President Bush Signs H.R. 4008, the Credit and Debit Card Receipt Clarification Act of 2007 Into Law

Act Eliminates Potentially Billions in Damages Exposure for Merchants Hit With FACTA Credit Receipt Class Actions

On June 3, 2008 President Bush signed H.R. 4008, the Credit and Debit Card Receipt Clarification Act of 2007 (Act) into law. The Act provides relief to hundreds of businesses facing class action law suits across the country. It prevents plaintiff class action attorneys from potentially “cashing-in” on a technical violation of a provision of the Fair Credit Reporting Act (FCRA) which prohibits merchants from printing the card expiration date on credit and debit card receipts. This provision was added to the FCRA by Congress in 2003 when it passed the Fair and Accurate Credit Transactions Act (FACTA).

Specifically the Act amends Section 616 of the FCRA (15 U.S.C. §1681n) by adding Subsection (d) which provides:

(d) Clarification of Willful Noncompliance - For purposes of this section, any person who printed an expiration date on any receipt provided to a consumer cardholder at a point of sale or transaction between December 4, 2004, and the date of enactment of this subsection but otherwise complied with the requirements of Section 605(g) [15 U.S.C. §1681c(g)] for such receipt shall not be in willful noncompliance with Section 605(g) by reason of printing the expiration date on such receipt.

By providing a merchant’s action in printing the expiration date on the receipt does not constitute a willful violation of the FCRA, the Act exempts hundreds of defendants facing class actions for alleged violations of Section 605(g) of the FCRA from exposure to hundreds of millions if not billions in potential damages in these cases.

FCRA Prohibits Printing More Than Last 5 Digits of Card Number or the Card Expiration Date on Receipts

FACTA amended the FCRA to prohibit merchants from printing either more than the last five digits of a credit or debit card number, or the card expiration date, on an electronically printed receipt issued to the cardholder at the point of sale. 15 U.S.C. §1681c (g)(1). Subsection (g)(2) provides that this provision applies only to receipts that are electronically printed and it does not apply to transactions where the sole means of recording the account number is by handwriting or an imprint of the card.

The intent of this provision was to make it more difficult for identity thieves to steal credit and debit card information which may enable them to commit credit card fraud or identity theft.

While the FACTA amendments prohibit a merchant from electronically printing both more than the last five digits of the card number and the card expiration date, most card payment industry experts believe that printing only the card expiration date does little if anything to aid a thief in committing credit card fraud or identity theft. The Act itself recognizes this as it states that Congress finds, “Experts in the field agree that proper truncation of the card number, by itself as required by the amendment made by the Fair and Accurate Credit Transactions Act, regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud.”

FCRA Provides for Severe Statutory Penalties for Willful Violations Regardless of Whether Individual Suffers Actual Harm

The FCRA allows an individual to bring a lawsuit against a defendant for violations of the statute including the prohibition against printing the card expiration date on an electronically printed credit or debit card receipt. The FCRA provides for a statutory penalty of between $100 to $1,000 for each violation if the merchant is found to have willfully violated the statute. Thus, a merchant who electronically printed the card expiration date on a credit card receipt could be sued by the card holder and face potential statutory penalties of between $100 and $1,000 for each receipt on which it printed the card expiration date. These statutory damages are available regardless of whether the cardholder suffered any actual injury.

As noted above, Congress found, and most card payment industry experts agree, that simply printing the card expiration date on a receipt does little to aid a thief in committing credit card fraud or identity theft. However, by virtue of the FACTA amendments, merchants faced exposure to severe statutory penalties in lawsuits brought for electronically printing only the card expiration date on a receipt regardless of the fact that the plaintiff did not suffer and was not likely to suffer any actual injury. In addition, the FCRA provides for an award of attorney’s fees to a successful plaintiff brining an action for a violation.

“Blood in the Water” – Enter the Plaintiff Class Action Attorneys

The FACTA amendments first became fully effective on December 4, 2006. In the lyrics of his epic ballad Fins, singer-songwriter Jimmy Buffet regales us with his story of “land sharks” feeding after dark on the local women in the bars in southern climes. Any self respecting Parrot Head (Buffet fan) is able to belt out the chorus to this song:

Can't you feel 'em circlin' honey?
Can't you feel 'em swimmin' around?
You got fins to the left, fins to the right,
and you're the only bait in town.

Smelling blood in the water, in the form of the huge potential statutory damages provided by the FCRA, certain plaintiff class action attorneys circled around waiting for the FACTA amendments to become fully effective on December 4, 2006. After the amendments became fully effective they pounced on unsuspecting merchants, large and small, filing hundreds of class action lawsuits across the country. In the majority of these suits the only alleged violation was printing the card expiration date and they did not allege that either the named plaintiff or the would-be class members suffered any actual injury.

In the context of a class action the potential exposure faced by merchants for printing the card expiration date is astronomical. Merchants issue thousands of credit and debit card receipts a day. Under the FCRA’s statutory penalties provision, every 1,000 receipts issued in violation of the FACTA amendments represents between $100,000 and $1,000,000 in potential damages. Thus, a plaintiff class of 1,000 members could claim damages of between $100,000 and $1,000,000.

Sen. Charles Schumer (D-NY), who made the motion for approval of H.R. 4008 in the Senate, commented on the floor of the Senate as to the destructive effect the resulting lawsuits have created. After the bill had passed Sen. Schumer commented:

"Let's be clear. These lawsuits are not alleging that consumers were harmed in any way. I will repeat that. The lawsuits are not alleging that consumers were harmed in any way. In fact, experts on identity theft will tell you that printing the expiration date doesn't present any risk of fraud or identity theft, as long as the account number is truncated.

"Yet companies are facing sky-high liability of up to $1,000 per receipt. Some of them are large retail businesses; most of them are small mom-and-pop stores. The damages in these cases are so huge that judges have refused to certify class actions because the lawsuits could actually destroy the companies--small and large.

"The long list of defendants in these cases includes many major corporations--we have all heard of the hotels, restaurant chains, et cetera--as well as little mom-and-pop stores.

"It is fair to say that these lawsuits will actually hurt consumers because companies will be forced to raise prices, or even close stores, in order to cover the cost of legal fees and expensive settlements. This is at a time when our economy and businesses- particularly those dealing with retail--are already struggling to rebound from tough times."

Cong. Rec. S. 4439-40 (May 20, 2008).

Congress to the Rescue – Act Effectively Eliminates Liability for Printing Only the Expiration Date

The Act amends the civil damages provision of the FCRA, which provides that if a merchant willfully violates the FCRA it can be held liable in a civil suit for the statutory damages of between $100 and $1,000 per violation. It provides that a merchant who prints only the card expiration date may not be found to have willfully violated the Act. If there is not a willful violation then the merchant cannot be held liable for the statutory damages. However, a plaintiff that can prove actual damages as result of printing the card expiration date may still recover the actual damages incurred. As noted above, few if any plaintiffs actually are injured by printing the card expiration date.

But for the Act, merchants hit with class action lawsuits with thousands of potential class members who are each seeking statutory damages of $100 to $1,000 per receipt, faced exposure for millions if not billions of dollars in damages for printing the card expiration date on a receipt. The Act eliminates this exposure and applies to any pending lawsuit or claim which has not been reduced to a final judgment.

The Act moved quickly through the legislative process. It was introduced in the House on October 30, 2007, by Rep. Tim Mahoney (D-FL) and was unanimously approved on May 13, 2008, by a vote of 407-0. The Senate then quickly approved the bill by unanimous consent on May 20, 2008. H.R. 4008 was sent to the President for signature on May 23, 2008. The President signed the bill into law on June 3, 2008.

Act Only Provides Relief up to the Date of its Enactment – Merchants Who Print Expiration Dates on Receipts After June 3, 2008 Still Face Exposure

The Act only provides relief to merchants who printed the card expiration date up to the date of its enactment. Thus, a merchant who prints a card expiration date on a receipt after June 3, 2008 faces the same liability for statutory damages which existed prior to the enactment of the Act. The Act represents a “get out of jail free card” and does not amend the substantive provision of the FCRA prohibiting the printing of the expiration date. Merchants must ensure that their electronically printed receipts are in compliance to avoid liability. A compliance auditing program would also be advisable.

Class action complaints which allege only that the merchant defendant printed the card expiration date and which do not allege the plaintiff sustained actual damages, will likely now be subject to dismissal on motions for judgment on the pleadings or summary judgment.

The Act does not provide relief to merchants who printed more than the last five digits of the card number on the receipt and there are several such cases pending. These cases will continue to be litigated.

A Case Study – A National Fast Food Restaurant is Hit With a Class Action for Printing the Expiration Date on Receipts

To illustrate the effect of the Act, consider the actual plight of a national fast food restaurant chain with 750 company owned stores and 2,879 point of sale (POS) cash registers. The restaurant chain was aware of the requirements of FACTA and was in compliance by April 2006, well in advance of December 4, 2006, the date the FACTA amendments became generally effective.

In April 2006, the restaurant chain contracted with a third party vendor to eliminate its free standing card readers and to incorporate built-in card readers into its point of sale terminals. While in the process of installing the built-in card readers, the third party vendor apparently inadvertently changed the software running the POS terminals causing them to print the card expiration date. The issue was reported to the restaurant chain on January 20, 2007, and it immediately began efforts to fix the problem. By February 27, 2007, the restaurant chain developed and implemented a software patch to prevent the card expiration date from being printed. However, it was later learned that the patch had not been fully implemented in 76 of the company’s 2,879 POS terminals.

On February 10, 2007, the named plaintiff used his debit card at one of the restaurant chain’s company owned stores and received a receipt on which his card expiration date was printed. In July 2007, the plaintiff filed suit in federal court against the restaurant chain on behalf of himself and a national class alleging it willfully violated the FCRA and seeking the allowed statutory damages of between $100 and $1,000 for each receipt printed in violation of the FCRA.

The restaurant chain likely issued thousands of non-complaint debit and credit card receipts. As a result, it likely faced millions of dollars in potential statutory penalties even though neither the named plaintiff nor any class member was alleged to have suffered actual injury. Further the entire matter arose as the result of an apparent inadvertent software error by a third party vendor. But for the passage of the Act the restaurant chain faced exposure for hundreds of millions of dollars for printing the card expiration date as a result of a software error.

Facing Huge Potential Exposure, Some Merchants Elected to Settle In Advance of the Passage of the Act

Some merchants who had been hit with class action lawsuits elected to settle in advance of the passage of the Act. For example, a national restaurant chain which was hit with a nation-wide class action on March 13, 2007, entered into a settlement agreement on July 31, 2007. The settlement agreement indicates that the restaurant chain issued approximately 225,000 receipts on which it printed the card expiration date. Under the statutory damages provision of the FCRA, the potential exposure for these 225,000 violations was $22.5 million to $225 million.

The settlement agreement provides that the restaurant chain will issue two four dollar coupons for food purchases at the restaurant to any class member making a claim. In addition, the restaurant will issue 225,000 sets of coupons to the first 225,000 patrons starting on a specific date. The restaurant also agreed to pay $110,000 to the plaintiff’s attorneys for attorney’s fees and costs and the costs of notice publication and claims administration. The settlement received final approval on October 27, 2007.

Merchants Need to Remain Vigilant and Ensure Receipts are in Compliance

The Act only provides relief up to the date of its enactment, which is June 3, 2008. Even though Congress has recognized that printing only the card expiration date does little to aid a thief intent on committing credit card fraud or identity theft, merchants may still face exposure for statutory damages of between $100 and $1,000 per receipt, merely for printing the card expiration date after the effective date of the Act.

This creates the opportunity for future class action litigation or the potential continuation of existing cases. Remember there are “fins in the water” and these “creatures” are constantly circling looking for the next defendant. Therefore, merchants need to remain vigilant to ensure that the electronically printed receipts which they are issuing are in compliance. You don’t want to become the bait. It is unlikely Congress will come to the rescue again.

Bart Murphy is a partner in Ice Miller's DuPage County, IL office (western suburbs of Chicago) and is a member of the Business Litigation Practice Group. His practice is focused on complex litigation matters including class action defense. He has defended clients in 5 FACTA credit card receipt class actions.

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice.  The reader must consult with legal counsel to determine how laws or decisions discussed herein apply to the reader's specific circumstances.