Under recent developments in state data privacy law, seemingly innocuous business practices can result in major liability for retailers.
Consider the following everyday scenario: A cashier in one of your retail stores swipes a customer’s credit card and asks the customer for her ZIP code. Without a second thought, the customer recites her ZIP code, and your cashier enters it into your electronic system. The customer leaves your store, and the cashier moves on to the next customer. Has your customer just become the newest class member in a potential class action? Is your company now a potential defendant in a class action seeking triple damages and attorneys’ fees for unfair and deceptive practices?
Unless your company has put appropriate policies and procedures in place, the answer to these questions is likely a resounding “Yes.”
Old Law, New Risks
Consistent with a California trend, Massachusetts’ highest court recently held that ZIP codes are “personal identification information,” and their collection during a credit card transaction can give rise to a legal claim against the retailer for unfair and deceptive practices. The decision, Tyler v. Michaels Stores, arose under a Massachusetts statute enacted in 1991. Back then, retailers would often request a customer’s bank account number or other “personal identification information” and then write it on the carbon paper form as part of the credit card transaction. To protect against identity fraud, the legislature prohibited merchants from writing personal identification information on credit card transaction forms.
Now, however, a law originally enacted to avoid abuses of the carbon copy form will be applied to the modern equivalent of the same, the electronic credit card transactions. The Tyler case effectively gives the green light to hundreds of potential class action suits—all seeking treble damages and attorneys’ fees—based on events similar to those described above. The outcome of those suits will depend on what information the merchant collected, how it was collected processed and stored, and the use to which the information was put.
