Since December 4, 2006, enterprising plaintiffs’ lawyers have filed numerous class action lawsuits alleging that retail businesses are violating federal identity theft laws by improperly printing credit card information on point-of-sale receipts. These lawsuits highlight both the importance of complying with the Fair Credit Reporting Act, which requires that consumer credit, employment, and insurance information be protected and used in a fair and equitable manner, and the substantial perils faced by businesses who do not protect their customers’ sensitive information.
Congress amended FCRA on December 4, 2003, through the adoption of the Fair and Accurate Credit Transaction Act. FACTA focuses on a number of areas, including the prevention of identity theft. In particular, FACTA added rules requiring businesses to truncate electronic receipts so that the receipts would not reveal more than the last five digits of credit or debit card numbers. [N]o person that accepts credit cards or debit cards for the transaction of business shall print more than the last five digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction. 15 U.S.C. §1681(c)(g)
This prohibition against businesses printing more than the last five digits of a credit or debit card number on an electronically generated point-of-sale receipt went into effect on January 1, 2005, for any new equipment first put into use on or after that date. Recognizing that businesses would need time to modify older equipment already in service, Congress created an exception for equipment already in use before January 1, 2005, for which the prohibition first took effect on December 4, 2006.
Businesses who “willfully” print receipts that violate the FACTA prohibitions are subject to an award of actual damages or statutory damages of not less than $100 and not more than $1,000 for each violation, as well as costs of suit, reasonable attorneys’ fees, and punitive damages. There is also liability for negligent failure to comply with the statute, but since statutory and punitive damages are not available remedies for negligent violations, plaintiffs are routinely alleging that defendants have acted willfully in their alleged non-compliance.
Since the FACTA December 4, 2006, deadline, plaintiffs have been quick to commence numerous lawsuits seeking to certify nationwide classes of consumers who allegedly have been harmed as a result of businesses printing credit and debit card receipts reflecting more than the last five digits of the consumers’ card numbers. These suits allege that despite the extra time afforded by FACTA to convert equipment in use prior to January 1, 2005, many defendants have failed to do so. Given the available statutory and punitive damages, the plaintiffs stand to receive substantial awards if they are able to establish willful non-compliance and obtain class certification. All businesses who accept credit or debit cards in consumer transactions should immediately check their compliance with the FACTA requirements.