Source: https://3dmerchant.com/blog/tag/credit-card-act
Timestamp: 2019-04-19 12:18:14+00:00

Document:
In a unanimous decision, the California Supreme Court prohibits retail stores in California from asking customers to provide a ZIP code when making a purchase, holding that holding that ZIP codes are “personal identification information” for the purposes of the Song-Beverly Credit Card Act. Retail store cashiers routinely asking, “May I have your zip code please?”, is about to disappear.
Statutory penalties are up to $250 for the first violation and $1,000 for each subsequent violation.
California is short on cash. Enforcing this ruling could bring in big money for the state. Why risk fines? I recommend merchants inform cashiers not to ask the question, and post a bulletin in the “break room” as a reminder. Note, the ruling applies to card present transactions only.
Additionally, if the point of sale system prompts for zip code, whether optional or required, update the system to remove the prompt. With an estimated 1.5 million merchants in California and 15 minutes to download a terminal update, there is the potential for merchants to experience delays in updating their systems.
For a dial up terminal, call your payment processor, ask to remove the zip code prompt from the program file, and then perform a partial download which will update the terminal.
For POS systems, contact your software provider.
For merchants using our host-based technology solution, please review your merchant settings. The zip code prompt is manageable at the administrative user level for all merchant accounts. This setting will not affect interchange qualification due to our back-end technology for least cost routing.
If you can’t instantly update what happens at your POS, contact us immediately to find out more about how we can help you avoid these situations in the future.
This ruling is yet another situation driving the need for merchants to have host-based payment processing technology. Updates are instant across local, regional and entire merchant operations instead of downloads to individual terminals.
Below is a copy of the filing.
San Diego County Super. Ct. No.
All unlabeled statutory references are to the Civil Code.
business requests and records a customer’s ZIP code during a credit card transaction. In light of the statute’s plain language, protective purpose, and legislative history, we conclude a ZIP code constitutes “personal identification information” as that phrase is used in section 1747.08. Thus, requesting and recording a cardholder’s ZIP code, without more, violates the Credit Card Act. We therefore reverse the contrary judgment of the Court of Appeal and remand for further proceedings consistent with our decision.
for purchase. She then went to the cashier to pay for the item with her credit card.
The cashier asked plaintiff for her ZIP code and, believing she was required to provide the requested information to complete the transaction, plaintiff provided it. The cashier entered plaintiff’s ZIP code into the electronic cash register and then completed the transaction. At the end of the transaction, defendant had plaintiff’s credit card number, name, and ZIP code recorded in its database.
Defendant subsequently used customized computer software to perform reverse searches from databases that contain millions of names, e-mail addresses, telephone numbers, and street addresses, and that are indexed in a manner resembling a reverse telephone book. The software matched plaintiff’s name and ZIP code with plaintiff’s previously undisclosed address, giving defendant the information, which it now maintains in its own database. Defendant uses its database to market products to customers and may also sell the information it has compiled to other businesses.
Plaintiff filed the matter as a putative class action, alleging defendant had violated section 1747.08 and the unfair competition law (UCL) (Bus. & Prof. Code, § 17200 et seq.). She also asserted an invasion of privacy claim. Defendant demurred, arguing a ZIP code is not “personal identification information” as that phrase is used in section 1747.08, that plaintiff lacked standing to bring her UCL claim, and that the invasion of privacy claim failed for, among other reasons, failure to allege all necessary elements. Plaintiff conceded the demurrer as to the UCL claim, and the trial court subsequently sustained the demurrer as to the remaining causes of action without leave to amend. As for the Credit Card Act claim, the trial court agreed with defendant and concluded a ZIP code does not constitute “personal identification information” as that term is defined in section 1747.08.
Both opinions were issued by Division One of the Fourth District Court of Appeal.
2009. On February 4, 2010, after 60 days had already run, an order was entered extending time for review to February 23, 2010, 90 days after the petition was filed. The order was entered nunc pro tunc as of January 22, 2010, a date before the original 60-day window had expired. Defendant contends such a nunc pro tunc order was invalid. We disagree.
indicator of legislative intent.” (Hsu v. Abbara (1995) 9 Cal.4th 863, 871.) We give the words their usual and ordinary meaning (Lungren v. Deukmejian (1988) 45 Cal.3d 727, 735), while construing them in light of the statute as a whole and the statute’s purpose (Walker v. Superior Court (1998) 47 Cal.3d 112, 124). “In other words, ‘ “we do not construe statutes in isolation, but rather read every statute ‘with reference to the entire scheme of law of which it is part so that the whole may be harmonized and retain effectiveness.’ ” ’ ” (Smith v. Superior Court (2006) 39 Cal.4th 77, 83.) We are also mindful of “the general rule that civil statutes for the protection of the public are, generally, broadly construed in favor of that protective purpose.” (People ex rel. Lungren v. Superior Court (1996) 14 Cal.4th 294, 313 (Lungren); see Florez, supra, 108 Cal.App.4th at p. 450 [liberally construing former § 1747.8, now § 1747.08].) “If there is no ambiguity in the language, we presume the Legislature meant what it said and the plain meaning of the statute governs.” (People v. Snook (1997) 16 Cal.4th 1210, 1215.) “Only when the statute’s language is ambiguous or susceptible of more than one reasonable interpretation, may the court turn to extrinsic aids to assist in interpretation.” (Murphy v. Kenneth Cole Productions, Inc. (2007) 40 Cal.4th 1094, 1103.) Our discussion thus begins with the words of section 1747.08.
otherwise.” (§ 1747.08, subd. (a)(2), italics added.)6 Subdivision (b) defines personal identification information as “information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number.” (§ 1747.08, subd. (b).) Because we must accept as true plaintiff’s allegation that defendant requested and then recorded her ZIP code, the outcome of this case hinges on whether a cardholder’s ZIP code, without more, constitutes personal identification information within the meaning of section 1747.08. We hold that it does.
Subdivision (b) defines personal identification information as “information concerning the cardholder . . . including, but not limited to, the cardholder’s address and telephone number.” (§ 1747.08, subd. (b), italics added.) “Concerning” is a broad term meaning “pertaining to; regarding; having relation to; [or] respecting . . . .” (Webster’s New Internat. Dict. (2d ed. 1941) p. 552.) A cardholder’s ZIP code, which refers to the area where a cardholder works or lives (see DMM, supra, ch. 602, subtopic 1.8.1 <http://pe.usps.com/text/dmm300/602. htm> [as of Feb. 10, 2011] [each U.S. post office is assigned at least one unique 5- digit ZIP code), is certainly information that pertains to or regards the cardholder.
Invoking the doctrine ejusdem generis, whereby a “general term ordinarily is understood as being ‘ “restricted to those things that are similar to those which are enumerated specifically” ’ ” (Costco Wholesale Corp. v. Superior Court (2009) 47 Cal.4th 725, 743 (conc. opn. of George, C.J.)), the Court of Appeal reasoned that an address and telephone number are “specific in nature regarding an individual.” By contrast, the court continued, a ZIP code pertains to the group of individuals who live within the ZIP code. Thus, the Court of Appeal concluded, a ZIP code, without more, is unlike the other terms specifically identified in subdivision (b).
There are several problems with this reasoning. First, a ZIP code is readily understood to be part of an address; when one addresses a letter to another person, a ZIP code is always included. The question then is whether the Legislature, by providing that “personal identification information” includes “the cardholder’s address” (§ 1747.08, subd. (b)), intended to include components of the address. The answer must be yes. Otherwise, a business could ask not just for a cardholder’s ZIP code, but also for the cardholder’s street and city in addition to the ZIP code, so long as it did not also ask for the house number. Such a construction would render the statute’s protections hollow. Thus, the word “address” in the statute should be construed as encompassing not only a complete address, but also its components.
individuals.7 Of course, section 1747.08 explicitly provides that a cardholder’s address and telephone number constitute personal identification information (id., subd. (b)); that such information might also pertain to individuals other than the cardholder is immaterial. Similarly, that a cardholder’s ZIP code pertains to individuals in addition to the cardholder does not render it dissimilar to an address or telephone number.
More significantly, the Court of Appeal ignores another reasonable interpretation of what the enumerated terms in section 1747.08, subdivision (b) have in common, that is, they both constitute information unnecessary to the sales transaction that, alone or together with other data such as a cardholder’s name or credit card number, can be used for the retailer’s business purposes. Under this reading, a cardholder’s ZIP code is similar to his or her address or telephone number, in that a ZIP code is both unnecessary to the transaction and can be used, together with the cardholder’s name, to locate his or her full address. (Levitt and Rosch, Computer Counselor: Putting Internet Search Engines to New Uses (May 2006) 29 L.A. Law. 55, 55; see Solove, Privacy and Power: Computer Databases and Metaphors for Information Privacy (2001) 53 Stan. L.Rev. 1393, 1406-1408.) The retailer can then, as plaintiff alleges defendant has done here, use the accumulated information for its own purposes or sell the information to other businesses.
Party City, upon which the Court of Appeal opinion heavily relies, assumes that a cardholder’s work address or telephone number constitutes personal identification information. (Party City, supra, 169 Cal.App.4th at p. 518.) While we express no opinion on this point, we acknowledge that nothing in section 1747.08, subdivision (b), explicitly limits its scope to a cardholder’s home address or telephone number.
There are several reasons to prefer this latter, broader interpretation over the one adopted by the Court of Appeal. First, the interpretation is more consistent with the rule that courts should liberally construe remedial statutes in favor of their protective purpose (Lungren, supra, 14 Cal.4th at p. 313), which, in the case of section 1747.08, includes addressing “the misuse of personal identification information for, inter alia, marketing purposes.” (Absher v. AutoZone, Inc. (2008) 164 Cal.App.4th 332, 345 (Absher).)8 The Court of Appeal’s interpretation, by contrast, would permit retailers to obtain indirectly what they are clearly prohibited from obtaining directly, “end-running” the statute’s clear purpose. This is so because information that can be permissibly obtained under the Court of Appeal’s construction could easily be used to locate the cardholder’s complete address or telephone number. Such an interpretation would vitiate the statute’s effectiveness. Moreover, that the Legislature intended a broad reading of section 1747.08 can be inferred from the expansive language it employed, e.g., “concerning” in subdivision (b) and “any personal identification information” in subdivision (a)(1). (Italics added.) The use of the broad word “any” suggests the Legislature did not want the category of information protected under the statute to be narrowly construed.
The Court of Appeal did not discuss subdivision (d) of section 1747.08. While Party City, supra, 169 Cal.App.4th at page 518, did briefly mention the issue, the court dismissed it without explanation.
identification information includes a cardholder’s ZIP code. We disapprove Party City Corp. v. Superior Court, supra, 169 Cal.App.4th 497, to the extent it is inconsistent with our opinion.
Even were we to conclude that the alternative interpretation urged by defendant and adopted by the Court of Appeal was reasonable, the legislative history of section 1747.08 offers additional evidence that plaintiff’s construction is the correct one.11 The Credit Card Act was enacted in 1971 to “impose fair business practices for the protection of the consumers.” (Young v. Bank of America (1983) 141 Cal.App.3d 108, 114.) It made “major changes in the law dealing with credit card practices by prescribing procedures for billing, billing errors, dissemination of false credit information, issuance and unauthorized use of credit cards.” (Sen. Song, sponsor of Sen. Bill No. 97 (1971 Reg. Sess.) Enrolled Bill mem. to Governor (Oct. 12, 1971) p. 1.) As originally enacted, however, the Credit Card Act did not contain section 1747.08 or any analogous provision.
The Court of Appeal did not discuss the legislative history of section 1747.08. And, while the opinion in Party City, supra, 169 Cal.App.4th at pages 514-516, has a section titled “Legislative History Arguments,” the court did not actually cite or discuss any of the statute’s legislative history.
clarifying and nonsubstantive suggests the Legislature understood former section 1747.8 to already prohibit the requesting and recording of any of the information, including ZIP codes, contained on driver’s licenses and state identification cards.
p. 5043, italics added.) “The obvious purpose of the 1991 amendment was to prevent retailers from ‘requesting’ personal identification information and then matching it with the consumer’s credit card number.” (Florez, supra, 108 Cal.App.4th at p. 453.) “[T]he 1991 amendment prevents a retailer from making an end-run around the law by claiming the customer furnished personal identification data ‘voluntarily.’ ” (Ibid.) That the Legislature so expanded the scope of former section 1747.8 is further evidence it intended a broad consumer protection statute.
To be sure, the legislative history does not specifically address the scope of section 1747.08, subdivision (b) or whether the Legislature intended a ZIP code, without more, to constitute personal identification information. However, the legislative history of the Credit Card Act in general, and section 1747.08 in particular, demonstrates the Legislature intended to provide robust consumer protections by prohibiting retailers from soliciting and recording information about the cardholder that is unnecessary to the credit card transaction. Plaintiff’s interpretation of section 1747.08 is the one that is most consistent with that legislative purpose.
Thus, in light of the statutory language, as well as the legislative history and evident purpose of the statute, we hold that personal identification information, as that term is used in section 1747.08, includes a cardholder’s ZIP code.
Second, defendant contends that plaintiff’s interpretation renders the statute unconstitutionally vague and, thus, our adoption of that interpretation should be prospectively applied only. We are not persuaded. In our view, the statute provides constitutionally adequate notice of proscribed conduct, including its reference to a cardholder’s address as an example of personal identification information (§ 1747.08, subd. (b)) as well as its prohibition against retailers’ recording any of the information contained on identification cards (id., subd. (d)). Moreover, while Party City, supra, 169 Cal.App.4th 497, reached a contrary conclusion, both defendant’s conduct and the filing of plaintiff’s complaint predate that decision; it therefore cannot be convincingly argued that the practice of asking customers for their ZIP codes was adopted in reliance on Party City.
The judgment of the Court of Appeals is reversed and the case is remanded for further proceedings consistent with this decision.
CANTIL-SAKAUYE, C. J. KENNARD, J. BAXTER, J. WERDEGAR, J.
Harrison Patterson O’Connor & Kinkead, Harrison Patterson & O’Connor, James R. Patterson, Harry W. Harrison, Matthew J. O’Connor and Cary A. Kinkead for Plaintiff and Appellant.
Atkins & Davidson, Todd C. Atkins and Clark L. Davidson for the Consumer Federation of California and The Privacy Rights Clearinghouse as Amici Curiae on behalf of Plaintiff and Appellant.
Sheppard Mullin Richter & Hampton, P. Craig Cardon and Elizabeth S. Berman for Defendant and Respondent.
Linda A. Wooley; Venable, John F. Cooney, Michael B. Garfinkel and Paul A. Rigali for Direct Marketing Association as Amicus Curiae on behalf of Defendant and Respondent.
Knox, Lemmon, Anapolsky & Schrimp and Thomas S. Knox for California Retailers Association as Amicus Curiae on behalf of Defendant and Respondent.
Cooley Godward Kronish, Cooley, Michelle C. Doolin, Lori R.E. Ploeger, Leo P. Norton and Darcie A. Tilly for The Gap, Inc., Old Navy, LLC, and Banana Republic, LLC, as Amici Curiae on behalf of Defendant and Respondent.
Call & Jensen, Matthew R. Orr, Melinda Evans and Scott R. Hatch for Kmart Holding Corporation as Amicus Curiae on behalf of Defendant and Respondent.

References: § 17200
 v. 
 v. 
 v. 
 v. 
 v. 
 § 1747
 § 1747
 v. 
 v. 
 v. 
 v. 
 v. 
 v.