February 14, 2011 - Privacy and identity theft are two issues that are near and dear to our hearts. And normally, we believe that maintaining your privacy helps you maintain your identity. But there is a recent California Supreme Court decision concerning ZIP code collection that makes us ask a very serious question about whether maintaining privacy at all costs could actually hamper efforts to stop identity theft. The answer is not as clear as you may think.

Tweet

A unanimous decision by the California Supreme Court makes it illegal for retailers in California to collect ZIP Code information from consumers who purchase from them. The one apparent exception to that ruling appears to be gas station point of sale transactions. More on that a little later.

To be perfectly clear, we are not questioning the actual decision by the court. In this day and age, virtually everyone's personal information is stored in a commercial database somewhere. Because of this, a merchant who has access to your name and ZIP Code can often provide those two bits of information to a database aggregator and, for a fee, determine your actual address, phone number and a wide variety of other information about you. Everything that the merchant needs to start sending you advertising directly to your door.

If that information becomes available to anyone who has less than honorable intentions, it could be enough to steal your identity.

Because of these considerations, the court determined that under California law, ZIP Codes can be considered "personally identifiable information". That's good.

The apparent exception - for gas stations - is due to the fact that when consumers enter their ZIP Code information at the pump, the information is not retained by the gas station. It is simply passed through to the credit card company and used to verify that the person to whom the credit card was issued is actually the person making the purchase. That's also good.

This brings up a serious question about how the California law, which is supposed to protect consumer privacy, is written. There are at least two legitimate uses for ZIP Code information that we can think of that don't involve compromising personal privacy.

The first of these uses has already been mentioned; verifying that the person using the card is actually the person to whom it was issued. The second of these is so that merchants can determine the effectiveness of advertising campaigns that were not targeted to the individual providing the ZIP Code. For instance, merchants have a legitimate need to know if a print ad in your area had an overall impact on their sales. They use this information to hold down the costs of advertising and to determine if they need to open new stores. Not having access to this information could actually increase consumer costs because merchants will have to spend more on advertising that provides less targeting.

It would seem that there should be a happy medium here. First, California may want to consider changing the current law in such a way that it would make it illegal for merchants to use a data aggregator to turn a ZIP Code into an address. Second, it might make sense to give merchants that want access to this information the ability to ask for it at the time of sale as long as they also tell the consumer that they don't have to provide it.

As for the merchants that are complaining so loudly that the California court got it wrong, we disagree. In fact, the way that the law is written, they appear to be spot-on! And it should be pointed out that merchants already have the ability to get around the ruling by offering incentives to consumers who provide their information. Many of them already do this. Just think of grocery store loyalty programs. Essentially, anyone enrolling in one of these programs is really just agreeing to sell their information for marketing purposes in return for incentives at the register. There is nothing in this ruling that prevents any merchant in the state from doing this.

All we're saying here is that both sides should probably take another look at this law. There are some common sense approaches to privacy and identity theft issues that the current law doesn't allow for. Those who are hailing the ruling as a panacea for privacy rights are just as wrong as those who are saying that it is a death-knell for California retailers. The ruling will inevitably lead to greater privacy for some but it may also hamper innovative identity theft prevention solutions for others while needlessly forcing prices of some goods to rise. 

byJim Malmberg

Note: When posting a comment, please sign-in first if you want a response. If you are not registered, click here. Registration is easy and free.

Follow me on Twitter: