LawyersUSA

In December 2003, Congress amended the Fair Credit Reporting Act with new requirements intended to protect consumers from identify theft.

The amendment, known as the Fair and Accurate Credit Transaction Act, or FACTA, went into effect in December 2006 and prohibits businesses from printing receipts with more than the last five digits of a credit card number or the card's expiration date.

FACTA's enforcement provisions provide for statutory damages of "not less than $100 and not more than $1,000" for willful violations.

Despite the three-year gap between enactment and enforcement, many businesses failed to adopt the changes required by the Act and more than 300 lawsuits have been filed since the law took effect, according to the U.S. Chamber of Commerce.

The suits have been filed against small retailers as well as national chains such as Ikea and Victoria's Secret.

Currently, courts across the country are struggling with two controversial issues:

• Whether the statute applies to Internet-based transactions; and

• The use of an "annihilation damages" defense, where companies argue that a class action shouldn't be certified because of the potential for astronomical statutory damages.

The courts are split on both issues.

"The cases are moving into the cyber world and the issues are starting to make their way to the circuit courts," said Shawn J. Organ, a partner at Jones Day in Columbus, Ohio who has defended companies like Macy's and Stride-Rite in FACTA cases.

Organ noted that the 11th Circuit is considering the e-commerce issue and the 9th Circuit is weighing the merits of the damages defense.

FACTA and the Internet

Does FACTA apply to e-commerce?

The statute provides that "[n]o person that accepts credit or debit cards for the transaction of business shall print more than the last five digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." (15 U.S.C. §1681c(g).)

In California, a U.S. District Court held that a confirmation e-mail was sufficient to meet the "print" requirement (Vasquez-Torres v. StubHub, Inc., No. CV 07-1328 (C.D.Cal. 2007)), and in Pennsylvania, a court ruled that the receipt mailed with a telephone order from a store to a customer's house fit under the statute. (Ehrheart v. Bose Corp., No. 07-350 (W.D.Pa. 2008).)

A U.S. District Court in Florida has held similarly. In Grabein v. 1-800 Flowers.com, Inc., No. 07-22235-CIV (S.D.Fla. 2008), the court noted that the Act does not define "print."

"[T]he ordinary meaning of the term 'print' encompasses the information included when a seller electronically transmits a receipt. …[and the] plaintiff's complaint…is consistent with the claim that defendants 'mark[ed]' his computer screen 'with printed characters' when it transmitted an electronic receipt with his credit card expiration date contained on it," the court held.

More recently, however, another Florida district court granted a defendant's motion to dismiss, ruling that Congress only intended the Act to cover paper receipts printed by the merchant and provided to the consumer at the point of sale. (King v. MovieTickets.com, No. 07-22119-CIV (S.D.Fla. 2008).)

Because of the split in the Florida courts, the defendants in the 1-800 Flowers case have petitioned the 11th Circuit for an interlocutory appeal, which the parties expect the court will grant, said Matthew Sarelson, a solo in Miami, Fla. who represents the plaintiffs in the case.

According to Sarelson, the statute "is completely clear. It doesn't say that it applies only to brick and mortar stores, or other particular types of retailers. It simply says: if you are a merchant and you provide a receipt, it can't contain certain information on that receipt."

Even though the plaintiffs don't have actual damages, such as identity theft, the defendants still put them at risk, claimed Sarelson.

"Congress realized … that it is virtually impossible to trace one individual act of identify theft to any one fraudulent transaction or receipt," he said. "So Congress permitted customers who are at risk to receive a small but nominal damage award to compensate them for the risk of potential identity theft in the future."

But defense attorneys disagree.

"The ultimate goal of the statute was to eliminate or reduce identity theft from dumpster divers," who look for receipts thrown away at the point of sale, Organ said. "It certainly wasn't meant to apply to technical violations where no harm occurred," particularly in the online context.

Organ said that he recently conducted an online transaction with the office of the U.S. Supreme Court, ordering a frame for a certificate stating that he was a member of the Court's bar. But when the frame arrived at his office, the receipt was in the box – with the expiration date printed on the receipt.

If e-commerce is covered under FACTA, then the Supreme Court is in violation of the Act, Organ said.

If the courts do permit e-commerce suits, then the next big argument will be whether Internet retailers could have committed "willful" violations resulting in statutory damages, predicted Richard Hoffman, a partner at Wildman Harrold in Chicago who defends FACTA cases.

"At least one U.S. District Court judge has already ruled that FACTA doesn't apply to Internet transactions. Certainly that means that companies doing e-commerce who didn't think the statute applied to them made a reasonable interpretation of the statute and didn't act willfully," he said.

And Organ noted that many electronic retailers include a waiver of class action rights in their online "terms of use" agreements, which would provide another line of defense against potential FACTA suits.

Disproportionality of damages

Increasingly, defense attorneys are arguing that courts should compare the amount of a class's actual damages – zero, in the majority of cases – to the potential statutory award.

In some cases, the size of the award could potentially "annihilate" the defendant's business.

While the 7th Circuit has rejected this argument as a means to prevent class certification in a FACTA case (Murray v. GMAC, 434 F.3d 948 (7th Cir. 2001)), several courts in the Central District of California have allowed it.

In Soualian v. International Coffee and Tea LLC, a U.S. District Court judge ruled that "[w]here massive damage awards would be disproportionate to any actual damage caused by the alleged violations, class action is not the superior method of adjudicating class members' claims." (No. 07-56377 (C.D. Cal. 2007).)

Robert L. Wallan, a partner at Pillsbury Winthrop Shaw Pittman in Los Angeles who represented the defendants in that case, said that for private companies whose annual revenue is unknown, the defense is slightly different – a "disproportionality defense."

In Soualian, he argued that because the plaintiffs had zero actual damages, any award of statutory damages to a class would be grossly disproportionate to the harm suffered.

But that argument "is simply not a proper legal basis for denying class certification under Federal Rule of Civil Procedure 23(b)(3)," claimed J. Mark Moore, a partner at Spiro Moss Barness in Los Angeles who represents the plaintiffs in Soualian.

"The fact that you violate the law a lot of times as opposed to a relatively small number of times doesn't insulate you from class action liability," he said. And the argument is "completely speculative, because the plaintiffs may not even win the case."

Jay M. Levy, a solo in Miami, Fla. who has 10 active FACTA cases, including the 1-800 Flowers case with Sarelson, said that plaintiffs recognize that defendants may need protection from potentially annihilatory awards.

However, "we think that is an issue that should only be taken into account after an award is made," he said, not used to make an "end run" around class certification.

But Hoffman suggested that the potential size of an award – even over as short a period of time as a month, a large national retailer could generate half a million or a million receipts – places undue stress on defendants to settle.

"Even if you think that the plaintiff doesn't have a good chance of winning the case or getting those damages, [defense attorneys] are under pressure to settle," he said. "It just doesn't make sense to spend hundreds of thousands of dollars to litigate a case with that kind of potential risk."

The Soualian case recently settled for attorney fees and beverage coupons, but the disproportionality issue hasn't gone away.

In another decision from the Central District of California, Reynoso v. South County Concepts, Inc., the court granted class certification over the defendant's disproportionality objections, holding that "the magnitude of the potential damage award does not affect the superiority of a class action for adjudication of this dispute." (No. SACV 07-373 JVS (C.D.Cal. 2007).)

An appeal is currently pending before the 9th Circuit.

Legislative fix?

Some of the legal wrangling could be for naught if legislation pending in the House of Representatives progresses.

H.R. 4008, the "Credit and Debit Card Receipt Clarification Act" would amend FACTA to state that the printing of expiration dates on receipts where the credit card number was properly truncated doesn't constitute a willful violation of the Act.

The bill, introduced by Rep. Tim Mahoney, D-Fla., remains in committee.

It would still allow plaintiffs who suffer actual harm if they get a receipt with an expiration date printed on it to recover damages and attorney fees, Wallan said, but would eliminate class actions seeking statutory damages for such an error.

Questions or comments can be directed to the writer at: correy.stephenson@lawyersusaonline.com