Identity Theft Protection or Legal Extortion?

If you've ever examined your credit card receipts, you've probably noticed that your credit card number has been reduced to a series of Xs with no more than four or five digits visible, and no other identifying information, such as expiration date.

That is, unless you've shopped at Costco, FedEx Kinko's, Toys 'R Us, IKEA, StubHub, Coffee Bean Tea & Leaf, or Jewell Food Stores, eaten at big Burrito Group eateries such as Mad Mex, purchased flowers at 1-800-FLOWERS or watched a movie at AMC Theaters.

These companies, among many others, have been targeted with class action lawsuits for violating a 16-month federal law designed to protect consumers' credit card information. The Fair and Accurate Credit Transaction Act (FACTA) prohibits companies from printing more than five digits of a credit card number or the expiration date on receipts to reduce the threat of identity theft.

Lawsuits have been flooding the legal system as consumers strike back against what they say is flagrant unresponsiveness to the FACTA statute. More than 300 class actions have been filed since the law went into effect in December 2006.

At stake is the livelihood of businesses across the country, from big box retailers and restaurants to small businesses such as parking garages and newsstands. With every noncompliant receipt assessed at anywhere from $100 to $1,000, companies are facing potential damages in the billions of dollars. The lawsuits are so financially damaging that retailers are threatening to file bankruptcy.

At issue is the fact that the plaintiffs don't need to demonstrate any real or actual damage caused by the violation or even that the companies had willful intent to cause harm. All they need is a receipt to claim statutory damages because a company has "flouted the law." Warehouse-club giant Costco is liable for as much as $17 billion – 15 times the company's 2007 profit – despite the fact that there are no claims of actual harm.

"In 22 years, I have never had a plaintiff sit across the table from me and say, 'I have no damages. My identity hasn't been stolen. I'm just bringing this lawsuit because I can,'" said David Block, a lawyer with Jackson Lewis, in a recent Law.com article. "There's something inherently wrong with a lawsuit where the plaintiff has no injury."

Defense lawyers are characterizing the lawsuits as "legal extortion," since the defendants did not profit from the infraction and plaintiffs have not shown evidence of actual harm. And some judges are paying attention – 12 have refused to certify some of these cases as class actions.

Many companies facing massive damage claims are quietly settling. Earlier this year, a class action lawsuit against big Burrito Group eateries was settled for FACTA violations. According to the settlement, customers who used a credit or debit card at various times at various big Burrito Group eateries last year are entitled to a $7 "settlement relief card." The cards can be used only at the company's Mad Mex restaurants under various restrictions. The settlement also calls for the company to pay for $105,000 in legal fees. Coffee Bean Tea & Leaf agreed to give customers free drinks and pay plaintiffs' lawyer fees. StubHub settled for undisclosed terms.

Should companies be compliant with the law? Heck yes. Should they be punished to the full extent of the law? Well, that depends. Bankrupting businesses or imposing maximum financial penalties will ultimately have a lasting negative impact on the quality and price of retail and online services. What price are we willing to pay to punish companies that were slow to comply with the law?