Legal Matters : Collecting Customer ZIP Codes? Beware the Legal Risks

Doing so might subject you to class-action lawsuits

The Supreme Court of California recently ruled that collecting ZIP codes from customers who paid by credit card may subject merchants to class-action lawsuits. Dozens of such actions have already been filed, including against retailers "yet to be named." Reported settlements paid by some companies have exceeded $25 million. The lesson is clear: All retailers should review their customer information collection practices in light of California law (and other states) to avoid becoming the target of class-action lawyers.

The California Supreme Court Decision
Pineda v. Williams-Sonoma was decided by the California Supreme Court on Feb. 10. The facts considered in the case are quite typical of the way many retailers process their in-store transactions. Jessica Pineda alleged that she visited a Williams-Sonoma store in California and selected an item for purchase. She proceeded to the cashier to pay by credit card, where she was asked for her ZIP code. Pineda believed it was required to supply the requested information to complete the transaction. The cashier entered her ZIP code into the point-of-sale system and completed the transaction. At the end of the transaction, Williams-Sonoma had captured Pineda's credit card number, name and ZIP code.

According to the court decision: "Defendant subsequently used customized computer software to perform reverse searches from databases that contain millions of names, e-mail addresses, telephone numbers, and street addresses, and that are indexed in a manner resembling a reverse telephone book. … Defendant uses its database to market products to customers and may also sell the information it has compiled to other businesses."

Legal Basis for the Court's Decision
The decision of the California Supreme Court that ZIP codes constitute personal identification information is based on the Song-Beverly Act. This law prohibits retailers accepting credit cards from requesting or requiring the cardholder to provide personal identification information, which the retailer records.

A trial court dismissed Pineda's claim that capturing her ZIP code violated the Act, and the Court of Appeal affirmed the dismissal on the grounds that while telephone numbers and mailing addresses constitute personal identification information, a ZIP code doesn't because it's not specific to the individual. When the case reached the California Supreme Court, however, the justices reversed the dismissal. They ruled that the Act is violated when a business requests and records a customer's ZIP code during a credit card transaction.

• MORE ON
• MANAGEMENT ISSUES