Copyright © 1994-2008. |
|
|
|
What Personal Information Should You Give to Merchants?
Merchants, both at retail store locations and online, generally want as much information as possible about their customers so they can more precisely target offers to them. But in our information-centric society, where billions of bits of information can easily be collated and distributed, it’s not necessarily in consumers’ interest to have a lot of their personal data accessible. Seemingly innocuous customer information obtained from consumers at the cash register or online can be combined with data from other sources to obtain a surprisingly detailed portrait of an individual customer. Is it possible that in the not-too-distant future an insurance company could check the choices you make at the grocery store and penalize you if you bought, say, cigarettes or high-fat foods? Or, could law-enforcement officials scan store records to see if you acquired materials that could have been used in a crime? The answer to the second question is “yes”. The FBI recently was reported to have mined customer data collected by San Francisco-area grocery stores, hoping that sales records of Middle Eastern food would lead to Iranian terrorists. (http://www.cnet.com/8301-13739_1-9812473-46.html) In this Fact Sheet, we look at common situations where consumers may be compelled, or may volunteer, to provide information as part of a transaction. You can decide if the benefits of giving that information outweigh the risks. If you want to limit your risks, we suggest safeguards you may wish to take.2. Paying by Credit Card or Check: What Can Merchants Ask? Many states have laws that dictate what kind of information merchants can and cannot ask for or write down when a consumer pays with a check or credit card. Those states and their applicable laws are listed at http://www.privacyrights.org/fs/fs15plus.htm . The remaining information in this section pertains specifically to California, except for the section entitled “Paying by Credit Card -- Merchant Rules,” which applies nationwide. Two California laws limit the collection of personal information by merchants when you pay by credit card or check. These laws were enacted to prevent fraud and limit the amount of personal information which can be collected by merchants.
2a. Paying by Credit Card: California State Laws
What personal information can’t a merchant collect when a consumer pays with a credit card?
Are there any exceptions? Yes. A merchant can collect personal information when:
California law does not prohibit a merchant from requiring a consumer who pays for goods or services by credit card to show identification such as a California driver’s license or California ID. If these are not available, another form of photo identification can be required to be shown. But merchants cannot write or record any information from these documents. As we explain in the next section, the major credit card company rules provide that merchants cannot make showing identification a condition of credit card acceptance. Merchants can record the cardholder’s driver’s license number or identification card number on any form associated with the transaction if the cardholder pays with a credit card but does not provide the credit card. An example is if you are at a department store and forget your credit card but want to charge something to your account. 2b. Paying by Credit Card: Merchant Rules Can merchants accepting MasterCard or Visa require customers to show a driver’s license or other identification as a condition of credit card acceptance? While merchants may ask a customer for identification, in most situations, a merchant may not condition acceptance of a Visa or MasterCard credit card upon the customer presenting identification. In other words, you can refuse to provide identification, and the merchant still must accept your credit card. Many merchants are unaware of this rule. Be aware that identification may be required for purposes other than the credit card transaction, for example, when purchasing alcohol, tobacco products, or certain medications. Identification may also be required for unusual transactions flagged during the authorization process. Some consumers feel that asking for ID helps protect them from identity theft. But others want to protect their privacy and personal security by not revealing their address, birthdate, and other information contained on their driver’s license to a stranger. If you want merchants to ask for your ID, sign your card and write “Ask for ID” below your signature. Be aware, however, that merchants are not bound to honor that instruction. If you do not want to show ID, simply sign your card and refuse to provide ID if asked. The MasterCard Merchant Rules Manual provides as follows:
MasterCard has an online form for reporting merchant violations of this rule. Go to http://www.mastercard.com/us/personal/en/contactus/merchantviolations.html and check the box: “The merchant/retailer required identification.” The Rules for Visa Merchants provides:
Unfortunately, the MasterCard and Visa Merchant Rules are often ignored by retailers. If you feel strongly about not showing identification as a condition of using your Visa or MasterCard credit card, you may wish to print out a copy of the relevant merchant rule (from the pdf links cited above) and ask to speak to a store manager. 2c. Paying by Check: California State Laws What personal information can’t a merchant collect when a consumer pays by check? Merchants who accept a check for goods or services sold or leased at retail cannot:
Are there any exceptions? Yes. A merchant can request or record a credit card number in connection with payment by check when:
The following is also allowed when a merchant accepts a check for goods or services sold or leased at retail:
Further, the merchant can:
2d. Compliance and Enforcement What happens when a merchant breaks these laws? In California, merchants may be fined up to $250 for the first violation and up to $1,000 for each subsequent violation. In addition, the court can order the merchant to stop violating the law. If the merchant violates the law, the consumer can do the following:
2e. Summary of California Merchant Laws Here is a summary of California laws regarding payments to merchants by credit card and by check:
What are signature-capture devices? Signature-capture devices have been widely introduced in recent years by merchants. They are usually located at the cash register and are used when consumers pay by credit card. The signature-capture device records the individual's signature and stores it in a computer system. According to merchants, signature-capture devices streamline their operations by saving them time and reducing the amount of paper generated. When there is a purchase dispute, it is easier for the merchant to locate the receipt by transaction number, using a computer, than locating the paper copy. Further, merchants point out that signature-capture devices reduce fraud because there is less paper containing sensitive information available for others to obtain. And they say sales clerks are more likely to check the customer's signature. However, some consumers feel uncomfortable using signature-capture devices. They are concerned about the security of having their signatures stored electronically in a computer system. Would it be possible, for example, for someone to break into the company's computer system, obtain customers' digitized signatures, and then copy them for forgery purposes? Although we haven’t heard of cases like that, the ingenuity of scam artists is boundless, and we will remain on the lookout. If you experience fraud or any other type of privacy abuse due to signature-capture devices, please let us know. Are you required to sign a signature-capture pad? Most merchants do not require that you sign a signature-capture device. However, sales clerks may be trained to encourage you to sign it. If you do not want to use a signature-capture device, you may have to be persistent and talk with a manager. Grocery stores, drugstores, and other retailers around the country use customer loyalty cards, which may also be called rewards cards, discount cards, or membership cards. Typically, consumers fill out an application to get the card, giving their name, address, and sometimes other information such as gender, phone number, birthday, email address, or income. Some stores actually require consumers to provide a driver’s license or other identification to prove their identity before issuing a loyalty card. When customers show their card at checkout, they may be given a discount for items covered by the card that day. Some cards also accrue points that can be redeemed for various rewards, such as airline miles or cash rebates. About 40% of food retailers offer loyalty programs, and three-quarters of customers participate, according to the Food Marketing Institute (www.fmi.org/docs/media/bg/loyaltymarketing.pdf). According to a 2004 poll conducted by Boston University’s College of Communication, 86% of American shoppers use some form of store card or discount card, “and the majority of them say the benefits of the card are worth giving up some privacy.” Customer loyalty programs allow the store to keep tabs on what customers buy and how often they shop. Merchants say this allows them to identify their most loyal customers, learn more about their buying habits, and offer such best customers the products and services they demand. However, some consumers and consumer-rights groups claim that the data collected by the stores violates privacy rights and may not even save consumers money. Longer-term, those critics say, the effect of this data collection could be even more troubling. Using cards to track purchase histories, stores could segment customers into groups based on how much and how often they purchase. Such information could help stores pinpoint the most desirable — that is, the most profitable customers -- and discriminate against the less profitable. Potentially, that could lead to tailoring prices to individual shoppers, much as airlines charge different prices for seats on the same plane. Do you save money? While such tailored pricing may be years away, critics say the loyalty cards already are being used to adjust prices. The result, they say, is that card-carrying consumers really don’t save anything while those who choose not to join card programs pay even higher prices. According to www.consumersaffairs.com, some studies have found that stores that use loyalty programs may actually increase the regular prices of items for non-club members, “making purchases more expensive for all buyers and reducing the margin of card members’ savings to almost nothing. ‘Everyday’ items can be marked up from 28-71% after card programs are introduced.” Merchants claim that they only analyze aggregate (group) data. However, some critics have questioned whether it isn’t just a matter of time before records of individual consumer preferences are either sold to third parties or made available to investigatory agencies. In fact, some apparently isolated examples of that have occurred. For example, in a Washington state case a few years ago, a suspected arsonist was arrested after police tracked down a fire-starter unit with a Safeway label attached. Safeway provided police with his purchase history. The charges were later dropped, but the point is that the store gave access to the customer’s personal information to authorities. And in another case, the U.S. Drug Enforcement Agency subpoenaed records from the customer database of a supermarket chain in the Southwest looking to see if certain individuals had purchased large quantities of plastic bags commonly used in drug transactions. (Robert O’Harrow, “Bargains at a Price: Shoppers’ Privacy,” Washington Post, Dec. 31, 1998, p. A-1.) In 2005, the drugstore chain CVS disabled a feature on its Web site after it was revealed that unauthorized persons could improperly obtain customer-purchase records by email. The company said the online feature was designed to provide customers with access to their own purchase information of over-the-counter medicines for tax purposes. (See Todd Weiss, “Privacy Fears Prompt CVS to Turn Off Online Service,” ComputerWorld, June 27, 2005.) And in another case, users of General Nutrition Center’s Gold Card had their personal information posted on a Web site by one of the company executives who was selling the information to a partner company. Sensitive to such possibilities, some industry groups are seeking to be proactive. For instance, members of the Food Marketing Institute have developed privacy principles that include allowing customers access to their data, giving them the ability to withdraw, and having all personally identifiable information about them deleted from the database. (See the guidelines at www.fmi.org/gr/consumerprivacyprogram.pdf.) What can you do? Many shoppers appear not to be terribly threatened or concerned that their “club memberships” might lead to compiling of personal information. But if you find the concept troubling, here are steps you can take:
When you purchase an appliance, like a microwave oven, or a consumer electronics product such as a computer, camera, or CD/stereo system, you’ll likely to find a product registration form included among the documents packaged with the product. Typically it’s a folding postcard, with survey questions on one side and a self-mailer on the other. The first few questions on such registration cards are usually dedicated to the name and address of the individual who purchased the product, as well as specific information about the product — essential data for the purpose of informing the company that the individual now owns one of its products, useful information in case of a product recall. But often the remainder of the card consists of a survey that asks the purchaser about his/her demographics and lifestyle characteristics, including:
Clearly, none of this demographics and lifestyle information is necessary to register the product with the company. Yet, usually nowhere on the registration forms is the individual told that providing answers to these questions is optional. Instead, there’s often a warning about the importance of filling out and mailing in the form, with the implication that failure to do so can invalidate the product warranty. (In actuality, the consumer needs only to save the receipt to activate the warranty.) What most consumers do not realize is the postcards are not really returned to the company that manufactured the product. Rather, most such forms are mailed to a data aggregation company. Thus, a tremendous amount of highly detailed personal data is collected from unwary consumers who are led to believe that they are taking the important step of registering their product. The opt-out notices on such forms are usually written in vague terms. They are printed in extremely small type, significantly smaller than the remainder of the form. And such notices are usually placed at the end of the survey, not at the top. The Privacy Rights Clearinghouse believes these so-called registration cards are one of the more deceptive data collection practices in existence today. See our comments to the FTC at http://www.ftc.gov/bcp/workshops/infomktplace/comments/givens.htm What can you do? Don’t send in the product registration cards unless you’re comfortable with your personal information being collected and possibly distributed for other purposes such as marketing. Or, fill in only the questions pertaining to your contact information and the product you purchased. If the product has a safety aspect to it that could result in it being recalled someday, you might want to consider the latter approach – providing only your contact information and details about the specific product. 6. The Future of Consumer Data GatheringAs we’ve seen in this Fact Sheet, merchants are increasingly taking advantage of the power of computers to gather information about their customers. A growing practice among retailers is database marketing. In database marketing, merchants build files as they learn more about the customers who shop in their stores. They often enhance data they collect from customers with additional information purchased from other companies. Such data might include estimated income, average ages of family members, hobbies and interests, home ownership or rental, and so on. They also can use it to market directly to their customers through mailed advertisements, alerting them to sales and special offers. Retailers claim that database marketing helps them improve services to their customers and develop a base of loyal shoppers. But many consumers are concerned about what is done with the data that is compiled about them. Is it sold to other companies to generate unwanted mail and phone solicitations? See PRC Fact Sheet 4 (“Junk Mail: How did They Get My Address?”) http://www.privacyrights.org/fs/fs4-junk.htm Is it possible that someday this data might be used for purposes unrelated to marketing, such as government surveillance, employment background checks, law enforcement investigations, or insurance company research? While this may sound farfetched to many, no laws prevent these types of uses of marketing data, and as we’ve seen, at least isolated cases exist. If you want to limit personal information that is collected by merchants, be assertive when asked for information that you do not feel is necessary for the transaction.
See also Fact Sheet 10 “My Social Security Number: How Secure Is It?” and Fact Sheet 10a “Social Security Numbers: Frequently Asked Questions.” http://www.privacyrights.org/fs/fs10-ssn.htm and http://www.privacyrights.org/fs/fs10a-SSNFAQ.htm
Privacy Rights Clearinghouse Publications
Other Organizations California Office of the Attorney General National Association of Attorneys General: 50-state directory of state, county, and city consumer protection offices in The Consumer Action Handbook of the Federal Consumer Information Center: Laws California Civil Code Sections 1725 and 1747.08 |
| Copyright © 1994-2008. Privacy Rights Clearinghouse/UCAN. This copyrighted document may be copied and distributed for nonprofit, educational purposes only. For distribution of this fact sheet, see our copyright and reprint guidelines. The text of this document may not be altered without express authorization of the Privacy Rights Clearinghouse. This fact sheet should be used as an information source and not as legal advice. PRC fact sheets contain information about federal laws as well as some California-specific information. Laws in other states may vary. Overall, our fact sheets are applicable to consumers nationwide. This publication was originally developed under the auspices of the University of San Diego. Privacy Rights Clearinghouse, 3100 - 5th Ave., Suite B, San Diego, CA 92103. Web: www.privacyrights.org Contact us: www.privacyrights.org/qwertyuiopasdfghjkl.php |
