Evan Schuman's StorefrontBacktalk

The court’s current decision focuses a lot on what the legislature’s intent was back when it was last revised in 1990, a good five or six years before the Web became commonly used by retailers.

“In construing statutes that predate their possible applicability to new technology, courts have not relied on wooden construction of their terms,” the court ruled, before quoting from a book on interpreting legal texts. “Fidelity to legislative intent does not ‘make it impossible to apply a legal text to technologies that did not exist when the text was created. Drafters of every era know that technological advances will proceed apace and that the rules they create will one day apply to all sorts of circumstances they could not possibly envision.'”

The rationale the justices embraced was that an associate in a store has lots of ways of discouraging fraud through identification—looking at a driver’s license, seeing the customer’s face, filming the customer via a closed-circuit security camera, etc.—that are not practical options for E-tailers. Therefore, the argument continued, online retailers need to be able to demand more information to strengthen anti-fraud efforts when dealing with downloadable goods.

The court also said that, when it comes to anti-fraud options, not all E-tailers are the same. When Walmart.com Walmart (NYSE:WMT) ships a lawnmower, at least it has a physical shipping address. It might be a maildrop, but at least it is something that can be observed. It’s also a non-arguable reason to ask for the address and Zip code.

That’s more than what E-tailers have, if the product is an electronic download such as when Apple’s iTunes (which was the retailer in the court’s decision) sells a song, movie or TV show or when Amazon sells an ebook, downloadable game, software applications or ringtones.

The phrasing of the law “shows that while the Legislature indeed sought to protect consumer privacy, it did not intend to do so at the cost of creating an undue risk of credit card fraud. Rather, (one section) demonstrates the Legislature’s intent to permit retailers to use and even record personal identification information when necessary to combat fraud and identity theft, objectives that not only protect retailers but also promote consumer privacy,” the written ruling said. “The safeguards against fraud that are provided are not available to the online retailer selling an electronically downloadable product. Unlike a brick-and-mortar retailer, an online retailer cannot visually inspect the credit card, the signature on the back of the card, or the customer’s photo identification. Thus, the key anti-fraud mechanism in the statutory scheme has no practical application to online transactions involving electronically downloadable products.”

The court also weighed in on how much data is reasonably necessary to try and discourage fraud. The consumer plaintiff in this case “argued that requiring a customer to provide his or her name, credit card number, card expiration date, and credit card identification number suffices to prevent fraud. But it is clear that the Legislature has disagreed. A customer’s name, credit card number, expiration date, and security code are all apparent to a brick-and-mortar retailer on the credit card itself when the card is presented during an in-person transaction,” the court wrote. “Yet the Legislature expressly authorized retailers to request additional information—namely a driver’s license, state identification card, or another form of photo identification—in order to combat fraud. The Legislature has thus decided that the information on the credit card is not necessarily sufficient by itself to protect consumers and retailers against fraud.”

The court noted that some have argued gas stations are often exempted from these fraud data-collection restrictions, and for good reason. “It seems counterintuitive to posit that the Legislature created a fraud prevention exemption only for pay-at-the-pump retailers while leaving online retailers unprotected, when online retailers—a multibillion-dollar industry by the year 2011—have at least as much if not more need for an exemption to protect themselves and consumers from fraud.”

That led the court to exempt all download-related E-tail activity from the law’s restrictions and to impose no limits on how the data can be used and whether it can be shared with non-virtual parts of the business.