You may recall the drama that played out in 2003 with regards to renewing certain provisions of the Fair Credit Reporting Act (FCRA). They were set to expire at the end of that year (if you don’t recall, trust me, folks in D.C. were losing sleep over this). 

“Sunset” provisions, as we call them, are popular with Congress. By using them, Congress can’t be accused of doing nothing, but it leaves the door open for undoing laws it dislikes (but feels politically compelled to enact) at some point in the future when the political climate may be more to its liking.

The other handy thing about sunset provisions is that they give Congress the opportunity to tinker with other provisions of the law in question that may not be expiring. It can also add new provisions that score political points. If this tinkering also happens to be a benefit to their constituency, well, that’s just gravy.

Congress made some hay with a side of gravy when it added certain new provisions to the FCRA through the enactment of the Fair and Accurate Credit Transactions Act of 2003 (FACTA). One of the provisions was the requirement that retailers, including auto dealers, truncate credit and debit card information on electronically printed receipts. This meant that receipts could contain no more than five digits of the debit or credit card used in the transaction. It also eliminated the printing of expiration dates.

There are a number of class actions in process right now over this provision, including Ehrheart vs. Lifetime Brands Inc. (Case No. WL 2141979). It was filed on July 20, 2007. Surviving the retailer’s motion to dismiss, the case is important at this moment because of how it views the nature of a violation under FACTA’s card number truncation provision.

Violations of FACTA/FCRA can be either negligent or willful, which is an important distinction. A negligent violation subjects the defendant to liability for actual damages (which require the plaintiff to prove he suffered an actual injury), court costs and reasonable attorneys’ fees. A willful violation provides for actual damages or statutory damages of $100 to $1,000 (which require no actual injury), unlimited punitive damages, court costs and reasonable attorneys’ fees. So, if you’re going to make a mistake, you clearly want your mistake to be negligent.

While not holding that the retailer in this case was “willful” in his alleged violation of FACTA, the court did decide that the complaint contained sufficient facts for the court to make such a holding. These included:

Because FACTA was enacted in 2003, the defendant should have known of FACTA’s requirements concerning the truncating of credit card numbers on electronically printed credit and debit card receipts, as well as prohibition on printing expiration dates. It was also based on the fact that VISA, MasterCard, the PCI Security Standards Council, companies that sell cash registers and other devices for processing credit and debit card payments, as well as other entities had been informing the defendant about the FACTA requirements for the past few years.

Despite knowing about and having been repeatedly informed about FACTA’s requirements, and despite having three years to comply with these requirements, the defendant violated these requirements by
printing more than five digits of the credit card number or the expiration date of the credit card on customer receipts.

If the court holds that these facts sufficiently prove that the defendant did commit a willful violation of FACTA’s card number truncation provision, his liability is essentially uncapped. That could well be catastrophic.

Now, I don’t mean to be presumptuous, but if this looks like your dealership, I expect it almost certainly would be catastrophic. Think about it — up to $1,000 per person, unlimited punitive damages and (my favorite) attorneys’ fees. If you gave out 10 credit card receipts a day for the last year, that could be $3.65 million in statutory damages alone. Add punitives, court costs and the plaintiff’s lawyer’s fees (not to mention your own), and we’re talking real money!

Take a walk through your shop and check your machines that spit out the credit card receipts. If they show more than the last five digits of the card number and/or print the expiration date of the customer’s card, get “hoppin” on a fix!

Michael Benoit is a partner in the Washington, D.C., office of Hudson Cook LLP. He is a frequent speaker and writer on a variety of consumer credit topics. He can be reached at michael.benoit@bobit.com. Nothing in this article is intended to be legal advice and should not be taken as such. All legal questions should be addressed to competent counsel.