Skip to main content
Menu Icon Menu Icon
Close

InfoBytes Blog

Financial Services Law Insights and Observations

Filter

Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.

  • Split en banc 11th Circuit vacates $6.3 million FACTA settlement

    Courts

    On October 28, the U.S. Court of Appeals for the Eleventh Circuit, in a 7-3 en banc decision, vacated a $6.3 million Fair and Accurate Credit Transactions Act (FACTA) class action settlement, concluding the plaintiffs lacked standing because they did not allege any concrete harm. According to the opinion, the named plaintiff filed a FACTA class action against a chocolate retailer, alleging that the retailer printed too many credit card digits on receipts over several years. The complaint only pursued statutory damages and explicitly stated it did “not intend[] to request any recovery for personal injury.” The parties agreed to settle the litigation for $6.3 million prior to the U.S. Supreme Court decision in Spokeo, Inc. v. Robins (holding that a plaintiff must allege a concrete injury, not just a statutory violation, to establish standing). After Spokeo, the district court approved the class action, and class objectors appealed, with one objector arguing that the district court lacked jurisdiction to approve the settlement because the named plaintiff did not allege an injury in fact. On appeal, the 11th Circuit issued multiple opinions, with the first two affirming the settlement approval. The full panel ordered a rehearing en banc, vacating the last opinion.

    The en banc panel vacated the district court order approving the settlement, concluding that the named plaintiff lacked standing under Spokeo. Specifically, the panel rejected the named plaintiff’s argument that “receipt of a noncompliant receipt itself is a concrete injury,” noting that “nothing in FACTA suggests some kind of intrinsic worth in a compliant receipt.”  Moreover, the panel disagreed with the named plaintiff’s distinction that his claim was a “substantive” violation and not just a “procedural” one, reasoning that “no matter what label you hang on a statutory violation, it must be accompanied by a concrete injury.” Because the complaint did not allege a concrete injury, the panel vacated the order.

    In dissent, one judge argued that the named plaintiff plausibly alleged concrete harm by establishing that the retailer’s FACTA violation elevated his risk of identity theft. In the second dissent, another judge asserted that both common law and congressional intent support the conclusion that the plaintiff’s complaint constitutes a concrete injury in fact. And lastly, the third dissent argued that the order should not be dismissed outright because the majority made “assumptions about the risks of identity theft without the benefit of a factual record, expert reports, or adversarial testing of the issue in the district court.” 

    Courts Eleventh Circuit FACTA Settlement Class Action Spokeo Standing Appellate

    Share page with AddThis
  • Appellate Court reverses and remands FACTA action

    Courts

    On January 22, the Illinois Appellate Court, Second District, reversed the dismissal for lack of standing of a FACTA class action brought on behalf of the class by two individuals (consumers) who claimed that an entertainment company (defendant) violated the act when it printed more than the last five digits of the consumers’ payment card number on their receipts. According to the opinion, the complaint alleged that the consumers made a number of purchases from the defendant, each time receiving sales receipts with the first six digits and the last four digits of the consumers’ debit card printed on each receipt. The consumers then filed a class action suit accusing the defendant of willful violation of FACTA, and further, of knowingly or recklessly failing to adhere to the acts’ prohibition against ‘“print[ing] more than the last 5 digits of the card or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.”’ The defendants first removed the action to federal district court, which granted the consumers’ motion to remand back to state court. The defendants then argued that: (i) the consumers lacked standing because they failed to allege an injury; and (ii) the consumers failed to allege facts showing a willful violation of FACTA. The lower court granted the defendant’s motion to dismiss as to standing on the first allegation, but did not consider the second allegation of willfulness, after which the consumers appealed.

    Upon appeal, the court reversed the lower court’s dismissal for lack of standing noting that unlike federal courts, Illinois circuit courts are vested with “jurisdiction to adjudicate all controversies,” and determined that the consumers did have standing to sue even without pleading actual injury, as an allegation of the violation was sufficient. The court stated that “when a person willfully fails to comply with FACTA’s truncation requirements, the statute provides a private cause of action for statutory damages and does not require a consumer to suffer actual damages before seeking recourse.” Additionally, the court decided that the consumers had alleged “sufficient facts” to show that defendant willfully violated FACTA. The panel remanded the case to the lower court to further consider the issues.

    Courts State Issues FACTA Enforcement Class Action Consumer Protection Appellate

    Share page with AddThis
  • Illinois Appeals Court vacates $4.3 million FACTA class action settlement

    Courts

    On September 6, the Illinois Appellate Court, 5th District, vacated a circuit court’s $4.3 million settlement in a class action brought against a merchant for allegedly violating the Fair and Accurate Credit Transaction Act (FACTA) when it printed the first six and last four digits of customers’ 16-digit credit card account numbers on receipts. The appeals court held, among other things, that the “record is devoid of facts that would have permitted a reasoned judgment that the class settlement was fair, reasonable and in the best interests of all affected.” Under FACTA, merchants are prohibited from including on a receipt more than the last five digits of a consumer’s credit card number, and a credit card’s expiration date. A class action suit claiming the merchant violated the restriction was originally filed in New York federal court, but the preliminarily approved settlement was later dismissed after objectors argued that the plaintiffs lacked standing. The named plaintiff requested dismissal of the federal action and subsequently filed suit immediately after in Illinois state court, asking the court to adopt a settlement agreement identical to the one that had been preliminarily approved by the federal court. The objector appealed once again, challenging, among other things, (i) the named plaintiff’s ability to adequately represent the settlement class; (ii) the original class notice, which she argued was insufficient to cover the state court settlement; and (iii) the “fairness, reasonableness, and adequacy of the ‘coupon settlement,’” in which class members received $12 merchant gift cards, while the named plaintiff received $4,000 and class counsel was awarded $500,000.

    On appeal, the appeals court disagreed with the objector’s contention that the named plaintiff lacked standing to represent the class because he kept his receipt and therefore had not been injured under FACTA, but found “a number of red flags” regarding the sub-class of more than 350,000 members of the merchant’s loyalty program, questioning whether the named plaintiff was an adequate representative for those class members since there was nothing in the record indicating whether he was a member of the program. Moreover, the appeals court agreed with the objector that the original class notice provided under the federal settlement did not sufficiently protect the due process rights of the settlement class, and that “due process requires the giving of notice anew of the pending state court settlement to absent class members so that they have the opportunity to protect their own interests.” The appeals court remanded the case to allow the trial court to more carefully scrutinize the terms of the settlement, stating that “we are unable to determine whether the trial court evaluated the merits of the cause of action, the prospects and problems of litigating the cause or the fairness of the terms of compromise.” The appeals court also ordered the trial court to further explain its findings that the $500,000 attorneys’ fee award and $4,000 lead plaintiff award are reasonable given the possibility that not every class member will use the coupon.

    Courts State Issues FACTA Credit Cards Privacy/Cyber Risk & Data Security Class Action

    Share page with AddThis
  • D.C. Circuit: Receipt containing complete credit card information constitutes concrete injury

    Courts

    On July 2, the U.S. Court of Appeals for the D.C. Circuit reversed a district court’s ruling that a consumer lacked Article III standing to allege a violation of the Fair and Accurate Credit Transaction Act (FACTA) when a merchant included all 16 digits of her credit card account number, her full name, and the expiration date on a receipt, because the receipt was not thrown away. Under FACTA, merchants are prohibited from including on a receipt (i) more than the last five digits of a consumer’s credit card number; and (ii) a credit card’s expiration date. The consumer alleged that the merchant violated the restriction, but the district court ruled that the consumer lacked standing to sue because she failed to describe a concrete risk of “actual or imminent” injury to a protected interest as defined in the U.S. Supreme Court’s decision in Spokeo, Inc. v. Robins. According to the district court, because the consumer did not dispose of the receipt, and was the only person who ever saw the receipt, her risk of identity theft had not increased. Moreover, the district court stated that the burden of protecting the non-compliant receipt did not constitute a concrete injury.

    On appeal, the D.C. Circuit reversed, holding that printing a receipt containing all 16 digits of a consumer’s credit card number is an “egregious” enough violation of FACTA to confer standing. According to the panel, the harm inflicted on the consumer by the merchant’s mishandling of her receipt had a “close relationship” to the type of harm that gives rise to a “breach of confidence” claim. Moreover, the panel stated that it was irrelevant that the consumer had been able to protect herself by safeguarding the receipt because: (i) FACTA protects an interest in avoiding an increased risk of identity theft, which the panel considered to be sufficiently concrete; and (ii) under the facts presented, the violation of the truncation requirement created a “risk of real harm” to such concrete interest. The D.C. Circuit remanded the case for further proceedings consistent with its findings. Notwithstanding, the panel was clear that not every violation of FACTA’s truncation requirement creates a risk of identity theft.

    Notably, while the D.C. Circuit’s decision is in agreement with an 11th Circuit opinion issued in April (prior InfoBytes coverage here), it conflicts with other appellate decisions, including an opinion issued by the 3rd Circuit in March (covered by InfoBytes here), wherein the 3rd Circuit held that, without concrete evidence of harm, a consumer lacks standing under FACTA to sue a merchant for including too many digits of a credit card account number on a receipt. The D.C. Circuit noted, however, that the 3rd Circuit “recognized its analysis would be different if it were presented with the facts [the consumer] presents to us.”

    Courts D.C. Circuit Appellate Privacy/Cyber Risk & Data Security FACTA Spokeo

    Share page with AddThis
  • 11th Circuit: Increased risk of identity theft is sufficient to bring FACTA claims

    Courts

    On April 22, the U.S. Court of Appeals for the 11th Circuit affirmed a district court’s ruling that including too many digits of a consumer’s credit card account number on a receipt was sufficient to constitute a concrete injury even if the consumer’s identity was not stolen. Under the Fair and Accurate Credit Transactions Act (FACTA), merchants are prohibited from including more than the final five digits of a consumer’s credit card number on a receipt. According to the opinion, the consumer filed a class action suit against a chocolate company, alleging that one of its stores printed the first six and last four digits of his account number on a receipt, which exposed the class members “to an elevated risk of identity theft.” When the parties sought approval of a proposed settlement, two unnamed class members contested the settlement on the grounds that, among other things, the consumer/class representative lacked standing to sue because he had not suffered a concrete injury as defined in the U.S. Supreme Court’s decision in Spokeo, Inc. v. Robins. The district court, however, approved the settlement.

    On appeal, the 11th Circuit held that an increased risk of identity theft is sufficient to bring claims under FACTA, and that the class representative’s “alleged injury is ‘particularized’ because the heightened risk of identity theft affected him ‘in a personal and individual way’—it was his credit card number that appeared on the receipt.” Moreover, the appellate court noted, “In our view, if Congress adopts procedures designed to minimize the risk of harm to a concrete interest, then a violation of that procedure that causes even a marginal increase in the risk of harm to the interest is sufficient to constitute a concrete injury.”

    Courts Appellate FACTA Privacy/Cyber Risk & Data Security Eleventh Circuit Class Action Settlement Spokeo

    Share page with AddThis
  • 3rd Circuit affirms no actual harm in FACTA suit

    Courts

    On March 8, the U.S. Court of Appeals for the 3rd Circuit issued a precedential opinion holding that, without concrete evidence of harm, a consumer lacks standing under the Fair and Accurate Credit Transactions Act (FACTA) to sue a merchant for including too many digits of his credit card account number on a receipt. According to the opinion, the plaintiff claimed that he received receipts from three different stores owned by the defendant, all of which included both the final four digits and the first six digits of his account number. The plaintiff filed a class action lawsuit alleging the defendant willfully violated FACTA, which prohibits printing more than the last five digits of credit card number on a receipt. The plaintiff alleged that this violation, which he also claimed increased the risk of identity theft, constituted an injury-in-fact sufficient to confer Article III standing as required under the U.S. Supreme Court’s 2016 ruling in Spokeo v. Robins (covered by a Buckley Special Alert). The district court dismissed the suit.

    On appeal, the 3rd Circuit agreed with the lower court, holding that the plaintiff failed to allege actual harm from the defendant’s practice. The appellate court held that the defendant’s technical violation of FACTA did not give the plaintiff standing to sue. Moreover, in the absence of actual harm, or a material risk of actual harm (the plaintiff did not allege that anyone—aside from the cashier—saw the receipt, that his credit card number had been misappropriated, or that his identity was stolen), the plaintiff would not have suffered the injury-in-fact that created federal court jurisdiction.

    Courts Third Circuit Appellate FACTA Credit Cards Consumer Finance Spokeo

    Share page with AddThis
  • Second Circuit Cites Spokeo, Rules No Standing to Sue for Violation of FACTA

    Courts

    On September 19, the U.S. Court of Appeals for the Second Circuit issued an opinion ruling that a merchant who had printed the first six numbers of a consumer’s credit card on a receipt violated the Fair and Accurate Credit Transactions Act (FACTA), but that because the violation did not cause a concrete injury, the consumer did not have standing to sue the merchant. Under FACTA, merchants are prohibited from including more than the final five digits of a consumer’s credit card number on a receipt. In this instance, the plaintiff filed a complaint in 2014, followed by an amended complaint later that same year, in which he alleged that he twice received printed receipts containing the first six digits of his credit card number, in violation of FACTA. The plaintiff claimed that the risk of identity theft was a sufficient injury to establish standing. The defendants argued that that the first six digits of the credit card account only identified the card issuer and did not reveal any information about the consumer, which did not “raise a material risk of identity theft.” Citing a Supreme Court ruling in Spokeo v. Robins, the district court opined that a procedural violation of a statute is not enough to allow a consumer to sue, because it must be shown that the violation caused, or at least created a material risk of, harm to the consumer—which, in this case, was not present. Accordingly, the appellate court affirmed the district court’s dismissal for lack of subject matter jurisdiction, but found that the district court erred in dismissing the suit with prejudice.

    Courts Litigation FACTA Second Circuit U.S. Supreme Court Spokeo

    Share page with AddThis
  • Second Circuit Affirms No Actual Harm in FACTA Suit

    Courts

    On June 26, the U.S. Court of Appeals for the Second Circuit held that, without concrete evidence of actual harm, a consumer lacks standing under the Fair and Accurate Credit Transactions Act (FACTA) to sue a merchant for printing credit card expiration dates on receipts. The consumer alleged that printing the expiration date on her credit card receipt led to a material risk of identity theft, and therefore constituted an injury-in-fact sufficient to confer Article III standing. The court disagreed, noting that Congress’s amendments to FACTA belie that expiration dates on credit card receipts increase the risk of identity theft. Moreover, the court held that the consumer failed to allege actual harm from the merchant’s practice.

    The court’s decision in Cruper-Wienmann comes approximately one month after the U.S. Supreme Court’s decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 194 L. Ed. 2d 635 (2016), as revised (May 24, 2016), which held that “bare procedural violation[s], divorced from any concrete harm” are not enough to establish standing.

    Courts Second Circuit Litigation FACTA Spokeo

    Share page with AddThis
  • Seventh Circuit Dismisses FACTA Truncation Class Action

    Fintech

    On April 18, the U.S. Court of Appeals for the Seventh Circuit dismissed a class action seeking damages against Shell under the Fair and Accurate Credit Transactions Act (FACTA) for displaying four digits of customers’ credit card numbers on receipts printed at Shell gas stations. Van Straaten v. Shell Oil Products Co. LLC, No. 11-8031, 2012 WL 1340111 (7th. Cir. Apr. 18, 2012). FACTA requires that such receipts truncate card numbers to display no more than the last five digits of the card number. Shell’s practice was to print the last four digits of what it calls the “primary account number,” which is the number appearing before the last five digits of the sequence of numbers appearing on the front of the credit card. The plaintiffs did not allege that Shell’s practice created a risk of identity theft, but that Shell violated FACTA by printing the wrong four numbers. Writing for a three-judge panel, Chief Judge Frank Easterbrook indicated that FACTA does not define the term “card number,” but the panel did not have to define the term, “because we can’t see why anyone should care how the term is defined.” He added that ”[a] precise definition does not matter as long as the receipt contains too few digits to allow identity theft.” As to FACTA’s authorization of $100 to $1,000 for each willful violation, Judge Easterbrook noted that “[a]n award of $100 to everyone who has used a Shell Card at a Shell station would exceed $1 billion, despite the absence of a penny’s worth of injury.”  Because Shell now prints no such digits on its receipts, “the substantive question in this litigation will not recur for Shell or anyone else; it need never be answered.”

    Credit Cards Class Action FACTA

    Share page with AddThis
  • FTC Releases Survey on Consumer Reporting Agencies and FACTA

    Consumer Finance

    On March 12, the FTC released the results of a survey conducted to gauge consumer experiences in dealing with consumer reporting agencies (CRAs) following an identity theft. While the survey indicates that the majority of consumers were satisfied with their experiences, many consumers were unaware of their rights under the Fair and Accurate Credit Transactions Act (FACTA) before contacting a CRA. In response to concerns raised by consumers in the survey, the report recommends that (i) CRAs make it easier for consumers to reach a live person and (ii) the CFPB use its examination and rulemaking authority, and the FTC employ its enforcement authority, to address CRAs’ practice of attempting to sell identity theft products to consumers reporting identify thefts.

    CFPB FTC FACTA Privacy/Cyber Risk & Data Security

    Share page with AddThis

Pages