Over the last decade, the privacy of various personal information, including Social Security numbers and credit card numbers, and identity theft have become national concerns. The U.S. Congress has responded to these concerns, resulting in legislative efforts to protect this sensitive information. The most recent chapter in these efforts, which all companies who accept credit or debit cards should be aware of, has already spawned numerous class action lawsuits in just four months.

This legislation (called the Fair and Accurate Credit Transactions Act of 2003 or FACTA) became fully effective on December 4, 2006. FACTA, which amended the Fair Credit Reporting Act, was intended to protect consumers from identity theft. The most significant provision in FACTA is Section 1861c(g) which prohibits any party that accepts payment by credit or debit card from including more than the last five digits of the card number or the expiration date on any electronically printed receipt provided to the cardholder.

As a result, businesses must ensure that they comply with those requirements. Alternatively, a business may print the credit or debit card expiration date on the receipt if it does not contain any digits of the card number. These restrictions; however, do not apply to receipts that are handwritten or prepared by imprinting the credit or debit card number on the receipt. The statute includes penalties that are significant in light of the number of credit card transactions processed by major retailers. Section 1681n provides that a person who willfully fails to comply with FACTA's requirements is liable for actual damages of not less than $100 or more than $1,000 per violation, plus punitive damages, attorneys' fees and costs. Even without any willfulness, Section 1681o permits an award of actual damages, attorneys' fees and costs for a negligent failure to comply.

Over 100 Class Action Lawsuits Filed

Plaintiffs' class action counsel wasted no time in filing cases under FACTA, with the first lawsuits being filed the day after the law became effective. More than 100 lawsuits have now been filed in federal courts in California alone against major restaurant chains and retailers such as In-N-Out Burger, El Pollo Loco, California Pizza Kitchen, IKEA and Costco. The lawsuits seek nationwide class certification, actual and punitive damages and attorneys' fees. Among other things, plaintiffs' attorneys claim that the alleged violations of FACTA were willful because the law was enacted three years ago and defendants had sufficient time to upgrade their systems in order to comply, yet failed to do so. Their position is that FACTA permits statutory damages of up to $1,000 per willful violation, with no requirement of any actual injury. By filing in California, plaintiffs' attorneys appear to be attempting to take advantage of a less rigid standard of willfulness adopted in 2006 by the Ninth Circuit U.S. Court of Appeals (which includes California) in a consolidated appeal of two cases involving alleged Fair Credit Reporting Act violations. While four other federal appellate courts had concluded that "willfulness" under the Fair Credit Reporting Act required a showing that a business intentionally and knowingly failed to comply with the law, the Ninth Circuit disagreed and adopted a relaxed standard that requires only that plaintiffs prove a conscious or reckless disregard of the law. Reynolds v. Hartford Fin. Servs. Group, Inc., 435 F.3d 1081, 1098 (9th Cir. 2006). (This case is currently on appeal to the United States Supreme Court.)

In addition to California, the federal courts in Pennsylvania also are becoming a popular venue for FACTA cases since the Third Circuit U.S. Court of Appeals (which includes Pennsylvania) previously had adopted the standard of willfulness applied in the Reynolds case. During March 2007 alone, over a dozen credit card receipt cases were filed in one U.S. District Court in Pennsylvania.

Although there have been no decisions on the merits in the 100+ FACTA cases, there has been at least one significant development. In a case involving IKEA (Eskandari v. IKEA U.S. Inc.), the retailer had moved to dismiss the complaint for lack of standing to sue on the grounds that the Fair Credit Reporting Act did not create a private right of action allowing consumers to sue for a violation of this FACTA provision. On March 12, 2007, the U.S. District Court for the Central District of California denied the motion in a brief decision, holding that the "plain language" of the statute "provides a private right of action for consumers." While this is only the first step in what is likely to be a much more significant battle, the court has allowed this case to go forward. As a result, it likely will be more difficult for other defendants to get these types of cases dismissed for lack of standing to sue.

Impact on Franchisors

Now that credit and debit cards are accepted at virtually all retail outlets, FACTA and these cases will have a direct impact on all franchisors who operate company units. Since the statute only imposes liability on the person who generates the credit card receipt, franchisors should not have any direct liability for their franchisees' transgressions; however, creative plaintiffs' counsel may allege otherwise or seek to impose indirect liability on franchisors.

If not already done, franchisors should verify that their POS systems and receipt printers have been programmed to print receipts that comply with FACTA and make sure that their franchisees are aware of the need to take these actions. Because FACTA imposes different penalties for willful versus negligent failure to comply (and the ability to claim negligent non-compliance will diminish over time as knowledge of the law becomes more widespread), it is critical to take prompt action. Correcting non-compliance will also cut off the time period for which damages may be sought. Documenting the steps taken to ensure compliance also would be prudent, since these records may help demonstrate that any alleged non-compliance was either an aberration or a minor oversight and therefore unintentional.