Quantcast StorefrontBacktalk » Blog Archive » Retailers Facing New Legal Landscape For Credit Card Receipt Cases
advertisement
advertisement

Retailers Facing New Legal Landscape For Credit Card Receipt Cases

Written by Evan Schuman
June 8th, 2007
Like this story? Share it
To share this story with people in your social network, please click on the network icons below.

Whether or not retailers can be legally punished for giving consumers receipts with full credit-card numbers has become much more uncertain, with a few recent critical?and conflicting?legal decisions.

A series of lawsuits against retailers for violating federal law by printing full credit card numbers on receipts is now facing unclear legal terrain, with two federal judges issuing contradictory rulings and the U.S. Supreme Court weighing in this week on a related case and giving some contradictory directions of its own.

In the initial lawsuits filed early this year, some 50 of the nation’s top retailers?including Rite Aid, Harry & David, Ikea, KB Toys, Disney, Regal Cinemas and AMC Theaters?were accused of printing full credit numbers and expiration dates on printed customer receipts, violating a provision of the Fair and Accurate Credit Transactions Act (FACTA) that makes it illegal for a retailer to print more than the last five digits or a credit/debit card number and it also forbids printing the card’s expiration data on that receipt. This is known as masking or truncation. The rule took effect in phases, but by December 2006, the latest of its phases kicked in.

More recently, at least two of those defendants have filed lawsuits against their POS vendors, saying that the POS firms should have protected the retailers when writing their POS software.

The first of the key federal judge rulings was last month, when U.S. District Judge Gary Allen Feess ruled against an attempt by Adidas to dismiss the case, describing some of the retail arguments “absurd” and “bizarre.”

In another case being heard in the courtroom of a different federal judge in California, the decision went the other way. That case involved retailer Cost Plus, which operates about 300 casual home furnishing stores in 34 states.

The judge for the Cost Plus case?U.S. District Court Judge John F. Walter?ruled in favor of the retailer. But Walter’s decision did not involve an attempt to dismiss the case, but was a request to allow the case to proceed as part of a class-action. A class-action status allows for many small?but identical or at least extremely similar?cases to be merged for the convenience of the court and of the litigants.

With the FACTA masking cases, the decisions on whether they can tried as class-action cases is crucial because the nature of the plaintiffs is such that it would almost certainly not be financially possible to proceed individually. In effect, then, a ruling preventing class-action status?if not overturned–is tantamount to a practical dismissal of the claims.

Each judge is only handling a portion of these FACTA masking cases. From a retailer’s perspective, it’s going to be essential whether other federal judges involved reach the same decision as Walter and whether those decisions survive appeals.

Walter’s decision found that the weight of the potential penalties?given the large number of receipts that each chain issues every day?was too extreme. “In this case, if a class is certified and plaintiff prevails, even the minimum statutory damages would be ruinous to defendant,” Walter wrote in his decision. “If plaintiff is able to prove that defendant committed a willful violation of FACTA, each class member would be eligible to receive between $100 and $1,000 in statutory damages. For a class of 3.4 million people, statutory damages alone would range from a minimum of $340 million and a maximum of $3.4 billion. Defendant’s entire net worth is approximately $316 million. Thus, an award of even the minimum statutory damages would put defendant out of business.”

Walter also wrote that the plaintiffs in this case did not claim to have sustained actual damages, which he found a good reason to deny the class certification request.

Lawyers representing plaintiffs in some of these cases found the judge’s ruling unusual, in the sense that it’s rare for a federal judge to rule against class certification because a defendant apparently broke federal law too often. It’s also unusual to rule a case involving federal law violations that no damages could be proven as a reason for dismissing class certification. Would frequent violations of OSHA safety regulations?with a company, for example, that blocked safety exits and left acids in the open?be dismissed because no employee had yet been injured?, one attorney asked.

This week, the U.S. Supreme Court issued an important?and unanimous?decision on FACTA enforcement, but the Supreme Court’s decision dealt with a portion of FACTA that is unrelated to the credit card receipt masking/truncation issue. But retail attorneys are still focusing on the decision because it touches on an important area that might impact the masking actions.

In the case of Safeco Insurance Co. of America Vs. Burr, the justices unanimously supported a decision by the U.S. Court of Appeals for the Ninth Circuit that had been seen as supporting the consumers trying to sue the retailers. But the detailed Supreme Court decision gave both sides something to cheer and cry about.

On the pro-consumer side, the court supported the ninth circuit and ruled that recklessness?as opposed to deliberate actual knowledge?is required to prove willfulness.

“Under the Court’s view of recklessness, a defendant should be found to be reckless if its interpretation of the statute was highly unreasonable and it should have known of the unreasonableness, even if it subjectively thought that what it was doing was completely proper,” wrote Scott Nelson, one of the attorneys involved in the Supreme Court case. “Thus, plaintiffs seeking to prove recklessness will not have to find smoking guns showing that defendants were actually aware of the risk that they were violating the law.”

But the decision also detailed requirements for a finding of reckless that might make it easier for retailers to defend themselves in these cases. If a retailer is arguing that they purchased professional POS software and had legitimate reasons to expect that to handle the new federal requirements, some of the Supreme Court’s wording might come to their aid.

Additional decisions in the new few weeks will be a strong indicator of whether these cases will continue.


advertisement

Leave a Reply

Newsletter

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly newsletter, with urgent bulletins as news merits.
advertisement

Most Recent Comments

Kill All The Passwords

This article does mention, but does not give enough attention to, the fact that the attacks discussed are only feasible when the encrypted password file can be copied and subjected to an offline attack. The trick is to have authentication performed on a separate, much more strongly secured host - such as an Active Directory Domain Controller, or a Kerberos server, or a NIS+ server, or even using something as banal as an LDAP-over-SSL authentication dialog. In these environments, the odds of the "password file" being stolen and subjected to an offline attack go to near zero, and only online attacks may be carried out by the attacker. With sensible exponential backoff between failed password attempts, lockout after a modest number of failed attempts on a single account, and pattern detection, that minimum 7 character password is quite secure enough. Passwords aren't dead yet for security purposes, and they will be with us for a very long while to come for practical purposes. The trick is to employ them correctly. Read more...
The possibilities you describe are years away from being implemented at best, so for the moment passwords are an ugly reality. Luckily, password managers can easily manage hundreds of passwords of any length. The only thing a user needs to remember is the master password. It seems like an easier task to educate users on how to use password managers rather than implement complex security technology on a global basis. Read more...