Attempting to strike a balance between the competing concerns of privacy and fraud protection, the California Supreme Court ruled yesterday that the Song-Beverly Credit Card Act does not apply to online retailers that collect personally identifiable information (PII) in connection with an online credit card transaction.
The plaintiff in the case, David Krescent, filed a proposed class-action suit against Apple in June 2011 after he was allegedly required to provide his telephone number and address for online media purchases using his credit card. In a split decision, the California Supreme Court held that California’s Song-Beverly Credit Card Act, which forbids the collection of PII for transactions, applies only to brick-and-mortar businesses, not to online purchases of electronically downloadable products. The court reasoned that, unlike brick-and-mortar businesses, online retailers have no opportunity to view personal identification information like a drivers’ license. As such, a request for PII by an online retailer in connection with an Internet credit card transaction is legitimately related to the need for preventing credit card fraud.
According to the majority, “While it is clear that the Legislature enacted the Credit Card Act to protect consumer privacy, it is also clear that the Legislature did not intend to achieve privacy protection without regard to exposing consumers and retailers to undue risk of fraud.” Nonetheless, despite holding that the Song-Beverly Act’s restriction on the collection of PII does not apply to online purchases of electronically downloadable products, the opinion ended on a cautious note: “We cast no doubt on Krescent’s claim that protecting consumer privacy in online transactions is an important policy goal, nor do we suggest that combating fraud is as important or more important than protecting privacy. We express no view on this significant issue of public policy.”
The majority decision was accompanied by two written dissents (joined collectively by three of the Justices) and is likely to face criticism from consumer privacy advocates and others who argue for increasingly narrow restrictions on the collection and use of personal information on the Internet. As the majority foreshadowed in its opinion, further clarification by the California legislature on the use of PII by online retailers can be anticipated.
