United States: Have You Been Sued For Recording ZIP Codes? Your Insurance May Cover The Claim

Following the recent California Supreme Court's decision in Pineda v. Williams-Sonoma Stores, Inc., 2011 WL 446921 (Cal. Feb. 11, 2011), numerous class action lawsuits have been filed under the Song-Beverly Credit Card Act of 1971, Cal. Civ. Code §§ 1747 et seq. ("Credit Card Act"), a state statute designed to protect the personal privacy of credit card users. These lawsuits expose California businesses to considerable defense costs and the potential for substantial damages. Law360 reports that in the wake of this ruling at least 30 proposed class actions have been filed in California, and many more are on the way. That's the bad news.

The good news is that these claims may be covered under your Commercial General Liability ("CGL"), Errors and Omissions ("E&O"), or Directors and Officers ("D&O") Liability insurance policies.

Background

In June 2008, Jessica Pineda filed a class action lawsuit against Williams-Sonoma for violating section 1747.08 of the Credit Card Act. This section specifically prohibits businesses from requesting or requiring customers to provide "personal identification information" ("PII") during credit card transactions and then writing down or otherwise recording this information. PII is any information concerning the cardholder other than what is actually on the credit card and includes, but is not limited to, the cardholder's address and telephone number.

In her complaint, Pineda alleged that Williams-Sonoma violated the Credit Card Act when it requested and then recorded her ZIP code during a credit card transaction. Williams-Sonoma disagreed and argued that, unlike an address or telephone number, a ZIP code is not PII. Siding with Williams-Sonoma, the trial court and court of appeals found that Williams-Sonoma had not violated the Credit Card Act.

California Supreme Court's Decision

On review, the California Supreme Court reversed the court of appeal's decision and unanimously held that a ZIP code constitutes PII as that term is used in section 1747.08 of the Credit Card Act. The court noted that at the end of the transaction, Williams-Sonoma had entered Pineda's name, ZIP code, and credit card number into its database and subsequently used specialized software to match this information with Pineda's previously undisclosed home address. Williams-Sonoma uses this compiled information to market products to customers and may sell it to other businesses. Finding these marketing tactics contradictory to the Credit Card Act's inherent consumer protection purpose – to combat the misuse of personal information for marketing purposes – and determining that the court of appeal's interpretation of the act was too narrow, the Supreme Court held in Pineda's favor. See California Supreme Court Rules that ZIP Codes Are "Personal Identification Information" Under Song-Beverly Act.

What This Means for YOU

Since the California Supreme Court's ruling, numerous California retailers have been hit with class action lawsuits, including Best Buy, Macy's, Trader Joe's, Shell Oil, Tiffany & Co., and RadioShack. It appears that no business is safe from impending litigation if it once requested and then recorded a cardholder's ZIP code while conducting a credit card transaction. Unless a business' collection practices fall within an exception to the Credit Card Act, this five-digit number may cost the business up to $250 for the first violation and $1,000 for each subsequent violation.

Typically, a business is exempt from the law if (1) the credit card is used to make a deposit or for a cash advance; (2) the business is contractually obligated to collect the PII to complete the transaction or is obligated to record the information under federal law or regulation; or (3) the information is required for a purpose that is incidental but related to the transaction, such as for shipping, delivery, service, or installation. Also, a business is always permitted to request the information as long as it does not record the information. And, the Credit Card Act does not apply to transactions conducted over the Internet or to non-credit-card transactions, such as payment by cash or check.

But, unless your business can squeeze within these narrow exceptions, it may face substantial liabilities.

But There Is Hope

Although the specific claims asserted and the specific insurance policies in question must be independently examined, defense costs and indemnity for Credit Card Act claims may be covered under your CGL, E&O, and D&O liability policies. The real issue will be whether the underlying Credit Card Act allegation – the unlawful collection and recording of ZIP codes for advertising and marketing purposes – constitutes a covered loss under the policy's provisions.

In determining whether a Credit Card Act claim is covered, a court will apply the general principles of insurance contract interpretation. Thus, it will look to the language of the policy and presume that (1) all terms should be interpreted broadly in favor of coverage; (2) exclusions should be interpreted narrowly; and (3) any ambiguity should be interpreted in favor of the insured.

It is also important to remember that the standard for obtaining a defense is much easier than obtaining indemnity for the claim. The mere potential for coverage triggers an insurer's duty to defend. Since defense costs may exceed the amount of any judgments or settlements, obtaining an insurer's defense may be critical to protecting your company from Credit Card Act lawsuits.

Commercial General Liability Policies

The Insuring Agreement in a typical CGL policy provides, in part, that:

"Advertising injury" is usually defined as an injury arising out of one or more of the policy's enumerated offenses, such as "oral or written publication, in any manner, of material that violates a person's right of privacy."

The Pineda court stressed that the Credit Card Act was enacted to protect the personal privacy of consumers who pay for transactions with credit cards. It held that Williams-Sonoma violated this act when, in its regular course of business, it requested and then recorded Pineda's ZIP code for marketing and advertising purposes. Thus, Williams-Sonoma's actions likely caused an "advertising injury" under a standard CGL policy since they were a written publication of material that violated Pineda's right of privacy.

But does recording a ZIP code into a business' computer database really pass muster as a "written publication"? Perhaps not. But what the business does with this personal information – distributing it to third parties or using it for the business' own marketing purposes– most likely does.

Errors and Omissions Policies

E&O policies typically cover claims arising out of "wrongful acts" committed in the course of the insured's "professional services." These policies increasingly extend coverage for "Privacy Liability." Privacy Liability includes claims arising from failing to comply with the insured's privacy policy regarding the use of PII as well as regulatory proceedings resulting from violations of privacy law that include statutes like the Credit Card Act. In light of the ruling in Pineda, the recording and use of ZIP codes may well constitute a violation of the insured's own privacy policy and, hence, trigger coverage under the Privacy Liability provisions of these E&O policies.

Directors and Officers Liability Policies

A business also may be entitled to coverage for Credit Card Act litigation under its D&O policy. Standard D&O policies cover claims against a business' directors and officers resulting from any wrongful act or omission committed by the directors or officers acting in their capacity as such, unless the wrongdoing is specifically excluded from coverage. Typically, "wrongful act" is defined broadly and includes any actual or alleged act, error, omission, neglect, breach of fiduciary duty, or other wrongdoing by the insureds, i.e., the directors and officers.

Collecting ZIP codes in California, if not protected by one of the statutory exceptions, likely constitutes a wrongful act under a typical D&O policy since it violates a state statute. If directors and officers are not named as defendants, D&O coverage itself may not be triggered, but many D&O policies also include coverage for certain claims against the company itself even if directors and officers are not also named as defendants. This "entity" or Side C coverage typically applies to all types of claims against private companies, unless the claims fall within a few narrowly tailored exclusions.

Conclusion

It is important to remember that the Credit Card Act applies solely to California residents shopping at retail stores in California; therefore, the Pineda decision has no force on businesses operating outside California. And while a handful of other states have statutes similar to the Credit Card Act, none appears to treat ZIP codes as PII –at least not yet.

As for California businesses, the recent holding may not be as alarming as originally feared. While insurance companies may initially deny coverage for Credit Card Act claims, the claim may well be covered under a standard CGL policy or, in the appropriate case, an E&O or D&O liability policy.

If your business is sued for allegedly violating the Credit Card Act, you should promptly notify your insurance carrier. Even if your broker or risk manager doubts that the claim would be covered, you should consult with an attorney specializing in insurance coverage. Perkins Coie has an insurance coverage group whose attorneys regularly advise policyholders regarding their rights under their insurance policies and litigate on their behalf in courts across the United States. These steps will maximize your chances of obtaining coverage for what will mostly likely become contentious and expensive litigation.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.