NEW YORK, Feb 10 (Reuters Legal) - Retail stores may not ask
a customer to provide a zip code in the course of a credit card
transaction, the California Supreme Court ruled on Thursday.
The decision, which has implications for all retailers
doing business in California, arose in a class action suit
against Williams-Sonoma. Plaintiff Jessica Pineda alleged that
the housewares company used customer zip codes to obtain the
home addresses of "hundreds of thousands, if not millions" of
customers and then used the data to market products to
customers or sold the information to other businesses.
Pineda claimed the practice breached her right to privacy
under the California Constitution and violated the Song-Beverly
Credit Card Act of 1971, which prohibits retailers from
recording a customer's "personal identification information" in
a credit card transaction. Each violation carries a civil
penalty of up to $1,000.
In its 15-page, unanimous decision, the California Supreme
Court ruled that the act was "designed to promote consumer
protection" and that "personal identification information"
includes a cardholder's zip code. Any other result, the court
wrote, would be an "end run" around the statute's clear
purpose. The ruling reversed two lower courts and rejected an
argument by Williams-Sonoma that the statute was
unconstitutionally vague. The ruling also allowed the decision
to be applied retroactively to past customer transactions.
"People don't understand they're giving information on
their addresses," said Gene Stonebarger, a lawyer for Pineda
who presented oral arguments before the Supreme Court in
January. "They believe they need to provide the zip code to
process the transaction, similar to what they do at a gas
station." Gas stations, however, do not store zip codes after a
transaction has been approved.
Stonebarger said it is dangerous to store this kind of
information for so many customers. He pointed to the major
breach of TXJ Companies Inc's customer database in 2007, in
which hackers stole over 45,000 credit card numbers and the
personal information of Marshall's and TJ Maxx customers.
Thursday's opinion is "an important decision to protect the
rights of California customers, to prevent against credit card
fraud and identity theft that can occur from this type of
conduct," Stonebarger said.
RETAILERS HAVE FACED SIMILAR LAWSUITS
Williams-Sonoma had argued that the law was never intended
as sweeping privacy legislation to prevent a retailer from
using legal means to send catalogues to its customers. Even
without zip codes, a business could still use other ways to
track down customer addresses, such as a phone book or
electronic database, the company said.
Sheppard Mullin's Craig Cardon, who represented
Williams-Sonoma, declined to comment on the court's decision.
Retailers doing business in California, including Pottery
Barn and Polo Ralph Lauren, have faced a number of similar
lawsuits. Most recently, in a 2008 case against Party City, the
California 4th District Court of Appeals ruled that zip codes
were too general to fall under the law's ban.
Donna Wilson, a partner at Buckley Sandler who has defended
multiple retailers in these cases said the Williams-Sonoma
decision was "about as broad a decision as could have been
issued" and raises the question of how retailers can maintain
contact with their customers without risking a violation of the
law. Applying it retroactively, she said, exposes retailers to
liability even though they relied on lower court opinions that
blessed the practice of zip-code gathering.
David Faustman, a partner at Fox Rothschild who represented
Party City in the previous case, said this kind of litigation
has caused retailers to reconsider doing business in
California.
It was not immediately clear whether the ruling would have
an impact beyond California. The Song-Beverly act was modeled
after a similar statute in New York, and other states including
Delaware, Kansas, Maryland, Massachusetts, Nevada and Rhode
Island have similar laws. None of those states prohibit the
collection of zip codes, Williams-Sonoma argued in its brief.
The high court sent the case back to San Diego superior
court for further proceedings.
The case is Pineda v. Williams-Sonoma Stores Inc,
California Supreme Court, No. S178241.
For Pineda: Gene Stonebarger, James Lindsay and Richard
Lambert of Lindsay & Stonebarger; James Patterson, Harry
Harrison & Matthew O'Connor of Harrison Patterson & O'Connor.
For Williams-Sonoma: Craig Cardon and Elizabeth Berman of
Sheppard Mullin Richter & Hampton.
(Reporting by Terry Baynes of Reuters Legal)