Massachusetts' Supreme Court joins California and other state courts in ruling that asking for Zip codes at POS amounts to an invasion of privacy. Although California has carved out an exception for the online side of retail operations (and then oddly imposed no restrictions on whether the online arm can share the data with its physical arm), Massachusetts' ruling is likely to quickly see an end to the Zip code requesting practice.
The court was not specifically ruling against the retailer (Michaels) involved in the litigation, but indicated that using Zip code would constitute a privacy violation. With such a ruling, retailers really do not want to be sued for their use of Zip codes.
The ruling is based on a Massachusetts state law that prohibits retailers from "writing, cause to be written or require that a credit card holder write personal identification information, not required by the credit card issuer, on the credit card transaction form." The legal dispute involved whether the Zip codes were needed to avoid fraud—which itself is a consumer protection. The court concluded that this was more a privacy invasion matter.
"Both title and caption thus expressly reference 'consumer privacy in commercial transactions,' reinforcing the view that the Legislature indeed was concerned, as Tyler (the consumer suing Michaels) suggests, about privacy issues in the realm of commercial dealings and in any event was not necessarily focused solely on preventing identity fraud," the court ruled.
The judges said consumers could sue in Massachusetts and specifically detailed a few kinds of harm that consumers could cite. "The actual receipt by a consumer of unwanted marketing materials as a result of the merchant's unlawful collection of the consumer's personal identification information. The merchant's sale of a customer's personal identification information or the data obtained from that information to a third party. When a merchant acquires personal identification information in violation and uses the information for its own business purposes, whether by sending the customer unwanted marketing materials or by selling the information for a profit, the merchant has caused the consumer an injury that is distinct from the statutory violation itself," the court said.
- See Chain Store Age story