Merchants Beware: Heed This Warning Before Printing Your Next Customer Receipt
The Implications of FACTA in Light of Long v. Tommy Hilfiger, USA
In a decision impacting all merchants and retailers, the U.S. Court of Appeals for the Third Circuit recently held that printing any portion of the expiration date of a customer’s credit or debit card on an electronically printed customer receipt constituted a violation of the Fair and Accurate Credit Transaction Act (FACTA). Although the retailer in Long v. Tommy Hilfiger U.S.A., __ F.3d __, 2012 U.S. App. LEXIS 1269 (3d Cir. Pa. Jan. 24, 2012), escaped liability because it was not in “willful” violation of the Act, this decision arguably sets the stage for a more stringent interpretation of FACTA against merchants down the road.
In October 2009, plaintiff Randy Long purchased a necktie from a Hilfiger store in Mercer County, Pennsylvania. Hilfiger charged Long’s credit card $24.99 and provided him with an electronically printed receipt that redacted all but the last four digits of Long’s credit card number. In addition, the receipt displayed the month, but not the year, of his card’s expiration date. Specifically, the receipt included the following information “############9802” and “EXPIRY: 04/##.” Two months after this purchase, Long initiated a putative class action suit against Hilfiger alleging that its failure to redact the entire expiration date constituted a willful violation of FACTA. Long sought statutory damages, punitive damages, and attorney’s fees.
Enacted in 2003 as part of Congress’ effort to prevent identify theft, FACTA prohibits merchants from printing certain credit and debit card information on receipts. The act provides in pertinent part: “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last five digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.” See, 15 U.S.C. §1681(c)(g)(1). In certain situations a merchant in violation of the act may be subject to civil liability depending on whether the violation was “negligent or willful.” Liability for a merchant’s negligence is limited to actual damages whereas liability for a “willful” violation allows a plaintiff to recover actual damages or statutory damages between $100 and $1,000 plus attorneys’ fees and potentially punitive damages.
According to the plaintiff here, although he had not incurred actual damages, statutory damages were appropriate because Hilfiger’s conduct of including a portion of his credit card’s expiration date amounted to a “willful” violation of the act. In its defense, Hilfiger argued that printing the month alone, without the year that the credit card expired, was consistent with FACTA. Although Hilfiger conceded that FACTA prohibits printing “the expiration date,” it argued that a date “requires the simultaneous coexistence of both the month and the year.” The court disagreed and explained its reasoning as follows:
Taking Hilfiger’s argument to its logical conclusion, a merchant would not violate FACTA so long as it redacted even a single number from either the month or year of the card’s expiration date. Furthermore, different merchants could each choose to redact different portions of the expiration date, making it possible to ascertain the entire expiration date from multiple receipts. This, of course, would be inconsistent with the statute’s objective of preventing identity theft and a result certainly not intended by Congress.
As a result, the court concluded that Hilfiger’s conduct amounted to a violation of the act. Nevertheless, the court held that Hilfiger’s interpretation of the statute was not “objectively unreasonable” and therefore could not be considered a willful violation of the act.
Although the court ruled in favor of Hilfiger and dismissed the plaintiff’s claims, this decision highlights the potential for merchant liability for violations of FACTA. Moreover, given the clear warning to retailers and merchants to remove any expiration date information, post-January 24, 2012 violators of FACTA may not receive the benefit of the doubt. An award of statutory damages, punitive damages, and attorneys’ fees is a real possibility for retailers that print customer credit card information on receipts in violation of FACTA. Accordingly, all businesses that accept payment by debit or credit card must carefully review their policies to ensure compliance with FACTA and, in particular, completely remove the expiration date from electronically printed credit and debit card receipts.
This decision is of particular concern in New Jersey, where the Truth in Consumer Contract Notice and Warranty Act, N.J.S.A. 56:12-14, et seq. (TCCNWA) subjects sellers to statutory damages for entering into contracts with consumers that include any provisions violating a federal or state law, without regard to whether the seller’s conduct was negligent or willful.