The Supreme Court of California recently ruled in Pineda v Williams-Sonoma Stores that a ZIP code constitutes “personal identification information” as the phrase is used in Civil Code § 1747.08, also known as the Song-Beverly Credit Card Act of 1971 (“Credit Card Act”). S178241. According to the decision in Pineda, a retailer violates the Credit Card Act by requesting and recording a customer’s ZIP code in conjunction with a credit card purchase.
The plaintiff filed a complaint against Williams-Sonoma in 2008, alleging that their practice of collecting ZIP code information at the time of credit card payment violated her privacy. Williams-Sonoma, after collecting the ZIP code from credit card purchasers, utilized software which matched customers’ names and ZIP codes in order to obtain their full mailing address, which it then maintained on its own database. Pineda claimed that this practice violated section 1747.08, the unfair competition law (“UCL”), and gave rise to an invasion of privacy claim.
The trial court dismissed the UCL claim and the invasion of privacy claim as a ZIP code was held not to constitute personal identification information under section 1747.08. The Court of Appeal affirmed in all respects. The Supreme Court of California granted review of plaintiff’s Credit Card Act claim and reversed this ruling, holding that a cardholder’s ZIP code constitutes personal identification information under section 1747.08. This was based upon the definition of “information concerningthe cardholder”, as one’s ZIP code pertained to and regarded the cardholder in the Supreme Court’s view. The Court also determined that “address” means not only the entire address, but also the addresses’ components, like the ZIP code, particularly in this case since the Court found that a ZIP code was unnecessary for the transaction and could be used to violate a person’s privacy, namely by locating them in a database and obtaining their full address.
The Effect of Pineda on Existing Law
Section 19:10 of Information Security and Privacy: A Guide to Federal and State Law and Compliance notes that plaintiffs had argued in other cases that ZIP codes should be considered personal identification information under the Credit Card Act. Andrew Serwin, Information Security and Privacy: A Guide to Federal and State Law and Compliance § 19:10 (Vol. 1 2010). In TJX Companies Inc. v. Superior Court, the court held that “Plaintiff is painting with too broad a brush to state that under the Act, any component of an address is necessarily a ‘personal identification’ item, since the zip code portion of an address does not in itself supply enough information to identify an individual.” 163 Cal. App. 4th 497, 86 Cal. Rptr. 3d 721 (4th Dist. 2008).
Clearly the unanimous decision by the Supreme Court of California in Pineda cuts the opposite way on this point. Under Pineda, retailers will not be permitted to inquire about a person’s ZIP code when a customer pays with a credit card because ZIP codes are now considered to be personal identification information under the Credit Card Act.