Businesses engaged in transactions with consumers in California should be aware of an important new ruling handed down by the California Supreme Court which clarifies that state law prohibits the practice of asking for a consumer’s personal identification information unless necessary to complete the transaction. In Pineda v. Williams-Sonoma, the Court held that businesses may not ask for a consumer’s ZIP code, even if the consumer has the option to decline the request.
The Legislature enacted the Song-Beverly Credit Card Act of 1971 to promote consumer protection. Section 1747.08 of this Act prohibits businesses from requesting and then recording “personal identification information” from cardholders during credit card transactions. In Pineda, a cashier at the defendant’s store asked a customer, who paid with a credit card, for her ZIP code. Believing it was necessary to complete the transaction, the customer provided her ZIP code, which the cashier then recorded. At the completion of the transaction, the defendant possessed the customer’s credit card number, name, and ZIP code. With this information, the defendant used customized computer software to perform reverse searches from certain databases. From these databases, the defendant found the customer’s address, which it then used to market products and sell to other businesses.
The customer filed a class action lawsuit alleging that the defendant had violated, among other laws, section 1747.08. The defendant-business argued that a ZIP code is not “personal identification information.” The trial court agreed and it was affirmed by the intermediate appellate court, which reasoned that an address and telephone number are specific to an individual, whereas a ZIP code pertains to a group of individuals within that geographic region.
Examining the purpose and language of the statute, the California Supreme Court reversed the appellate court’s decision and held that requesting and recording a cardholder’s ZIP code violates the Credit Card Act. The Supreme Court explained that the statute’s overriding purpose was the protection of consumers' personal privacy by prohibiting businesses from requiring unnecessary information. Looking to the statute as a whole and broadly construing its language in favor of this protective purpose, the Supreme Court reasoned that a ZIP code is part of an address, is unnecessary to the sales transaction, and together with the cardholder’s name could be used for the retailer’s business purposes.
In the weeks following the California Supreme Court’s decision, several lawsuits have been filed targeting businesses who did not immediately suspend the practice. Businesses engaged in the practice should take necessary steps to ensure that all information relating to consumers’ information is obtained, maintained and protected in a manner that fully complies with privacy regulations.