Info Law Group : Technology Lawyers & Attorneys : Information Law Group : Privacy, Security & Intellectual Property Law

The Song-Beverly Credit Card Act prohibits retailers that accept credit cards from requesting and recording "personal identification information" concerning the cardholder.  The statute defines "personal identification information" (sometimes referred to as "pii") as "information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder's address and telephone number."  Cal. Civ. Code § 1747.08(b).  As noted above, the Fourth Appellate District held last December that zip codes are not, as a matter of law, pii for purposes of the Act.  So, why the need for a new published opinion on the subject?

Here, Pineda alleged that the retailer at issue collected zip codes in order to search databases and gather even more pii about the individual.  Specifically, Pineda alleged Williams-Sonoma used "customized computer software to perform reverse searches from databases that contain millions of names, e-mail addresses, residential telephone numbers and residential addresses, and are indexed in a manner that resembles a reverse telephone book," and that the software matched her name, zip code or other personal information with her previously unknown address. Pineda further alleged that Williams-Sonoma then maintained all this information in a database.

Pineda filed what has become the typical Song-Beverly Credit Card Act putative class action, alleging claims for violation of California's infamous Business & Professions Code section 17200 (California's unfair business practices act) and for invasion of privacy.

The Fourth Appellate District affirmed the trial court's ruling sustaining Williams-Sonoma's demurrers to Pineda's claims.

First, with respect to the Song-Beverly Credit Card Act, the court rejected Pineda's argument that Party City was distinguishable because there was no evidence in that case showing that the defendant used the collected zip codes to obtain its customers' addresses:

. . . the Party City court was well aware of the allegation that the defendant used the collected zip codes to locate individuals before it concluded, as a matter of law, that a zip code did not constitute "personal identification information" within the meaning of the Act.

Simply put, the Act either allows a retailer to ask customers for a zip code or it prohibits this conduct. The Party City court concluded, and we agree, that the Act does not prohibit this conduct. Although Pineda asserts a zip code should be covered by the Act because existing technology allows any company or person to locate an individual based on the individual's name and zip code, this argument is best presented to the Legislature.

(Italics in original; emphasis added.) 

Second, the court examined and rejected plaintiff's claim that Williams-Sonoma's conduct constituted an illegal intrusion into her privacy, finding no allegations (a)  that her home address was not otherwise publicly available or (b) of any efforts she made to keep her address private:

Without such facts, using a legally obtained zip code to acquire, view, print, distribute or use an address that is otherwise publicly available does not amount to an offensive intrusion of her privacy.

. . . Even assuming Pineda had [alleged Williams-Sonoma had sold her home address to third parties for profit], we fail to see how selling an address that is otherwise publicly available amounts to "an egregious breach of the social norms underlying the privacy right." . . .

Additionally, . . . the complaint contains absolutely no facts showing the extent and gravity of the alleged invasion of privacy. Under the facts alleged, the disclosure of Pineda's address amounted to a trivial invasion of her assumed privacy interest.

(Emphasis added.)

Bottom line - it is not surprising that, given the extent of already publicly available information about individuals (including home address, phone number, etc.) available in databases and online, and the difficulty of establishing harm, plaintiffs continue to encounter difficulty in pursuing purported claims for invasion of privacy beyond the demurrer, motion to dismiss, or summary judgment stage. 

The more difficult question, and the subject of a future blog post, is the extent to which individuals understand that the information they regularly share online or in other contexts becomes forever public (see, e.g., NPR's recent interview with Professor Viktor Mayer-Schonberger about social media and what he calls the "temporal Panopticon").  Stay tuned for more on that front.