Opinion
09 C 1188.
September 26, 2011
MEMORANDUM AND ORDER
In 1950, Diners Club issued its first credit cards, crafted from cardboard, so diners could charge meals in 27 restaurants in New York City. One year later, nearly 20,000 Americans had a Diners Club card. In 1958, American Express and BankAmericard (now Visa) created credit cards that rapidly gained acceptance as the words "charge it!" became part of the American lexicon. See M.J. Stephey, A Brief History of: Credit Cards, TIME, Apr. 2009, available at http://www.time.com/time/magazine/article/0,9171,1893507,00.html (last visited Sept. 26, 2011).
The ease and convenience of signing for purchases made on credit, however, had negative repercussions that likely were not contemplated back in the 1950s. Specifically, after credit card identity theft based on misappropriated credit card information became an unfortunate reality for many Americans, the Fair and Accurate Credit Transactions Act ("FACTA"), 15 U.S.C. § 1681c(g), was enacted. Among other things, FACTA prohibits merchants from printing the expiration date or more than the last five digits of a credit or debit card number on electronically printed receipts provided at the point of sale.
In this case, plaintiff Natalie Van Straaten seeks to represent a class of consumers who used Shell's proprietary credit and debit cards at Shell gas stations. Ms. Van Straaten contends that Shell Oil Products Company, Equilon, and Shell Oil (collectively Shell) improperly truncated the digits on Shell's payment cards by masking the wrong digits on the receipt. Shell's motion for summary judgment is before the court. For the following reasons, Shell's motion is denied.
I. Background
The following facts are undisputed unless otherwise noted.
A. The Magnetic Stripe
Credit and debit card transactions are overwhelmingly processed electronically. Electronic processing uses electronically encrypted data in the magnetic stripe on the back of a payment card, as opposed to the numbers that are embossed on the front of the card. International standards promulgated by the International Organization for Standardization and the International Electrotechnical Commission govern, among other things, the data contained in the magnetic stripe. The information in the magnetic stripe allows electronic point of sale terminals to read data and process transactions after a card is swiped. Thus, when a consumer uses a card, the data in the magnetic stripe is transmitted to an intermediate institution and then to the cardholder's bank, after which an electronic signal approving or rejecting the transaction is sent back to the merchant's point of sale terminal.
International standards mandate that every payment card's magnetic stripe must contain a series of digits called the primary account number, or PAN. The PAN consists of account and other numbers that are prescribed by international standards and recognized throughout the payment card industry. It consists of a maximum of 19 digits, and includes digits identifying the industry associated with the card, the card holder, and the card issuer. The following diagram illustrates the composition of the PAN:
Exhibit
ISO/IEC standard 7812-1, attached as Ex. C to the plaintiff's statement of facts.
For example, the PAN for a financial institution card such as Visa or MasterCard starts with a 5, a travel and entertainment card such as American Express starts with a 3, and a petroleum industry card starts with a 7. The PAN also contains digits constituting the "individual account identification" for the card holder. Next, the PAN contains a "check digit" that acts as an anti-fraud measure and is a number derived from an algorithm known as the "Luhn formula." See Joe Celko, Joe Celko's Thinking in Sets: Auxiliary, Temporal, and Virtual Tables in SQL § 8.3.3 (2008). The PAN may also include digits indicating the specific card issued to an account that has multiple cards (ex: Jane and John Doe's cards associated with their joint account may contain digits that indicate whether the card is Jane's or John's).
B. Numbers Embossed on the Front of a Payment Card
Because digits embossed on the front of a payment card are irrelevant to electronic processing, which relies on the data in the magnetic stripe, there are no international standards governing which numbers should be embossed onto the front of a payment card. As a general rule, the numbers embossed on the front of the card correspond to data in the magnetic stripe, as none of the data in the stripe (the PAN and other information) is visible to the naked eye.
Each type of card (Visa, MasterCard, etc.) has all or a part of the PAN embossed onto the front of the card. To the extent that PAN digits are omitted from the front of a card, those omitted digits are not at the end of the PAN. To illustrate, assume that the PAN for hypothetical payment card Z contains 18 digits. The front of that card has the last 15 of those digits embossed on its face, which means that the last five digits of the PAN and the last five digits on the front of the payment card are identical:
PAN = 1 2 3 4 5 6 7 8 9 A B C D E F G H I
Face of the card = 4 5 6 7 8 9 A B C D E F G H I
C. Shell Payment Cards
With respect to Shell payment cards, the system governing the arrangement and labeling of the numbers embossed on the front was designed more than 50 years ago by a Shell employee whose name has been lost to the ages. The numbers embossed on the front are taken from the PAN. The digits are arranged in two groups labeled "account number" (on the left) and "card number" (on the right):
Graph
Dkt. No. 85, Page ID#536. Each number has a designated significance.
The method Shell used to select the digits comprising Shell's so-called "card number" causes many of its payment cards to have the same digits in the area of the card designated as the "card number." According to Shell, this duplication (as opposed to the more unique sequence of digits in the "account number" section of a Shell payment card) makes it difficult for a merchant to use digits from Shell's "card number" to cross-reference receipts and other documents when performing returns, refunds, and chargebacks.
D. Electronically Printed Receipts and Masking
1. Pre-FACTA
The software controlling electronic processing of credit and debit card transactions dictates which PAN digits will be printed on the receipt. When electronic processing started, receipts contained the entire PAN, the card's expiration date, and the cardholder's name. This made things easy for identity thieves. To combat the growing problem of identify theft, Visa, by contract with its merchants, began to require the software to mask all but the last four digits of the PAN.
Turning back to hypothetical payment card Z, which has an 18-digit PAN with the last 15 digits of the PAN embossed on its face, the PAN, face of the card, and the electronically printed receipt issued following Visa's protocol are as follows:
PAN = 1 2 3 4 5 6 7 8 9 A B C D E F G H I
Face of the card = 4 5 6 7 8 9 A B C D E F G H I
Receipt = X X X X X X X X X X X F G H I
Due to Visa's size, its PAN masking protocol became the unofficial standard. In the meantime, states passed their own masking statutes to fight identity theft. These statutes often contained inconsistent terms. Eventually, Congress enacted FACTA in an effort to wipe out the patchwork of conflicting state laws and protect consumer credit information.
2. FACTA
The masking provisions in FACTA provide that:
(g) Truncation of credit card and debit card numbers
(1) In general
Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.
(2) Limitation
This subsection shall apply only to receipts that are electronically printed, and shall not apply to transactions in which the sole means of recording a credit card or debit card account number is by handwriting or by an imprint or copy of the card.15 U.S.C.A. § 1681c(g) (emphasis added).
3. Shell's Masking Protocol
Shell designed its masking protocol before FACTA's enactment. After FACTA was enacted, Shell employees who are not attorneys analyzed the statute and related materials and decided that Shell's pre-FACTA masking protocol complied with FACTA. Under Shell's masking protocol, every digit embossed on the face of a payment card (which, the reader will recall, is a subset of the numbers comprising the PAN) is masked except the last 4 digits of what Shell calls the "account number," which is the first group of numbers embossed on the front of a Shell payment card. Thus, an electronically processed receipt from a purchase made with a Shell payment card looks like this:
XXX XX1 234 XXXXX — ACCOUNT NUMBER — — CARD NUMBER — Exp Date: XXX Ms. Van Straaten contends that Shell is masking the wrong numbers because the relevant numbers on a Shell card under FACTA consist of the entire sequence of digits on the front of a Shell's payment card, which corresponds with the PAN. Ms. Van Straaten then asserts that FACTA requires Shell to mask all of the numbers embossed on the front of the card except up to five digits at the end of the entire sequence of numbers on the front of the card. Under this interpretation of FACTA, an electronically processed receipt from a purchase made with a Shell payment card would look like this: XXX XXX XXX 12345 — ACCOUNT NUMBER — — CARD NUMBER — Exp Date: XXXII. Discussion
A. Standard for A Motion For Summary JudgmentSummary judgment is proper "if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed.R.Civ.P. 56(a); Celotex Corp. v. Catrett, 477 U.S. 317, 322 (1986). "The evidence of the non-movant is to be believed, and all justifiable inferences are to be drawn in his favor." Valenti v. Qualex, Inc., 970 F.2d 363, 365 (7th Cir. 1992). A court should grant a motion for summary judgment only when the record shows that a reasonable jury could not find for the nonmoving party. Id.
To successfully oppose a motion for summary judgment, however, the non-moving party must do more than raise a "metaphysical doubt" as to the material facts. Matsushita Electric Industrial Co. v. Zenith Radio Corp., 475 U.S. 574, 586 (1986). Instead, it must demonstrate that a genuine issue of fact exists. See id. at 587; see also Fed.R.Civ.P. 56(e) ("If a party fails to properly support an assertion of fact or fails to properly address another party's assertion of fact" the court may: "(1) give an opportunity to properly support or address the fact; (2) consider the fact undisputed for purposes of the motion; (3) grant summary judgment if the motion and supporting materials — including the facts considered undisputed — show that the movant is entitled to it; or (4) issue any other appropriate order").
B. Shell's Masking Protocol
This case turns on the meaning of the words "card number." 15 U.S.C.A. § 1681c(g)(1) ("Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number). However, Congress did not provide a definition of "card number."
It is well established that a statute's plain language is "the best indication of Congressional intent." Rodas v. Seidlin, No. 09-3760, ___ F.3d ___, 2011 WL 3836460, at *6 (7th Cir. Aug. 31, 2011); O'Kane v. Apfel, 224 F.3d 686, 688 (7th Cir. 2000) ("When interpreting congressional statutes, we first look at the plain language of the statute because that is the best way to determine congressional intent"). In addition, a court must give the words chosen by Congress their "most natural reading." See McNeil v. United States, 508 U.S. 106, 112 (1993); see also Smith v. City of Jackson, Mississippi, 544 U.S. 228, 249 (2005) (discussing the plain language of a statute in terms of its "natural reading"); Commodity Trend Service, Inc. v. Commodity Futures Trading Com'n, 233 F.3d 981, 989 (7th Cir. 2000) ("The [Act] does not define client, so we assume that Congress intended the word to have its ordinary meaning").
As the reader will recall, Shell's credit card layout and masking protocol is unique since it divides the numbers embossed on the front of the card into two groups, which it names the "account number" and the "card number." Shell masks all digits except the last four digits of the "account number." In contrast, payment cards such as Visa and Mastercard have a single series of numbers embossed on the front, and mask all digits except the last four.
Ms. Van Straaten argues that Shell must work backwards from all of the numbers on the front of a Shell payment card ( i.e., a sequence consisting of Shell's so-called "account number" plus Shell's so-called "card number"). Under this world view, Shell would mask all digits except the last four digits of all of the numbers embossed on the front of the card. These last four numbers are the same as the last four digits of the PAN that is encrypted on the back of the card.
In contrast, Shell asserts that its so-called "account number" embossed on the front of its payment cards is the same thing as FACTA's "card number." It thus contends its practice of masking of all digits except the last four digits of its so-called "account number" complies with FACTA, even though Shell's "account number" digits are neither at the end of the entire sequence of numbers embossed on the front of a Shell card nor the same as the last four digits of the PAN encrypted on the back.
The court is unpersuaded by Shell's interpretation of the words "card number." First, the most natural definition of "card number" as those words are used in FACTA is "all of the numbers on the front of a card." A consumer purchasing a product on-line, when asked to input her card number, types in all of the numbers on the front of the card. If she only typed in a portion of the number, such as the digits corresponding to Shell's so-called "account number" (which Shell asserts is identical to the "card number" in FACTA), the transaction would be rejected.
Furthermore, a common sense understanding of payment cards is that information encrypted on the back of a payment card corresponds to the numbers on the front. See Gil v. Reed, 381 F.3d 649, 662 (7th Cir. 2004) (the court "need not check [its] common sense at the door"). It is likely that anyone who uses payment cards has experienced the phenomena of the swipe that does not work, leading to the manual entry of the numbers on a card's front into a terminal. Once these numbers are entered, the transaction is processed and an electronic receipt is generated. The person manually entering the numbers does not type in a portion of the numbers on the front; she types in the entire sequence. The court thus concludes that the phrase "card number" most naturally refers to the entire sequence of numbers on the front of the card, which corresponds (as described above) to the PAN encrypted on the back.
Moreover, "[s]tatutory language only has meaning in context." Shlahtichman v. 1-800 Contacts, Inc., 615 F.3d 794, 802 (7th Cir. 2010), quoting Graham County Soil Water Conservation Dist. v. United States ex rel. Wilson, 545 U.S. 409, 415 (2005). FACTA was enacted to, among other things, safeguard against identity theft. See id. at 802, quoting Pub.L. 108-159, 117 Stat. 1952 (Dec. 4, 2003) (describing FACTA as "[a]n [a]ct [t]o amend the Fair Credit Reporting Act, to prevent identity theft, improve resolution of consumer disputes, improve the accuracy of consumer records, make improvements in the use of, and consumer access to, credit information, and for other purposes"). To achieve this purpose, Congress chose to focus on electronically printed receipts. See 15 U.S.C.A. § 1681c(g)(2) ("This subsection shall apply only to receipts that are electronically printed, and shall not apply to transactions in which the sole means of recording a credit card or debit card account number is by handwriting or by an imprint or copy of the card").
As noted above, the PAN corresponds to the numbers embossed on the front of a payment card. The PAN is encrypted onto the magnetic stripe on a payment card and is an essential part of the creation of electronically printed receipts. Indeed, international standards require the magnetic stripe to contain the PAN. Because FACTA only applies to electronically printed receipts and international standards require the magnetic stripe to contain the PAN, the phrase "the last 5 digits of the card number" necessarily must refer to the last five digits that can be read electronically. To hold otherwise would require the court to ignore Congress' expressed intent to regulate receipts produced electronically since swiped payment cards read the magnetic stripe, not the numbers on the face of a card. See Commodity Trend Service, Inc. v. Commodity Futures Trading Com'n, 233 F.3d 981, 989 (7th Cir. 2000) (generally, "all words in a statute should, if possible, be given effect").
Similarly, the court must "avoid interpreting a statute in a way that renders a word or phrase redundant or meaningless." United States v. Berkos, 543 F.3d 392, 396 (7th Cir. 2008). Congress did not authorize the printing of up to five digits of any portion of the card number. Instead, it specifically chose to adopt a uniform system based on printing of "the last 5 digits of the card number." 15 U.S.C.A. § 1681c(g)(1) (emphasis added). "Dictionaries are a helpful resource in ascertaining the common meaning of terms that a statute leaves undefined." Shlahtichman v. 1-800 Contacts, Inc., 615 F.3d at 799. "Last," instead, means "[f]ollowing all others; coming at the end." "Last, adj. (and n.) and adv." The Oxford English Dictionary (2d ed. 1989). Thus, a merchant may not, at its discretion, choose a subset of the numbers on the front of the card (which as noted above correspond to information encrypted on the back of the card) and then print up to the last five digits of that chosen sequence. See generally Sobitan v. Glud, 589 F.3d 379, 386 (7th Cir. 2009) (rejecting party's interpretation of a statute because it would render words in the statute "superfluous, a result we try to avoid").
This conclusion is further supported by the fact that the existence of a patchwork of inconsistent masking protocols and the resulting potential for identify theft led to the enactment of FACTA. See Pub.L. No. 108-159, 117 Stat. 1952 (Dec. 4, 2003) (FACTA was enacted to provide a uniform standard, preempting all state laws, to "prevent identity theft"). The court declines to accept Shell's contention that FACTA permits it to mask numbers at the end of one of two sequences it has chosen to emboss on the front of Shell cards, as allowing a card issuer to choose the digits to mask would subvert the intent of Congress to provide a national standard. See id.; see also Creative Hospitality Ventures, Inc. v. U.S. Liability Ins. Co., 655 F. Supp. 2d 1316, 1333 (S.D. Fla. 2009) (collecting authority concluding that FACTA was meant to address the "national concern" of identify theft).
Shell also appears to be contending that because it chose to call a series of numbers on the front of the card the "account number," it can disclose up to five digits of that series of numbers. This argument is based on Shell's position that its "account number" is the same as FACTA's "card number." The court has already rejected this idiosyncratic interpretation of the words "card number."
Shell next notes that the terms "card number" and "account number" are generally used interchangeably in the payment card industry. It then concludes that its practice of printing the last four digits of its "account number" complies with FACTA because "card number" and "account number" are the same thing. The court disagrees. For virtually all payment cards other than Shell cards, the terms "card number" and "account number" refer to the same series of numbers. Thus, they can be used interchangeably because regardless of what the series of numbers is called, the contents of the series remain the same. In contrast, Shell's focus on its so-called "account number," which is a sub-set of the "card number" as that term is used in FACTA, means it is an outlier. Since Shell chose not to follow the otherwise uniform industry standard when designing its payment cards and masking protocol, its current predicament is of its own making. It cannot, therefore, find refuge in the general interchangeability of the terms "card number" and "account number."
In addition, Shell argues that its so-called "account number" is the same as FACTA's "card number" because if FACTA's "card number" refers to a sequence of numbers contained in the PAN, a Shell card user would be unable to ascertain if Shell had complied with FACTA's masking protocol by looking at a receipt since the PAN can only be read electronically. This is unpersuasive; Shell chose to selectively place and group certain numbers on the front of its payment cards. To the extent that its protocol does not allow consumers to ascertain if a merchant properly masked "the last 5 digits of the card number," 15 U.S.C.A. § 1681c(g)(1), Shell is responsible and cannot use its own chosen protocol to support its interpretation of FACTA.
Finally, Shell notes that the method used to select the digits comprising the "card number" section on a Shell payment card ( i.e., the second group of numbers on the front of a Shell card) causes many Shell payment cards to share the same Shell "card number." According to Shell, this duplication makes it difficult for a merchant to use digits from the Shell "card number" to cross-reference receipts and other documents when performing returns, refunds, and chargebacks.
This concern is at odds with FACTA, which allows merchants to choose between electronically printing the expiration date or up to the last five digits of the card number. 15 U.S.C.A. § 1681c(g). Congress thus explicitly allows merchants to print the month-year expiration date of a payment card (MM-YY or MM-YYYY) on an electronically produced receipt instead of up to five digits of the card number. The expiration date digits are far less distinctive than the last five digits of Shell's "card number" because a significant number of payment cards have an identical expiration date. Thus, the information on receipts associated with cards expiring in the same year would be identical. In contrast, the last five digits of FACTA's "card number" are more distinctive.
In sum, "[w]hen the statute's language is plain, the sole function of the courts — at least where the disposition required by the text is not absurd — is to enforce it according to its terms." Lamie v. United States Trustee, 540 U.S. 526, 534 (2004) (internal quotations and citations omitted). Following the enactment of FACTA, Shell chose to keep its pre-FACTA card number arrangement scheme and elected to continue to mask based on the "account number" digits on the front of Shell payment cards. For the reasons discussed above, the court finds that this masking system fails to comply with FACTA.
C. Constitutionality of FACTA
Shell contends that if its interpretation of FACTA is wrong, then FACTA's masking provisions are unconstitutionally vague because they fail to give fair warning of what is prohibited. Ms. Van Straaten did not respond to this argument, but the court declines to strike down a provision in a federal statute as unconstitutional based on forfeiture.
A law is void for vagueness if it "fails to give fair warning of what is prohibited, if it fails to provide explicit standards for the persons responsible for enforcement and thus creates a risk of discriminatory enforcement, and if its lack of clarity chills lawful behavior." Anderson v. Milwaukee County, 433 F.3d 975, 978 (7th Cir. 2006); see also Coe v. Cook County, 162 F.3d 491, 496 (7th Cir. 1998) ("[s]tatutes and other enactments present a constitutional issue of vagueness when they deter constitutionally protected activity, fail to provide even minimum guidance as to people's legal obligations, or give law enforcers excessive discretion that might be exercised in arbitrary or invidious ways").
If a statute regulates economic activity, it "is subject to a less strict vagueness test [than criminal statutes] because its subject matter is often more narrow, and because businesses, which face economic demands to plan behavior carefully, can be expected to consult relevant legislation in advance of action." Iosello v. Leiblys, Inc., 502 F.Supp.2d 782, 785 (N.D. Ill. 2007), quoting Village of Hoffman Estates v. Flipside, Hoffman Estates, Inc., 455 U.S. 489, 498 (1982). The court must thus consider whether FACTA's masking provisions are "sufficiently clear that [their] prohibitions would be understood by an ordinary person operating a profit-driven business." Id.
Numerous defendants who provided electronic receipts with the last four or five digits of a card number and the expiration date have unsuccessfully argued that FACTA's masking protocol is ambiguous. See, e.g., Ramirez v. Midwest Airlines, Inc., 537 F. Supp. 2d 1161, 1171 (D. Kan. 2008) (collecting cases). Similarly, defendants have unsuccessfully argued that the prohibition against printing more than the last 5-digits or expiration date rule is unconstitutionally vague. See id. at 1172 (rejecting claim by defendant who printed last four digits and the expiration date); Follman v. Village Squire, Inc., 542 F. Supp. 2d 816, 820-21 (N.D. Ill. 2007) (collecting cases). Merchants have also unsuccessfully tried to escape FACTA liability by contending that FACTA's statutory damages provision is unconstitutionally vague because it authorizes an award of damages ranging from $100.00 to $1,000.00 but does not specify criteria for assessing the amount of damages within that range. See, e.g., Harris v. Mexican Specialty Foods, Inc., 564 F.3d 1301, 1311-12 (11th Cir. 2009). Shell, however, appears to be the first card issuer to contend that the phrase "the last 5 digits of the card number," 15 U.S.C.A. § 1681c(g)(1), is unconstitutionally vague.
As noted above, Shell's problems flow from its decision to emboss a subset of the PAN on the front of Shell payment cards as the so-called "account number" and then mask everything except the last four digits of that "account number." As discussed above, however, the court declines to find that FACTA, which was enacted to ensure that sensitive, private consumer information would be handled uniformly, permits merchants to select their own series of numbers to disclose. Without meaning to impugn the Shell employees responsible for Shell's masking policy, a person of common intelligence would grasp this and would not have chosen to eschew the otherwise universally accepted practice of having the numbers on the front of a card correspond to the PAN encrypted on the back and disclosing the numbers at the end of this sequence of numbers as opposed to a self-selected subset of those numbers. The court thus declines to strike down § 1681c(g) as unconstitutionally vague.
D. Willfullness
Ms. Van Straaten concedes that Shell's masking protocol has not caused her to incur any damages. Indeed she apparently continues to use her Shell payment card. Nevertheless, she seeks damages under 15 U.S.C. § 1681n(a)(1)(A), which allows actual damages or statutory damages of at least $100 but no more than $1,000 per occurrence. See 15 U.S.C. § 1681 n(a)(1)(A) ("Any person who willfully fails to comply with any requirement imposed under this title with respect to any consumer is liable to that consumer in an amount equal to the sum of (1)(A) any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000"). Given the number of Shell payment cards in existence, even the low end of this range would be an extremely large number if this case were to proceed as a class action. If Shell's conduct is willful, it may also be liable for Ms. Van Straaten's costs and attorney's fees as well as punitive damages. See 15 U.S.C. § 1681n(a)(2)-(3). In contrast, if Shell's conduct is negligent as opposed to willful, Shell may be liable only for actual damages, costs, and attorney's fees. See 15 U.S.C. § 1681o(a)(1)-(2).
A willful violation of FACTA can be either knowing or reckless. See Safeco Ins. Co. v. Burr, 551 U.S. 47, 57 (2007). According to the Supreme Court, the Restatement (Second) of Torts is helpful in understanding what conduct is "reckless":
The actor's conduct is in reckless disregard of the safety of another if he does an act or intentionally fails to do an act which it is his duty to the other to do, knowing or having reason to know of facts which would lead a reasonable man to realize, not only that his conduct creates an unreasonable risk of physical harm to another, but also that such risk is substantially greater than that which is necessary to make his conduct negligent.Id. at 69, citing Restatement (Second) of Torts § 500 (1963-64).
Shell's decision to challenge the constitutionality of FACTA's masking provisions led to the court's finding that FACTA's reference to "the last five digits of the card number," 15 U.S.C. § 1681c(g), is "sufficiently clear that its prohibitions would be understood by an ordinary person operating a profit-driven business," Iosello v. Leiblys, Inc., 502 F.Supp.2d at 785. This does not, however, necessarily mean that Shell's conduct was willful. The court thus considers whether Shell is entitled to summary judgment in its favor as to willfulness.
Shell first contends that its conduct was not willful because no court has issued a decision stating that Shell's specific masking protocol violates FACTA. In support it directs the court's attention to Shlahtichman v. 1-800 Contacts, Inc., a recent Seventh Circuit decision holding that a defendant's masking protocol was not willful because "[t]o date, there has been no contrary opinion from a court of appeals or federal agency suggesting that the company's understanding of the statute is wrong." 615 F.3d at 794. In Shlahtichman, the Seventh Circuit went on to note that "even if its construction of the statute turns out to be mistaken, it is objectively reasonable nonetheless for all of the reasons we have discussed" so the defendant's inclusion of information prohibited by FACTA in an email receipt was not reckless. Id.
Critically, in Shlahtichman, the Seventh Circuit found that the defendant's interpretation of the statutory language at issue was objectively reasonable because the court agreed with that interpretation. In contrast, in this case the court did not find that Shell's conduct was objectively reasonable as it concluded that Shell's masking protocol violates FACTA. Moreover, the court declines to adopt a FACTA version of the age old proverb "every dog is allowed one bite" as the mere absence of authority contrary to Shell's position does not mean that as the first company to adopt this position, it gets an automatic free pass. See generally OXFORD DICTIONARY OF PROVERBS, at 79 (Jennifer Speake ed. 2003) ("The proverb [every dog is allowed one bite] is based on the old common law rule (dating at least from the seventeenth century) by which the keeper of a domestic animal was not liable for harm done by it unless he knew of its vicious propensities").
The court thus turns to the evidence presented by the parties that purportedly demonstrates that Shell was/was not willful. It is undisputed that Shell knew about FACTA's truncation requirements and decided (erroneously, as discussed above) that its protocol complied with FACTA. At Shell, Frankie McCuller, Shell's Rule 30(b)(6) witness, and two of her co-employees, Mike Iribarren and Elwood Holmes, were responsible for ensuring compliance with state truncation laws, and Ms. McCuller was responsible for deciding the truncation protocol used by Shell's software. None of these employees are lawyers. Ms. McCuller is thus Shell's key witness regarding wilfulness as Shell did not involve lawyers in its decisions about FACTA truncation and, in any event, the court previously held that Shell could not rely on an "advice of counsel" defense because it claimed during discovery that information about its communications with counsel were privileged. See Docket No. 71.
Ms. McCuller received communications stating that FACTA required merchants to mask digits at the end of the PAN. She nevertheless reviewed FACTA and decided that Shell's masking software, which masked digits from the "account number" section embossed on the front of the Shell cards, complied with it. Ms. Van Straaten characterizes this decision as reckless, especially given that Ms. McCuller is not an attorney. Shell, on the other hand, decries this position as "elitist" and contends that the facts surrounding Ms. McCullen's decision — including her review of documents that allegedly support her interpretation of FACTA — show that she was an experienced employee who made considered, educated decisions within her scope of expertise. This court declines to determine, as a matter of law based on the current record, whether Shell's conduct was reckless. This issue is a question of fact that must be considered by a jury.
III. Conclusion
For the above reasons, Shell's motion for summary judgment [84] is denied. In addition, Ms. Van Straaten's motions for leave to file a sur-reply [111] and supplemental authority [147] are granted. A joint status report summarizing the dates set by the magistrate judge for remaining pretrial matters and the parties' views regarding what further proceedings are necessary shall be filed by October 18, 2011. This matter is set for status on October 20, 2011, at 11:00 a.m.