Shell Oil Prods. Co. v. Van Straaten, No. 11-8031 (7th Cir. 2012)
Annotate this Case
Justia Opinion Summary
Want to stay in the know about new opinions from the Seventh Circuit U.S. Court of Appeals ?
Sign up for free summaries delivered directly to your inbox. Learn More ›
You already receive new opinion summaries from Seventh Circuit U.S. Court of Appeals . Did you know we offer summary newsletters for even more practice areas and jurisdictions? Explore them here.
The Fair and Accurate Credit Transactions Act, 15 U.S.C. 1681c(g), requires that electronically printed receipts not display more than the last 5 digits of the card number, but does not define "card number." A Shell card designates nine digits as the "account number" and five as the "card number" and has 14 digits embossed on the front and 18 digits encoded on the magnetic stripe. Shell printed receipts at its gas pumps with the last four digits of the account number. Plaintiffs contend that it should have printed the final four numbers that are electronically encoded on the magnetic stripe, which the industry calls the "primary account number." Plaintiffs did not claim risk of identity theft or any actual injury, but sought a penalty of $100 per card user for willful failure to comply. The district court denied Shell summary judgment. The Seventh Circuit reversed, holding that Shell did not willfully violate the Act.
Download PDF
In the United States Court of Appeals For the Seventh Circuit No. 11-8031 N ATALIE VAN S TRAATEN, on behalf of herself and a class, Plaintiff Respondent, v. S HELL O IL P RODUCTS C OMPANY LLC, E QUILON E NTERPRISES LLC, and S HELL O IL C OMPANY, Defendants Petitioners. Petition for Leave to Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 09 C 1188 Blanche M. Manning, Judge. S UBMITTED JANUARY 4, 2012 D ECIDED A PRIL 18, 2012 Before E ASTERBROOK, Chief Judge, and C UDAHY and M ANION, Circuit Judges. E ASTERBROOK, Chief Judge. The Fair and Accurate Credit Transactions Act, 15 U.S.C. §1681c(g), requires the truncation of credit-card numbers on electronically printed receipts. The receipt must not display more 2 No. 11-8031 than the last 5 digits of the card number . The statute does not define the phrase card number . This interlocutory appeal which the district court authorized under 28 U.S.C. §1292(b), see 2011 U.S. Dist. L EXIS 142894 (N.D. Ill. Dec. 8, 2011) presents the question whether card number and primary account number are interchangeable. Shell Oil printed on receipts at its gas pumps the last four digits of what Shell calls the customer s account number . Natalie van Straaten contends that Shell printed the wrong four digits that it should have printed the final four numbers that are electronically encoded on the card s magnetic stripe, a number the industry calls the primary account number or PAN. She does not contend that the digits Shell chose to print would have allowed identity theft, prevention of which is the goal behind the Act. (The parties call the statute FACTA, but we prefer simple words to awkward initialisms.) A Shell Card designates nine digits as the account number and five as the card number . Here is an illustration: No. 11-8031 3 If someone had used this sample Shell Card at a Shell station, the electronically printed receipt would have displayed 6789 , one fewer digit than the statute allows but, the district judge held, the wrong digits. The sequence 0000 should have been printed for this sample card, the judge concluded when denying Shell s motion for summary judgment. 2011 U.S. Dist. L EXIS 110108 (N.D. Ill. Sept. 26, 2011). Shell s receipts looked like this: XXX XX6 789 XXXXX Account Number Card Number The district court held that they should have looked like this: XXX XXX XXX X0000 Account Number Card Number A Shell Card has 14 digits embossed on the front and 18 digits encoded on the magnetic stripe. This 18digit primary account number could be rendered 123456789ABCDEFGHI. According to van Straaten and the district court, only FGHI or EFGHI on an electronic receipt complies with the Act no matter what sequence is accessible to the eyes or a machine that takes a physical imprint of the card. If the number visible to a customer were ABCDE 123 456 789 (reversing the order of account number and card number on the sample above, while still having 14 embossed digits), still the only permissible sequence on the receipt would be the last four or five digits of the machine-readable primary account number. 4 No. 11-8031 The Act does not define card number . The Federal Trade Commission and the Consumer Financial Protection Bureau, which have some authority to interpret the Fair Credit Reporting Act (§1681c is part of that statute), also have not defined the term. The FTC s staff did issue a bulletin alerting businesses to the statutory requirement soon after its enactment, but this publication not only lacks a definition but also has no authoritative effect; it is neither an exercise in notice-and-comment rulemaking nor the outcome of administrative adjudication. (The bulletin, and much of the Commission s other advice issued before it handed enforcement over to the Bureau, is recapped in 40 Years of Experience with the Fair Credit Reporting Act, an FTC Staff Report with Summary of Interpretations (July 2011).) But we need not essay a definition of card number as an original matter, because we can t see why anyone should care how the term is defined. A precise definition does not matter as long as the receipt contains too few digits to allow identity theft. The Act does its work by limiting the number of exposed digits, and Shell Oil printed one fewer digit than the Act allows. Van Straaten and the class she represents do not contend that Shell s choice of digits left them at risk of identity theft. They have not claimed to suffer injury and do not want compensatory damages. Instead they seek the penalty provided by 15 U.S.C. §1681n(a)(1)(A), which says that a person who willfully fails to comply with any requirement in the Fair Credit Reporting Act is liable in the amount of any actual damages sustained by the consumer as a result of the failure or dam- No. 11-8031 5 ages of not less than $100 and not more than $1,000 . An award of $100 to everyone who has used a Shell Card at a Shell station would exceed $1 billion, despite the absence of a penny s worth of injury. Penalties under §1681n depend on a violation being willful . The Supreme Court defined that term, as §1681n uses it, in Safeco Insurance Co. v. Burr, 551 U.S. 47, 69 (2007), concluding that a practice is willful when the action is not only a violation under a reasonable reading of the statute s terms, but shows that the company ran a risk of violating the law substantially greater than the risk associated with a reading that was merely careless. In other words, the Justices wrote, only a reading that is objectively unreasonable can be deemed a willful violation. Ibid. The absence of a statutory or regulatory definition of the phrase card number and the fact that the four digits Shell exposed on the receipt created no greater risk for its customers than printing the last four digits of the primary account number means that Shell s decision cannot be called objectively unreasonable . See also Long v. Tommy Hilfiger U.S.A., Inc., 671 F.3d 371 (3d Cir. 2012) (printing on a receipt the month of a credit card s expiration date, but not the year, is not a willful violation, even though §1681c(g) prohibits printing any portion of a card s expiration date). Plaintiff insists that Shell s position can be revealed as unreasonable by analysis of industry practices. When businesses started to read credit-card numbers electronically in the 1980s, transmitting them to financial institutions for each purchase s approval, they needed a 6 No. 11-8031 uniform format both the sequence of numbers and a standard of encoding (and potentially encrypting) so that computers could understand and work with them. The International Organization for Standardization (ISO) came up with a format that can be read when a card is swiped through a terminal, or a radio-frequency identification (RFID) tag in the card is brought close to a near-field-communications reader. In this standard some of the 18 or 19 digits designate the industry in which the card s issuer participates, some the individual account, and at least one is a check digit; it is also possible to encode whether the card is the original or a replacement for one that was lost or stolen. Plaintiff s expert witnesses testified by reports and depositions that the payment-card industry understands account number and the ISO s primary account number to be the same thing, and that lobbyists informed congressional staff of this in 2003 when Congress was considering proposals that led to §1681c(g). On this view, since everyone knows that §1681c(g) refers to the last four or five digits of the primary account number, it was unreasonable for Shell to print the last four digits of its self-defined account number, digits that occur somewhere in the middle of a primary account number that meets the ISO s standards. Everyone knows is no substitute for support in the text. Legislative history may help decode ambiguous statutory text, but what lobbyists told the staff is not legislative history. If the information made its way to a committee report, telling readers that the statutory phrase card number means the same as the ISO s pri- No. 11-8031 7 mary account number, that could help flesh out the statute though we re not at all sure that it is automatically unreasonable to read a statute in a way that departs from a committee report. See, e.g., American Hospital Ass n v. NLRB, 499 U.S. 606 (1991), where a federal agency rejected the meaning assigned to a statutory phrase by a committee report and was unanimously sustained by the Supreme Court. But what the lobbyists may have told the staff in private never appears in a committee report, and for all we know never reached the ears of a single Member of Congress. It certainly did not enter the statutory text which, recall, is card number rather than account number or primary account number. If everyone who is anyone knew that merchants are supposed to print only the last four or five digits of the ISO-defined primary account number, why didn t that phrase and a reference to ISO make it into the enacted text? The everyone knows approach is further confounded by the difference between the language of paragraphs (1) and (2). Here are the first two paragraphs in full: (g) Truncation of credit card and debit card numbers (1) In general Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction. 8 No. 11-8031 (2) Limitation This subsection shall apply only to receipts that are electronically printed, and shall not apply to transactions in which the sole means of recording a credit card or debit card account number is by handwriting or by an imprint or copy of the card. Paragraph (1) uses the phrase card number and paragraph (2) the phrase account number . Why the difference? Van Straaten and her experts don t have an explanation. Worse for them, the phrase account number in paragraph (2) does not mean the ISO s primary account number. That number is encoded on a magnetic stripe or RFID chip. Some credit and debit cards emboss the primary account number on the front, but many don t. A Shell Card has only 14 of the ISO standard s 18 or 19 digits on the card s front. So when paragraph (2) says that an imprint or copy of the card can record the whole account number, it means that the imprint can contain all of the embossed digits, which are not necessarily the same as the primary account number. Likewise, we conclude, card number in paragraph (1) is not necessarily the same as the primary account number. Maybe all card number means is number appearing on the card. Then the merchant may print any of the digits in that number, provided only that it prints no more than five. Printing any small subset of the digits on a card enables the customer to know which card was used for a particular purpose (that s why merchants want to print some of the digits), without enabling a stranger to learn the full number. No. 11-8031 9 Plaintiff wraps up her presentation in this court with the assertion that the law is settled that willfulness cannot be decided on summary judgment but must be submitted to a jury. She then cites three opinions issued by district courts. Yet decisions of district courts are not authoritative even within the rendering district. They cannot settle any proposition. Plaintiff does not mention Safeco Insurance, in which the Supreme Court of the United States treated willfulness as a question of law and directed that judgment be entered in a defendant s favor without a trial. The principal districtcourt decision that van Straaten invokes rests its conclusion on Whitfield v. Radian Guaranty, Inc., 501 F.3d 262, 270 71 (3d Cir. 2007), which it reads for the proposition that disputes about willfulness must be submitted to a jury. See Searcy v. eFunds Corp., 2010 U.S. Dist. L EXIS 104557 at *18 19 (N.D. Ill. Sept. 30, 2010). But Whitfield not only did not discuss the fact that Safeco Insurance treated the subject as one of law (the statutory standard concerns objective reasonableness, not anyone s state of mind), but also has been vacated as moot. 553 U.S. 1091 (2008). The point of vacatur is to ensure that a decision carries no precedential force after mootness prevents further review. See United States v. Munsingwear, Inc., 340 U.S. 36 (1950). When the third circuit held in Long, as a matter of law, that printing part of a card s expiration date is not a willful violation of §1681c(g)(1), it did not cite Whitfield. That decision is defunct; it has no force in or out of the third circuit. We hold that Shell Oil did not willfully violate the Act by printing the last four digits of the account number 10 No. 11-8031 designated on the face of its cards. This means that it cannot be held liable under §1681n. This also makes it unnecessary for us to decide whether Shell violated the Act at all. Shell tells us that it has changed its practice and now prints zero digits, and plaintiff tells us that every other firm in the industry prints the last four or five digits of the ISO-defined primary account number, if it prints any at all. Thus the substantive question in this litigation will not recur for Shell or anyone else; it need never be answered. We grant the petition for leave to appeal. The decision of the district court is reversed, and the case is remanded with instructions to enter judgment for defendants. C UDAHY, Circuit Judge, concurring. I join without reservation the comprehensive majority opinion and write separately only to comment briefly on the issue of willfulness that is the sole basis of decision here. Willfulness may include recklessness, and that is specifically the question here. See Safeco Ins. Co. v. Burr, 551 U.S. 47, 69 (2007); see also Long v. Tommy Hilfiger U.S.A., Inc., 671 F.3d 371 (3d Cir. 2012). According to Safeco, at least with unclear text and in the absence of authoritative guidance or case law, the appropriate and sole mea- No. 11-8031 11 sure of recklessness is objective reasonableness. Safeco, 551 U.S. at 70 n.20. Following Safeco, this may be determined as a matter of law and without trial. See id. at 71. Such a course is consistent with the nature of the test, which presumably establishes that the risk of harm has not been increased by any objectively reasonable interpretation of the statute. Here, the majority opinion reasonably hypothesizes that the risk of identity theft is not affected by which series of numbers is blocked, so long as no more than five are visible. In the present case, the district court found that Shell s interpretation of the statute was incorrect but did not rule on the interpretation s objective reasonableness. The district court discussed willfulness recklessness in terms of state-of-mind evidence reflected in Shell s procedure in evaluating its conformity with the statute an approach which the plaintiff also urged. There is much discussion of Shell s use of nonlawyers (and non-college graduates) to evaluate its compliance with the statute. It is not clear whether Shell ever submitted the question of compliance to counsel, since, at one point, communications with counsel were ruled inadmissible on grounds of privilege. Van Straaten v. Shell Oil Prods. Co., 813 F.Supp.2d 1005, 1017 (N.D. Ill. 2011). Simply as a matter of normal procedure, it is hard to imagine the issue of compliance not being submitted to counsel. Had Shell sought the advice of counsel in conforming with the statute, Shell might have claimed immunity on that basis (although Safeco leaves undecided whether such a claim could succeed in the context of that case). Safeco, 551 U.S. at 70 n.20. 12 No. 11-8031 However, the issue pursued in the case before us is not related to immunity but to whether assigning the matter of statutory compliance to non-lawyers might be evidence of recklessness. Of course, that question rests with the objective reasonableness of the interpretation, which is demonstrated by the majority opinion, and the credentials of Shell s evaluators are irrelevant. Because the district court pursued these various threads of allegedly deficient procedure by Shell and thereby created issues of fact it is not surprising that the district court erroneously denied summary judgment and prescribed jury trial to determine willfulness. However, in the absence of increase in risk of harm as demonstrated by the finding of objective reasonableness, the latter is dispositive as a matter of law. 4-18-12
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
