Privacy Law Blog : Privacy Lawyers & Attorneys : Proskauer Rose Law Firm : CAN-SPAM, FCRA, FACTA

Fifteen states and the District of Columbia have laws that place restrictions on a retailer’s collection of personal information when a customer pays with a credit card. (A number of states also restrict the collection of personal information when a customer pays by check, but who uses checks anymore?) Of these states with credit card laws, eight states’ statutes broadly restrict the collection of personal information, although some of them contain a variety of conditions of applicability and exceptions. California’s Song-Beverly Act, the most litigated of these laws, has even been interpreted by a court to prevent a retailer from collecting a ZIP Code under most circumstances. The remainder of states have more limited restrictions, such as on the collection of addresses, which nonetheless could apply to electronic receipts if a state court or attorney general interprets “address” expansively to encompass an email address. Notably, some states have exceptions that allow the collection of personal information under certain circumstances, such as when the collection is required “for a special purpose incidental but related to the individual credit card transaction,” which may be broad enough to encompass electronic receipts.

The penalties for violations of these statutes vary. For instance, California’s statute provides for a liability cap of $250 per violation for a first violation of its statute and a $1,000 per violation cap for each subsequent violation. If class action status is sought, potentially crippling liability exposure can accrue overnight. While most states treat improper data collection as a civil matter, Delaware, for instance, treats a violation of its data collection law as a misdemeanor. To our north, the offering of electronic receipts has already caught the attention of Canada’s Office of the Privacy Commissioner, which notes that under Canadian law, customers should be informed about how their email addresses will be used.

Thus, because of the potential liabilities and new technology that is quickly catching the eyes of class action plaintiff lawyers and regulators, retailers considering offering electronic receipts would be well-advised to consider state laws before implementing an electronic receipt option. By taking these laws into consideration in advance, electronic receipt programs can be designed to comply with these laws in at least most states.  Such consideration and appropriate planning may help avoid significant legal and financial liabilities under state laws.

On June 26, 2008, in Absher v. Autozone, Inc. et al. (2008), the California Court of Appeal in the Second Appellate District, confirmed that California’s Song-Beverly Credit Card Act of 1971, California Civil Code § 1747.08 (hereinafter, the “Act”) does not apply to a refund for the return of merchandise purchased by credit card.

Under the Act, merchants who accept credit cards as a form of payment may not request or require as a condition to accepting payment by credit card the personal information of a cardholder, which information the merchant causes to be recorded upon a credit card transaction form or otherwise (such as a receipt, etc.). 

In the Absher case, plaintiff Dave Absher (who, when returning merchandise purchased from Autozone, was required to put his name and telephone number on a voucher in order to process the refund), claimed that Autozone’s practices violated the Act. In the trial court, Autozone moved for summary judgment arguing that the statute does not apply to return transactions. The trial court granted Autozone’s motion and the Court of Appeal affirmed the dismissal of plaintiff’s cause of action, holding that the Act’s restrictions are limited to initial purchase transactions and not return transactions. In particular, the court held that the legislative history behind the Act, as well as a policy interest in providing retailers with a reasonable means to safeguard against potential abuses in connection with the return of merchandise, weighed in favor of its interpretation that the Act does not apply where a merchant’s request for personal information is in connection with a refund for the return of merchandise purchased by credit card.

The outcome in this most recent case is not surprising given the court’s other recent decision, on May 22, 2008, which case involved The TJX Companies, Inc., T.J. Maxx of CA, LLC, Marshalls of CA, LLC, Marshalls of MA, Inc. and Marmaxx (collectively, “TJX”), and in which case the California Court of Appeal also narrowed the scope of claims available under the Act in ruling that the statute does not apply to merchandise returns.

Kathryn Conroy, a Summer Associated in Proskauer’s Los Angeles office, contributed to this post.

As discussed here last year , the Supreme Court ruled in Safeco Insurance Co. of America, et al. v. Burr, et al that reckless disregard of the requirements of FCRA can constitute willful violation.  The court left open the question of whether it was objectively reasonable for merchants to continue to print expiration dates on customer receipts after the date for compliance with FACTA had passed. 

In response to the widespread FACTA litigation, Congress amended FCRA to prevent certain putative consumer class actions. The “Credit and Debit Card Receipt Clarification Act of 2007” (“the Act”), signed by President Bush on June 3, amends FCRA to specify that printing expiration dates on receipts where the account number is otherwise properly truncated does not in and of itself constitute willful noncompliance.  Consumers will not be entitled to pursue suits claiming willful violation, and thus not be entitled to seek statutory damages, merely because an expiration date is printed on an otherwise compliant receipt.  The Act does not affect negligence suits filed by consumers who can show actual harm as a result of the printing of the expiration date, or suits against merchants who are otherwise not in compliance with FACTA’s requirements.  The Act applies to any company that printed an expiration date on any receipt provided to a consumer cardholder at a point of sale or transaction between December 4, 2004, and the date of the enactment. 

Proskauer summer associate Nicole Ross contributed to this post.