On February 10, 2011, the Supreme Court of California decided that ZIP codes are “personal identification information” (PII) for purposes of the Song-Beverly Act (the “Act”); therefore, they may not be requested or required as a condition to accept credit cards as part of a transaction. This decision puts an end to the retailer practice of collecting ZIP codes during credit card transactions and later combining them with customer names to find addresses for marketing purposes.

The Act prohibits retailers from “request[ing], or requir[ing] as a condition to accepting the credit card, PII.” Many retailers concluded that ZIP codes were not included in the definition of PII, however, the court determined otherwise. The court’s decision was based on the plain language, “protective purpose,” and legislative history of the Act. It concluded that PII includes, among other things, information that may pertain to third parties, information that can be used for a “retailer’s business purposes,” and information that is not required by financial institutions and banks to process the credit card transaction. The Act has exemptions for cash advances, collecting PII required by federal laws or regulations, and reasons incidental to the transaction such as shipping and delivery.

The decision came out of the Pineda v. Williams-Sonoma Stores, Inc. case, where the plaintiff claimed that Williams-Sonoma violated her rights under the Act by requesting her ZIP code during a credit card transaction, recording and combining it with her name to find her address, and including it in the store’s database for marketing purposes. The decision is retroactive and will affect all cases that have been stayed pending this decision. Penalties under the Act are a maximum of $250 for the first violation and $1,000 for each violation thereafter. It is within the discretion of the trial court to determine the final penalty.

As a result of this decision, retailers must be very cautious about collecting information not permitted under the Act, which only permits the collection of information on the face of the credit card. It excludes information on the face of personal identification (i.e., drivers’ licenses). Therefore, ZIP codes should never be requested or collected for purposes of a credit card transaction. California is a large market and retailers nationwide should be aware of the provisions of the Act and the decision in this case.

Arent Fox is continuing to monitor updates surrounding the Song-Beverly Act, fashion, and privacy-related issues. Please contact Anthony V. Lupo, Sarah Bruno, or Eva Pulliam with questions.