Defendants who "willfully" violate FCRA are subject to significant statutory damages of $100 to $1,000 for every instance of violation, as well as punitive damages. Safeco involved notice obligations to consumers regarding adverse action based on consumer reports, but the relevant provision of FCRA - §1681n(a) - imposes penalties for violation of other provisions of the statute, including the FACTA amendments mandating credit card truncation. Unfortunately, after Safeco, the boundaries of what constitutes "willful" remain unclear.
Safeco Insurance Co. and GEICO were involved in separate suits, both in the Ninth Circuit, that were consolidated to resolve a Circuit split as to whether Section 1681n(a) reaches "reckless disregard." The Ninth Circuit held that a defendant "willfully" fails to comply with FCRA if it acts with "reckless disregard" of a consumer’s rights.
The high Court was quick to point out that "willfully" is a "‘word of many meanings whose construction is often dependent on the context in which it appears’" (quoting Bryan v. United States, 524 U.S. 184, 191 (1998) (internal quotation marks omitted)). Although the Court did not furnish a clear-cut definition, it confirmed that reckless disregard - or "action entailing ‘an unjustifiably high risk of harm that is either known or so obvious that it should be known’" - can be considered willful. The defendant’s actions must be objectively unreasonable. "[A] company subject to FCRA does not act in reckless disregard of it unless the action is not only a violation under a reasonable reading of the statute’s terms, but shows that the company ran a risk of violating the law substantially greater than the risk associated with a reading that was merely careless." The Court did not find it necessary to identify the "negligence/recklessness line." However, it is clear that a defendant need not have actual knowledge of a violation to be found to have willfully violated the statute.
Both the Safeco and GEICO cases stemmed from an insurance company’s notice obligations to certain customers under Section 1681m. Under that provision, companies must inform a customer if "adverse action" is taken based in whole or in part on information contained in the customer’s consumer report. Since the initial rate offered by GEICO to the plaintiff/respondent was the one he would have received if his credit score had not been taken into account, the Court determined that GEICO had not violated the statute at all, let alone willfully. The Court found that Safeco Insurance Co. did violate FCRA by failing to notify certain individuals based on its erroneous determination that the statute did not apply to initial insurance applications.
However, the Court ruled that Safeco’s conduct fell short of action with "unjustifiably high risk" of violating the statute. Its interpretation of the statute, while "erroneous, was not objectively unreasonable," because Safeco’s position had a "foundation in the statutory text." Invoking authority holding that the determination of reasonableness for qualified immunity purposes is guided by legal rules that were "clearly established" at the time, the Court also acknowledged that, "[b]efore these cases, no court of appeals had spoken on the issue, and no authoritative guidance has yet come from" the Federal Trade Commission. The Court did not address the question of whether good-faith reliance on legal advice should render companies immune to claims under Section 1681n(a), but did "not foreclose the possibility."
Safeco’s Implications
The impact of this decision extends far beyond notification of adverse actions taken by insurance companies. Currently pending are the dozens of FACTA class action lawsuits alleging willful violations of FACTA’S prohibition on printing more than five digits, or the expiration date, of a credit card on receipts provided to the customer. It remains to be seen how those courts will apply the rule enunciated in Safeco. However, given (a) the dearth of legal authority or guidance on the proper interpretation of the FACTA provision at issue in those cases, Section 1681c(g) - a provision that did not even go into full effect until December 4, 2006; (b) the lack of any apparent connection between the printing of an expiration date and the risk of identity theft; and (c) the large number of businesses that plaintiffs have accused of violating the language of the statute, there exists ample ground for a court to find that a retailer’s decision to continue printing expiration dates on receipts after FACTA was not objectively unreasonable.
