15 Chap. L. Rev. 677 (No PDF)
Chapman Law Review
DIGEST: PINEDA V. WILLIAMS-SONOMA STORES, INC.
Matthew A. Susson
Copyright (c) 2012 Chapman Law Review; Matthew A. Susson
Opinion by Moreno, J., with Cantil-Sakauye, C.J., Kennard, J., Baxter, J., Werdegar, J., Chin, J., and Corrigan, J.
While visiting a Williams-Sonoma store in California, Jessica Pineda (“Pineda”) selected an item for purchase and brought it to the cashier to pay by credit card. The cashier asked Pineda for her ZIP code, which she furnished, believing the cashier required it to complete the transaction. The cashier entered the ZIP code into the register and completed the transaction, at which time Williams-Sonoma retained Pineda’s credit card number, name, and ZIP code in its database.
Williams-Sonoma later used computer software to perform reverse searches of large databases containing millions of names, e-mail addresses, telephone numbers and street addresses, to match Pineda’s name and ZIP code with her previously undisclosed address.
In June 2008, Pineda filed a complaint against Williams-Sonoma Stores, Inc. as a putative class action. She alleged Williams-Sonoma violated both the Song-Beverly Credit Card Act of 1971 (“Credit Card Act”) and the unfair competition law (“UCL”), and asserted an invasion of privacy claim as well. Williams-Sonoma demurred and argued that a ZIP code is not “personal identification information” as used in section 1747.08, that Pineda lacked standing to bring her UCL claim, and that the invasion of privacy claim failed to allege all necessary elements. Pineda conceded the demurrer as to the UCL claim, and the trial court sustained the demurrer as to the remaining causes of action without leave to amend. The trial court held that a ZIP code does not constitute “personal identification information” as used in section 1747.08.
Pineda appealed, and the court of appeal affirmed in all respects, relying upon Party City Corp. v. Superior Court with respect to the Credit Card Act claim. Pineda sought review from the Supreme Court of California regarding her Credit Card Act claim and invasion of privacy cause of action. The court granted review only of Pineda’s Credit Card Act claim.
The court first set forth guiding principles of statutory construction and noted that it broadly construes civil statutes meant to protect the public in a manner consistent with their protective purpose.
The court next discussed section 1747.08, which provides, in pertinent part:
[N]o person, firm, partnership, association, or corporation that accepts credit cards for the transaction of business shall . . . [r]equest, or require as a condition to accepting the credit card as payment in full or in part for goods or services, the cardholder to provide personal identification information, which the person, firm, partnership, association, or corporation accepting the credit card writes, causes to be written, or otherwise records upon the credit card transaction form or otherwise.
Subdivision (b) of the same section defines “personal identification information” as “information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number.” The court stated that the outcome of the case depended upon whether a cardholder’s ZIP code, on its own, constituted personal identification information within the meaning of section 1747.08. The court responded in the affirmative.
The court found that a cardholder’s ZIP code, which refers to the area in which the cardholder works or lives, unequivocally constitutes information that pertains to or regards the cardholder, in the contexts of both subdivision (b) and the definitional meaning of “concerning.”
The court first pointed out that a ZIP code is part of an address, and that when the Legislature defined “personal identification information” to include “the cardholder’s address,” it must have intended to include the components of that address. Otherwise, a business could essentially request a cardholder’s entire address, and need only refrain from asking for the house number. As such a construction is nonsensical and inconsistent with the statute’s protective intent, the court held that the word “address” embraces a complete address and its components.
Second, the court concluded a ZIP code is specific to an individual, like an address and telephone number. The court found that an address or telephone number, like a ZIP code, might pertain to individuals other than the cardholder. Thus, a ZIP code is not dissimilar from the enumerated examples of “personal identification information” in subdivision (b) of section 1747.08.
Next, the court articulated an alternative understanding of section 1747.08’s enumerated terms. It proposed that an address and a telephone number are both unnecessary to the sales transaction and may–along with other pertinent cardholder data–be used for the retailer’s business purposes. In this way, the court argued that a cardholder’s ZIP code is similar to his or her address or telephone number.
The court then provided support for its broader interpretation of subdivision (b) of section 1747.08. First, it reasoned that its interpretation is more consistent with the rule that courts should construe remedial statutes liberally and in favor of their protective purposes. The court further argued that the Legislature’s expansive language supports a broad reading under which the category of information protected by section 1747.08 should not be narrowly construed.
Second, it argued that only the broader interpretation is consistent with subdivision (d) of section 1747.08, which permits businesses to require a cardholder to provide reasonable forms of identification, such as a driver’s license, provided none of the information contained thereon is written or recorded. Under subdivision (d), a business may thus require a cardholder to provide a driver’s license, but may not record any information thereon, including the ZIP code.
The court concluded that the only reasonable interpretation of section 1747.08 is that “personal identification information” includes a cardholder’s ZIP code, thereby disapproving of Party City to the extent it is inconsistent with its opinion.
In 1990, the Legislature enacted former section 1747.8 to address the misuse of personal identification information and prohibit businesses from requiring information that merchants, banks, or credit card companies neither require nor need. A year later, the Legislature amended former section 1747.8. The Legislature added a provision that permitted “businesses to require cardholders to provide identification so long as none of the information thereon was recorded.” Because the amendment was a “clarifying, nonsubstantive change,” the court inferred that the Legislature intended the former 1747.8 to already prohibit the requesting and recording of the information on driver’s licenses, for example, including ZIP codes.
The Legislature later expanded the 1991 version of former section 1747.8 to prevent businesses from both requiring and requesting the cardholder to provide personal identification information in certain circumstances. The court explained that the Legislature intended to prevent businesses from matching such information with the consumer’s credit card number.
The court then briefly addressed Williams-Sonoma’s due process concerns. It found the statute does not “mandate fixed penalties,” and that the trial court would retain discretion to impose any penalty of its choosing. The court also held the statute provides constitutionally adequate notice of proscribed conduct, and that the contrary ruling of Party City postdated both Williams-Sonoma’s conduct and Pineda’s complaint.
The court reversed the court of appeal and remanded the case for further proceedings consistent with its decision. The court held that “personal identification information,” as that term is used in section 1747.08, includes a cardholder’s ZIP code. As such, requesting and recording a cardholder’s ZIP code, without more, violates the Credit Card Act. The court disapproved Party City Corp. v. Superior Court to the extent Party City is inconsistent with its opinion.
Rather than limiting the scope of its ruling to cases in which businesses reverse engineer a customer’s address, the court asked and answered a broader question of greater significance. While the court acknowledged that the 1990 amendments to the Credit Card Act intended to address the misuse of personal identification for marketing purposes, it interpreted the Legislature’s “expansive language” to prevent California businesses from requesting ZIP codes for any purpose, marketing or otherwise.