In a case with major implications for retailers and marketers, the Supreme Court of California ruled on February 10, 2011 that state law prohibits businesses from requesting and recording ZIP codes from consumers prior to credit card transactions, including requests for use in marketing. Pineda v. Williams-Sonoma Stores, Inc., S178241 (Cal., Feb. 10, 2011). Numerous other states have laws similar to California's that regulate merchant practices with respect to collecting and recording personal information in connection with a credit card purchase.
The impact of the Court's decision is not limited to future practices. The Court also held that its interpretation of the statute applies retroactively, thereby opening the door to class action consumer lawsuits based on businesses' prior requests for ZIP codes for marketing purposes. Within days of the Court's ruling, over a dozen cases have already been filed in California against major retailers. Courts can impose statutory damages of up to $1000 per violation of the law.
Drawing on our expertise in the arenas of privacy and class action defense, Venable drafted an amicus brief for the Direct Marketing Association supporting the defendant retailer's arguments. We summarize the California Supreme Court's ruling below.
Case Background
According to the plaintiff, Williams-Sonoma requested a ZIP code from the plaintiff while she was making a credit card purchase, recorded the ZIP code, and then used the plaintiff's name and ZIP code to locate her residential address. The plaintiff claimed that she believed the ZIP code was necessary to complete the purchase.
The plaintiff sued Williams-Sonoma, arguing that the request for her ZIP code violated California's Song-Beverly Credit Card Act of 1971 (the "Song- Beverly Act"). The Song-Beverly Act generally prohibits merchants that accept credit cards from requesting, or requiring as a condition of accepting the credit card payment, "personal identification information" ("PII") that the merchant then records. The central question in the Pineda case was whether a ZIP code alone constitutes PII. The Song-Beverly Act defines PII as "information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder's address and telephone number." Cal. Civ. Code § 1747.08(b).
Although the timing of the ZIP code request was not at issue in the Pineda case, a prior appellate decision found that the Song-Beverly Act prohibits requests for PII that occur and are recorded before a credit card transaction is completed, because customers may perceive that the requested PII is required to complete the transaction. Florez v. Linens 'n' Things, 108 Cal. App. 4th 447 (Cal. Ct. App. 2003). However, requests after a payment are permitted. Id. at 451-52.
The trial court ruled in favor of Williams-Sonoma, and the Fourth District appeals court upheld that decision in October 2009, finding that the Song- Beverly Act did not prohibit a merchant from requesting a ZIP code alone. Pineda v. Williams-Sonoma Stores, Inc., D-054355 (Cal. Ct. App., Oct. 8, 2009). This ruling relied in large part on a previous decision that found, as a matter of law, that a ZIP code is not PII for the purpose of the Song- Beverly Act, because it pertains to a group of residents rather than an individual. Party City Corp. v. Superior Court, 169 Cal.App.4th 497 (Cal. Ct. App. 2008).
California Supreme Court Ruling
The California Supreme Court reversed, concluding that "requesting and recording a cardholder's ZIP code, without more, violates the [Song- Beverly] Credit Card Act." Pineda, S178241 at 2. The Court reasoned that interpreting the ban to include ZIP codes is more consistent with the principle that remedial statutes should be construed broadly to effectuate their purpose of protecting the public. In this regard, the Court expressed concern that, if requests for ZIP codes were not prohibited, retailers might use ZIP codes to obtain addresses indirectly in an "end run" around the statutory prohibition on direct requests. The Court also stated that its interpretation is consistent with another provision of the Song-Beverly Act which permits businesses to require cardholder identification, such as a driver's license, as long as the information on the identification is not recorded. Further, the Court cited legislative history in support of its conclusion, including committee reports expressing concern about marketing uses of information.
The Court's ruling will not only impact future business practices, but creates the possibility of significant liability arising from past practices. The Court ruled that its new interpretation of the statute applies retroactively to past conduct, rejecting the defendant's argument that the plaintiff's interpretation rendered the law unconstitutionally vague. Despite prior contrary decisions by lower appellate courts, the Supreme Court concluded that the statute itself provides constitutionally adequate notice of proscribed conduct. As a result, plaintiffs may bring cases against businesses challenging requests for ZIP codes that occurred before the Supreme Court decision announcing that such requests are prohibited.
Equally important, the Court rejected the defendant's argument that treating ZIP codes as PII would be unconstitutionally oppressive due to the statutory penalties available under the Song-Beverly Act. The statute permits penalties up to $250 for the first violation and $1,000 for each subsequent violation, which could mount steeply if a business has had a practice of requesting ZIP code for every credit card transaction. The Court dismissed the defendant's concern in this regard, stating that the Song-Beverly Act sets maximum rather than fixed penalties and that the trial court has discretion over the amount actually awarded.
Stuart P. Ingis is nationally recognized as a leading attorney and thought leader on privacy, marketing, advertising, e-commerce and Internet law. Mr. Ingis co-leads Venable's privacy practice, which won the Chambers USA Award for Excellence in 2009 for the top privacy practice in the United States and the 2010 Award for Excellence for top advertising practice in the United States. Mr. Ingis has also been repeatedly listed in the first tier of privacy attorneys in Chambers USA, Legal 500 and ComputerWorld magazine.
Douglas C. Emhoff, Partner-in-Charge of Venable's Los Angeles office, has substantial experience in commercial litigation, including privacy matters. Recent representations include defending a leading media conglomerate in a putative class action challenging mobile ad serving technology under a variety of state and federal privacy statutes and defending a mobile content provider in a consumer class action alleging improper business practices. Mr. Emhoff also received a favorable settlement for a national retailer in a Song-Beverly class action alleging improper capture of personal information during credit card transactions at retail locations.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.