Last month, a class action lawsuit was filed against Michael Stores, Inc., accusing the arts and crafts retailer of violating a Massachusetts consumer protection statute when it collects and records zip codes during consumer credit card transactions. The lawsuit, Tyler v. Michaels Stores, Inc. filed in Massachusetts District Court, comes several months after the California Supreme Court decision in Pineda v. Williams-Sonoma Stores, Inc., which held that zip code information is personal identification information (“PII”) under California’s Song-Beverly Credit Card Act. (the “Song-Beverly Act”).
In Tyler, the plaintiff made a purchase at a Michael’s store with her credit card and, during the sales process, the cashier requested the plaintiff’s zip code. The plaintiff provided her zip code to the cashier allegedly based on the belief that it was necessary to complete the transaction. The plaintiff asserts that Michaels subsequently combined her zip code with other information to obtain her home mailing address, and began sending unwanted marketing materials. According to the complaint, the collection and recording of zip codes during a credit card transaction violates Mass. Gen. Laws ch. 93 § 105, under which a business cannot “write, cause to be written or require that a credit card holder write [PII], not required by the credit card issuer, on the credit card transaction form.”
The plaintiff in Tyler argues that Mass. Gen. Laws ch. 93 § 105 should be interpreted in a manner consistent with the California Supreme Court’s interpretation of the Song-Beverly Act in Pineda. In that case, the court held that a cardholder’s zip code qualified as “information concerning the cardholder. . .” as used within the Song-Beverly Act’s definition of PII. As a result, businesses in California face restrictions from requesting and recording a person’s zip code as part of a credit card transaction. The Massachusetts statute defines PII in a different, though arguably similar fashion to the Song-Beverly Act. Specifically, the statute includes an open-ended definition of PII that is not limited to a credit card holder’s address or telephone number. The plaintiff in Tyler is seeking injunctive relief, damages, and attorneys’ fees.
Businesses that collect customer information at the sales register should pay close attention to this case, as it may signal lawsuits in other states with statutes that are similar to California’s Song-Beverly Act.