Yesterday, the California Supreme Court held that ZIP codes are “personal identification information” within the meaning of the state’s Song Beverly Credit Card Act. The court’s decision in Pineda v. Williams-Sonoma Stores, Inc., No. S178241 slip op. (Cal. Feb. 10, 2011), casts a dark cloud over the established retail practice of asking for ZIP codes when customers make purchases using a credit card in brick-and-mortar stores. In Pineda, the plaintiff sued Williams-Sonoma alleging that when she made a purchase at one of defendant’s stores, the cashier requested her ZIP code and recorded it as part of her credit card transaction. Subsequently, Williams-Sonoma used plaintiff’s ZIP code to perform a “reverse append” and thereby locate plaintiff’s home address.
The Song Beverly Act prohibits businesses from requesting that cardholders provide “personal identification information” during credit card purchase transactions that do not fall within one of the exceptions in subdivision (c), and then recording that information. Personal identification information is defined as “information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number.” The trial court in Pineda concluded that a ZIP code, without more, did not constitute personal identification information. The Court of Appeal affirmed the trial court’s decision in all respects, in large part because a ZIP code pertains to a group of individuals, unlike an address or telephone number that is “specific in nature regarding an individual.”
The California Supreme Court, however, rejected the trial court’s and the Court of Appeal’s reasoning. Relying (too heavily it seems) on the Song Beverly Act’s protective purpose and expansive language, the court concluded that the word “address” should be construed as “encompassing not only a complete address, but also its components.” The court expressed concern about Williams-Sonoma’s “reverse append” practices and the potential for retailers to make an end-run around the statute by collecting indirectly what they cannot legally collect directly. But the Court’s language does not appear to be limited to collecting and using ZIP codes to perform such reverse appends. Rather, the decision broadly states that “[i]n light of the statute’s plain language, protective purpose, and legislative history, we conclude that a ZIP code constitutes ‘personal identification information’ as that phrase is used in section 1747.08.” In so holding, the Supreme Court essentially reversed the Court of Appeal’s decision in Party City Corp. v. Superior Court, 169 Cal. App. 4th 497 (2008), in which the Court of Appeal first explained that a ZIP code identifies a relatively large group rather than an individual. In fact, the Party City record showed that there were 24,953 individual addressees in the plaintiff’s ZIP code. Consequently, the Court of Appeal concluded that a ZIP code was not, as a matter of law, the kind of personalized or individual identification information that falls within the scope of the Act.
In addition to some spirited debate, the Pineda decision is likely to generate a healthy number of lawsuits against California retailers. So ZIP up those jackets and be prepared to weather the storm!