Retailers with concerns about credit card data protection face an uncertain legal landscape as a series of lawsuits and federal court decisions render contradictory rulings.
The outcome of several lawsuits against retailers for violating federal law by printing full credit card numbers on receipts remains unresolved, with two federal judges issuing contradictory rulings and the U.S. Supreme Court weighing in on a related case and giving some contradictory directions of its own.
In the initial lawsuits filed early this year, some 50 of the nations top retailers—including Rite Aid, Harry & David, Ikea, KB Toys, Disney, Regal Cinemas and AMC Theaters—were accused of printing full credit numbers and expiration dates on printed customer receipts, violating a provision of the FACTA (Fair and Accurate Credit Transactions Act) that makes it illegal for a retailer to print more than the last five digits of a credit or debit card number or the cards expiration date on a receipt. This is known as masking or truncation. The rule took effect in phases, but the latest phase went into effect in December 2006.
More recently, at least two of those defendants have filed lawsuits against their POS (point-of-sale) vendors, saying that the POS companies should have protected the retailers when writing their POS software.
The first of the key federal judge rulings was last month, when U.S. District Judge Gary Allen Feess ruled against an attempt by Adidas to dismiss the case, describing some of the retail arguments as “absurd” and “bizarre.”
In another case being heard in the courtroom of a different federal judge in California, the decision went the other way. That case involved retailer Cost Plus, which operates about 300 casual home furnishing stores in 34 states.
The judge for the Cost Plus case—U.S. District Court Judge John F. Walter—ruled in favor of the retailer. Walters decision did not involve an attempt to dismiss the case but was a request to allow the case to proceed as part of a class-action lawsuit. A class-action status allows for many small—but identical or at least extremely similar—cases to be merged for the convenience of the court and of the litigants.
With the FACTA masking cases, the decisions on whether they can be tried as class-action cases is crucial because the nature of the plaintiffs is such that it would almost certainly not be financially possible to proceed individually. In effect, then, a ruling preventing class-action status—if not overturned—is tantamount to a practical dismissal of the claims.
Each judge is only handling a portion of these FACTA masking cases. From a retailers perspective, its going to be essential whether other federal judges involved reach the same decision as Walter and whether those decisions survive appeals.
Walters decision found that the weight of the potential penalties—given the large number of receipts that each chain issues every day—was too extreme. “In this case, if a class is certified and plaintiff prevails, even the minimum statutory damages would be ruinous to defendant,” Walter wrote in his decision. “If plaintiff is able to prove that defendant committed a willful violation of FACTA, each class member would be eligible to receive between $100 and $1,000 in statutory damages. For a class of 3.4 million people, statutory damages alone would range from a minimum of $340 million and a maximum of $3.4 billion. Defendants entire net worth is approximately $316 million. Thus, an award of even the minimum statutory damages would put defendant out of business.”
Walter also wrote that the plaintiffs in this case did not claim to have sustained actual damages, which he found a good reason to deny the class certification request.
Lawyers representing plaintiffs in some of these cases found the judges ruling unusual, in the sense that its rare for a federal judge to rule against class certification because a defendant apparently broke federal law too often. Its also unusual to rule in a case involving federal law violations that no damages could be proven as a reason for dismissing class certification. One attorney asked: Would frequent violations of OSHA safety regulations—with a company, for example, that blocked safety exits and left acids in the open—be dismissed because no employee had yet been injured?
The week of June 4, the U.S. Supreme Court issued an important—and unanimous—decision on FACTA enforcement, but the Supreme Courts decision dealt with a portion of FACTA that is unrelated to the credit card receipt masking/truncation issue. But retail attorneys are still focusing on the decision because it touches on an important area that might impact the masking actions.
In the case of Safeco Insurance Co. of America vs. Burr, the justices unanimously supported a decision by the U.S. Court of Appeals for the Ninth Circuit that had been seen as supporting the consumers trying to sue the retailers. But the detailed Supreme Court decision gave both sides something to cheer and cry about.
On the pro-consumer side, the court supported the ninth circuit and ruled that recklessness—as opposed to deliberate actual knowledge—is required to prove willfulness.
“Under the Courts view of recklessness, a defendant should be found to be reckless if its interpretation of the statute was highly unreasonable and it should have known of the unreasonableness, even if it subjectively thought that what it was doing was completely proper,” wrote Scott Nelson, one of the attorneys involved in the Supreme Court case. “Thus, plaintiffs seeking to prove recklessness will not have to find smoking guns showing that defendants were actually aware of the risk that they were violating the law.”
But the decision also detailed requirements for a finding of recklessness that might make it easier for retailers to defend themselves in these cases. If a retailer is arguing that they purchased professional POS software and had legitimate reasons to expect that to handle the new federal requirements, some of the Supreme Courts wording might come to their aid.
Additional decisions in the new few weeks will be a strong indicator of whether these cases will continue.
Retail Center Editor Evan Schuman can be reached at Evan_Schuman@ziffdavis.com.
