August 2008 Issue
Among the eight years of words and deeds comprising George W. Bush's presidential legacy, a new law clarifying the rules for printing payment card information on customer receipts likely will slip quickly through the sieve of history, pushed out by weightier issues.
But while policy wonks and historians debate the wisdom of Bush's policies on energy, the environment and Iraq, payment-systems managers at retailers being sued for printing card-expiration dates on customer receipts will mark June 3, 2008, as the day the president gave them a break.
That is when the president signed into law the Credit and Debit Card Receipt Clarification Act of 2007. The law says that merchants who printed card-expiration dates on customer receipts between Dec. 4, 2004, and June 3, 2008, did not willfully violate the federal Fair and Accurate Credit Transactions Act. The act bans merchants from printing expiration dates on customer receipts and requires them to truncate all but the last five digits of card-account numbers.
The clarification effectively killed dozens of lawsuits around the country because statutory damages only apply to willful FACTA violations.
"It's a get-out-of-jail-free card for merchants," says Bart Murphy, a partner at Ice Miller LLP, an Indianapolis-based law firm that has defended six merchants facing litigation for posting expiration dates on receipts.
Plaintiffs' attorneys suing retailers for receipt-printing rule infringements agree with that assessment. "You're seeing a bunch of expiration-date cases being dismissed across the country," says Daniel Lynch, a Chicago lawyer who dropped his own clients' suit against Jewel Food Stores Inc. because of the new law.
While the clarification law provides amnesty for merchants who had previously misinterpreted
FACTA statutes, it leaves little legal maneuvering room for merchants who print too much information on customer receipts in the future.
The new law does limit merchants' immunity from litigation. The clarification act, which the U.S. House and Senate passed in May, does not exempt merchants who failed to truncate credit or debit card numbers on receipts during those 42 months. Moreover, merchants that print expiration dates on customer receipts after June 3 are not exempt.
In 2003, lawmakers added the Fair and Accurate Credit Transactions Act as an amendment to the Fair Credit Reporting Act. FACTA, as the amendment is called, did not require point-of-sale software and equipment to comply until Dec. 4, 2006, to give merchants time to upgrade or replace noncompliant See chart.
"As soon as the law went into effect, the lawsuits started coming in," says Scott Vinson, vice president of the National Council of Chain Restaurants, a division of the National Retail Federation that has some 60 members. "I had over a dozen members whose companies were being sued."
Violators face statutory damages that range from $100 to $1,000 per violation.
In May, the federation estimated some 300 lawsuits had been filed across the country, most of them against merchants that properly truncated card numbers but printed expiration dates. By then, Vinson was one of several lobbyists and attorneys arguing in court and to lawmakers that the law, as written, was vague on expiration dates.
The debate hinged on differing interpretations of the word "or" in the statute's edict that no person
"... shall print more than the last five digits of the card number or the expiration date upon any receipt provided to the cardholder... ." The law exempts handwritten receipts and those created by nonelectronic devices that capture carbon imprints of card faces.
Difference Of Opinion
Consumer-privacy advocates argued that the statute's intent was clear: Do not print the full number and do not print the expiration date. Merchant advocates interpreted that phrase as meaning they could choose either to truncate the payment card number or omit the expiration date, but they could not print both at the same time, according to their attorneys.
Representatives of the National Retail Federation maintain that including expiration dates on receipts does not harm consumers. "Once the (card-account) number is truncated, it doesn't matter if you print the expiration date itself because the expiration date is of no value," says Craig Shearman, federation vice president of government affairs. Conversely, a full card number printed on a receipt is of no use to a thief without an expiration date, he adds.
Consumer-privacy advocates disagree that failing to truncate card numbers on consumer receipts is an innocuous mistake, especially if other receipts carry expiration dates. "It is absurd to claim that a full credit card number does not create a vulnerability. Together with an expiration date, you have a card," says Ed Mierzwinski, consumer program director of the U.S. Public Interest Research Group.
Mierzwinski considers the Credit and Debit Card Receipt Clarification Act of 2007 an overreaction by Congress to the lawsuits. "While some lawsuits may have been frivolous, they could have been handled under frivolous-lawsuit rules, not by reducing incentives to comply with identity-theft laws," Mierzwinski says. "Of course, FACTA itself is deficient since it only limits printing on the consumer receipt. Identity thieves working in concert with employees could commit fraud with the merchant copy."
But Shearman says the federation welcomes the Credit and Debit Card Receipt Clarification Act of 2007 as "a technical correction that recognized retailers had complied with the intent of the law if not the exact letter and that the law was ambiguous."
The wording of FACTA's receipt-printing provisions remains the same. But the FTC issued a business alert in May 2007 stating that the requirement means merchants should truncate all but the last five digits of card numbers and should suppress expiration dates. Months of subsequent publicity and a corrective law have left little room for merchants, payment systems vendors or their attorneys to interpret the statute otherwise.
As an attorney defending merchants against lawsuits related to FACTA violations, Ice Miller's Murphy says he disagrees with the structure of penalties for improper receipt printing. "It's not as though someone is skirting the law for their own economic advantage," he says. "It's merely a remnant of how business was done until very recently, and point-of-sale systems are catching up."
Murphy points to Cowley et al v. Burger King, filed in July 2007 in U.S. District Court in Miami. Burger King's payment terminals had been properly printing only the last five digits of card numbers and suppressing expiration dates on customer receipts. But when a third-party vendor performed some work on Burger King's point-of-sale software, the vendor accidentally changed the code and receipts started printing expiration dates. The parties settled the case in May.
Instead of subjecting merchants to class-action lawsuits that could hit merchants with up to $1,000 per violation, Murphy says a more-appropriate punishment would be an initial warning from the Federal Trade Commission. "If the merchant does not correct the situation, then the severe penalties the Fair Credit Reporting Act imposes might be warranted," Murphy says.
Lynch disagrees. "Throughout federal law, there's any number of statues that provide civil penalties where you can't prove damages," he says. "It's a time-honored way for the court to get its way when the government decides it wants to [promote] certain behavior."
Most of the parties in the lawsuits Lynch had brought against merchants by May 2007 have since been settled for various reasons he would not disclose. But Lynch is pressing on with his clients' case against Standard Parking for printing the first four and last four digits of card numbers on receipts for customers at Chicago-area parking lots.
Lynch has little patience for merchants who know about the receipt-truncation law but do not change their point-of-sale systems until forced to do so by litigation. "I've had cases where there's been three or four complaints and nothing has changed," he says.
But Lynch sympathizes with merchants whose acquirers and point-of-sale equipment and software vendors have not informed them of FACTA rules and did not help them comply.
"What's goofy is that when Congress came up with this, (the lawmakers) imposed liability on the merchants," he says. "How are they supposed to know about this? It surprises me from a public-policy standpoint that this liability doesn't fall on the processors because they're the ones that could institute these changes so you'd never see expiration dates again."
Indeed, many merchants sued for improperly printing card data on receipts have filed their own lawsuits against point-of-sale equipment and services vendors, even though those vendors had limited-liability contracts with the retailers, Lynch notes.
Despite the publicity in the payments and merchant circles, along with spotty reporting in consumer media about receipt-printing rules, Lynch continues to encounter improperly printed receipts with his own transactions as a consumer. In those cases, Lynch asks for a manager and explains the mistake.
"I get a variety of reactions," he says. "The usual reaction is suspicion."
Once managers get over the message that a customer says the store is doing something illegal, some, but not all, welcome unsolicited information about the law, Lynch says. "With businesses I frequent and know on a more personal level, (such as) my dry cleaner or the grocery store, when I bring it up, I get a kinder reception," he says.
Ice Miller's Murphy encounters his share of receipt-printing infractions, too. "Most merchants have caught up with it," he says. "But I was out for pizza with my family, and when I paid for it with my credit card and got the receipt back, there was my credit card number. I was shocked."
Vinson says he also encounters merchants–mostly small, independent retailers–that are unaware they are out of compliance. The National Council of Chain Restaurants has been trying to educate its members about the law, as has the organization's parent, the National Retail Federation, he adds.
"I would hope that the Federal Trade Commission would also try to get the word out because this affects every single merchant in the United States, and the potential for liability is huge," Vinson says.
Despite such sympathy even from some plaintiffs' attorneys, merchants printing expiration dates or more than the last five digits of card numbers on consumer receipts likely will not get another clarification act to bail them out of court. CP