March 5, 2010
Previously published on February 18, 2010
Operators of e-commerce sites would be well advised to avoid allowing the online display of credit card data within their shopping cart pages. Apart from it being a good idea for data security purposes, there had been some controversy over whether even an online-only display of credit card information, including the complete account number and expiration date, would be a violation of the federal FACTA law's prohibition of "printing" full credit card data. Some courts have found favor in that theory, although many others have not. A new case out of Illinois continues the trend against the theory and extends it to e-mails as well as web pages. Still, we lack a broad ruling by a court at an appellate level that many might choose to rely upon. So, we continue our recommendations on how businesses can avoid entanglement in the problem.
In brief, FACTA created a new prohibition regarding credit card receipts, prohibiting the "printing" of receipts that contained any more than the last few digits of the credit card number or the expiration date. On its face, the law would seem to be addressing solely the paper receipts that we receive when we complete a credit card transaction at a brick and mortar retailer, and was intended to deal with the problem of dumpster-diving for credit card receipts. And, as any of us who use credit cards well know, most brick and mortar retailers have adopted new paper receipt systems to comply with the law.
The controversy at hand arose over allegations by some who had engaged in a purely online transaction that the act of returning a web page only display, in the course of going through a credit card transaction in an online only sale, which contained more than the last few digits of the consumer's credit card, was itself a "printing" of the credit card numbers in violation of FACTA. A number of class-action lawsuits ensued on that theory, and a few courts found favor with the plaintiffs' ideas.
This was in spite of what some thought was a very stretched interpretation of what Congress intended in its use of the word "print." Could Congress have really intended the idea of a "printed receipt" to encompass an online-only display?
The majority of cases, albeit still all only at a local US District Court level rather than the more authoritative appellate court levels, have held against the theory. A recent decision out of an Illinois federal district court is typical. It dismissed the theory that a web page is a "printed" receipt because it did not conform to the plain meaning of the word "print," which the court held means a rendition of text onto physical paper. The court held that an e-mail order confirmation sent to a purchaser is not a printed receipt under FACTA, which takes this even further than prior cases that were focused on the web pages that a retail site might display in the course of the sales process.
Our earlier advice still holds - Don’t Do It! (in other words, do not display more than the last 5 digits of credit card numbers or expiration dates whenever possible, whether paper or screen). Still, e-tailers that happen to get caught up in the onslaught of class action suits based on the theory of "print equals computer screen" can take some comfort in the trends.
|