“Willful” Noncompliance with the FACT Act Could Mean Substantial Liability for Your Business

All businesses accepting credit and debit cards as a form of payment should take note that scores of putative class action lawsuits have recently been filed against a variety of retailers, restaurants and other merchants.  The lawsuits all claim the targets willfully violated the Fair and Accurate Credit Transactions Act of 2003 (the “FACT Act”) (codified at 15 U.S.C. § 1681c(g)) by issuing printed receipts bearing either the customer’s entire credit/debit card number or the card’s expiration date.

According to a recent decision by a federal court in California, many businesses subject to the FACT Act may not be in compliance with it, and as a result may be vulnerable to claims that are invariably accompanied by a request for statutory damages, punitive damages and attorney’s fees.

What Is A Violation Of The FACT Act?
Businesses accepting debit and credit cards in the course of their operations are likely aware of the FACT Act’s requirement that credit/debit card numbers be truncated on printed receipts so only the last 4 or 5 digits appear.  But many businesses may not be aware the FACT Act can be read – and now has been interpreted by at least one court to mean – that in addition to truncating card numbers, businesses must also ensure the expiration date of the card being used for payment does not appear on the printed receipt.  The FACT Act states in relevant part that:

Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.

A quick review of the receipts in your wallet will demonstrate that many retailers, restaurants and other merchants accepting credit/debit cards have interpreted this statute to require EITHER the truncation of credit card numbers OR the masking of the card’s expiration date.  This is reasonable because the combination of a truncated credit/debit card number and the card’s expiration date is likely not sufficient information for an identity thief to be able to use the card.  Because prevention of identity theft was the entire purpose of the FACT Act, it is reasonable to conclude that either truncation of the card number or masking of its expiration date would constitute compliance.   

“Willful” Violations Require No Proof of Actual Harm
In Pirian v. In-N-Out Burgers, 2007 U.S. Dist. Lexis 25384 (C.D. Cal. April 5, 2007), the Court interpreted the FACT Act differently, however, concluding that it requires BOTH the truncation of credit/debit card numbers AND the masking of the card’s expiration date.  The significance of this conclusion cannot be understated.  Under the Pirian Court's reasoning, thousands of retailers, restaurants and merchants are currently violating the FACT Act. 

The type and amount of damages available for violations of the FACT Act vary depending on whether the violations are “negligent” or “willful.”  In order to recover damages for negligent violations, a customer must prove he or she was actually harmed as a result of the defendant’s negligence.  With respect to “willful” violations, most courts require proof of actual knowledge and intentional violation of the relevant statute.  Despite this seemingly more difficult standard of proof, plaintiffs’ class action lawyers have uniformly chosen to allege “willful” violations in their lawsuits because customers need only prove a technical violation, without regard to actual harm, to be entitled to an award of statutory damages of between $100 and $1,000 per violation.  Violations of the FACT Act, whether negligent or willful, are also accompanied by the possibility of an award of punitive damages and attorney’s fees. 

The availability of statutory damages and attorney’s fees makes the pursuit of FACT Act claims very desirable to plaintiffs’ class action lawyers for a number of reasons.  The targets of their claims are often businesses viewed to have the financial ability to pay damages and attorney’s fees.  Also, the fact that none of the plaintiffs’ lawyers’ clients have been harmed could weigh in favor of class certification because the claims appear to be more uniform.  And the sheer number of potential violations may increase the likelihood a target would settle at the outset of a lawsuit instead of incurring attorney’s fees to defend itself, thereby allowing the plaintiffs and their lawyers to recover a large amount of money without ever proving a violation – much less a willful violation – of the FACT Act. 

Conclusion
The FACT Act had varying effective dates based upon the date that point of sale or cash register equipment used in credit/debit card transactions went into service, the latest of which was December 4, 2006.  As a result, it is too early to tell whether this rash of class actions will continue or subside as businesses become compliant with the Act’s requirements.  Rather than adopting a “wait and see” attitude, however, businesses that may be in violation of the FACT Act should ensure compliance on an ongoing basis and should attempt to preserve documentation and electronically stored information relating to their recent credit/debit card transactions and their compliance with the Act. 

For assistance with compliance with the FACT Act, or if your business is named in a lawsuit similar to those described above, please contact Peter Cummins at (502) 779-8190 or pcummins@fbtlaw.com or any other member of Frost Brown Todd’s Business & Commercial Litigation Practice Group.

Posted by: Peter M. Cummins

Categories: Credit Cards