A Penny Saved, a Lifestyle Learned? the California and Connecticut Approaches to Supermarket Privacy

• Publication year: 2002
• Citation: Vol. 4 No. 2002

Allison Kidd⁰

It is becoming increasingly difficult to find a grocery store where consumers can take advantage of special discounts without first handing over a frequent shopper card for scanning. While many may consider this grocery store technology a new form of coupon clipping, few stop to consider the privacy implications. Grocery store technology, like technology in other areas, allows for the consolidation and dissemination of personal information in ways never before possible. As grocery stores install ever more sophisticated methods to track what we buy, what we are willing to pay, and which grocery aisles are our favorites, additional state privacy protections modeled after the California Supermarket Club Card Disclosure Act of 1999¹ and the Connecticut Consumer Discount Cards law² are necessary.

This article investigates privacy implications stemming specifically from the use of discount shopping cards in the supermarket industry. The first part of this article will describe shopper card technology. The second part will investigate consumers' current rights to privacy, both from disclosure to the government and from sale of personal information to private third parties. The third part will explore the privacy protections offered by the California and Connecticut Acts and the implications of those laws for supermarket shoppers across the country. This article will conclude by discussing whether the California and Connecticut Acts could serve as models for protecting consumers' privacy in other states.

I. Supermarket Tracker Programs

Six out of every ten supermarkets either currently collects or has plans to begin collecting grocery consumer data through discount club cards.³ Catalina Marketing Corporation, which administers supermarket discount programs for more than 5,000 stores, maintains a database with shopping preferences of thirty million households.⁴ In a typical transaction, customers present their cards, rather than coupons, at the register. The cashier swipes the magnetic strip on the card through an electronic reader, awarding customers discounts and building a record of their buying habits.⁵ Supermarkets tie a customer's social security number or driver's license number to purchase records of food, personal hygiene and tobacco products, alcohol, over the counter medicines, and, in some cases, prescription drugs.⁶ Grocers use the cards to build customer loyalty and make decisions about pricing.⁷ Supermarkets often share the information collected with marketers and product manufacturers.⁸ Some supermarkets sell customer information to marketing agencies that target coupon mailings based on consumer preferences.⁹ Customers who prefer not to have a card face higher shelf prices.

II. Privacy and Supermarket Tracking Programs

The Supreme Court has defined privacy as "the individual's control of information concerning his or her person."¹⁰ The privacy concerns raised by supermarket club cards currently in use, as well as those planned for future use, are numerous. The most pressing of these concerns fall into two categories: disclosure of shopping records to government entities and disclosure or sale of shopping information to private third parties.

A. Disclosure of Shopping Records to Government Entities

Grocery records are a new source of information for government investigations.¹¹ For example, after receiving subpoenas from the Drug Enforcement Administration ("DEA"), one supermarket released information on customers' purchases.¹² The DEA was interested in whether a suspected drug dealer purchased a large supply of plastic sandwich bags, which are commonly used to package drugs.¹³ While the DEA obtained information on plastic bags pursuant to a subpoena, not every grocer is likely to wait for an official demand for information.

Some grocers have voluntarily shared consumer information with government agencies. For example, an employee of one grocery chain, in the wake of the September 11, 2001 terrorist attacks, delivered all customer information collected at his store to federal investigators.¹⁴ The agencies had expressed no interest in obtaining the records.¹⁵ Few consumers, however, realize that their grocery purchases could be the subject of a government investigation.

The government has begun to use supermarket records to ensure food stamp and welfare benefits are used properly.¹⁶ In England, "[g]overnment medical and dental programs have already linked to similar shopper monitoring programs . . . ."¹⁷ While the United States does not have a nationalized health care system like England, many Americans do receive assistance for health care through government programs, such as Medicaid or Medicare, raising fears supermarket records could be linked to health records. often, supermarkets ask customers to make decisions regarding the release of shopping information without fully disclosing these possible uses of the information.

1. Federal Constitutional Protections Against Disclosure to Government Entities

The Fourth Amendment protects individuals from unreasonable search and seizure by the government.¹⁸ The Fourth Amendment also prevents government officials from using third parties to obtain information not otherwise available to the government.¹⁹ In such cases, the third party could be acting as the government's agent.²⁰ Although there has been no litigation about the release of supermarket shopper card information to government agencies to date, existing Fourth Amendment law suggests that shoppers will not find protection in the Constitution.

Fourth Amendment decisions focus on customers' reasonable expectations of privacy.²¹ There is no reasonable expectation of privacy when information is voluntarily transmitted to a third party, regardless of customers' assumptions regarding use of that information.²² The Supreme Court:

has held repeatedly that the Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to Government authorities, even if the information is revealed on the assumption that it will be used only for a limited purpose and the confidence placed in the third party will not be betrayed.²³

For instance, the telephone numbers one dials from a home telephone cannot reasonably be expected to be private since those numbers are revealed to a third party, the telephone company.²⁴ Similarly, revealing personal and financial information when opening a bank account prevents one from having a reasonable expectation of privacy in her bank records.²⁵ One also loses her reasonable expectation of privacy when depositing illegal materials in a trashcan.²⁶ Therefore, revealing one's grocery purchases to a third party cashier arguably removes any reasonable expectation of privacy since cashiers, grocery baggers, and other customers can see all grocery items selected.

Despite the public nature of grocery shopping, however, supermarkets' use of discount club cards can be distinguished from cases involving phone companies and banks. A key distinction exists between what information supermarket customers know they are revealing to stores and what information stores actually collect. Many customers believe that shopper cards do nothing more than trigger coupons and that their purchases are exposed only to the cashier and those people standing around the register.²⁷ The framers of the Fourth Amendment did not anticipate the potential privacy invasions technological advances have created.²⁸ Yet, until the Supreme Court recognizes a broader expectation of privacy, the distinction will not protect supermarket shoppers.

2. State Court Protections Against Disclosure to Government Entities

State courts give consumers more privacy protection than the federal Constitution.²⁹ However, no state has recognized an interest in the privacy of one's shopping activities, and at least one state has considered the issue and decided that no such reasonable expectation of privacy exists.³⁰

Supermarket customers may understand that a supermarket could sell their shopping records,³¹ but the fact that a supermarket can tie shopping records to other customer information does seem to separate the case of shopper cards from other forms of retail transactions. The information supermarkets keep on file from shopper cards provides more intimate details of customers' lives than do telephone records. While telephone records could indicate whether someone is planning a trip, looking for a job in another city, or comparing prices for an upcoming purchase, the groceries one purchases can reveal one's health, bad habits, and even life expectancy. In fact, federal agents were able to use shopper card transactions of the September 11 hijackers to piece together a profile of "ethnic tastes and terrorist supermarket-shopping preferences."³² Existing state privacy law suggests that state courts would recognize privacy protection for supermarket tracker program information when those records are tied to other, more personal forms of information, but likely would not protect individuals' shopping lists.

3. Statutory Protections Against Disclosure to Government Entities

State legislatures can protect a reasonable expectation of privacy where courts have found no such expectation. At least eight states guarantee some degree of personal privacy in their constitutions, protecting consumers against invasion of privacy by governmental actors.³³ These guarantees often merely mirror federal protections or have yielded, in practice, very little protection of information privacy.³⁴

While federal law regulates the government's use of information collected on individuals,³⁵ consumer protections against the release of information by a third party to the government tend to regulate only a particular industry or protect only a particular type of customer.³⁶ For example, action has been initiated to restrict government access to the records of corporations tracking individuals' online...