Under the Fair and Accurate Credit Transactions Act of 2003 (FACTA), retailers are prohibited from printing more than the last 5 digits of a credit card number or the expiration date on a purchase receipt. The law was enacted to combat identity theft, because receipts other could provide criminals with easy access to credit and debit card information. FACTA also includes a private right of action, allowing consumers to sue a business that prints a receipt that includes the prohibited information.
Since then, however, efforts to enforce FACTA have faced a hurdle, as courts in several cases have held that the plaintiff lacked standing because receiving a receipt with some of the prohibited information did not cause injury. Some courts found no injury because the plaintiff kept and destroyed the receipt; others have found no injury because they did not see the harm in a receipt that included, for example, an expiration date.
The DC Circuit today issues a strong decision finding that a plaintiff had standing and explaining the importance of FACTA and the risks it protects against. In Jeffries v. Volume Services America, the court held that the injury suffered when a credit card purchase receipt is printed with more than 5 digits (there, all 16 digits) creates a real risk of harm to the concrete interests protected by FACTA. The opinion looks to the common law and to Congress's determination of harm in enacting the statute.
The opinion is here.