in Pineda or the same subsection, so those decisions should stand and an argument can be created that the additional information is necessary for fraud protection purposes. It will, however, be important that if information is collected for special purposes or returns, that consideration be given before the collected information is also used for marketing purposes.
Another point of interest in the Pineda decision relates to the penalties. When addressing the possible penalties upon remand, the Court noted that the Song- Beverly Credit Card Act does not mandate fixed penalties, but rather sets maximum penalties. Citing to a lower court decision, the Court noted that “this could span between a penny ….to the maximum amounts authorized by the statute” and further indicated that the amount of the penalties awarded rests within the sound discretion of the trial court.
The Song-Beverly Credit Card Act
The case involved interpreting the section of California’s Song-Beverly Credit Card Act of 1971 (“Song- Beverly Credit Card Act”) which restricts collection of information from consumers during a credit card transaction and the section defining personal identification information. The relevant portion of Sections 1747.08(a)(2) and 1747.08(b) provide as follows:
(a)(2) “[N]o person, firm, partnership, association, or corporation that accepts credit cards for the transaction of business shall . . . (2) Request, or require as a condition to accepting the credit card as payment in full or in part for goods or services, the cardholder to provide personal identification information, which the person, firm, partnership, association, or corporation accepting the credit card writes, causes to be written, or otherwise records upon the credit card transaction form or otherwise.” [emphasis added]
(b) “Personal identification information” is defined as “ informat ion concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number.”
The Song-Beverly Credit Card Act has been significant over the last several years because it provides a private right of action and statutory damages of up to $250 for the first violation and $1000 for a second violation. After the decision in Florez v. Linen N Things 4 there have been numerous class actions filed against retailers under the Song-Beverly Credit Card Act that have resulted in settlements. The Supreme Court decided to hear the Pineda case after the lower courts had ruled that collection of ZIP code was not personal information and, therefore, was not covered by this prohibition in the Song-Beverly Credit Card Act .
The Court’s reasoning
The following provides more insight into the decision and how the Court supported its ruling that a ZIP code, without more, is personal identification information:
- Giving words their plain meaning in the statute, the Court considered that the definition of personal identification information is information concerning the cardholder and “concerning” is defined in the dictionary as pertaining to or regarding. The Court then held that a ZIP code “pertains to or regards the cardholder.”
- The Court believed that the use of “concerning” and “any” personal identification information was an indication that the Legislature intended a broad reading of the Song-Beverly Credit Card Act.
- The Court also considered legislative history, which included a statement that the problem is that retailers acquire additional personal information for their own business purposes, to build mailing lists which they use and sell.
- The Court ruled that the Legislature, by including the cardholder’s address within the definition of personal identification information, intended to include components of the address.
- The Court looked at the reference to address and phone number in the definition of personal identification information and stated that what those pieces of information have in common is that they both “constitute information unnecessary to the sales transaction that, alone or together with other data such as a cardholder’s name or credit card number, can be used for the retailer’s business purposes.” It then rationalized that because the Song-Beverly Credit Card Act is a remedial statute it must be liberally const rued and the ZIP code (similar to address and phone) is unnecessary to the transaction and can be used with the cardholder’s name to locate the address.
- The Court also relied on 1747.08(d) which permits businesses to require a cardholder to provide forms of identification, but prohibits information on the identification form f rom being wr i t ten or recorded. The Court believed that an interpretation of 1747.08(a)(2) that would allow collection and recording of personal identification information, such as a ZIP code, would be an inconsonant result when considering subsection (d) and such result would not be intended by the Legislature.
- The 1991 amendment adding the prohibition for “requesting” personal identification information to the existing prohibition of requiring such information was seen as evidence by the Court that the Song-Beverly Credit Card Act was intended to be a broad consumer protection statute.