IN BRIEF
- Most federal courts now agree that printing credit- and debit-card expiration dates on sales receipts does not cause the injury in fact required to support Article III jurisdiction.
- Nevertheless, consumer attorneys continue to bring class-action lawsuits alleging expiration date violations under FACTA in state court even where the actions could not proceed in federal court.
- State courts—and federal courts that do continue to exercise Article III jurisdiction—should dismiss these claims for failing to satisfy FACTA’s willful noncompliance standard.
The Fair and Accurate Credit Transactions Act (FACTA), 15 U.S.C. § 1681 et seq., prohibits merchants from including, among other information, credit- and debit-card expiration dates on printed receipts.* See 15 U.S.C. § 1681c(g)(1). After this provision originally became effective in 2004, plaintiff class-action firms flooded courts with expiration date lawsuits, which courts and others “met with varying degrees of contempt.” Sieber v. Havana Harry’s, 604 F. Supp. 2d 1368, 1369 (S.D. Fla. 2009).
Congress eventually amended FACTA in 2008 to include findings that the presence of credit- and debit-card expiration dates on printed receipts does not increase a consumer’s risk of identity theft. See Pub. L. No. 110-241, § 2(a)(6). Due in large part to Congress’s 2008 clarification, most federal circuits now hold that FACTA expiration date claims fail to allege the bare minimum injury in fact needed for federal courts to exercise jurisdiction. See, e.g., Meyers v. Nicolet Rest. of De Pere, 843 F.3d 724, 727–28 (7th Cir. 2016). Nevertheless, plaintiffs continue to file these claims in state court to avoid this federal jurisdictional bar. Although some question whether Congress can allow plaintiffs to bring federal claims in state court that they could not bring in federal court, most FACTA expiration date claims should in any event fail on the merits.
If a FACTA plaintiff suffers no actual damages, then he or she must demonstrate willful noncompliance to recover statutory or punitive damages, which entitles his or her attorneys to recover their reasonable fees. See, e.g., 15 U.S.C. §§ 1681o, 1681n. Willfulness under FACTA requires either known or reckless misconduct. See, e.g., Safeco v. Burr, 551 U.S. 47, 57 (2007). Given that few, if any, merchants would truncate the card number but leave the expiration date just to flout the will of Congress, most FACTA expiration date claims do not implicate the voluntary, intentional, or deliberate misconduct needed to show known violations. See, e.g., Howard v. Hooters, No. H-07-3399, 2008 U.S. Dist. LEXIS 30776 *3 (S.D. Tex. Apr. 5, 2008). Thus, liability typically hinges on whether the merchant’s noncompliance can qualify as reckless, i.e., whether the merchant disregarded an unjustifiably high risk of harm to the consumer. See Vidoni v. Acadia, No. 11-cv-448, 2012 U.S. Dist. LEXIS 59967 *6–*16, 2012 WL 1565128 (D. Maine Apr. 27, 2012).
Plaintiffs cannot as a matter of law demonstrate that a merchant’s alleged FACTA violation disregarded an unjustifiably high risk of harming consumers if Congress specifically found that the alleged violation by itself does not increase the risk of harm to consumers. See, e.g., Vidoni, 2012 U.S. Dist. LEXIS 58867, *15. Accordingly, where a plaintiff can only allege that the merchant included a credit- or debit-card expiration date on a printed receipt, without more, courts should dismiss willful noncompliance claims under FACTA with prejudice at the pleading stage.
FACTA and the Clarification Act
In 2003, Congress enacted FACTA as an amendment to the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., “in response to what it considered to be the increasing threat of identity theft.” Meyers, 843 F.3d at 725. FACTA requires merchants to truncate all but the last five digits of a consumer’s credit or debit card on electronically printed receipts. See 15 U.S.C. § 1681c(g)(1). The merchant must also truncate the card’s expiration date. Id. Negligent noncompliance allows consumers to recover actual damages. See 15 U.S.C. § 1681o. If consumers do not suffer actual damages, then they must show willful noncompliance to recover statutory or punitive damages. See 15 U.S.C. § 1681n.
Congress provided merchants a safe-harbor period to comply with FACTA’s requirements, setting December 4, 2004, as the earliest possible date the act would subject merchants to potential liability. See, e.g., 15 U.S.C. § 1681n(g)(3). “Almost immediately after Congress’ deadline for compliance with FACTA’s substantive provisions, scores of class action lawsuits were filed—many against small businesses.” Sieber, 604 F. Supp. 2d at 1369. “These suits were met with varying degrees of contempt from district courts, the national business lobby, and Congress.” Federal courts “bemoan[ed] the destructive effects” of these types of claims, and they “characteriz[ed] the many FACTA class actions as a great waste of judicial time and effort.” (Quotations omitted.)
Notably, all federal circuits to have expressly considered the issue now refuse to even hear class-action lawsuits alleging that merchants printed credit- and debit-card expiration dates on receipts, without more, because they find the allegations insufficient to establish the bare minimum injury needed to give federal courts standing to consider the dispute. See, e.g., Jeffries v. Volume Servs. Am., 928 F.3d 1059, 1066 (D.C. Cir. 2019) (circuit courts “have unanimously concluded that a FACTA violation based solely on a failure to truncate an expiration date does not qualify as a concrete injury in fact”). Accordingly, some plaintiff class-action firms are bringing these “great waste[s] of judicial time and effort” to state courts instead.
In 2008, responding to “a spate of lawsuits against merchants who printed receipts showing credit card expiration dates,” Congress passed the Credit and Debit Card Receipt Clarification Act (Clarification Act). Basset v. ABM Parking, 883 F.3d 776, 778 (9th Cir. 2017). The Clarification Act found that “[e]xperts in the field agree that proper truncation of the card number, by itself . . . regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud.” Pub. L. No. 110-241, § 2(a)(6). It therefore amended FACTA “to ensure that consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits that do not protect consumers but only result in cost to business and potentially increased prices to consumers.” Id. § 2(b).
More specifically, Congress added the following provision to the section governing civil liability for willful noncompliance:
For the purposes of this section, any person who printed an expiration date on any receipt provided to a consumer cardholder at a point of sale or transaction between December 4, 2004, and June 3, 2008, but otherwise complied with the requirements of section 1681c(g) of this title for such receipt shall not be in willful noncompliance with section 1681c(g) of this title by reason of printing such expiration date on the receipt.
15 U.S.C. § 1681n(d). Congress did not amend the substantive language governing FACTA’s truncation requirements for electronically printed receipts. See 15 U.S.C. § 1681c(g).
Congress Amended FACTA to Limit Abusive Lawsuits and Protect Small Businesses
The Clarification Act did not remove FACTA’s requirement that merchants redact credit- and debit-card expiration dates. See 15 U.S.C. § 1681c(g)(1). When passing the bill, individual members of Congress confirmed that the Clarification Act “does not eliminate a business’s obligation to . . . redact the expiration dates from its receipts” and “[g]oing forward, companies will still have to meet the same strict rules Congress originally passed.” 154 Cong. Rec. E925, 925 (May 14, 2008); 154 Cong. Rec. S4439, 4440 (May 20, 2008). Nevertheless, the Clarification Act’s express findings cast substantial doubt on whether printing expiration dates alone can constitute willful misconduct. See Pub. L. No. 110-241, § 2(a)(6).
As one federal court explained: “the Clarification Act reflects Congress’ view that FACTA went too far in subjecting small businesses to potentially crippling class action lawsuits where only an expiration date was printed on an otherwise redacted credit card receipt.” Sieber, 604 F. Supp. 2d at 1371. Thus, as another federal court recognized, “the statute changed the type of relief one can obtain when a merchant fails to redact the expiration date from a credit card receipt but otherwise complies with FACTA.” Barbieri, 2009 U.S. Dist. LEXIS 9309, *14. “Before the Clarification Act, the failure to redact the expiration date could constitute a willful violation; however, after the Clarification Act, it cannot (provided that the other provisions of FACTA are followed).” Id. at *10.
Some federal district courts construe the Clarification Act’s date ranges to suggest that Congress only meant to extend its original safe-harbor period to June 3, 2008, meaning that failing to truncate the expiration date after June 3, 2008, can still possibly constitute willfulness under FACTA. See, e.g., Hepokoski v. Brickwall of Chicago, No. 09 C 611, 2009 U.S. Dist. LEXIS 122389 *8, 2009 WL 5214311 (Sept. 22, 2009). They find that any reading extending the Clarification Act’s amendment beyond June 3, 2008, renders inclusion of the June 3, 2008 date superfluous. Id. Importantly, however, these interpretations ignore the impact of the Clarification Act’s findings and stated purpose, and many state courts do not consider district court opinions controlling, even on matters of federal law. See, e.g., State v. Burnett, 93 Ohio St. 3d 419, 424 (2001); Pacific Shore Funding v. Lozo, 138 Cal. App. 4th 1342, 1352 (2d Dist. 2006).
As noted, Congress amended FACTA to protect small businesses from “potentially crippling class action lawsuits where only an expiration date was printed.” Sieber, 604 F. Supp. 2d at 1371. It seems unlikely that Congress intended the Clarification Act to merely delay abusive lawsuits from crippling small businesses until after the amendment went into effect. It more likely intended the opposite. If Congress meant for the Clarification Act to continue allowing FACTA plaintiffs to cripple small businesses that only printed an expiration date, then it would not have specified that “[t]he purpose of this Act is to ensure that consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits that do not protect consumers but only result in increased cost to business.” Pub. L. No. 110-241, § 2(b).
Relatedly, FACTA specifically allows federal regulatory agencies and state attorneys general to enforce the statute outside the civil liability provisions for private litigants. See 15 U.S.C. § 1681s. In other words, Congress’s decision to protect merchants from expansive liability for conduct creating no risk to consumers does not relieve merchants from their obligation to redact expiration dates. Rather, it prevents consumers never exposed to even a possible risk of harm from initiating private litigation to recover small awards for statutory damages so their attorneys can seek large awards for fees. Nothing in FACTA indicates that Congress intended the statute as a fund-raising mechanism for private attorneys. See Batra v. RLS Supermarkets, No. 16-cv-2874-B, 2017 U.S. Dist. LEXIS 125877 *10, 2017 WL 3421073 (N.D. Tex. Aug. 9, 2017) (“While Congress undoubtedly hoped that FACTA would reduce identity theft, it does not follow that Congress contemplated private actions by individuals who have not sustained any actual harm.”) (internal quotations omitted).
Typical Allegations in Expiration Date Claims Cannot Constitute Willfulness
FACTA expiration date claims typically include mostly the same allegations: (1) that merchants had substantial time to comply with the requirements after the act’s effective date; (2) that FACTA’s obligations received widespread public attention, including through guidance issued by regulatory agencies, trade associations, and similar organizations; (3) that major credit-card companies ordinarily incorporate FACTA’s requirements into their contracts with merchants; and (4) that most businesses know about and follow the law. See, e.g., Vidoni, 2012 U.S. Dist. LEXIS 58867, *4–*5; Seo v. CC CJV Am. Holdings, No. CV 11-05031, 2011 U.S. Dist. LEXIS 120246 *4–*5, 2011 WL 4946507 (C.D. Cal. Oct. 18, 2011); Gardner v. Appleton Baseball Club, Inc., No. 09-C-705, 2010 U.S. Dist. LEXIS 31653 *9, 2010 WL 1368663 (E.D. Wis. Mar. 31, 2018); Rosenthal v. Longchamp Coral Gables, 603 F. Supp. 2d 1359, 1361 (S.D. Fla. 2009).
Before most circuits confirmed that FACTA expiration date claims do not allege sufficient injury to implicate Article III jurisdiction, district courts split on whether these allegations alone could withstand motions to dismiss. Compare Komorowski v. All-American Indoor Sports, No. 13-2177, 2013 U.S. Dist. LEXIS 125747, 2013 WL 4766800 (D. Kan. Sept. 4, 2013) with Lavery v. Radioshack, No. 13-cv-5818, 2014 U.S. Dist. LEXIS 85190, 2014 WL 2819037 (N.D. Ill. June 23, 2014). However, a careful reading of the Clarification Act, along with Congress’s express findings and statement of purpose, suggests that electronically printing expiration dates on credit- and debit-card receipts cannot, by itself, constitute willfulness as a matter of law.
Knowing Violations Require Voluntary, Intentional, or Deliberate Conduct
Willfulness under FACTA requires not only that the merchant knew about the act, but that it “voluntarily or intentionally violated it.” Vidoni, 2012 U.S. Dist. LEXIS 59967, *9. “Merely being aware of a statute [ ] is insufficient to state a claim for willfulness.” Id. *11. Plaintiffs must also allege “a voluntary, deliberate, or intentional violation.” Id. See also Howard, 2008 U.S. Dist. LEXIS 30776, *2 (“To have willfully violated the statute, [the defendant] must have knowingly or recklessly disregarded it, purposefully exposing its customers to identity theft.”).
The typical FACTA expiration date allegations cannot support the voluntary, deliberate, or intentional misconduct required for knowing violations. Some courts have found knowing violations based on additional allegations, such as: (1) the merchant disregarding recommendations from a third-party contractor hired to ensure FACTA compliance; (2) the merchant choosing not to update its systems to avoid incurring the additional expense of reprogramming its machines; and (3) the merchant having been named in previous FACTA lawsuits alleging the same violations. Bouton v. Ocean Props., 201 F. Supp. 3d 1341, 1350 (S.D. Fla. 2016); Zaun v. Tuttle, No. 10-2191, 2011 U.S. Dist. LEXIS 47916 *5–*6, 2011 WL 1741912 (D. Minn. May 4, 2011); Steinberg v. Stitch & Craft, No. 09-60660, 2009 U.S. Dist. LEXIS 72908 *6–*7, 2009 WL 2589142 (S.D. Fla. Aug. 18, 2009). However, most plaintiffs bringing FACTA expiration date claims must rely on the merchant’s alleged recklessness to establish willfulness.
Recklessness Requires Risk of Harm
“To sustain a claim for recklessness [under FACTA], the Plaintiff is required to allege that the Defendant disregarded an ‘unjustifiably high risk of harm’ to its customers by failing to omit expiration dates from its receipts.” Vidoni, 2012 U.S. Dist. LEXIS 59967, *15 (quoting Safeco, 551 U.S. at 68). Multiple federal courts to have examined the issue conclude that a merchant cannot disregard an unjustifiably high risk of harm by printing expiration dates on its receipts because Congress specifically found that printing the expiration date, without more, creates no risk of harm, much less an unjustifiably high one. Id. See also, e.g., Gardner, 2010 U.S. Dist. LEXIS 31653, *17 (noting based on the Clarification Act that “it is far more likely that the violation was merely negligent, if even that”); Rosenthal, 603 F. Supp. 2d at 1362 (agreeing with argument that “the mere allegation that Defendant failed to delete the expiration date cannot by itself establish a willful reckless violation of the statute”).
Federal courts mostly agree that FACTA can create liability for willful violations even where no actual harm occurs. See, e.g., Ramirez v. Midwest Airlines, 537 F. Supp. 2d 1161, 1168 (D. Kan. 2008). Nonetheless, the U.S. Supreme Court confirms that recklessness requires “an unjustifiably high risk of harm that is either known or so obvious that it should be known.” Safeco, 551 U.S. at 68 (emphasis added). See also Gardner, 2010 U.S. Dist. LEXIS 31653 *17 (“given the fact that no additional protection of the consumer is achieved by deleting the expiration date, it can hardly be said that its action ‘entail[ed] an unjustifiably high risk of harm that is either known or so obvious that it should be known’”) (quoting Safeco).
Thus, the issue is not whether printing the expiration date actually harms the consumer; Congress itself confirmed that it cannot. See Pub. L. No. 110-241, § 2(a)(6). The issue is whether printing expiration dates creates even the possibility of harm to the consumer, i.e., whether the merchant ignores an unjustifiably high risk of known or obvious harm. See, e.g., Safeco, 551 U.S. at 68. It does not. See, e.g., Vidoni, 2012 U.S. Dist. LEXIS 59967, *15; Gardner, 2010 U.S. Dist. LEXIS 31653 *17; Rosenthal, 603 F. Supp. 2d at 1362.
FACTA’s Statutory Structure Requires a Risk of Harm
Some federal courts have rejected the risk of harm component of recklessness under FACTA. See, e.g., Ramirez, 537 F. Supp. 2d at 1169. For example, before Congress enacted the Clarification Act, at least one district court determined that “it is the reckless disregard of statutory duties (not harm) that makes a violation willful.” Id. However, such opinions improperly ignore FACTA’s statutory structure for civil liability. See 15 U.S.C. §§ 1681n, 1681o.
Under FACTA, negligently failing to comply with statutory requirements subjects an actor to liability for a consumer’s actual damages. See 15 U.S.C. § 1681o. In contrast, willfully failing to comply can subject the actor to liability for statutory and punitive damages even without actual damages. See 15 U.S.C. § 1681n. This statutory structure makes rational sense when viewed in the context of the act’s purpose to mitigate the risk of identity theft and credit-card fraud. See Pub. L. No. 110-241, § 2(a)(1) (FCRA’s purpose is to restrict “access to consumers’ private financial and credit information in order to reduce identity theft and credit card fraud.”).
For instance, if an actor negligently violates a statutory duty under FACTA in a way that could pose a risk to a consumer (i.e., unreasonably creates a risk of identity theft or credit-card fraud) then the statute makes the actor liable for the actual damages from any harm caused to the consumer. See, e.g., 15 U.S.C. § 1681o. If an actor willfully violates a statutory duty in a way that could pose a risk of harm to a consumer (i.e., knowingly or recklessly creates an unjustifiably high risk of identity theft or credit-card fraud), then the statute makes the actor liable for statutory and punitive damages regardless of whether the consumer suffered any actual injury. See, e.g., 15 U.S.C. § 1681n. This system of increasing civil liability makes intuitive sense.
However, if the analysis removes the requirement for some degree of consumer risk, the system no longer makes intuitive sense. Without consumer risk of harm, technical statutory violations that do not create any risk and cannot cause any harm, but are deemed “willful,” would expose small businesses to liability for statutory and even potentially punitive damages while more serious substantive violations that cause harm, but are deemed merely “negligent,” would expose the same businesses to liability for only actual damages. See 15 U.S.C. §§ 1681n, 1681o. Courts should not interpret consumer protection statutes such as FACTA to compel such an absurd result. See, e.g., Jerman v. Carlisle, McNellie, Rini, Kramer & Ulrich, 559 U.S. 573, 600 (2010).
Relatedly, as discussed above, Congress amended FACTA’s civil liability provisions “to ensure that consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits that do not protect consumers.” Pub. L. No. 110-241, § 2(b). FACTA accomplishes this objective in part by increasing the level of liability for conduct based on different degrees of consumer risk. See 15 U.S.C. §§ 1681o, 1681n. Under an analysis that did not consider consumer risk, courts would determine liability, regardless of whether the lawsuit protects consumers, based solely on whether the merchant “willfully” created no threat of harm to consumers or just “negligently” created no threat of harm to consumers. Again, courts should not interpret consumer protection statutes like FACTA to compel absurd results. See Jerman, 559 U.S. at 600.
Put differently, even if the court asks whether the merchant recklessly disregarded “statutory duties (not harm),” as some courts may consider appropriate (see, e.g., Ramirez, 537 F. Supp. 2d at 1169), that question lacks any meaning without considering risk. What qualifies as “recklessly” disregarding a statutory duty to protect consumers if it does not require disregarding an unjustifiably high risk of harming consumers? Federal courts are clear that a merchant who implements an objectively reasonable policy that still fails to comply with the law only negligently violates the statute. See, e.g., Long v. Tommy Hilfiger, 671 F.3d 371, 376–77 (3d Cir. 2012). Thus, only an objectively unreasonable policy recklessly violates the statute. Id. See also Safeco, 551 U.S. at 69. So what constitutes an objectively unreasonable policy for truncating expiration dates?
In the context of FACTA expiration date claims, the merchant: (1) knows about expiration date truncation requirement and intentionally ignores it for some financial motive; (2) knows about the requirement and attempts to truncate the expiration date but fails; or (3) does not know about the requirement. No other possibilities exist.
Some courts consider the first situation, knowing about the truncation requirements and intentionally ignoring them for financial gain, to constitute a knowing violation. See, e.g., Zaun, 2011 U.S. Dist. LEXIS 47916, *5–*6 (denying motion for judgment on pleadings where defendant allegedly fired third-party compliance administrator who warned it to upgrade systems to comply with FACTA to save money). The second situation, knowing about the truncation requirement and attempting but failing to comply, would presumably constitute at most a negligent violation. See, e.g., Long, 671 F.3d at 377.
That leaves only the third situation, not knowing about the truncation requirement, to potentially qualify as reckless. However, a merchant who fails to implement a policy to truncate expiration dates because it did not know about the requirement necessarily does not implement an objectively unreasonable policy. It does not implement any policy at all.
Relatedly, if not knowing about the requirement qualified as reckless by itself, then a merchant’s potential liability would nonsensically bounce back and forth from liability for not knowing about its statutory duties, to effectively no liability for inadvertently failing to comply with known statutory duties, and then back to liability for intentionally ignoring known statutory duties. See, e.g., 15 U.S.C. §§ 1681n, 1681o. This ping-pong effect on potential liability lacks the same intuitive sense accompanying an interpretation that recognizes risk of harm as a component of recklessness.
Congress Did Not Create Civil Liability for All FACTA Violations
Moreover, removing consumer risk of harm from the willfulness analysis improperly imposes civil liability on merchants for all FACTA expiration date violations, despite Congress specifically limiting civil liability to only negligent or willful noncompliance. See 15 U.S.C. §§ 1681n, 1618o. See, e.g., Gardner, 2010 U.S. Dist. LEXIS 31653, *15 (if printing expiration dates alone constituted willfulness, then “every violation of the statute would be willful simply because it was a violation”) (emphasis in original).
As discussed above, FACTA expiration-date claims can only involve three possible scenarios: (1) the merchant knows about the expiration date truncation requirement and intentionally ignores it; (2) the merchant knows about the requirement and attempts to truncate the expiration date but fails; or (3) merchant does not know about the requirement. If the third scenario qualifies as reckless, then all expiration date violations invoke civil liability regardless of whether they are negligent or willful, directly contradicting FACTA’s plain statutory language.
Had Congress intended to impose civil liability for all FACTA violations in this way, it would not have specified different standards for negligent and willful noncompliance. See, e.g., Duncan v. Walker, 533 U.S. 167, 174 (2001) (court must “give effect, if possible, to every clause and word of a statute”). Instead, it would have just created civil liability for noncompliance and increased the potential damages for willful noncompliance. See Fish v. Kobach, 840 F.3d 710, 740 (8th Cir. 2016) (“When Congress knows how to achieve a specific statutory effect, its failure to do so evinces an intent not to do so.”) (emphasis in original). Ignoring consumer risk improperly abrogates Congress’s clear statutory intent that civil liability only extends to either negligent or willful violations. See, e.g., 15 U.S.C. §§ 1681n, 1681o.
Conclusion
FACTA requires merchants to redact expiration dates from electronically printed receipts, and it provides enforcement mechanisms allowing the appropriate agencies and state actors to ensure that merchants comply. See 15 U.S.C. §§ 1681c(g)(1), 1681s. Congress never intended these requirements to expose merchants to crippling class-action liability for noncompliance that creates no possible risk of harm. See, e.g., Pub. L. No. 110-241, § 2(b); Sieber, 604 F. Supp. 2d at 1371. A merchant who violates FACTA in a way that Congress specifically found does not increase the risk of identity theft cannot have recklessly disregarded the nonexistent risk, and it therefore cannot have willfully failed to comply with the act. See, e.g., Vidoni, 2012 U.S. Dist. LEXIS, *15–*16. State courts forced to hear expiration date claims because federal courts will not exercise jurisdiction over them should dismiss the claims with prejudice at the pleading stage.
* Kevin M. Hudspeth serves as of counsel to Maurice Wutscher LLP, a national financial services law firm, where he practices in the appellate, consumer credit, and regulatory compliance groups. He has extensive experience with litigation at all levels in federal and state courts across the country, including appeals, class-action lawsuits, and matters involving complicated facts and complex legal issues. He is actively litigating the issues discussed in this article.