L.A. District Attorney: Macy's Refusal To Hand Over CRM/POS Data Puts Children At Risk

Macy's is "playing a dangerous game of hide the ball" in relying on its privacy-protection policy to fight a subpoena seeking the names of customers that bought children's jewelry containing possibly toxic levels of lead, according to a new court filing from the Los Angeles District Attorney's Office.

In a rebuttal to court documents filed by Macy's, in which the company is fighting a state request for CRM and POS data identifying people who bought the items, Los Angeles Deputy District Attorney Daniel Wright wrote that "Macy's is attempting to conceal from customers the fact that it sold them lead-contaminated jewelry for their children."

Given that prior judges have ruled that a benefit to consumers is helpful in establishing the need for a subpoena to overcome retail privacy policies, Wright told Superior Court Judge Fred Rotenberg that "it is hard to imagine more of a benefit than allowing Macy's customers to take a toxic substance away from their children. (Macy's) is playing a dangerous game of hide the ball and the only one who loses are the children it puts at risk."

The case is important because it raises many critical retail IT issues, including how private--or proprietary--the courts should consider data, including purchase histories from CRM/loyalty and POS payment files. Beyond privacy issues, such subpoenas could force retailers to publicly reveal that they are collecting and saving a lot more information than they want to disclose. There are also PCI implications, where a merchant could theoretically be shown to be saving prohibited payment card data.

Macy's faces misdemeanor charges of false advertising because, according to the complaint, it labeled the necklaces as being lead-free when knew or should have known that they quite full of lead, a toxic substance. The U.S. Consumer Product Safety Commission examined the children's necklaces and found that they "contain high levels of lead."

The D.A.'s office and the state of California said an earlier case in California established that "Macy's has repeatedly sold lead-contaminated children's jewelry and shows that Macy's was fully aware of the problem, the danger it poses, yet did nothing. Macy's previous prosecution by the Attorney General only shows that Macy's knew, or by the exercise of reasonable care should have known that children's jewelry it sold was not 'lead free.' Macy's (earlier) prosecution is also a prior bad act and shows a common scheme or plan to sell lead-contaminated children's jewelry."

That earlier case began in 2004 when California accused a lengthy list of major retailers--including Macy's, Wal-Mart, Burlington Coat Factory, J.C. Penney, Kmart, Nordstrom, Sears, Forever21, Kohls, Walgreen, Target, QVC, Saks, The Gap and Toys R Us--of selling lead jewelry to children and not labeling it as containing lead. That case was settled in 2006 with the retail defendants paying substantial fines to the state of California. The next hearing on the case is scheduled for Monday (May 18) where Rotenberg might announce whether he is forcing Macy's to comply with the subpoena and turn over to Wright the necklace customer names.

In his filing, Wright contends Macy's privacy concerns are "minimal" and cannot be used by the company to keep the names secret. Wright said those who bought the necklaces are likely to be called as witnesses and "will testify as to whether or not they were misled" by the labels. He asserted the customers also "could provide context, shed light on other assurances, circumstances, complaints or statements made by Macy's pertaining to the crimes committed."

Lawyers for Macy's lawyers want the charges dismissed. In asking Rotenberg to quash the state's subpoena seeking the customer identities, they assert providing the names is inappropriate because the case is about false advertising and can be argued without the state knowing exactly who bought the items in question.

"Macy's promises its customers to keep their personal information confidential except in certain limited circumstances," said a motion by Macy's lawyer Donald Etra.

"Macy's customers therefore have a reasonable expectation that any identifying information collected and retained by Macy's as a result of their purchases will be kept confidential and not disclosed unless Macy's is compelled to do so by proper legal process," Etra wrote. "As the privacy concerns of third parties is high and the usefulness of the documents to the people's prosecution of the false advertising claims against Defendants is non-existent, production should not be required."

In his opposition to Etra's motion, Wright said that Macy's is ignoring California's Evidence Code and that the requested information is highly relevant to show Macy's intent, preparation, plan and knowledge that the necklaces did, indeed, contain lead.

Macy's has told the judge it doesn't have information "as to every customer" that bought one of the necklaces. "If a customer used a Macy's proprietary credit card to purchase the product--either a Macy's credit card or a Macy's branded Visa--”Macy's retains such information, though such retention and any possible disclosure is governed by the terms of Macy's privacy policy," the Macy's court filing said. "If a customer purchased the products on a credit card other than Macy's, Macy's may not have in its possession the customer's personal contact information from the credit card transaction and thus may not have any documents reflecting that customer's identity. Macy's does not have information relating to the identities of those who purchased the products with cash."

In February 2008, the U.S. Consumer Product Safety Commission was involved in a recall of the jewelry. It figures some 2,900 necklaces were sold from January 2006 through November 2007, warning that "the children's necklaces contain high levels of lead. Lead is toxic if ingested by young children and can cause adverse health effects."