The Fair Credit Reporting Act (15 U.S.C. § 1681(c)), as amended by Section 113 of the Fair and Accurate Credit Transactions Act (the “Act”) mandates that “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last five digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.” The dispute in Natalie van Straaten v. Shell Oil Products Company LLC, Equilon Enterprises LLC, and Shell Oil Company involved Shell’s practice of printing on receipts at its gas pumps the last four digits of what Shell called the customer’s “account number” (which consisted of the first nine digits on a card face with 14 total digits). The Plaintiff argued that the Act required printing the final four numbers that were electronically encoded on the card’s magnetic stripe. In the card industry, numerical series electronically encoded on the card’s magnetic stripe is known as the primary account number (the “PAN”), consisting of 18 or 19 digits. In a decision rendered April 18, 2012, the Seventh Circuit held that the definition of the term “card number” in the Act is ambiguous and thus the plaintiff had not met her burden of establishing a willful violation of the Act. The court declined to fashion a definition of “card number,” finding that a precise definition was irrelevant given that Shell printed only 4 digits and thus complied with the Act’s general purpose of preventing identity theft: “the Act does its work by limiting the number of exposed digits, and Shell printed one fewer digit than the Act allows.”
As stated above, the court determined that “account number,” as used in the five digit limit requirement of the Act, did not mean the card industry’s PAN. PANs are encoded on a magnetic stripe or RFID chip. Although some credit and debit cards emboss these numbers on the front of the card, many do not. The court reasoned that the term “card number” may mean simply “number appearing on the card,” which would thus enable the merchant to print any of the digits on the card, provided only that it printed no more than five. In the end, the court found that whichever number was the “correct” one, Shell had complied because whichever Shell used, no identity theft could occur.
The court went on to conclude that Shell could not be held liable for a willful violation of the Act, the standard required for liability. The court cites Safeco Insurance Co. v. Burr, 551 U.S. 47 for the willful standard. In that decision, the Supreme Court held that where willful is a statutory condition of civil liability, it is generally taken to cover not only knowing violations, but reckless ones as well. Safeco, 551 U.S. at 51. Based on the common law standard for recklessness, the decision articulated that such conduct must entail “an unjustifiably high risk of harm that is either known or so obvious that it should be known” and a company thus “does not act in reckless disregard of the Act unless the action is not only a violation under a reasonable reading of the statute, but [a movant] shows that the company ran a risk of violating the law substantially greater than the risk associated with a reading that was merely careless.” Id. Consequently, the court in van Straaten held that the absence of a statutory or regulatory definition of the phrase “card number” and the fact that the four digits Shell printed on the receipts created no greater risk for its customers than printing the last four digits of the PAN, meant that Shell’s actions could not be deemed willful. The court’s determination that any violation was not willful thus mooted the court’s consideration of whether a violation had occurred.