In a decision last week, the Massachusetts Supreme Court held that zip codes are personally identifiable information, perhaps serving as a harbinger for other state court decisions still yet to come. This ruling is important for all retailers when considering their privacy practices in conjunction with ever-evolving privacy laws, especially in the class action context.

In Tyler v. Michaels Stores, Case No. SJC-11145 (Mass., Mar. 11, 2013), the plaintiff alleged that a Michaels retail store routinely requested zip codes from credit card customers, even though this information was not required by its credit card issuers. Using zip codes, the plaintiff further alleged that Michaels looked up customer phone numbers and addresses and then directed unsolicited phone calls, mail pitches, and other “unwanted marketing material” to its customers.  

This case was initially brought before a federal district court in Massachusetts. That court granted defendant’s early motion to dismiss the class allegations, and explained that the named plaintiff failed to assert sufficient “cognizable injury” under Massachusetts General Laws Chapter 93, Section 105(a).  The federal district court then certified several questions of state law to the Massachusetts Supreme Court. One of the questions was whether zip codes constitute personally identifiable information in Massachusetts.

The Supreme Court accepted certification and held that zip codes are personally identifiable information under Consumer Privacy in Commercial Transactions, Section 105(a), explaining that when a merchant “uses the information for its own business purposes, whether by sending the customer unwanted marketing materials or by selling the information for a profit, the merchant has caused the consumer an injury that is distinct from the statutory violation itself.”

Tyler v. Michaels Stores appears to have fallen in line with Pineda v. Williams-Sonoma, Case No. S178241 (Cal., Feb. 10, 2011), a similar decision where the California Supreme Court held that zip codes are personal information under the California Song-Beverly Credit Card Act.  That ruling caused a swift abundance of litigation related to retailer practices of collating zip code information. In light of these recent state Supreme Court trends, retailers and research companies should be particularly vigilant to take proper security precautions to adequately protect customer privacy, especially when it comes to zip code information.