Massachusetts High Court Holds State Credit Card Law Intended to Protect against Invasion of Privacy, ZIP Codes Protected

Privacy/Cyber Risk & Data Security

On March 11, the Massachusetts Supreme Judicial Court held that a credit card holder may bring an action for violation of a state law prohibiting businesses from requiring personal identification information as part of a credit card transaction, even in the absence of identity fraud. Tyler v. Michaels Stores, Inc., No. SJC-11145, 2013 WL 854097 (Mass. Mar. 11, 2013). The card holder moved the Massachusetts Supreme Judicial Court to certify three questions interpreting the statute after a case she brought against the retailer in federal court was dismissed. The U.S. District Court for the District of Massachusetts had held that a retailer’s collection of ZIP codes during a credit card transaction can constitute a violation of the credit card law, but that the card holder failed to allege actual harm. The Massachusetts Supreme Judicial Court agreed that a ZIP code amounts to personal information under the statute, and found that the law is “intended primarily” to protect card holders from invasion of privacy by merchants, not against credit card identity fraud. However, the court noted that the statute did not contain an express limitation barring card holders who were not the victim of fraud. On a third question, the court held that the term "credit card transaction form" refers equally to electronic and paper transaction forms.