Header graphic for print
Privacy Law Blog

California Court of Appeal Says Chevron Can Collect ZIP Code Information for Pay-at-the-Pump Transactions

Posted in California, Data Privacy Laws, Identity Theft, Privacy Litigation

On June 20, 2013, the California Court of Appeal affirmed the dismissal of a putative class action which alleged that Chevron violated California’s Song-Beverly Credit Card Act (“Song-Beverly”) by requiring California customers to enter ZIP codes in pay-at-the-pump gas station transactions in locations with a high risk of fraud. Flores v. Chevron U.S.A. Inc., No. B240477, 2013 WL 3084913 (Cal. Ct. App. June 20, 2013), available here. With certain exceptions, Song-Beverly prohibits requests for personal identification information from customers paying by credit card in California and provides for up to $1,000 in civil penalties per violation.

The plaintiffs filed the suit shortly after the California Supreme Court held that ZIP codes constitute “personal identification information” within the meaning of Song-Beverly. Pineda v. Williams-Sonoma Stores, Inc., 51 Cal.4th 524, 527 (2011), available here. In response to the Pineda decision, the California Legislature passed several amendments to Song-Beverly, including section 1747.08(c)(3)(B) which permits requesting or requiring personal identification information in credit card fuel purchases at automated machines “solely for prevention of fraud, theft, or identity theft.” Section 1747.08(b) defines “personal identification information,” as “information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number.”

The parties disputed whether the amendments applied retroactively to the plaintiffs’ complaint.  The Court of Appeal did not address this issue, instead resolving the appeal based on a statutory exception that preceded Pineda. Under section 1747.08(c)(4), requesting or requiring personal identification information does not violate Song-Beverly “if personal identification information is required for a special purpose incidental but related to the individual credit card transaction, including, but not limited to, information relating to shipping, delivery, servicing, or installation of the purchased merchandise, or for special orders.” Chevron argued that its use of personal identification information was required for the special purpose of preventing fraud, citing the 80 percent reduction in fraudulent transactions since requiring ZIP codes.  Moreover, Chevron asserted, and the plaintiffs did not dispute, that it used the ZIP codes exclusively to prevent fraud and that the data is purged after 90 days once Chevron reconciles the transactions.

In siding with Chevron, the Court of Appeal rejected the plaintiffs’ argument that the special purpose exception applies only if personal identification information “is required for the completion of the transaction.” The Court of Appeal also rejected the plaintiffs’ assertion that preventing fraud is insufficiently similar to the statute’s listed “special purposes,” pointing out that the statute states that the relevant special purposes are not limited to those listed.

This post was prepared by Brent Canter, a Law Clerk in Proskauer’s Los Angeles office.