When discussing privacy with clients, it is important to realize that many consumers, companies and legislators have become sensitized to information privacy solely as it relates to online activities.
The flurry of discussions in social media, proposed and passed legislation or regulations related to the collection and use of consumers’ personally identifiable information (PII) on the Internet can divert attention away from equally important privacy issues in the physical world. One example is the collection of PII by merchants at the point of sale (POS).
Collection may occur at a cash register , kiosk or gas pump.
Last year, Pineda v. Williams-Sonoma Stores brought attention to the practice of requesting or collecting a customer’s zip code, for marketing purposes. The CA Supreme Court ruled that a ZIP code constitutes “personal identification information” and requiring collection of ZIP codes was in violation of section 1747.08 of the Song-Beverly Credit Card Act of 1971 (Credit Card Act).
For purposes of this section “personal identification information,” means information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number.
The Court ruled that since a ZIP code is a component of a cardholder’s address, it is protected under section 1747.08.
There are important exceptions to this rule. Merchants are allowed to require and record PII in the following instances:
- If the credit card is being used as a deposit to secure payment in the event of default, loss, damage, or other similar occurrence.
- Cash advance transactions.
- If any of the following applies: The person, firm, partnership, association, or corporation accepting the credit card is
(A) contractually obligated to provide personal identification information in order to complete the credit card transaction.
(B) a sales transaction at a retail motor fuel dispenser or retail motor fuel payment island automated cashier uses the Zip Code information solely for prevention of fraud, theft, or identity theft.
(C) is obligated to collect and record the personal identification information by federal or state law or regulation.
Other exceptions include instances when:
- personal identification information is required for a special purpose that is incidental, but related to the individual credit card transaction, including, but not limited to, information relating to shipping, delivery, servicing, or installation of the purchased merchandise, or for special orders.
- the cardholder pays for the transaction with a credit card number and does not make the credit card available upon request to verify the number, the cardholder’s driver’s license number or identification card number may be recorded on the credit card transaction form or otherwise.
When Why Matters
After the Pineda v. Williams-Sonoma Stores ruling, there was a rush of lawsuits brought against merchants that required a zip code at the POS. Many gas stations require that a customer provide their zip code when paying for gasoline or other services. In Flores v. Chevron, a customer alleged that the practice at gas stations of asking for the billing ZIP Code of the credit card being used to purchase gas violated the Song-Beverly Credit Card Act.
On March 14, 2012 a California district court ruled that gas stations gathering ZIP Codes for fraud prevention did not violate the Song-Beverly Credit Card Act. As noted above, a gas station collecting PII solely for prevention of fraud, theft, or identity theft is exempt from section 1747.08.
Secondary Use
Had Williams-Sonoma Stores stated that they collected PII solely for fraud prevention they may have been able to make a case for an exception even though they are not a retail motor fuel dispenser. This argument may not have held up in court, but it would have been more defensible than collecting personal data for marketing purposes.
If a merchant states that PII is collected solely for fraud prevention, but then utilizes the collected data for marketing without advising consumers – and obtaining permission – for such secondary uses, the merchant may be exposing itself to liability for violation of the Choice / Consent section of the Fair Information Practice Principles, enforced by the Federal Trade Commission (FTC).
Specifically, choice relates to secondary uses of information – i.e., uses beyond those necessary to complete the contemplated transaction. Such secondary uses can be internal, such as placing the consumer on the collecting company’s mailing list in order to market additional products or promotions, or external, such as the transfer of information to third parties.
Business Opportunity
Viewing this situation solely as a matter of compliance misses the opportunity to change a potentially negative or neutral engagement with consumers into an opportunity to promote your organization in a positive way.
Compliance should not be an end in itself. There is much more that can be gained by understanding the spirit of the regulation! Consumer Privacy is really about Consumer Trust.
Customers who take the time to voice concerns over your company’s practices are likely sensitive to potential misuse of their data, interested in causing embarrassment or fishing for grounds for a lawsuit.
Leaving such a customer frustrated or angry and potentially negatively affecting others in proximity when they vent those frustrations at your place of business risks damage to reputation and a positive customer experience. You want to inspire loyalty, not generate doubts in others within earshot of such questions – or at least not discourage repeat commerce.
This ruling illustrates why a merchant should have a policy stating why PII is being recorded. Such a policy will clearly state the purpose for collecting personal data. It may be wise to educate employees about why the cardholders’ ZIP code is required so they can answer queries by customers.
Given that business owners may be uncomfortable entrusting explanation of corporate policy and regulations to cashiers or attendants, merchants can post a short explanation with an easily recalled URL or toll-free phone number where consumer’s can obtain a friendly explanation of the rule and your desire to provide answers about your practices.
Further, encourage consumers to participate! Provide them an opportunity to comment on the response they received to their question. There is potential for an additional benefit - to gauge employee performance, drive organizational change and to reinforce expected behaviors by your staff. Make sure to take advantage of the opportunity to pass along praise, or another tangible reward, when a customer gives positive feedback in these interactions. This makes it a win-win situation.
Again, this is an opportunity for merchants to deepen their relationship with consumers by reinforcing the customer care message. Instead of simply presenting the customer with a legal disclaimer, use the opportunity to engage the customer in a dialogue.
Consider links to best practices for consumer protection, other corporate social responsibility programs and the opportunity to leave comments. Give the customer the opportunity to voluntarily provide contact information to receive a reply or additional information. Do not, however, let information become outdated or requests for interaction go unanswered.
KWabst - 