FACTA

August 2017

Another Court Rules No Harm In Unredacted Zip Codes

O’Shea v. P.C. Richard
Dismissed – P.C. Richard allegedly printed full expiration dates on a credit card receipts. The court found plaintiffs failed to allege their identities had been stolen, or they had been victims of credit card fraud. The allegations of increased risk were insufficient to constitute a concrete harm.

The court declined to consider the “other things” plaintiffs alleged were printed on the receipt, since the printing of the “other things” (brand of card, last four digits of card number, full name, physical address, telephone number, and email) were not proscribed by FACTA.
[S.D. N.Y.; 2:15-cv-09069]
jbho: the court heavily referenced Cruper-Weinmann v. Paris Baguette (2nd. Circ; 14-3709 [Orig: S.D. N.Y.; 1:13-cv-07013]) in its analysis, where the court found a printed expiration date did not raise a material risk of identity theft. 

 

July 2017

Another Receipt Case In South Florida

Gesten v. Burger King
Class complaint – Burger King allegedly printed the first six and last four digits of plaintiff’s credit card on an in store receipt. Plaintiff claimed the receipt also identified his card as a debit card. Plaintiff further alleged Burger King has been previously sued for FACTA violations, and should have known better than to print the extraneous information on its receipts.
[S.D. FL; 1:17-cv-22541]
jbho: given the success rate of receipt printing cases in the 11th, anyone doing business there would be wise to update their registers to print at most the last five digits of a card number (and hide/mask expiration dates as well).

May 2017

Printing Unredacted Expiration Date & Payment Card Type Leads To Class Claims

Romero v. Darden Restaurants
Class complaint – Darden allegedly printed the expiration date and type of payment card on a receipt at a Bahama Breeze restaurant. The receipt allegedly identified plaintiff paid with a debit card. Plaintiff further alleged the (prohibited) information was printed despite the fact Darden was contractually prohibited from doing so, and had previously been sued for similar violations (e.g., violations were willful).

UPDATE: 1Aug2017 – The case was jointly dismissed without explanation (Doc #24)

[S.D. FL; 0:17-cv-61098]
jbho: the complaint doesn’t appear to plead any harms. However, other plaintiffs have had success in the 11th on similar claims. Remember both FACTA and card brand rules only permit the last five digits of a card number to be displayed.

Statutory Damages Don’t Automatically Confer Standing

Katz v. Donna Karan
Dismissed – Donna Karan allegedly printed the first six and last four digits of plaintiff’s credit card on in-store receipts from at least two locations.

The court found plaintiff failed to allege any harm, imminent or otherwise (no loss, no protective measures taken, no allegation anyone saw the receipt). On plaintiff’s claim the statutory damages under FCRA/FACTA automatically conferred Article III standing, the court found that while a procedural violation may constitute a concrete harm (e.g., risk of identity theft – the congressionally proscribed harm), plaintiff failed to allege any imminent risk resulting from Donna Karan’s alleged procedural violation. Under Spokeo, the availability of statutory damages, without any injury, did not automatically confer standing.
[S.D. N.Y; 1:14-cv-00740]
jbho: yet again, no disclosure, no harm

Interestingly, the court also noted that FACTA did not necessarily create a privacy right. The congressional intent was the security of consumer identities.

April 2017


$0.86 Receipt Case Eighty-Sixed Under Spokeo

eighty-six

Hendrick v. Aramark
Dismissed – Plaintiff purchased a soda, and Aramark allegedly displayed 10 credit card digits on his printed receipt, rather than the statutorily permitted ‘last five.’ The court found plaintiff alleged only an increased risk of harm, but no injury. The receipt remained in his possession, and there was no allegation anyone else saw the receipt. Nor did he allege any attempt to use or access his credit information. Thus, the allegations of increased risk were insufficient to meet the concreteness standard.
[E.D. PA; 2:16-cv-04069]
jbho: another case of no disclosure, no harm.

No Harm In Unredacted Expiration Date

Weinstein v. Intermountain
Dismissed – Intermountain Park City Clinic allegedly printed a full expiration date on a credit card receipt. The court found plaintiff failed to allege (i) the receipt was seen by or in the possession of another party, (ii) that he was a victim of fraud or identity theft as a result of the disclosure, or (iii) that he had taken a steps to protect himself as a result. Thus the “bare procedural violation” did not provide plaintiff standing, and claims were dismissed with prejudice.
[D. UT; 2:16-cv-00280]
jbho: once again, no disclosure, no harm.

Beefed Up FACTA Complaint

Gennock v. Kirkland
Class complaint – Kirkland allegedly printed the first six and last four digits of plaintiffs’ credit cards on in-store receipts. Plaintiffs claim since not all receipts are in their possession, they are at increased risk of identity theft and credit card fraud.
[W.D. PA; 2:17-cv-00454]
jbho: appears complaints are evolving to address the recent trend of no disclosure, no harm in FACTA cases.

Class Claims Extra Digits Printed In Two Ways

Fernandez v. University of California
Class complaint – UCLA allegedly printed more than the permitted last five digits of her credit card number on paper receipts. Plaintiff seeks to represent two classes:
• People with cafeteria receipts that displayed the first six and last four digits
• People with campus store receipts that displayed the first digit and last four digits
[L.A. Co. Super. Ct.; BC656256]
jbho: as these cases get dismissed in federal court, there seems to be an uptick in filings at the state level. A reminder that Spokeo doesn’t make cases go away, it just keeps them out of federal court.

March 2017

Whopping $31 Million For Unmasked Credit Card Expiration Dates

Flaum v. Doctor’s Associates
Preliminary $31M settlement – Subway Franchises owned by Doctor’s Associates allegedly printed unmasked expiration dates on credit card receipts. Highlights include:
• $30,900,000 non-reversionary settlement fund
• ~ $130 for each class member (estimated)
• $20,000 for lead class representative, $10,000 for supporting class representative
• $10.3 million for class counsel (requested – 1/3 of settlement fund)
Final Approval Hearing is set for 11 October 2017
[S.D. FL; 0:16-cv-61198]
jbho: a follow up on a previously covered case. Same as below, remember both FACTA and card brand rules require expiration dates to be masked.

According to the motion, the $31 settlement would be “the largest all-cash FACTA settlements … a new record for FACTA class actions.” Certainly the largest I’ve seen (so far…)

$1.2 Million Credit Card Truncation Settlement

Guarisma v. Microsoft
$1.2M preliminary settlement – Microsoft allegedly printed the first six and last four digits of plaintiff’s credit card number on his in-store receipt. Highlights include:
• $1,194,696 non-reversionary settlement fund
• up to $100 for each class member (expected)
• $10,000 for class representative (requested)
• $398,232 for class counsel (requested – 1/3 of settlement fund)
[S.D. FL; 1:15-cv-24326]
jbho: reminder that both FACTA and card brand rules only permit the last five digits to be displayed.

No Disclosure, No Harm

Paci v. Costco
Dismissed – Costco allegedly printed the first six digits of plaintiff’s credit card on a copy of her in-store receipt, a copy produced by Costco’s customer service desk. The court found plaintiff failed to allege any risk of identity theft (the receipt never left her care), or that a change in her normal receipt-handling routine (having to store the receipt in a filing cabinet) caused her any expense or emotional distress.
[N.D Ill.; 1:16-cv-00094]
jbho: another case that seems to follow the emerging model of no disclosure, no concrete harm.

January 2017

$2.5 Million For Unmasked Credit Card Expiration Dates

Wood v. J Choo
$2.5M preliminary settlement – Jimmy Choo allegedly printed unmasked expiration dates on in-store credit card receipts. Highlights include:
• $2,500,000 non-reversionary settlement fund
• $75 – $175 for each class member (expected)
• $5,000 for class representative (requested)
• $150,000 for class administration (expected)
• $833,333.33 for class counsel (requested – 1/3 of settlement fund)
Unclaimed funds will revert to a cy pres distribution.
[S.D. FL; 9:15-cv-81487]
jbho: an update on a previously covered case, and a reminder that both FACTA and card brand rules require expiration dates to be masked. Although here, an aggravating factor may have been the inclusion of home address and telephone number on the receipt as well.

$0.00 For Unmasked Credit Card Expiration Dates

Cruper-Weinmann v. Paris Baguette
Dismissed with prejudice – Paris Baguette allegedly printed unmasked expiration dates on credit card receipts. The action was dismissed with prejudice in 2014 (pre-Spokeo), where the court found plaintiff failed to sufficiently plead Paris Baguette knowingly or recklessly violated the FACTA. On appeal, the 2nd Circuit vacated the dismissal, and instructed the lower court to re-evaluate plaintiff’s standing under Spokeo.

On remand, the court ruled plaintiff did not allege anyone saw or accessed her receipt, or that she was at an increased risk of identity theft. Thus inclusion of an unmasked expiration date was merely a procedural violation and there was no threat of concrete harm under the circumstances.

Update – 26June2017 – the decision was affirmed by the appellate court, determining a printed expiration date did not raise a material risk of identity theft. (2nd. Circ; 14‐3709)
[S.D. N.Y.; 1:13-cv-07013]
jbho: interesting in comparison to the J Choo case above. A circuit split? Or is Spokeo still working its way through the system?

Also of note, since the court found plaintiff suffered no concrete harm, it declined to address Paris Baguette’s larger argument that a failure to redact a card expiration date categorically does not subject consumers to increased risk of identity theft.

December 2016

Beware The Allure Of A Federal Forum

Mocek v. AllSaints
Attorney’s fees granted – AllSaints allegedly printed the first six and last four digits of plaintiff’s credit card number on her receipt. Plaintiff filed suit in Cook County court, and AllSaints moved to have the case removed to federal court. Upon removal, AllSaints filed a motion to dismiss for lack of subject matter jurisdiction (no concrete harm under Spokeo). Plaintiff countered with a motion to remand and a request for attorney’s fees.

The court found the case never belonged in federal court, and both parties’ motions agreed on this point. Therefore, as all were in agreement the federal court lacked subject matter jurisdiction, no Article III analysis was necessary, and a remand to state court was in order.

On plaintiff’s motion for attorney’s fees, the court found defendant’s strategy of asserting – then immediately disavowing – federal jurisdiction, unnecessarily prolonged the proceedings. With both sides arguing against federal jurisdiction, it should have been obvious to defendant the only possible outcome was a remand to state court. Therefore, defendant lacked an objectively reasonable basis for seeking removal, and plaintiff was entitled to recover the $58,112.50 in attorney’s fees incurred as a result of removal.
[N.D. Ill; 1:16-cv-08484]
jbho: Spokeo doesn’t make cases go away, it just keeps them out of federal court.

October 2016

No Harm Under Spokeo in the 8th Circuit

Thompson v. Rally House
Dismissed – Rally House allegedly printed the first six digits of plaintiff’s credit card number on a receipt issued at one of its retail stores. The court found that although this was a clear violation of the FACTA, this ‘bare procedural violation’ – under recently established precedent in the 8th Circuit – was insufficient for Article III standing. Plaintiff did not (and could not) allege his credit card information had been exposed or that he faced an imminent risk of identity theft. Nor had plaintiff claimed to have taken any measures to protect himself from the supposed risks. Thus plaintiff filed to demonstrate any concrete harm, and claims were dismissed for lack of subject matter jurisdiction.
[W.D. MO; 4:15-cv-00886]
jbho: interesting result in that two similar cases in S.D. FL recently settled for a collective $13.8 million:
• $6.3 million in Muransky v. Godiva (S.D.  FL; 0:15-cv-60716) for printing the first six and last four digits
• $7.5 million in Legg v. Spirit Airlines (S.D. FL;  0:14-cv-61978) for printing the first seven and last four digits (see below)
On the other hand, a nearly identical case in New Jersey was recently dismissed for failure to allege any concrete injuries from printing the first six digits (Kamal v. J. Crew; N.D. N. J.; 2:15-cv-00190).

Circuits remain split?

September 2016

$6.3M Credit Card Settlement

Muransky v. Godiva
Preliminary settlement – Godiva allegedly printed the first six digits of plaintiff’s credit card number on a receipt issued at one of Godiva’s retail stores. Highlights include:
• $6,300,000 non-reversionary settlement fund
• $60 for each class member
• $10,000 for class representative
• $2,100,000 for class counsel (1/3 of settlement fund)
[S.D. FL; 0:15-cv-60716]
jbho: make sure PoS programmers know this law…

August 2016

One Million For Each Extra Digit

Legg v. Spirit Airlines
$7.5 million settlement approved – Spirit allegedly displayed more than the statutorily permitted ‘last five’ digits of a credit card number on electronically printed receipts. Plaintiff paid a $45.00 dollar baggage fee at an automated kiosk at the Fort Lauderdale-Hollywood International Airport, and said the receipt printed the first seven and last four digits of his credit card number. Highlights include:
• non-reversionary $7,500,000 settlement fund
• ~ $265 for each class member
• $10,000 for class representatives
• $2.5 million for class counsel (35% of settlement fund)
• any unclaimed funds will be split equally between the Public Interest Research Group and The Sedona Conference.
[S.D. FL; 0:14-cv-61978]
jbho: make sure PoS programmers know this law…

Failure To Mask Expiration Dates Violates FACTA; Concrete Harm

Wood v. J Choo
Motion to dismiss denied – Jimmy Choo allegedly printed unmasked expiration dates on credit card receipts. The receipt also contained other sensitive information about Plaintiff, including her home address and telephone number. However, only the last four digits of her credit card number were displayed (as required by FACTA).

The court found the FACTA encompasses two separate truncation requirements: one for the credit card number, and one for the card expiration date (as codified in the Credit and Debit Card Receipt Clarification Act of 2007 [15 U.S.C. § 1681n(d)]).

The court also concluded that Congress created a substantive legal right for consumers, and Jimmy Choo’s willful failure* to protect their personal financial information through truncation constituted a concrete harm (under Spokeo), sufficient to confer standing.

* the record shows Jimmy Choo was previously sued for the FACTA violation in this case, and had been notified by major credit card companies of the same.
[S.D. FL; 15-cv-81487]
jbho: a reminder that both FACTA and card brand rules require expiration dates to be masked.

Failure To Mask Expiration Dates Concrete Harm

Flaum v. Doctor’s Associates
Motion to dismiss denied – Subway Franchises owned by Doctor’s Associates allegedly printed unmasked expiration dates on credit card receipts. The court found since FACTA created a substantive legal right to receive truncating receipts protecting consumers’ financial information, plaintiff personally suffered a concrete harm in receiving a receipt that violated the statute. Thus plaintiff sufficiently alleged an injury-in-fact, and the Court had subject-matter jurisdiction over this case.
[S.D. FL; 0:16-cv-61198]
jbho: a reminder that both FACTA and card brand rules require expiration dates to be masked. According to the Order, Doctor’s Associates had been sued four times previously for printing the full expiration dates of cards on its receipts.

A Correct Interpretation Of Spokeo?

Noble v. Nevada Checker Cab
Dismissed – Checker Cab allegedly printed the first number plus the last four numbers of Plaintiffs’ credit card numbers on receipts, rather than just the last five digits as permitted under the FACTA. Checker Cab argued the first number of a card is simply a code identifying the card company — information that it is lawful in word form — and was not the kind of private financial information FACTA was intended to protect. The court agreed and found the putative technical violation of the FACTA created no concrete harm. As plaintiff pled no actual injury resulting from the technical violation, plaintiff had no Article III standing to pursue claims under the FACTA.
[D. NV; 2:15-cv-02322]
jbho: reason prevails?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s