“’May I have your zip code?’ is an all-too-familiar question that may be going the way of the dinosaur in Massachusetts.” (Mintz Levin)
On March 11, 2013, Massachusetts became the second state in the union after California to prohibit retailers from collecting customer ZIP codes when processing purchases via credit card.
The background, from attorneys at Perkins Coie:
“In 2011, Melissa Tyler, a customer of Michaels Stores, Inc. (Michaels), filed an action on behalf of herself and a putative class of Michaels’ customers. The complaint alleged that Michaels repeatedly violated [Massachusetts’ Credit Card law] Section 105(a) by requesting customer ZIP code information when processing credit card transactions. Michaels filed a motion to dismiss the complaint and the U.S. District Court for the District of Massachusetts certified the following questions to the Supreme Judicial Court of Massachusetts:
- Does a ZIP code constitute PII under Section 105(a)?
- Can a plaintiff bring an action under Section 105(a) absent any indication of identity fraud?
- Does the statute’s reference to a ‘credit card transaction form’ include electronic forms in addition to paper forms?”
Here’s what the justices found:
1. ZIP codes are personal identification information and subject to privacy law:
“[T]he SJC held that a consumer’s zip code constitutes personal identification information under Section 105(a). Given the plaintiff’s allegations that a zip code and name are enough to enable a merchant to identify a consumer’s address and telephone number – the very information that Section 105(a) identifies as personal identification information – the SJC concluded that to hold otherwise ‘would render hollow the statute’s explicit prohibition on the collection of customer addresses and telephone numbers, and undermine the statutory purpose of consumer protection.’” (Mintz Levin)
2. Actual fraud isn’t required to prove “injury:”
“The Massachusetts Supreme Court’s answer that a plaintiff may bring an action for violation of the Credit Card law absent identity fraud is important for retailers, as it opens the door to litigation based on a wide range of injuries (or lack of actual injuries). To bring a claim, the Court instructed plaintiffs to allege a ‘separate and identifiable “injury” resulting from the allegedly unfair or deceptive conduct,” and provided two examples of such injuries… These examples flowed directly from the Court’s conclusion that the primary purpose of the statute is to protect consumer privacy, not to protect against identity fraud.” (Morrison & Foerster)
3. In-person and online transactions are treated the same:
“[T]he Court concluded that Section 105(a)’s reference to a ‘credit card transaction form’ is intended to apply to both electronic and paper credit forms. Again, the court turned to the language of the statute, which provides that ‘[n]o person … or … business entity that accepts a credit card for a business transaction shall write, cause to be written or require that a credit card holder write personal identification information … on the credit card transaction form.’ … The court held that a narrow interpretation of the statutory language would render Section 105(a) ‘essentially obsolete in a world where paper credit card transactions are a rapidly vanishing event,’ and concluded that credit card transaction forms refer equally to electronic and paper forms.” (Perkins Coie)
“In light of Tyler, merchants (whether in brick-and-mortar stores in Massachusetts or with online operations) should carefully review their credit card sales practices to determine whether they involve recording customer zip codes and other personal identification information, and if so, whether the company’s practices need to be revised to avoid a potential consumer class action suit like Tyler.”
- Massachusetts Supreme Judicial Court Rules That Retailers May Be Sued for Wrongful Use of Customer Zip Codes Recorded During Credit Card Sales – Mintz Levin
- Retailers Beware: Massachusetts Court Restricts Ability To Collect ZIP Codes At Point Of Sale – Perkins Coie
- It’s Déjà Vu All Over Again: Massachusetts Allows Actions for Violation of Privacy Rights Based on Collection of ZIP Codes – Morrison & Foerster LLP
- Massachusetts High Court Decision Regarding ZIP Codes Increases Consumer Litigation Risk for Retailers – Ropes & Gray LLP
- Massachusetts Echoes California and Disavows Data Mining by Zip Code – BakerHostetler
- Zip Code as Personal Information: The Massachusetts Round 2 – Mintz Levin
- Retailers Beware: Common Credit Card and Marketing Data Collection Practices Could Violate Law – McCarter & English, LLP
Find additional legal commentary and analysis relating to the use of ZIP Codes at JD Supra>>