California Supreme Court Rules Company Violated Song-Beverly Act

Los Angeles, CARetailers in California that store customer personal information when completing a credit card transaction could face a Song-Beverly Credit Card Act lawsuit. Following a 2011 ruling from the Supreme Court of California, even the collection and storage of a customer's zip code could be a Song-Beverly Act privacy violation. Already, numerous Song-Beverly class action lawsuits have been filed against retailers alleging they inappropriately took and stored the personal information of customers.

Under the Song-Beverly Credit Card Act of 1971, retailers are prohibited from collecting a customer's personal identification information (PII) when completing a credit card transaction. That personal information includes any information that is not included on the credit card itself, such as the cardholder's address and telephone number. In 2011, a California Supreme Court ruled that the cardholder's zip code is included in the personal identification information and should not be collected and stored to complete credit card transactions.

In Pineda v. Williams-Sonoma Stores, Inc., the California Supreme Court reversed two lower court opinions and made its decision retroactive, opening California courts to more class action lawsuits against retailers who collected zip code information. According to Reuters (2/16/11), this means that any retailers who recorded customer zip codes before the California Supreme Court issued its decision could now face class action lawsuits. So far, lawsuits have reportedly been filed against Tiffany & Co., Shell, Ikea, and a variety of gasoline stations.

It is not illegal for retailers to ask for the information to confirm the customer's identity. What is prohibited, however, is for the retailer to store that information, such as in a database. Some retailers collect customer information and sell it to third parties who use that information for marketing purposes.

Reuters reports that most Song-Beverly lawsuits settle because plaintiffs do not have to prove they suffered harm from the personal information being collected and because retailers do not want to face stiff penalties