Businesses take note: Customers are becoming aware of their data privacy rights and are willing to sue to protect their rights. Recently, a Pennsylvania woman brought a class action lawsuit against Lifetime Brands, Inc. better known to you and me as the Cadillac of sewing machines called Pfaltzgraff. Ehrheart v. Lifetimebrands, Inc. 2007 WL 2141979 (E.D.Pa. July 20, 2007). The complaint, filed in the Federal Eastern District of Pennsylvania, alleges that Pfaltzgraff violated the Fair and Accurate Transaction Act of 2003, which requires retailers to conceal or at least not disclose credit card information on purchase receipts given to customers. Specifically, Section 605(c)(g) expressly requires that “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.” 15 U.S.C. § 1681(c)(g)(1). The Plaintiff in this case alleges that Pfaltzgraff gave her a receipt that included the consumer’s full credit card number and even printed the expiration date of the credit card.
Defendant Pfaltzgraff filed a traditional motion for summary judgment stating that Plaintiff lacked standing because the complaint failed to assert that Defendant acted willfully and that Plaintiff was not the victim of identity theft as a result of Defendant’s wrongful conduct. Defendant also argued that it was entitled to summary judgment because Plaintiff failed to allege that she suffered injury in fact. The Federal District Court correctly noted, however, that FACTA does not require that a plaintiff to suffer actual monetary damages in order to bring suit under the Act. The mere fact that a business violated the Act, such as printing more than the last five digits of her credit card or debit card number and/or printed the expiration date of her card, is sufficient to allege an injury under FACTA. Consequently, the Court held that the Plaintiff may be entitled to monetary damages.
So what is the Fair and Accurate Credit Transactions Act? FACTA is an amendment to the Fair Credit Reporting Act enacted in 2003 primarily to help the American public prevent identity theft. FACTA was also meant to protect businesses from having to comply with individual state laws. In truth, FACTA bars states from enacting stronger privacy laws than the Act allows. Most consumers are not aware of FACTA, but they are aware of the immediate benefits FACTA requires. For example, FACTA is best known by consumers for giving them the right to obtain one free credit report from each of the three major credit bureaus every 12 months. However, businesses need to be aware of FACTA because as noted in the Ehrheart decision, mere violation of the Act may give a consumer the right to file suit and seek monetary damages. Section 616, et. seq. outlines the civil liability for willful noncompliance and Section 617, et. seq., summarizes a business’ civil liability for negligent noncompliance.
Finally, business should take note that FACTA requires businesses and individuals to take suitable measures to dispose of an individual’s personal sensitive information derived from consumer reports. Therefore, businesses that use consumer reports for business purposes are subject to the FACTA Disposal Rule. Please note that the Disposal Rule applies to consumer reports and the information derived from consumer reports. The Federal Trade Commission considers consumer reports to include “information obtained from a consumer reporting company that is used, or expected to be used, in establishing a consumer’s eligibility for credit, employment, or insurance, among other purposes.” The Disposal Rule not only applies to credit reports, but also includes credit scores, reports businesses obtain regarding employment background, check writing history, insurance claims, residential or tenant history or medical history. Therefore, the Disposal Rule is broad in nature and businesses should be aware whether FACTA applies to the internal operations as well as the external business itself.