Court documents filed July 6 allege that Laboratory Corporation of America Holdings (LabCorp) violated the Fair and Accurate Credit Transactions Act (FACTA) by including information on its credit card receipts that expose its customers to increased risk of identity theft. The class action suit, filed in the Southern District of Florida, is seeking statutory and punitive damages, injunctive relief, attorneys’ fees, and litigation expenses.
Statutory damages under FACTA include a minimum $100 and can reach $1,000 per violation even if the victim incurs no actual injury. The statute requires willful violations of FACTA. The complaint alleges that is the case here and provides a variety of allegations that attempt to prove that, including the fact that LabCorp complied with the redaction of credit card numbers required under the statute indicating it was aware of the provisions of the law, according to the complaint. LabCorp also engaged the services of an international law firm that allegedly advised it regarding FACTA requirements related to identity theft. The law has been in effect since 2006, but businesses had until 2009 to comply.
According to the court documents, lead plaintiff Christopher Legg alleges that he received services from a LabCorp facility and paid with a credit card. At the point of service he received a printed receipt that included the expiration date for his credit card. Including the expiration date on a printed receipt for a credit or debit card transaction is specifically prohibited by FACTA, which states that “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last five digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.” According to the complaint, despite the clear language of the statute, LabCorp willfully chose not to comply with the requirements of the law and exposed all customers who paid with a credit or debit card to increased risk of identity theft. The complaint says that all such customers are entitled to an award of statutory damages.
FACTA Can Be Burdensome and Risky
These kinds of lawsuits happen to the full gamut of businesses, from a small mom-and-pop business to very large national corporations. The risks associated with not complying with a law like FACTA increase almost daily because of media reports about identity theft and even advertisements for companies that can help an individual avoid problems. In many cases, the violation or problem identified is something that occurs to many people rather than a few because these problems tend to be systematic. Many cases end up as class actions, and this case represents just such a situation.
The class in the LabCorp case is defined in the complaint as:
(i) All persons in the United States (ii) who, when making payment to LabCorp, (iii) made such payment using a credit or debit card, (iv) and within the five (5) years prior to the filing of the complaint (v) were provided with a receipt of the payment (vi) which displayed the expiration date of said credit or debit card.
Depending on the number of credit or debit card transactions, a suit like this can cost a company a lot of money and create a lot of headaches. Labs should monitor this case and they should review their own policies and procedures if they accept payment for services with credit or debit cards.
Takeaway: Any laboratory that allows payment for its services with credit or debit cards should become familiar with the provisions of FACTA or face potentially significant monetary penalties should they violate its provisions.