Topic: Privacy/Data Security/Cyber Risk

A recent decision of the California Supreme Court is sending a chill through a common retail practice: requesting a customer’s ZIP code during a credit card transaction for research and marketing purposes. The decision, in Pineda v. Williams-Sonoma Stores, Inc., found that the practice of collecting ZIP codes violates a California statute, the Song-Beverly Credit Card Act, which forbids businesses from requesting “personal identification information” during a credit card transaction. 

The Federal Trade Commission (the “FTC”) recently released a preliminary staff report entitled Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers, proposing a normative framework for company protection of consumers’ privacy (the “Proposed Framework”).  The Proposed Framework is intended to inform policymakers as they develop solutions, policies and potential laws governing privacy. 

The Federal Trade Commission (the “FTC”) recently issued a publication entitled Businesses Must Provide Victims and Law Enforcement with Transaction Records Relating to Identity Theft (the “Publication”).  As outlined in the Publication, the Fair Credit Reporting Act provides victims of identity theft with the right to ask businesses for a copy of transaction records relating to the theft of their identity (“Transaction Records”).