Zip Codes Are Personal Information

In a case pitting a “determined shopper” against “a multistate retail chain” a federal court in Massachusetts recently ruled that a customer’s ZIP code information constitutes “personal identification information” under a Massachusetts consumer protection statute. The multistate retail chain here is Michaels. Apparently, the Michaels store in Everett Massachusetts routinely asked Tyler (the determined shopper) and other customers making credit card purchases to provide their ZIP code. Tyler apparently thought the ZIP code information was necessary for Michaels to process the credit card transaction. It wasn’t. Michaels then used the ZIP information in conjunction with other commercially available databases to find the customers’ addresses and phone numbers. Those customers would then receive marketing materials whether they wanted them or not. Michaels argued that the statute never included ZIP code information in the definition of personal identification information. But the court disagreed, noting that a ZIP code can be used in conjunction with other information to identify an individual. But that was the end of the good news for Tyler. The court found that she was unable to establish any injury. The Massachusetts statute was designed to prevent identity theft. Tyler simply presented no evidence that Michaels had put her identity at risk. Her primary “injury” was the fact that she received the unwanted marketing materials. But the court found that as annoying as that was, it was not the type of injury contemplated by the statute. Michael’s is probably lucky that the case came up under Massachusetts law. The Massachusetts court cited to a similar California statute that would have prohibited the very same use. The point for retailers I think is not to deceive your customers. Sometimes the obvious is the best practice.