The new protections, added in the Fair and Accurate Transactions Act, went into effect in early December 2006. The provisions were meant to protect shoppers from identity thieves, who have been known to dig through trash dumps to steal receipts in search of credit-card information.
Very shortly after the law took effect, class-action lawyers pounced, charging that dozens of retailers had violated the FCRA by continuing to print receipts without redacting all or some of the data . Citing what they called questionable wording in the statute, attorneys for the retailers claimed their clients were operating under the position that compliance with the law meant redacting either the credit card number or the expiration date, but not necessarily both. (Judge for yourself - the statute reads: "No person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt... .")
Companies found guilty of failing to observe this portion of the FCRA can be fined between $100 to $1,000 per violation, a potentially huge sum for retailers that print tens of thousands of receipts per day.
The plaintiffs filed most of their cases in California, where the Ninth Circuit Court of Appeals had issued a pair of decisions that signaled it was apt to be more lenient in deciding which actions (or inactions) constitute a "willful" violation of the FCRA. The Ninth Circuit sent that signal in Safeco Insurance v. Burr and Geico General Insurance v. Edo, saying the insurers violated the FCRA when they failed to tell customers anytime that low credit scores affected the rates they paid. The AP story on Monday's decision says that consumer groups point to the notification requirement in FCRA as "the cornerstone to cleansing credit reports of inaccurate information."
The Ninth Circuit held that defendants could be found liable for a willful violation of the FCRA absent proof that they either actually knew that they would be violating the statute or acted in reckless disregard of whether they were violating it.
The two insurance cases were appealed to the Supreme Court, which on Monday reversed the Ninth Circuit's opinions, sending them back to the lower courts for further deliberation. The High Court's majority opinion, written by Justice David Souter, effectively confined the Ninth Circuit's open-ended definition of what kinds of actions constitute reckless disregard. In order for a company to be found liable for a reckless violation, Souter wrote, its conduct must involve an unjustifiably high risk of harm that is either known to a company or is so obvious that it should have been known.
Charles A. Patrizia, a partner with the Washington office of law firm Paul Hastings, which is representing a number of the retailers targeted in the class-action suits,
said the high court's ruling was a positive development for the defendants, but he doubted that the any of the plaintiffs would go so far as to drop their cases as a result of today's decision.
"So now the question becomes, even with the expiration date printed on the receipt and only part of the credit card number, is there an unjustifiably high risk that someone is going to figure out a way to guess those last missing digits and use it? That risk seems pretty low."
Mark Rasch, a former Justice Department prosecutor who now serves as a managing director at FTI Consulting, called Monday's decision good news for the retailers in the class-action cases, but said the jury was still out for its impact on consumer rights.
"While this decision doesn't mean companies can avoid liability simply by avoiding knowing about legal requirements, it means companies are free to be wrong, as long as they're not grossly wrong," Rasch said.
