Can I have your zip code please?
Consumers just lost a privacy case in California when the federal Ninth Circuit decided that Redbox did not violate California’s credit card privacy law when it collected zip codes from consumers renting movies and games. The class action Sinibaldi v. Redbox alleged that Redbox was using consumer zip codes for marketing purposes, to create email and mailing lists. Redbox claimed that it was using zip codes as a sort of security deposit, so that if the consumer failed to return the rental, Redbox could then charge a penalty ($25 for movies, $60 for games). In a split decision, the Ninth circuit judges rules in favor of Redbox.
Their decision was based on a 1971 California law, the Song-Beverly Credit Card Act, that makes collecting personally identifying information illegal with a few exceptions. The court agreed with Redbox that it was using the consumer’s credit card as “a deposit to secure payment”, one of the exceptions allowed under the Song-Beverly Act. It is very likely had the case been filed in Massachusetts that the result would have been the opposite.
The law that governs the use of consumer’s personal identifying information in Massachusetts has a broad definition of consumer privacy. In 1991 our legislature passed the “Consumer Privacy in Commercial Transactions” act, M.G.L. c. 93 sec. 105(a), designed to address merchants’ check cashing and credit card practices. Section 105(a) bars a merchant from writing “personal identification information, not required by the credit card issuer, on the credit card transaction form.” The Supreme Judicial Court ruled last year in Tyler v. Michaels that zip codes are personal identification information (PII) under our law.
Further, the Massachusetts law specifically authorizes merchants to request, receive, or record a credit card number in lieu of requiring a cash deposit to secure payment in event of default, loss, damage or other occurrence. (M.G.L. c. 93 sec. 105(c)(1).) Since the law so clearly defines what a merchant may collect as a deposit, the courts would be highly unlikely to permit the additional collection of zip code information. Therefore, the plaintiffs in Sinibaldi v. Redbox would probably have won if suing under Massachusetts law.
In order to bring a zip code class action, you must have some form of damage, either that your personally identifiable information was sold to a third party, or that it was used for marketing purposes. If you are forced to give out PII and suddenly begin to receive mailings, catalogs, or other marketing solicitations, you may even be eligible to file a class action. With over three decades of representing plaintiffs and consumers, Thornton Law Firm is well prepared to handle even the largest and most complex class action cases. If you are interested in having your potential claim reviewed, please contact us at 1-888-491-9726, or tell us your story here, and one of our attorneys will evaluate your claim free of charge.
