We use cookies to give you the best online experience. By using our website you agree to our use of cookies in accordance with our cookie policy. Learn more here.Close Me
United States: California Supreme Court Holds Online Retailers Of Downloadable Products May Require Personally Identifying Information For Credit Card Transactions
The California Supreme Court held on February 4, 2013 that the
provision of the Song-Beverly Credit Card Act of 1971 (the
"Act") prohibiting retailers from requesting personally
identifying information as a condition to processing credit card
transactions does not apply to online purchases of electronically
downloadable items. (Apple v. Super. Ct., S199384, Case
No. B238097, available athttp://www.courts.ca.gov/opinions/documents/S199384.PDF.)
The Court agreed with Apple that online sales of electronically
downloadable products fall outside the coverage of the Act. The
Court's reasoning emphasized that the collection of some
personally identifying information is important in preventing
online fraud. Although the Act does not apply to the transactions
in question, the Court pointed out that online retailers are not
given free rein because other state and federal laws do apply to
place limits on the collection and use of personally identifying
information.
Among the provisions of the Act, codified at California Civil
Code section 1747 et seq, is a prohibition in section 1747.08
against retailers' requesting or requiring a credit card
holder's personal identification information in order to
process a credit card transaction. The Court has previously held
that requesting and recording a Zip Code during a credit card
transaction in a brick-and-mortar store is forbidden under the Act.
Pineda v. Williams-Sonoma Stores, Inc., 51 Cal. 4th 524
(2011). The Court wrote in Apple that the plain meaning of
the statute's language was not decisive of the issue at hand,
and an analysis of the legislature's statutory scheme as a
whole was necessary. The Court also pointed out that section
1747.08 of the act makes no reference to online transactions, which
is unsurprising, given that the provision that later became section
1747.08 was enacted in 1990.
The plaintiff in the underlying trial court case alleged that
Apple requested or required his address and telephone number in
order to accept his credit card payment for electronically
downloadable items. Apple demurred to the Complaint, arguing that
online transactions fall outside the scope of the Act, and that
holding otherwise would undermine the prevention of online identity
theft and fraud. Although not addressed in the opinion, presumably,
Apple's payment card processor cross-checks the address
information provided by the customer with the payment card billpay
address as a method to verify the customer is the authorized
cardholder.
The Court noted in its Apple decision various
exceptions to the prohibition outlined in the Act, including where
the retailer is contractually required to provide personally
identifying information to complete the transaction, uses the Zip
Code solely to prevent fraud, is obligated to collect information
by a federal or state law, or collects the information for a
purpose incidental but related to the credit card transaction (like
shipping or delivery information). Furthermore, section 1747.08,
subdivision (d) specifically states that the Act does not prohibit
retailers from requiring safeguards, in the form of reasonable
forms of positive identification, as a precondition to a credit
card transaction.
The Court reasoned that since the law's exceptions and its
allowance to check IDs at the point of sale do not have practical
applicability in e-commerce transactions, it must be that the
legislators did not intend the law to apply to e-commerce
transactions at all. The Court seemingly was also influenced by a
desire to balance the protection of consumers from undesired
solicitation against the need to authenticate payment card
purchasers who are not physically present to show an ID or provide
their signature on a transaction form.
The Court explicitly did not identify specifically what types of
personally identifying information would be allowable to collect
for authentication purposes. The Court held only that section
1747.08 cannot have been intended to apply to online sales of
downloadable products because holding otherwise would foreclose
anti-fraud protections enabled by the collection of personal
information during e-commerce transactions.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
The 2010 theft of an unencrypted laptop containing confidential health care information made front-page news in 2013, not because a huge number of patients were affected, but for the exact opposite reason.
Identity theft is a serious threat. In 2012, more than 12.6 million adults became victims of identity theft in the U.S.1 And the costs have been astronomical.
On April 22 Verizon released its 2013 Data Breach Investigations Report (DBIR), which has since 2008 become a leading annual survey of data breaches, with participants across the globe.
Increasingly, privacy is a big concern in app development. California and other jurisdictions are ramping up enforcement efforts around existing privacy laws.
Understanding the complexities of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules is often a challenge for health care providers and consumers.
Any company that collects personal data from consumers should take proactive steps to have appropriate legal counsel review its data security practices, as well as its terms of service or privacy practices, to identify any potential problem areas.
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published on its website a series of factsheets designed to educate consumers unfamiliar with their rights under the Health Insurance Portability and Accountability Act’s (HIPAA) Privacy and Security Rules.
Steven Tyler: Paparazzi Problem In Hawaii Shouldn’t Be Ignored (Video Content)
