Alvarez v. Kmart Holding Corp.

Filed 9/30/10 Alvarez v. Kmart CA4/1
NOT TO BE PUBLISHED IN OFFICIAL REPORTS
California Rules of Court, rule 8.1115(a), prohibits courts and parties from citing or relying on opinions not certified for
publication or ordered published, except as specified by rule 8.1115(b). This opinion has not been certified for publication
or ordered published for purposes of rule 8.1115.
COURT OF APPEAL, FOURTH APPELLATE DISTRICT
DIVISION ONE
STATE OF CALIFORNIA
ALEXANDRA M. ALVAREZ,
Plaintiff and Appellant,
v.
KMART HOLDING CORPORATION,
Defendant and Respondent.
D056005
(Super. Ct. No. 37-2008-00097746-
CU-NP-CTL)
APPEAL from a judgment of the Superior Court of San Diego County, Charles R.
Hayes, Judge. Affirmed.
California's Song-Beverly Credit Card Act of 1971 (Civ. Code,1 § 1747 et seq.,
hereafter the Act) prohibits merchants from requesting and recording "personal identification
information" as part of a credit card transaction. Alexandra Alvarez filed a complaint against
Kmart Holding Corporation (Kmart), alleging Kmart violated the Act and her right to
privacy under the California Constitution when, as part of her credit card purchase, Kmart
1 All further statutory references are to the Civil Code.

-- 1 of 9 --

2
requested and recorded her ZIP Code for the purpose of using it and her name to obtain her
address. Alvarez sought to represent a class of consumers who purchased goods with credit
cards at California Kmart stores during the previous two years.
The trial court granted Kmart's motion for judgment on the pleadings. The court
relied on our decision in Party City Corp. v. Superior Court (2008) 169 Cal.App.4th 497
(Party City), which held as a matter of law ZIP Codes are not "personal identification
information" within the meaning of the Act. (§ 1747.08.) The court also found Alvarez did
not state a constitutional privacy claim.
On appeal, Alvarez challenges the court's ruling only on her statutory claim. She
contends Party City is not controlling because she alleged facts showing Kmart uses ZIP
Codes from customer credit cards to identify a customer's home address through computer
technology. We conclude these added allegations do not show a violation of the Act. The
Act prohibits the collection of certain information and does not govern the retailer's later use
of information properly obtained. Thus, our holding in Party City that the Act does not
prohibit a retailer from collecting ZIP Code information applies regardless of the manner in
which the retailer later uses, or intends to use, the information.2
2 This issue is currently on review before the California Supreme Court in an
opinion by a different panel of this court. (Pineda v. Williams-Sonoma Stores, Inc.
(2009) 178 Cal.App.4th 714, review granted Feb. 10, 2010, S178241.)

-- 2 of 9 --

3
FACTUAL AND PROCEDURAL BACKGROUND
Because we are reviewing a judgment on the pleadings, we base our factual summary
on the allegations of the complaint. (Buesa v. City of Los Angeles (2009) 177 Cal.App.4th
1537, 1540.)
Kmart operates numerous retail stores throughout the United States. During 2008,
Alvarez went to a San Diego Kmart store, selected products from the store, and approached a
Kmart cashier to pay for the items with a credit card. The cashier told Alvarez the amount
owed for the products. The employee then instructed Alvarez to swipe her card at the point-
of-sale machine, "which also required [Alvarez] to provide" her ZIP Code. Alvarez swiped
her credit card and entered her ZIP Code on Kmart's point-of-sale machine. The Kmart
employee then asked to see Alvarez's credit card for verification. Alvarez handed the
employee her credit card. After this transaction was completed, Alvarez left the store with
her purchased products.
In December 2008, Alvarez filed a class action complaint, seeking to represent the
class of persons who engaged in credit card transactions and were asked to provide a ZIP
Code at a California Kmart store during the prior two years. Alvarez alleged two causes
of action: (1) violation of the Act; and (2) invasion of privacy in violation of the
California Constitution.
With respect to the statutory violation, Alvarez alleged Kmart has an " 'Information
Capture Policy' " under which Kmart cashiers routinely request and record ZIP Codes at
the "point-of-sale." Kmart then uses the "customers' zip codes, names and credit card
numbers to obtain its customer's residential addresses with the help of third-party vendors

-- 3 of 9 --

4
that use sophisticated software with access to proprietary databases containing hundreds
of millions of consumers' contact information." Alvarez alleged on information and
belief that one of those third party vendors is "Acxiom," which "advertises its 'Shopper
Registration' software on its website claiming: 'All you have to do is capture the
shopper's name from a check or a third-party credit card at the point of sale and ask for
the shopper's zip code . . . and Address Append takes the name, combined with the
collected zip code, and matches them to Acxiom's [database]. Acxiom provides a match
rate report that tells you how many addresses were matched and appended.' "
Kmart moved for judgment on the pleadings, and the court granted the motion.
The court found the statutory claim was barred by this court's decision in Party City,
supra, 169 Cal.App.4th 497. Quoting Party City, the trial court stated that a ZIP Code
" 'is not facially individualized information in the same way that a personal (or, e.g., an
individual's work) telephone number is . . .' " The court also found Alvarez failed to state
an invasion of privacy claim because "there is no reasonable expectation of privacy with
regards to a Zip Code nor is the procurement of this information sufficiently severe."
On appeal, Alvarez's arguments are directed only to the court's ruling on the
statutory claim. Alvarez has thus waived her appellate rights with respect to her invasion
of privacy claim. (See OCM Principal Opportunities Fund v. CIBC World Markets
Corp. (2007) 157 Cal.App.4th 835, 839, fn. 3.)

-- 4 of 9 --

5
DISCUSSION
A. Standard of Review
A motion for judgment on the pleadings should be granted if the complaint does
not state facts sufficient to state a cause of action against the defendant. The motion
"performs the same function as a general demurrer, and [thus] attacks only defects
disclosed on the face of the pleadings or by matters that can be judicially noticed.
[Citations.]' [Citation.]" (Burnett v. Chimney Sweep (2004) 123 Cal.App.4th 1057,
1064-1065.) The court's task is to determine whether the complaint states a cause of
action assuming all of the alleged facts are true. (Lance Camper Manufacturing Corp. v.
Republic Indemnity Co. (1996) 44 Cal.App.4th 194, 198.) We review the court's ruling
de novo. (Howard Jarvis Taxpayers Assn. v. City of Riverside (1999) 73 Cal.App.4th
679, 685.)
B. Overview of the Act
The Act prohibits merchants from requesting, in a credit card transaction, that the
cardholder provide "personal identification information" and recording that information.
(§ 1747.08, subd. (a)(2).) " '[P]ersonal identification information[ ]' means information
concerning the cardholder, other than information set forth on the credit card, and including,
but not limited to, the cardholder's address and telephone number." (§ 1747.08, subd. (b).)
The Act imposes monetary penalties for a statutory violation. (§ 1747.08, subd.
(e).) "Any person who violates this section shall be subject to a civil penalty not to
exceed two hundred fifty dollars ($250) for the first violation and one thousand dollars
($1,000) for each subsequent violation." (Ibid.; see The TJX Companies, Inc. v. Superior

-- 5 of 9 --

6
Court (2008) 163 Cal.App.4th 80, 85-86.) Because of these mandatory and potentially
significant civil penalties, the Act must be strictly construed against a finding of liability.
(Party City, supra, 169 Cal.App.4th at p. 511.) But the courts have also recognized the
Act is a consumer protection statute that " ' "is remedial in nature" ' " and thus " ' "is to be
liberally construed to the end of fostering its objectives." ' " (Florez v. Linens 'N Things,
Inc. (2003) 108 Cal.App.4th 447, 450.)
C. Analysis
In Party City, this court concluded, as a matter of law, that a ZIP Code is not personal
identification information within the meaning of section 1747.08, subdivision (b) because a
ZIP Code is not facially individualized information. (Party City, supra, 169 Cal.App.4th at
pp. 506, 518.) We reasoned that "[i]f the Legislature intended 'personal identification
information' to include all components of an address, not just specific ones, it would not have
specified in subdivision (b) of section 1747.08 that the protected information (address and
telephone number) is of the kind that pertains to individuals, not groups of zip code
inhabitants. The canon of ejusdem generis supports a construction of the phrase in section
1747.08, subdivision (b), 'personal identification information,' or 'information concerning the
cardholder, other than information set forth on the credit card,' as meaning that the
enumerated items (address and telephone number) were intended to be specific in nature
regarding an individual, rather than a group identifier such as a zip code. If the Legislature
had intended 'address' to be used in its unrestricted sense, it would not also have mentioned a
specific item such as a telephone number in this context." (Id. at p. 520.)

-- 6 of 9 --

7
Alvarez contends Party City is distinguishable because there was no evidence
presented in that case that the defendant used the collected ZIP Codes to obtain customer
addresses. Alvarez argues that her allegation that Kmart uses computer services to locate
customer addresses from collected ZIP Codes essentially transmutes a ZIP Code into
"personal identification information." Alvarez maintains that because the Act absolutely
prohibits Kmart from requesting a customer's residential address, Kmart should be equally
precluded from requesting a customer ZIP Code to later obtain this same information.
We agree Party City was decided on a record that did not include facts showing the
company used or intended to use the ZIP Code information to locate a particular customer's
address or phone number. (See Party City, supra, 169 Cal.App.4th at pp. 504-505 & p. 505,
fns. 5 & 6.) However, the additional allegations in this case do not support a different result.
The Act prohibits only certain information from being collected, and does not
govern the purposes for which the merchant later uses properly obtained information.
There is nothing in the Act stating that a merchant's liability is dependent on the
merchant's intent in collecting the information or the nature of the retailer's subsequent
conduct. Under the plain language of the statute, the meaning of "personal identification
information" is determined at the time the information is requested, and not based on
subsequent events. (§ 1747.08, subd. (a)(1).) Thus, if ZIP Code information is not
prohibited by the Act, the statutory provisions do not preclude Kmart from later using
customer ZIP Codes to obtain addresses.
Moreover, Alvarez's proposed interpretation could render the statute
impermissibly vague as to the precise conduct that is being prohibited. For example, if

-- 7 of 9 --

8
statutory liability is triggered by the retailer's later use of the information, retailers would
be required to predict the capabilities of new technology when deciding whether it is
lawful to ask for certain identification information. This could not have been the
legislative intent when enacting the statute.
Alvarez argues that we should hold that a merchant violates the Act if it intends to
use customer ZIP Codes to obtain personal information because this holding would align
the current state of computer technology with the legislative intent underlying the Act,
which sought to protect consumer privacy and prevent retailers from requesting
information unnecessary to completing the transaction. (See Florez v. Linens 'N Things,
Inc., supra, 108 Cal.App.4th at p. 452.) However, when construing or interpreting a
statute, we may not "imply additional language in order to accomplish some supposed
legislative purpose." (Gray v. Superior Court (2002) 95 Cal.App.4th 322, 327.) This is
especially true as the Act imposes mandatory and potentially significant civil penalties.
(Party City, supra, 169 Cal.App.4th at p. 511.)
It is the Legislature's task, and not the role of the judiciary, to consider whether to
modify laws in the light of technological changes. Because of the multiple conflicting
interests involved in the discovery of personal consumer information and the evolving
state of computer technology, the Legislature is uniquely suited to formulate rules that
balance the privacy concerns with legitimate business needs in this area. If the
Legislature wishes to prohibit merchants from using collected information in a particular
manner, it can enact legislation to achieve this objective.
The trial court properly granted Kmart's motion for judgment on the pleadings.

-- 8 of 9 --

9
DISPOSITION
The judgment is affirmed. Kmart shall recover its costs on appeal.
HALLER, J.
WE CONCUR:
HUFFMAN, Acting P. J.
NARES, J.

-- 9 of 9 --