The recent ruling by the California Supreme Court in Pineda v. Williams-Sonoma Stores, Inc., no. S178241 (Cal. Feb. 10, 2011) has unleashed a wave of lawsuits against retailers doing business in California that have asked their customers to provide ZIP codes when making in-store purchases with a credit card over the past year. In the two weeks since the Pineda decision, suits have been filed against Target, Wal-Mart, Victoria’s Secret, Bed Bath & Beyond, Crate & Barrel, Cost Plus Inc., Macy’s and Old Navy LLC, among others.
The California Supreme Court’s decision in Pineda, which was handed down February 10, 2011, held that retailers are prohibited under California’s Song-Beverly Credit Card Act (the “Act”) (Civ. Code, §1747 et seq.) from asking for and storing customers’ ZIP codes during in-store credit card transaction (which the Court found to be “personal identification information” (“PII”) for the purposes of the Act). The Act prohibits businesses from requesting that cardholders provide PII during credit card purchase transactions, and then recording that information. PII is defined in the Act as “information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number.” Relying on the Act’s purpose to promote consumer protection, the Act’s expansive language and its legislative history, the high court concluded that the term “address” should be construed as “encompassing not only a complete address, but also its components.”
The Act calls for maximum fines of $250 for the first violation and $1,000 for each additional one, exposing each company to millions of dollars of liability, but judges are also free to award token fines for violations. Since the Act does not mandate fixed penalties and the court in Pineda remanded the issue for further proceedings, penalties could span from a penny to the maximum allowed by the Act.
Within California, the effect of this ruling is significant given that retail stores routinely ask customers for their ZIP code for both marketing and regional sales forecasting. The effect is compounded by the fact that in 2008, this practice was considered exempt from the Act by California’s 4th District Court of Appeals holding in Party City Corp. v. Superior Court, 169 Cal.App.4th 497 (2008) which held that ZIP codes were too general to be covered by the Act because they pertain to a group of individuals, unlike an address or telephone number that is specific in nature regarding an individual.
Outside of California, it is unclear what impact the Pineda decision will have. The Act was modeled after a similar New York statute, and other states including Delaware, Kansas, Maryland, Massachusetts, Nevada and Rhode Island have similar laws, but, like the California Act, none of those expressly prohibit the collection of ZIP codes.
At a minimum, retailers with brick and mortar locations in California should re-examine their information collection practices and update those policies in light of this decision.