When Congress passed a sweeping law in December 2003 to crack down on identity thieves, it had no intention of setting up restaurant owners and retailers for potentially devastating class action litigation. But plaintiffs' attorneys have seized on an ambiguous clause in the Fair and Accurate Credit Transactions Act (FACTA), filing more than 150 class action lawsuits alleging violations of the law.

The cookie-cutter suits allege the merchants failed to comply with a FACTA provision designed to prevent theft of credit and debit card numbers from electronically generated receipts. The problem is that Congress wasn't clear on how that should be accomplished. Almost all the defendants truncated cardholders' numbers as the law requires. But the defendants failed to also remove customers' card expiration dates, which the suits argue was required under FACTA. Defendants include national chains Costco, California Pizza Kitchen, TGI Friday's, FedEx Kinko's, IKEA, Wendy's, T.J. Maxx and Radisson Hotels.

On their face, the suits seem silly. After all, what can thieves do with a few digits of a card number? But the defendants aren't laughing. FACTA does not require plaintiffs to prove actual damages if the defendants are found to be in “willful non-compliance,” and it allows them to claim up to $1,000 of statutory damages for each receipt that violates the act.

“We are easily talking tens of billions of dollars if the plaintiffs succeed in getting these cases certified as class actions,” says Barry Parsons, counsel at Crowell & Moring, who is defending a FACTA suit. “Many companies could be wiped out.”

Ambiguous Clause

FACTA, which amended the Fair Credit Reporting Act (FCRA), is best known for allowing every American to obtain a free annual credit report. Among its 26 provisions is one prohibiting businesses that accept credit or debit cards from including “more than the last five digits of the card number or the expiration date” on electronically generated receipts. That provision became effective Dec. 4, 2006. The next day, plaintiffs' attorneys filed the first class action.

The fact that plaintiffs accuse several major retail and restaurant chains of violating an act they had three years to prepare for raises the question of how a federal law could be so widely ignored.

“There is no easy answer as to why,” says Kenneth Kan, associate at Berman, Berman & Berman, which represents a defendant. “One of the most logical explanations is that the word did not filter down to those who needed to know.”

In fact, media coverage of FACTA centered on the free credit reports, ignoring the section on receipts. The FTC, charged with protecting consumers from identity theft, did not publicize the receipt provision. Equipment and technology vendors also apparently failed to spread the word, or perhaps notified people who weren't around when the law finally took effect.

“A lot of these changes would be implemented by an IT department, and you can't expect continuity of employment or communication of a change like that over a three-year period,” says Daveed Schwartz, partner in Pillsbury Winthrop Shaw Pittman.

Word Play

Attorneys defending the FACTA cases also argue that the law's wording is ambiguous. The plaintiffs contend that merchants needed to remove all but the last five digits of card numbers and the expiration date. But defense attorneys say their clients interpreted the law to mean they could either truncate the number or remove the expiration date.

It appears that even the FTC's staff may not have realized that the law required both. The only FTC news release on the subject summarizes June 2004 Congressional testimony on FACTA by J. Howard Beales III, director of the Bureau of Consumer Protection. “FACTA seeks to reduce ?? 1/2 fraud by requiring merchants to truncate the full number on electronic receipts,” Beales testified. He never mentioned expiration dates.

Because some state laws and credit card issuers required truncation of account numbers prior to FACTA's enactment, some merchants thought they already were in compliance.

“They were not turning a blind eye to concerns about identity theft,” Parsons says. “The industry had come up with a standard for truncation of credit card numbers and virtually all of them were in compliance. But they were continuing to print expiration dates.”

Defense attorneys say their clients had no motivation to violate the law.

“It's difficult to imagine any retailer deliberately including information that would put their customers at risk for identity theft,” Schwartz says.

Two-Step Process

Early defense motions to dismiss were unsuccessful. For those cases that go to trial, litigation will be a two-step process, according to John Gibson, partner in Paul, Hastings, Janofsky & Walker.

“The first step is determining whether the defendant violated the statute,” Gibson says. “It's possible the courts will say they had a choice to truncate the numbers or eliminate expiration dates. Only if the court says it is a violation not to do both will it go to the second step–was the violation willful or not?”

That second step is crucial because FACTA authorizes damages of $100 to $1,000 for each receipt found to be a “willful” violation, even when there is no proof of actual injury. On the other hand, a “negligent” violation requires proof that the consumer suffered actual damages before the defendant becomes liable.

Definitions of “willful” differ among the federal circuits. The 9th and 3rd Circuits have held that consumers do not need to prove that the companies intentionally broke the law to qualify for willful damage awards. Instead, consumers need to prove only that the companies ignored the law's requirements.

Because the 9th and 3rd Circuits have expansive “willful non-compliance” definitions, plaintiff's attorneys have filed most of the FACTA suits in California, Nevada and Pennsylvania.

Attorneys are anxiously awaiting a Supreme Court decision on the 9th Circuit's “willful violation” standard that could significantly impact the course of the FACTA litigation. Should the High Court strike down the 9th Circuit's standard, plaintiffs would have trouble winning damages.

“They would only have left cases for actual damages where the plaintiff's identity was stolen,” Gibson says. “Those cases would be few and far between.”

Meanwhile, attorneys warn business owners still printing receipts with full card numbers or expiration dates to re-program their registers rather than waiting for the courts to clarify the law.