On February 10, 2011, the California Supreme Court issued its opinion in Pineda v. Williams- Sonoma Stores, Inc., holding unanimously that a ZIP code is “personal identifi cation information” under California Civil Code Section 1747.08(b). As a result, California retailers who request and record a customer’s ZIP code in the course of a credit card transaction violate the Song-Beverly Credit Card Act of 1971.
The Song-Beverly Act
The Song-Beverly Act prohibits businesses that accept credit cards from requesting and recording a cardholder’s “personal identifi cation information.” The act defi nes “personal identifi cation information” as information concerning a cardholder, other than information provided on the face of the credit card, including a cardholder’s address and telephone number.
The issue in Pineda was whether a ZIP code constitutes “personal identifi cation information” under the Song-Beverly Act. In 2008, the California Court of Appeal, Fourth District, took up this very issue and ruled in Party City Corp. v. Superior Court that a ZIP code, without more, does not constitute “personal identifi cation information.” The lower courts in Pineda dismissed the suit on the same basis, but were reversed by the highest court.
The Supreme Court Pineda based its conclusion that a cardholder’s ZIP code is personal identifi cation information upon: (a) the statutory language of Section 1747.08, (b) the legislative history, and (c) the evident purpose of the statute.
With respect to the language of the statute itself, the Court observed at the outset that a cardholder’s ZIP code refers to the area where a cardholder works or lives and is certainly information that “pertains to or regards” the cardholder. Thus, a ZIP code is covered by the statutory language of Section 1747.08(b).
In analyzing the legislative history of the Song-Beverly Act, the Court concluded that the Legislature intended to include components of a cardholder’s address in the defi nition of “personal identifi cation information.” The Court found that a ZIP code is readily understood to be part of an individual’s address. Additionally, the Court observed that the Legislature meant for a ZIP code to be “personal identifi cation information” because it can be easily used to fi nd a customer’s full address and phone number.
As to the evident purpose of the statute, the Court found that the Song-Beverly Act was designed to promote consumer protection. Specifi cally, the Court observed that the purpose of the statute is to address the misuse of personal identifi cation information for marketing purposes, and therefore should be interpreted broadly to prevent the collection of ZIP codes. In conclusion, the Court said its decision would be applied retroactively to past customer transactions.
The Impact on Retailers
The Pineda decision has implications for all retailers doing business in California. As a result of the decision, retailers cannot request and record a customer’s ZIP code in the course of a credit card transaction. To the extent that the collection of such information is important to business marketing, the decision is strongly unfavorable.
California retailers may need to adjust their business practices and policies to comply with Pineda. The Song-Beverly Act provides damages of up to $250 for the fi rst transaction in violation of the statute, and up to $1,000 for further violations. Requesting and recording a cardholder’s ZIP code could therefore result in signifi cant liability, especially in class action lawsuits. The statute does, however, provide for limited safe harbor from the imposition of a penalty where preventative procedures were adopted and the violation is accidental.
Because the Court applied its decision retroactively, retailers are exposed to liability even if they relied on the lower courts’ decisions. As a result, retail businesses that have been engaged in such practice may potentially fi nd themselves faced with consumer lawsuits brought in response to the Pineda decision.
Despite the wide-reaching consequences of Pineda, the decision still allows for ZIP codes to be collected in certain limited situations. For example, the decision does not extend to credit card transactions that involve shipping, or where a credit card is used for a deposit or cash advance. Additionally, gas stations can continue to require customers to provide their ZIP codes for security reasons.