Mass. High Court: ZIP Codes Are "Personal Identification Information"

Overview of General Laws, Chapter 93, Section 105(a)
Section 105(a) prohibits any business from writing or requiring that a credit-card holder write “personal identification information, not required by the credit card issuer, on the credit card transaction form.” PII “shall include, but shall not be limited to, a credit card holder’s address or telephone number.” Under section 105(d), any violation of section 105(a) “shall be deemed to be an unfair and deceptive trade practice” and thus, a violation of General Laws, chapter 93A, section 2. Section 105(a) applies to “all credit card transactions” and exempts the collection of PII for “shipping, delivery or installation of purchased merchandise or services or for a warranty when such information is provided voluntarily by a credit card holder.”

The Lower Court Decision in Tyler 
Filed in the wake of the Pineda decision by the California Supreme Court, Tyler arose out of a putative class action filed in the U.S. District Court for the District of Massachusetts.

In her complaint, the plaintiff alleged she made purchases using her credit card at Michaels stores during the past year and during those transactions a Michaels employee asked for her ZIP code. She claims she provided her ZIP code believing it was necessary to complete her credit-card purchase. The plaintiff further claimed the employee wrote the information in an electronic credit-card transaction form and that Michaels used her name and ZIP code to obtain her address and phone number from commercial databases. The plaintiff alleged Michaels then sent her marketing materials.

Michaels moved to dismiss the complaint. The district court found that ZIP codes constitute PII and that Michaels’ electronic credit-card terminal qualified as a “credit card transaction form” for purposes of section 105(a). However, the district court dismissed the complaint because it found that Tyler did not allege she suffered an injury cognizable under General Laws, chapter 93A. The judge certified three questions to be answered by the Massachusetts SJC: (1) whether a ZIP Code is PII; (2) whether a plaintiff can bring an action under section 105(a) absent identity fraud; and (3) whether the term “credit card transaction form” includes an electronic form.

Questions Answered by Supreme Judicial Court in Tyler 
Before delving into the three certified questions, the SJC analyzed the text, title, and legislative history of section 105(a). It held that “based on the text, title and caption, and legislative history of § 105, we are persuaded that the principal purpose of § 105 (a), in contrast to § 105 (b), is to guard consumer privacy in credit card transactions, not to protect against credit card identity fraud.”

With the underlying purpose of the statute in mind, the SJC turned to the text and purpose of the statute to determine if ZIP codes are PII. The SJC found that the definition of PII in the statute is “nonexhaustive” and the consumer-protection purpose of the statute would be frustrated if ZIP codes were not PII because a business could obtain a customer’s address and phone number (which is PII) by entering the customer’s name and ZIP code into a publicly available database. As such, the SJC held that ZIP Codes constitute PII.

As to the second certified question, the SJC observed that section 105(a) is not expressly limited to victims of identity fraud. Thus, it saw no reason to read such a limitation into the statute. Further, the SJC clarified that when a business uses a customer’s PII “for its own business purposes, whether by sending the customer unwanted marketing materials or by selling the information for a profit, the merchant has caused the consumer an injury that is distinct from the statutory violation itself and cognizable under G.L. c. 93A, § 9.”

Lastly, because the statute specifically states it applies to “all credit card transactions,” the SJC held that it encompasses electronic credit-card-transaction forms.

Impact of Tyler 
After the California Supreme Court issued its decision in Pineda, numerous class-action lawsuits against retailers in California who had requested ZIP codes from credit-card-paying customers were filed. Whether Tyler will spawn class-action lawsuits like its California counterpart remains to be seen. Nevertheless, given the Massachusetts SJC’s emphasis inTyler on the consumer-protection purpose of section 105(a), retailers doing business in Massachusetts should evaluate their own policies to ensure compliance with section 105(a).

Keywords: consumer litigation, PII, Massachusetts SJC, identity fraud, Tyler v. Michaels Stores, Pineda

Michelle Doolin is a partner and Darcie Tilly and Lindsay Parker are associates with Cooley LLP in San Diego, California.

^{Copyright © 2013, American Bar Association. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. The views expressed in this article are those of the author(s) and do not necessarily reflect the positions or policies of the American Bar Association, the Section of Litigation, this committee, or the employer(s) of the author(s).}