Retailers in California and 15 other states have been inundated in recent years with lawsuits by privacy advocates challenging the collection of customers’ addresses, telephone numbers and other personal information in connection with credit card purchases. On February 10, the California Supreme Court raised the stakes in a decision that will apply retroactively to the collection by retailers of ZIP codes from their customers. In Pineda v. Williams-Sonoma Stores, Inc., No. S178241 slip op. (Cal. Feb. 10, 2011), the Supreme Court ruled that a customer’s ZIP code alone constitutes “personal identification information” under the California Song-Beverly Credit Card Act of 1971 (the “Credit Card Act”)1 and that requesting and recording such information during the course of certain credit card transactions may subject the retailer to claims for up to $1,000 per transaction, as well as other liabilities.2 In little over a week since the Pineda decision, proposed class action lawsuits have been filed throughout California against at least 16 different retailers, including Target Corp., Bed Bath & Beyond, Inc., Big 5 Sporting Goods, Cost Plus, Inc., Trader Joe’s Company, Michaels Stores and The Gap, Inc.

The Statute and Prior Practice

The Credit Card Act defines personal identification information as “information concerning the cardholder . . . including, but not limited to, the cardholder’s address and telephone number.” The Credit Card Act prohibits a retailer that accepts credit cards for the transaction of business from requesting or requiring as a condition to accepting the credit card in full or in part for goods or services, that the cardholder provide personal identification information, which it then causes to be written, or otherwise records upon the credit card transaction form or otherwise.3 Most retailers have adopted a policy of not requesting addresses or telephone numbers on any transaction – including cash transactions – to avoid inadvertently violating the Credit Card Act.

Prior to the recent holding in Pineda, many California retailers have had an established practice of collecting ZIP codes, relying on lower court rulings that held that a ZIP code does not constitute “personal identification information” under the Credit Card Act. The lower courts based their rulings on the rationale that given the number of people that can live in any given ZIP code, retailers did not have the ability to trace a ZIP code to a particular individual.4 Although the Credit Card Act was enacted in part to prohibit retailers from reconstructing the customers’ addresses for marketing purposes, many retailers use ZIP codes from customers for legitimate business purposes, including determining where to locate new stores or to focus general advertising, such as in newspapers.

The Pineda Decision

Plaintiff Pineda alleged in her complaint that she visited a Williams-Sonoma store in California, where she used her credit card to pay for her purchase. The cashier asked Pineda for her ZIP code, which was then entered into the cash register. Pineda alleged that Williams-Sonoma later used Pineda’s name, credit card number and ZIP code to conduct reverse searches that matched Pineda’s name and ZIP code with her previously undisclosed address, so it could be stored in the retailer’s database for marketing purposes and also sold to other businesses. Pineda claimed that the collection of her ZIP code violated the Credit Card Act, the unfair competition law and gave rise to an invasion of privacy claim. The trial court dismissed the plaintiff’s claims, and the Court of Appeals affirmed.

The Supreme Court considered the statute’s plain language, protective purpose and legislative history to find that a ZIP code constitutes “personal identification information.” The court found that a ZIP code is readily understood to be part of an address and that the California legislature intended each component of an address to be part of personal identification information. The court also noted that a ZIP code is both unnecessary to the transaction and can be used, together with the cardholder’s name, to locate his or her full address for use in other ways by the retailer.

In its ruling, the court stated that it was trying to prohibit retailers from having an “end-run” around the statute’s clear purposes, and that its ruling was consistent with prohibitions on retailers recording information included on a driver’s license or identification card. The court noted that its ruling was also consistent with the statute’s legislative history, which indicated that the legislature meant to protect privacy and provide robust consumer protections to prohibit retailers from soliciting and recording information about the cardholder that is unnecessary to the credit card transaction. The ruling reversed two lower court rulings and allowed the decision to be applied retroactively to prior customer transactions. In applying its interpretation retroactively, the Supreme Court reasoned that the Credit Card Act provided constitutionally adequate notice of proscribed conduct, including its reference to a cardholder’s address as an example of personal identification information. Thus, ZIP code collection practices of retailers conducted prior to the Pineda decision would be subject to potential litigation based on the interpretation that ZIP codes constitute personal identification information.

Lessons from Pineda

Retailers who accept credit card payments from customers in California should promptly review their information collection and use policies in connection with credit card transactions for compliance with the Credit Card Act in light of the Pineda decision. In particular, customer service and point of sale practices need to be revised, with updated training provided to store sales staff.

Retailers outside of California should also be on alert, as similar laws restricting the collection of personal identification information in connection with credit card transactions exist in 15 other states.5 Although these other states have yet to specifically decide whether ZIP codes constitute personal identification information, the Pineda decision is certainly persuasive and may trigger litigation of this issue even outside of California.