Massachusetts Court Notes ZIP Codes Personally Identifiable Under Credit Card Transaction Laws

Following the lead of California courts, a Massachusetts district court recently held that ZIP codes are personal identifiable information under a Massachusetts law that prohibits recording such information on a credit card transaction form. In that case, the plaintiffs alleged that a large national retailer collected and recorded ZIP codes on credit card transaction forms at the time of purchase, and used the ZIP codes in conjunction with other information to obtain plaintiffs’ home addresses to send marketing materials. Despite concluding that ZIP codes fell under the statute, the court nevertheless ordered a dismissal of the case, determining that plaintiffs failed to allege requisite injury resulting from the retailer’s conduct. Interestingly, the court still went through the analysis of whether ZIP codes are subject to the Massachusetts statute which prohibits recording personal information on a credit card transaction form. In determining that ZIP codes should not be collected, the court explained that the statute in question is designed to prevent fraud and protect consumers from identity theft by prohibiting retailers from recording on credit card forms information that could be used to put a consumer at risk (for example, by accessing a credit card account). The court noted that credit card companies may require consumers to provide ZIP codes as verifying information, just like it would with a PIN number. Thus, just as a consumer would be at risk if his or her PIN number was recorded, so, too, would the consumer be at risk if the ZIP code was recorded.

TIP: Massachusetts follows California as the second state to hold that ZIP codes constitute personal information under laws regulating collection such information during a credit card transaction, or recording such information on credit card transaction forms. Similar cases may arise in other states with similar laws. Retailers should thus review their credit card transaction practices carefully to ensure they have appropriate procedures in place.