Massachusetts Tells Retailers Who Collect Customer ZIP Codes to… “Zip It.”

“’May I have your zip code?’ is an all-too-familiar question that may be going the way of the dinosaur in Massachusetts.” (Mintz Levin)

On March 11, 2013, Massachusetts became the second state in the union after California to prohibit retailers from collecting customer ZIP codes when processing purchases via credit card.

The background, from attorneys at Perkins Coie:

“In 2011, Melissa Tyler, a customer of Michaels Stores, Inc. (Michaels), filed an action on behalf of herself and a putative class of Michaels’ customers. The complaint alleged that Michaels repeatedly violated [Massachusetts’ Credit Card law] Section 105(a) by requesting customer ZIP code information when processing credit card transactions. Michaels filed a motion to dismiss the complaint and the U.S. District Court for the District of Massachusetts certified the following questions to the Supreme Judicial Court of Massachusetts:

  • Does a ZIP code constitute PII under Section 105(a)?
  • Can a plaintiff bring an action under Section 105(a) absent any indication of identity fraud?
  • Does the statute’s reference to a ‘credit card transaction form’ include electronic forms in addition to paper forms?”

Here’s what the justices found:

1. ZIP codes are personal identification information and subject to privacy law:

“[T]he SJC held that a consumer’s zip code constitutes personal identification information under Section 105(a). Given the plaintiff’s allegations that a zip code and name are enough to enable a merchant to identify a consumer’s address and telephone number – the very information that Section 105(a) identifies as personal identification information – the SJC concluded that to hold otherwise ‘would render hollow the statute’s explicit prohibition on the collection of customer addresses and telephone numbers, and undermine the statutory purpose of consumer protection.’” (Mintz Levin)

2. Actual fraud isn’t required to prove “injury:”

“The Massachusetts Supreme Court’s answer that a plaintiff may bring an action for violation of the Credit Card law absent identity fraud is important for retailers, as it opens the door to litigation based on a wide range of injuries (or lack of actual injuries). To bring a claim, the Court instructed plaintiffs to allege a ‘separate and identifiable “injury” resulting from the allegedly unfair or deceptive conduct,” and provided two examples of such injuries… These examples flowed directly from the Court’s conclusion that the primary purpose of the statute is to protect consumer privacy, not to protect against identity fraud.” (Morrison & Foerster)

3. In-person and online transactions are treated the same:

“[T]he Court concluded that Section 105(a)’s reference to a ‘credit card transaction form’ is intended to apply to both electronic and paper credit forms. Again, the court turned to the language of the statute, which provides that ‘[n]o person … or … business entity that accepts a credit card for a business transaction shall write, cause to be written or require that a credit card holder write personal identification information … on the credit card transaction form.’ … The court held that a narrow interpretation of the statutory language would render Section 105(a) ‘essentially obsolete in a world where paper credit card transactions are a rapidly vanishing event,’ and concluded that credit card transaction forms refer equally to electronic and paper forms.” (Perkins Coie)

The bottom line for retailers that do business in the state? From Chip Phinney and Cynthia Larose of law firm Mintz Levin:

“In light of Tyler, merchants (whether in brick-and-mortar stores in Massachusetts or with online operations) should carefully review their credit card sales practices to determine whether they involve recording customer zip codes and other personal identification information, and if so, whether the company’s practices need to be revised to avoid a potential consumer class action suit like Tyler.”

The updates:

Find additional legal commentary and analysis relating to the use of ZIP Codes at JD Supra>>