Retailers must now beware of collecting zip codes on both coasts and the possibility of consumer class action suits. Massachusetts’ highest court ruled that zip codes are personal information and that the law prohibiting retailers from requesting codes from credit card purchases was designed to protect their privacy.

In 2011, Melissa Tyler, a customer of Michaels Stores, Inc., filed suit against the craft retailer. She claimed that the company violated a Massachusetts consumer protection law by requesting and recording her zip code while processing her credit card transaction. Tyler filed her suit just weeks after the seminal decision from the California Supreme Court in Pineda v. Williams-Sonoma, which held that retailers may not collect zip codes from consumers who use their credit cards, as they are considered “personal identification information” under the state’s Song-Beverly Credit Card Act.

Giving hope to retailers, a federal court judge dismissed Tyler’s suit last year but gave the plaintiff the option of filing a request to certify questions about the statute to the Massachusetts Supreme Judicial Court, the state’s highest court.

Answering the questions, the court determined that a zip code constitutes personal identification information for the purposes of the state law, G.L. c. 93, §105(a), and the term “credit card transaction form” applies equally to electronic and paper transaction forms. In addition – and most troubling for retailers – the court said that a plaintiff may bring an action for violation of the law absent identity fraud and still recover statutory damages.

The district court judge reached the wrong conclusion about the intent of the statute, which has a “principal purpose…to guard consumer privacy in credit card transactions, not to protect against credit card identity fraud,” the court said. With that backdrop, “We see no reason to read into the statute a requirement that one be the victim of identity fraud in order to assert a claim under [the statute].”

Elaborating on what a plaintiff must allege under the statute to establish injury or loss, the court said “the violation of the legal right that has created the unfair or deceptive act or practice must cause the consumer some kind of separate, identifiable harm arising from the violation itself.”

The court identified two types of injury or harm that might be caused by a merchant’s violation of the statute: “the actual receipt by a consumer of unwanted marketing materials as a result of the merchant’s unlawful collection of the consumer’s personal identification information” and “the merchant’s sale of a customer’s personal identification information or the data obtained from that information to a third party.”

In a footnote, the court was even more explicit. “In the present case, for example, if Michaels obtained a customer’s zip code, placed that information in a file (paper or electronic), and never used the information for any purposes thereafter, a consumer would not have a cause of action for damages [under the statute], even though Michael’s request for and saving of the zip code information may have violated [the law],” the court said.

Because Tyler alleged that she received unwanted marketing materials as a result of Michaels’ collection and recording of her zip code, the court’s holding effectively reverses the district court’s decision.

Turning to damages, the court acknowledged that the use of a consumer’s personal information in the two situations it described would not be likely to cause a quantifiable loss of money or property or measurable emotional distress. However, recovery would still be available.

In the first situation, “receipt of unwanted marketing material as a result of a §105(a) violation represents an invasion of the consumer’s personal privacy causing injury or harm worth more than a penny, and the consumer is thus entitled to the minimum statutory damage award of twenty-five dollars,” the court said.

In the second scenario, where a retailer sold a consumer’s personal information to a third party, the court said that disgorgement of a merchant’s profits would be an appropriate remedy. “It is a close approximation of the value of the consumer’s personal identification information on the open market and because such an award would remove any financial incentive to merchants to violate the statute.”

To read the decision in Tyler v. Michaels Stores, click here.

Why it matters: With two states now denying retailers the right to collect zip codes, similar suits should be expected in other states. Massachusetts-based retailers should also brace themselves to see suits pile up similar to those in the California courts after Pineda.