The Third Circuit recently affirmed a district court’s decision refusing to enjoin an amendment to the New Jersey Unclaimed Property Act (the “Act”) which requires issuers of stored value cards (“SVCs”) to obtain the name and address of purchasers of SVCs and to maintain a record of the zip code of each purchases. New Jersey Retail Merchants Assoc. v. Sidamon-Eristoff, Nos. 10-4551, 10-4552, 10-4553, 10-4714, 10-4715, 10-4716, 11-1141, 11-1164 & 11-1170 (3d Cir. Jan. 5, 2012); Am. Express Travel Related Servs. Co. v. Sidamon-Eristoff, No. 10-4328 (3d Cir. Jan. 5, 2012). The case returns to the district court for further proceedings.
The Act is intended to ensure that an owner’s right to property is not forfeited by the passage of time and seeks to reunite customers with their property. In 2010, a series of amendments were made to the Act, 2010 N.J. Laws Chapter 25 (NJ A3002), addressing for the first time, SVCs (e.g. gift certificates, gift cards, etc.).
Under the Act, a “stored value card” is defined as any “record that evidences a promise, made for monetary or other consideration, by the issuer or seller of the record that the owner of the record will be provided, solely or a combination of, merchandise, services, or cash in the value shown in the record, which is pre-funded and the value of which is reduced upon each redemption. The term ‘stored value card’ includes, but is not limited to the following items: paper gift certificates, records that contain a microprocessor chip, magnetic stripe or other means for the storage of information, gift cards, electronic gift cards, rebate cards, stored-value cards or certificates, store cards, and similar records or cards.”
The Act provides that SVCs are deemed to be abandoned after two years of inactivity, requiring issuers to transfer to the State the remaining value on the SVCs. Issuers of SVCs must obtain:
– name and address of the purchaser/owner of each SVC issued/sold; and
– at a minimum, maintain the record of the zip code of the purchaser/owner.
N.J. Stat. Ann. 46:30B-42.1c (2010) (Chapter 25, § 5c) (“data collection provision”). SVCs issued under a promotion program, customer loyalty program, charitable program or by a business selling $250,000 or less of SVCs in the prior year are exempt. (Per the State Treasurer until further notice, also exempt from the reporting requirements under the Act are “prepaid phone cards” and “prepaid calling cards” issued solely for the purpose of providing telephone call services. “Prepaid phone cards” do not include those cards issued by the telecommunications industry that are used for prepaid services and are redeemable for cash or merchandise).
Chapter 25, § 5c contains both a “data collection provision” and a “place-of-purchase presumption” provision – which provides that if an issuer does not have the name and address of the purchaser or owner of the SVC, the purchaser or owner assumes the address of the place where the SVC was purchased or issued – and if the SVC was purchased or issued in New Jersey, the address must be reported to the State.
Subsequent to Chapter 25’s enactment, SVC issuers, including the New Jersey Retail Merchants Association, New Jersey Food Council, and American Express Prepaid Card Management Corporation, in separate complaints, sought a preliminary injunction against the law – challenging the constitutionality of the law. Part of the litigation focused on the “place-of-purchase” presumption provision in Chapter 25, § 5c. The District Court, in a consolidated decision, enjoined, inter alia, the prospective enforcement of the “place-of-purchase presumption” under Chapter 25, § 5c. The District Court declined to prospectively enjoin the “data collection provision” included in Chapter 25, § 5c, holding that the provision was severable (separable into legally distinct obligations).
On January 5, 2012, the Third Circuit affirmed the lower court’s decision of enjoining the “place-of-purchase presumption” without enjoining the “data collection provision”, holding that the provisions in Chapter 25, § 5c are severable. Whether the New Jersey law will ultimately be enforceable remains to be seen. In the meantime, however, per the “data collection provision,” SVC issuers must obtain the name and address of the purchaser or owner of each SVC issued or sold in New Jersey, and maintain, at a minimum, a record of the zip code of the owner or purchaser. It is anticipated that the New Jersey Office of the State Treasurer will issue guidance on the data collection requirement.
Given that the information SVC issuers must obtain, and maintain, may constitute personal information under state data breach statutes, SVC issuers must have a policy and procedure for protecting the security of the information being collected and stored. For example, in New Jersey, a breach of security pertains to personal information that has not been secured by encryption, or by any other method or technology that renders the personal information unreadable or unusable. In addition, as an SVC issuer must only maintain the information collected for a two year period, SVC issuers should also institute a policy and procedure for destruction of such records.
