Court Ruling Jeopardizes Credit Card Privacy Law

Printer-friendly versionSend to friend

By Gene Stonebarger

The California Legislature long ago recognized the dangers associated with collecting and maintaining consumers’ personal identification information, finding that the practice put the physical safety of consumers at risk and jeopardized consumers’ financial security due to identify theft and credit card fraud. In response, the Legislature enacted an amendment to the Song Beverly Credit Card Act in 1990 to protect privacy rights guaranteed to consumers by Article 1, Section 1 of the California Constitution. A recent State Court of Appeal ruling now threatens to open a loophole in this law, enabling retailers to collect detailed personal information on customers who pay with credit cards.

The amendment (California Civil Code Section 1747.08) prohibits the collection of unnecessary personal identification information during credit card purchase transactions. Section 1747.08 was originally enacted to counter the common practice of retailers collecting addresses and/or telephone numbers from consumers during credit card transactions for marketing purposes, because consumers were mistakenly being led to believe that the requested personal identification information was necessary to complete their credit card transactions, when in fact, it was not.

Due to significant advances in technology in recent years, many retailers have now begun collecting customer zip codes during credit card purchase transactions, because a customer’s zip code can be easily matched with the customer’s name and utilized to specifically identify the customer and obtain the customer’s home address. Specifically, many retailers are (1) deceptively requesting their credit card customers’ zip codes under the guise of needing them to process their credit card transactions, which customers are accustomed to providing at gas stations, (2) covertly capturing customers’ names from their credit cards, and (3) providing all of this information to a sophisticated third-party vendor with access to proprietary databases that uses it to pinpoint and specifically identify the customers’ home addresses.

Using a customer’s name and zip code is extremely effective to obtain the customer’s home address because customers are less likely to object to a request for their zip code since they believe it is being used to verify their credit cards, even though it is not. Consumers have become accustomed to this common practice at gas stations, where zip codes are required by credit card companies during "pay at the pump" transactions since there is no live person present to check the cardholder’s identification. However, in this context, the zip code information is being provided to the issuing bank for the credit card to verify the billing address of the cardholder and this billing address information is not provided to or shared with the gas stations. Customers naturally believe that retailers are likewise requesting their zip codes to protect them from identity theft and credit card fraud when, in reality, these retailers are placing them at these very risks by collecting and storing their names, credit card numbers, zip codes, and home addresses, along with other specific information about the customers, in massive databases that are often targeted by dishonest employees and computer hackers.

Section 1747.08 is the only California statute protecting consumers from having to provide unnecessary personal identification information during credit card transactions. Its purpose is more important now than ever. Identity theft is the fastest growing crime in the United States. Sophisticated computer hackers often target retailers and others that collect and store customers’ personal information along with their credit card numbers. The very real and immediate dangers associated with this practice are highlighted in the numerous recent data security breaches affecting California consumers. For example, in 2007 and 2008 The TJX Companies, Inc. reported that hackers infiltrated its company database and stole over fifty million customers’ credit card numbers, as well as home addresses and other personal information. The breach led to massive identity theft and credit card fraud throughout the world.

Allowing retailers to request zip codes from its customers under the false pretense that zip codes are required to complete credit card transactions, and then to utilize the zip codes, along with the customers’ names obtained from their credit cards, to obtain the customers’ respective home addresses, defeats the express purpose of Section 1747.08 and provides retailers with an effective means to circumvent the statute. Unfortunately, in a recent decision issued by the California Court of Appeal, Fourth District, Division One, in the case entitled Pineda v. Williams-Sonoma Stores, Inc., the Court found that this conduct does not violate Section 1747.08 or give rise to a claim for invasion of privacy. The Court found that a zip code is not a unique personal identifier, as is a complete street address, and discounted evidence which showed that with the customer’s name and zip code, the retailer was able to obtain the consumer’s home address and use it for marketing purposes.

If the Pineda decision stands, retailers will be free to build their marketing databases with unsuspecting consumers who provide their zip codes believing they are necessary as a security measure to complete their credit card transactions. Justice cannot tolerate a situation where retailers are collecting zip codes from customers under the false pretense of needing them to process their credit card transactions, covertly capturing customers’ names from their credit cards, and then utilizing all of this information with advanced technology to specifically identify the customers’ home addresses. Because this information is then stockpiled with additional information about customers, including credit card information, consumers are exposed to potential security breaches which can lead to mass-scale credit card fraud and identity theft. It is vital that consumers be protected from information being collected and stockpiled about them without their knowledge.

Plaintiff in the Pineda case intends on requesting the California Supreme Court to review and reverse the Fourth District’s decision.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Gene Stonebarger is a a founding shareholder of Lindsay&Stonebarger, APC,, a law firm located in Folsom, California. The firm represents plaintiffs in class action and complex business litigation, with extensive experience representing consumers in financial privacy cases.