• The Fair and Accurate Credit Transactions Act: Consumer Haven or Plaintiffs' Heaven?
  • July 9, 2007 | Authors: Michael E. Chaplin; Mark E. Gustafson
  • Law Firm: White & Case - Los Angeles Office
  • As initially reported in a White & Case litigation alert in March 2007, a new wave of litigation has broken this year. Since January 1, 2007, approximately 100 lawsuits alleging violations of the Fair and Accurate Credit Transactions Act ("FACTA") have been filed against scores of businesses. The lawsuits have been filed in jurisdictions across the country, including in California, Illinois, Minnesota, Pennsylvania and Texas, but the overwhelming majority have been filed in the United States District Court for the Central District of California. The targeted businesses: (1) are in the retail business; (2) issue machine-printed credit card receipts; and (3) allegedly violated FACTA. The alleged violations expose each defendant to potentially massive damage awards (actual/statutory damages, punitive damages and lawyer fees).

    What Does the Fair Credit Transactions Act Require?
    FACTA (Public Law 108-159) added new sections to the Fair Credit Reporting Act, codified at 15 U.S.C. §1681 et seq. FACTA was enacted into law in 2003, but did not become fully effective until December 2006. One aspect of FACTA requires businesses to limit the amount of information printed on credit card receipts: "Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. §1681c(g)(1).

    To comply with Section 1681c(g)(1), electronically-printed credit card receipts should contain not more than the last five digits of the card number and should not include the card's expiration date. Even though the language of the statute could seemingly be read to mean that, alternatively, the receipt could contain the expiration date and not the last five digits of the card number, at least one district court in California has held the statute's plain language clearly prohibits printing more than the last five digits of the card number and also prohibits printing the expiration date. Businesses should also note that this subsection only applies to "receipts that are electronically printed, and shall not apply to transactions in which the sole means of recording a credit card or debit card account number is by handwriting or by an imprint or copy of the card." 15 U.S.C. §1681(g)(2).

    Penalties for Noncompliance Can Be Harsh
    Pursuant to Section 1681n, a person who willfully fails to comply with these requirements "is liable" in an amount equal to the sum of:

    • Actual damages of not less than $100 or more than $1000
    • Punitive damages
    • Lawyer fees and costs

    On the other hand, Section 1681o provides that a person who negligently fails to comply "is liable" in an amount equal to the sum of:

    • Actual damages sustained
    • Lawyer fees and costs

    The lawsuits that have been filed thus far allege willful noncompliance. In addition to the lure of recovering statutorily mandated actual damages (with a floor of $100 per violation), lawyer fees and punitive damages, plaintiffs have likely chosen to file in Los Angeles and focus on willfulness due to the less rigid standard for willfulness applied by the US Court of Appeals for the Ninth Circuit. While some other circuits require a showing that businesses intentionally and knowingly failed to comply, the Ninth Circuit only requires a showing of reckless disregard. As initially reported in the March 2007 White & Case litigation alert, this issue was on appeal to the United States Supreme Court.

    On June 4, 2007, the Supreme Court adopted the Ninth Circuit's holding that willfulness could be established by a showing of recklessness. In so holding, the Court explained that a showing of recklessness must be based on "an objective standard." Safeco Ins. Co. of America v. Burr, 551 US (2007). That is, it is "action entailing an unjustifiably high risk of harm that is either known or so obvious that it should be known." Id. (citation and quotation omitted). It is this "high risk of harm, objectively assessed, that is the essence of recklessness at common law." Id. Thus, "a company subject to FCRA does not act in reckless disregard of it unless the action is not only a violation under a reasonable reading of the statute's terms, but shows that the company ran a risk of violating the law substantially greater than the risk associated with a reading that was merely careless." Id. However, the Court did not define the boundary separating a reckless action from one that is merely careless. It is likely, therefore, that this issue will be based on the facts of each case.

    It is also important to remember that each transaction potentially constitutes a separate violation of FACTA and, therefore, the damages can grow at an alarming rate. So, for example, a business that printed 10,000 receipts could face statutorily mandated damages of $1 million to $10 million, plus punitive damages and lawyer fees. Even for those businesses that mount a successful defense, legal fees and costs can be substantial. Seeing a potential goldmine, plaintiffs' lawyers appear eager to test the legal waters.

    What Should You Do Now?
    A comprehensive internal audit is a good starting point. Remember that even if you limit the digits printed, printing the expiration date can still be a potential violation. Surveying your credit card machines to assure compliance and correcting those that fail to meet statutory standards is imperative. Even if you discover machines that still need to be modified in order to comply with the law, quick modification could be used to show that the failure was not willful, though plaintiffs may argue that post-compliance modification shows that your business could have and should have complied sooner. Still, quick action may limit the size of any potential damage award -- remember, each transaction is a potential violation. On the other hand, continued delay not only increases potential damages but also makes it increasingly difficult to argue that any noncompliance was merely negligent.

    What Should You Do If You Are Sued?
    If you have been named as a defendant in a FACTA lawsuit, or believe you are at risk of being sued, you need experienced lawyers who know the law and can mount a vigorous defense on your behalf. The lawyers at White & Case have substantial experience successfully defending against class action lawsuits.