Written By Attorneys: Christopher J. DiIenno and John F. Mullen, Sr.

This article is an interpretation of current law and is offered for informational purposes only. This material is not legal advice and should not be construed or used as a substitute for the advice of an attorney. 

The common request for customer zip codes by retailers could have far-reaching implications due to a recent ruling by The California Supreme Court. In Pineda v. Williams-Sonoma Stores, Inc., 2011 WL 446921 (Cal. February 10, 2011), the court ruled that zip codes are now among the growing list of what constitutes protected "personal identification information" (PII).

In order to complete a credit card transaction at one of Williams-Sonoma's stores, plaintiff, Jessica Pineda alleged that she was required to give her zip code. Williams-Sonoma allegedly recorded Pineda's name, credit card information and zip code, and from this information was able to obtain her home address which it used for marketing purposes and, potentially, sold the information to other merchants. The matter was filed as a class action alleging Williams-Sonoma's practices violated California's Song-Beverly Credit Card Act, which prohibits businesses from requiring credit card holders provide personal identification information and then recording that information in order to complete the transaction. Civil damages under the Act may be assessed up to $250.00 per violation.

The immediate implications of this expansion of PII may be more lawsuits. It has been reported that similar lawsuits may already have been filed against other retail giants. This ruling will likely be used to support arguments that names combined with zip codes should be considered personal information for the purposes of other privacy laws, such as California's data breach notification laws. The ruling might also be used to support arguments that similarly broaden the interpretation of personally identifiable information in areas beyond addresses, such as financial information or medical information. It is also possible that this ruling will influence legislation both in California and around the country.

The decision highlights the ability of companies and individuals to use smaller and smaller pieces of information to locate consumers or even to build false identities. It also shows courts' growing awareness of the erosion of privacy facilitated by technological advances. Although business practices have been largely protected from class action law suits in the area of private personal data, state legislatures and the judiciary are steadily moving towards providing greater consumer protections.

NLdH will continue to monitor future developments related to this issue.