It is a common practice for retailers to collect customers’ personal information when processing the exchange or return of merchandise. A recently filed lawsuit, however, provides a warning that companies should tread carefully when utilizing customers’ driver’s licenses to facilitate these transactions.

According to a class action complaint filed with the US District Court for the Southern District of Florida, electronics retailer Best Buy Co. (Best Buy) has “flagrantly” violated the Driver’s Privacy Protection Act (DPPA) by using customers’ driver’s licenses to collect personal information while processing merchandise returns. Siegler v. Best Buy Co. of Minnesota, 9:11-cv-81292 (SD Fla. Nov. 22, 2011). In October of last year, when a Best Buy customer attempted to return merchandise to a South Florida store, a return clerk allegedly requested the customer’s driver’s license, swiped it through a card reader, and then refused the customer’s subsequent demands to delete any personal information that had been collected. As a result, the customer, whose complaint seeks to establish a national class of Best Buy customers from whom Best Buy has similarly collected information since November 21, 2007, has sued Best Buy, claiming that the retailer’s collection, retention, use, and sharing of personal information derived from motor vehicle records is a “per se” violation of the DPPA. The complaint seeks compensatory damages, which include liquidated damages of $2,500 per DPPA violation, as well as punitive damages and injunctive relief.

The DPPA governs the privacy of personal information gathered by state Departments of Motor Vehicles (DMVs) by prohibiting any person from knowingly obtaining or disclosing personal information from a motor vehicle record, unless done pursuant to certain “permitted purposes.” For instance, one exception permits use in the “normal course of business” by a legitimate business or its agents, employees, or contractors, but only to verify or correct personal information submitted by the individual to the business or its agents. An “authorized recipient” of the information may then resell or disclose the information, but only pursuant to one of the enumerated “permitted purposes.” If it does so, it must thereafter maintain, for five years, records identifying each person or entity receiving the information and the permitted purpose for which the information will be used. Where, however, “highly restricted personal information” such as an individual’s photograph, social security number, or medical or disability information is involved, use or disclosure is prohibited without the individual’s express, written consent.

According to the complaint, Best Buy failed to inform the plaintiff, prior to purchase, of any policy requiring him to provide his personal information in order to return the purchased item. Indeed, Best Buy’s receipt, provided to the plaintiff only after he consummated the purchase, includes a statement that “some of the information from (his) ID may be stored in a secure, encrypted database of customer activity that Best Buy and its affiliates use to track exchanges and returns.” The complaint suggests that this statement fails to adequately explain the nature of the information collected, where the data is stored, how long the data is stored, the identities of Best Buy’s “affiliates,” or how the retained information is ultimately used. Moreover, the plaintiff, citing a definition found on the Florida DMV website, claims that Best Buy’s authority to use personal information “in the normal course of business” is limited to “verifying information for employment purposes.” As such, he argues, any use of the information by Best Buy that is not related to employment verification violates the DPPA.

This case illustrates a potential pitfall in maintaining a database to track merchandise exchanges or returns. Companies should also be aware of state statutes governing the collection of personal information at the point of sale. Where enacted, these laws generally prohibit merchants from requesting personal information such as phone numbers, addresses, or zip codes in connection with credit card transactions, and, in some cases, check transactions. While these laws typically do not apply to returns or exchanges, the situation may be different where customers’ driver’s licenses are swiped in connection with crediting their accounts to process returns. Retailers are therefore advised to have appropriate legal counsel review their privacy policies as well as any customer information collection practices that they employ.

Arent Fox will continue to monitor this case.