Privacy Point of Sale Alert: Massachusetts District Court Finds that Zip Codes Are PII

In June 2011, we wrote about a class action lawsuit filed against Michael Stores, Inc. (“Michaels”), accusing the arts and crafts retailer of violating a Massachusetts consumer protection statute when it collects and records zip codes during consumer credit card transactions. Last week, a Massachusetts District Court granted Michaels’ motion to dismiss the lawsuit after finding that the plaintiff failed to show cognizable injury. Nevertheless, the Court sent a clear message to businesses that collect customer information at the sales register by concluding that zip codes are personally identifiable information (“PII”) and Michaels may have violated the state statute when it requested plaintiff’s zip code during the sales transaction.

In Tyler v. Michael Stores, Inc., the plaintiff made a purchase at a Michael’s store with her credit card and, during the sales process, the cashier requested the plaintiff’s zip code. The plaintiff provided her zip code to the cashier allegedly based on the belief that it was necessary to complete the transaction. According to the plaintiff, Michaels then combined her zip code with other information to obtain her home mailing address, and began sending unwanted marketing materials. The plaintiff argued that the collection and recording of zip codes during a credit card transaction violates Mass. Gen. Laws ch. 93 § 105, under which a business cannot write, cause to be written or require that a credit card holder write [PII], not required by the credit card issuer, on the credit card transaction form.”

In its order dismissing the case, the Court determined that a zip code is PII under §105. Specifically, the Court noted that a Massachusetts criminal statute concerning identity theft defines PII as any number” used alone or in conjunction with any other information” to assume the identify of an individual. According to the Court, zip codes fit within this definition and are no different than PIN numbers used in debit card transactions because both numbers could be used fraudulently to assume the identity of the card holder when the numbers are recorded on the credit card transaction form. Moreover, despite Michaels’ argument that §105 applies only to credit card information recorded on paper, the Court stated that the statute applies to all credit card transactions, including those processed manually, electronically, or by other methods.

Notably, the Court distinguished its rationale from the California Supreme Court decision in Pineda v. Williams-Sonoma Stores, Inc., which held that zip code information is PII under California’s Song-Beverly Credit Card Act (the Song-Beverly Act”). The Court stated that, while the California statute was intended to prevent retailers from directly or indirectly obtaining PII for marketing purposes, §105 is more narrow in scope and is intended only to reduce the risk of identity fraud by limiting consumer information required on a transaction form.

Despite the Court’s determination that zip codes are PII, the Court dismissed the case after finding that the plaintiff could not show that she was injured by Michaels’ conduct. Specifically, the Court held that the statutory violation standing alone did not constitute redressable injury because the statute was enacted to prevent fraud, and not to create a free standing privacy right. The Court also found that the plaintiff did not show that Michaels misappropriated her mailing address, and that receiving unwanted mail is not an injury under the statute. Further, the Court rejected plaintiff’s unjust enrichment claim finding that plaintiff did not sufficiently allege that consumers would expect to be compensated by Michaels for divulging their zip code.

As this case and the Pineda case show, courts are becoming increasingly cognizant of the manner in which certain information can be combined with other data to personally identify consumers. Businesses that collect customer information at the sales register should continue to closely follow this issue as these cases may foretell lawsuits in other states with consumer protection statutes that are similar to those in Massachusetts and California. This post was written by Alysa Z. Hutnik.