Any company that collects or processes credit cards should be aware of a set of new lawsuits — primarily in California but found around the country — related to the printing of credit card numbers on receipts. These suits — brought as class actions — rely on section 1681c(g) of the Fair Credit Reporting Act, a new requirement from the 2003 Fair and Accurate Credit Transactions (FACTA) law that prohibits the printing of full credit card numbers on receipts. As of December 4, 2006, this requirement became applicable to older cash registers and now applies to all electronically printed credit card receipts. Plaintiffs' class action lawyers are taking the position that FACTA permits statutory damages of up to $1,000 per willful violation of the law, as a means of attempting to avoid common problems related to a lack of actual damages in privacy and security cases.
The Bureau of National Affairs reports that more than 100 of these suits have been filed in California, against defendants including Rite Aid, Costco, California Pizza Kitchen, Avis Rent-A-Car and others. A limited number of cases have been filed in other states, largely in Pennsylvania.
While these suits are new, there has been one early decision testing part of this theory. In a case involving Ikea (Eskandari v. Ikea U.S. Inc., C.D. Cal. No. 8:06-cv-01248-JVS-RNB (March 12, 2007)), the court issued the first decision in this area, ruling on Ikea's assertion that the Fair Credit Reporting Act did not create a private cause of action for violation of this FACTA provision. The court, in a brief decision, held that the "plain language" of the statute "provides a private right of action for consumers." Accordingly, while this is only the first step in what is likely to be a much more significant battle, the court has allowed this case to go forward.
Companies should review promptly their policies related to credit card receipts. They also should begin to review more aggressively the overall requirements of the FACTA law, including such broadly applicable provisions as the "disposal rule" related to the disposal of consumer report information.