BILL ANALYSIS �
AB 1219
Page 1
ASSEMBLY THIRD READING
AB 1219 (Perea)
As Amended May 17, 2011
Majority vote
BANKING & FINANCE 11-0 JUDICIARY 8-0
-----------------------------------------------------------------
|Ayes:|Eng, Achadjian, Fletcher, |Ayes:|Feuer, Wagner, Atkins, |
| |Fong, Gatto, Harkey, | |Dickinson, Hagman, |
| |Roger Hern�ndez, Lara, | |Huffman, Jones, Monning |
| |Morrell, Perea, Torres | | |
| | | | |
-----------------------------------------------------------------
SUMMARY : Provides clarification for those instances when an
entity that accepts credit cards may not request certain types
of personal identification information (PII) to complete the
transaction. Specifically, this bill :
1)Exempts from the prohibition against the collection and
retention of PII under the following circumstances:
a) The PII is used solely for prevention of fraud, theft,
or identify theft;
b) The PII is requested to verify that a person has
proprietary credit card account with the entity accepting
the card and that person does not produce the card at the
time of the transaction; and,
c) In a face-to-face transaction the credit card does not
have a functioning magnetic stripe or otherwise not
electronically readable and the PII is used only to
complete the transaction and is thereafter deleted,
discarded or destroyed.
EXISTING LAW :
1)Provides that under the Song-Beverly Credit Card Act of 1971
(Credit Card Act) (Civil Code Section 1747 et seq.), no
person, firm, partnership, association or corporation that
accepts credit cards shall do any of the following:
AB 1219
Page 2
a) Require, or request, as condition of accepting the
credit card, the cardholder to write any PII identification
information upon the credit card transaction form or other
document �Section 1747.08a(1)];
b) Require, or request, as a condition of accepting the
credit card, the cardholder to provide PII identification
information which the entity accepting the card would then
write or record upon the credit transaction form or
otherwise �Section 1747.08a(2)]; or,
c) Utilize in any credit card transaction, a credit card
form that contains preprinted spaces for PII identification
information of the cardholder �Section 1747.08a(3)].
2)Specifies that the prohibitions in a), b), and c) above do not
apply under the following circumstances:
a) If the credit card is being used as a deposit to secure
payment in the event of default, loss, damage, or other
similar occurrence �Section 1747.08(1)];
b) Cash advance transactions �Section 1747.08(2)];
c) If the entity requesting the information is
contractually obligated to provide the PII information in
order to complete the transaction, or is obligated to
collect and record the PII identification information by
federal law or regulation �Section 1747.08(3)]; or,
d) If PII is required for a special purpose, incidental but
related to the individual credit card transaction,
including but not limited to, information relating to
shipping, delivery, servicing, or installation of the
purchased merchandise, or for special orders �Section
1747.08(4)].
3)Clarifies that the prohibitions on collecting PII
identification information relating to the credit card
transaction does not prohibit a requirement that the
cardholder provide reasonable forms of positive
identification, including a driver's license or California
State identification card, or another form of identification
�Section 1747.08(4)d].
AB 1219
Page 3
4)Specifies that if the cardholder pays for the transaction with
a credit card number and does not make the credit card
available upon request to verify the number, the cardholder's
driver's license number or identification card number may be
recorded on the credit card transaction form �Section
1747.08(4)d].
5)Defines "PII" as information concerning the cardholder, other
than information set forth on the credit card, and including
but not limited to, the cardholder's address and telephone
number �Section 1747.08(3)b].
FISCAL EFFECT : None
COMMENTS : The need for this bill arises from Pineda v.
Williams-Sonoma Stores, Inc., (2011) 51 Cal.4th 524, in which
the California Supreme Court ruled that a consumer's ZIP code is
PII under the Credit Card Act, and as such, falls under the
restricted uses contained within the statute. Prior to
addressing how this bill would address this issue, it is
important to provide background on the case.
Pineda v. Williams-Sonoma Stores, Inc .
The plaintiff sued retailer Williams-Sonoma Stores, Inc.,
claiming the retailer violated the Credit Card Act during a
transaction in which a cashier at the retailer asked the
plaintiff for her ZIP code. The plaintiff complied with the
request, believing her ZIP code was necessary for completing the
transaction. Subsequently, the defendant used computer software
to conduct reverse searches and cross checks against databases
that contain millions of names, email address, telephone
numbers, and street addresses. Using the software, the
defendant was able to match the name and ZIP code of the
plaintiff to match with her address which was then retained in
the defendant's own database used for marketing purpose.
Additionally, such information was also sold by the defendant to
other businesses. The plaintiff filed a class action alleging
that the retailer had violated the Credit Card Act.
The trial court and court of appeal agreed with the defendant
that the ZIP code does not constitute PII. The California
Supreme Court agreed to take up the issue. The Court concluded
AB 1219
Page 4
that under the Credit Card Act, PII does include the ZIP code.
The Court concluded that because address is a sum of its parts
(i.e., name, street, city, ZIP code) in that the ZIP code "is
readily understood to be part of an address; when one addresses
a letter to another person, a ZIP code is always included. The
question then is whether the Legislature?intended to include
components of the address. The answer must be yes."
Additionally, the Court also found that the broad language used
in the statute demonstrated that the Legislature intended the
statute to be interpreted broadly.
Discussion .
In the Pineda case, the retailer was collecting ZIP codes for
marketing purposes and potentially for sale to other businesses.
However, the Supreme Court did not address uses of ZIP codes
for what could be described as more legitimate purposes.
Specifically, ZIP codes are also used for fraud prevention
purposes, or at a basic level, as part of the shipping address
for an online internet transaction. The author of this bill is
concerned that the Court's decision could be interpreted to
disallow legitimate uses of ZIP codes that may actually benefit
consumers.
Gas stations have commonly required the input of a zip code when
the customer uses a credit card to purchase gas as a form of
fraud detection. This process originally was implemented as gas
stations with high incidences of fraudulent transactions
involving stolen cards, but has migrated to include almost all
gas stations. While the protection of PII has been a paramount
concern of the California Legislature for many years, so has
establishing those parameters in which information is necessary
to protect the consumer engaged in various electronic
transactions.
Other than fraud prevention, another legitimate use for ZIP code
is online retail transactions in which the retailer needs the
address, including the ZIP code of the consumer in order to ship
the item. Many retailers have expressed concern, and several
lawsuits attest, that the necessity to require an address for
shipping is being used as a cause of action in civil litigation.
Analysis Prepared by : Mark Farouk / B. & F. / (916) 319-3081
AB 1219
Page 5
FN: 0000673