Holding: zip codes “may well qualify” as personally identifiable information under the Massachusetts law controlling the treatment of PII in credit card transactions. Mass. Gen. Law ch. 93A § 105(a) (2012).
The complaint predicated an alleged violation of Section 105(a) which provides:
“No person, firm, partnership, corporation or other business entity that accepts a credit card for a business transaction shall write, cause to be written or require that a credit card holder write personal identification information, not required by the credit card issuer, on the credit card transaction form. Personal identification information shall include, but shall not be limited to, a credit card holder’s address or telephone number. The provisions of this section shall apply to all credit card transactions; provided, however, that the provisions of this section shall not be construed to prevent a person, firm, partnership, corporation or other business entity from requesting information that is necessary for shipping, delivery or installation of purchased merchandise or services or for a warranty when such information is provided voluntarily by a credit card holder.”
The court had to “decide whether a ZIP code constitutes ‘personal identification information’ in a credit card transaction.”
The court held that
“[b]ecause in some circumstances the credit card issuer may require the ZIP code to authorize a transfer of funds, as a debit card issuer requires a PIN number, both a ZIP code and a PIN number may be used fraudulently to assume the identity of the card holder. Just as a merchant who records a PIN number in the transaction form puts the customer at risk of identity fraud, so too does a merchant who records a ZIP code in the transaction form. Therefore, this Court holds that ZIP code numbers are ‘personal identification information’ under Section 105(a), because a ZIP code number may be necessary to the credit card issuer to identify the card holder in order to complete the transaction. This construction is more consistent with the Massachusetts legislative intent to prevent fraud than a statutory construction that simply views the ZIP code as a component of an address that later can be used to obtain a full address for marketing purposes.”
The full text is available at http://scholar.google.com/scholar_case…