.jpg)
ELGIN — A state appeals panel has given new life to a class action accusing Six Flags of including too many payment card digits on receipts for purchases at the Great America theme park.
Hugo and Sharon Soto sued Six Flags in August 2017 in Lake County Circuit Court, saying the company willfully violated the Fair and Accurate Credit Transactions Act of 2003 by printing receipts with at least the first six and last four digits of their debit cards when they made purchases at the park in suburban Gurnee.
Lake County Judge Luis Berrones granted Six Flags’ motion to dismiss, agreeing with the amusement park operator that the plaintiffs didn’t allege an actual injury beyond improper disclosure. Six Flags said the first six digits of a card are the Issuer Identification Number, which according to the International Standards Organization doesn’t reveal any information identifying the cardholder. Berrones did not address whether Six Flags acted willfully.
The Sotos appealed to the Illinois Second District Appellate Court, which issued an opinion on the matter Jan. 22. Justice Robert McLaren wrote the opinion; justices Ann Jorgensen and George Bridges concurred.
According to the panel, FACTA was enacted as an amendment to the Fair Credit Reporting Act that has preventive and deterrent purposes.
“Accordingly,” McLaren wrote, “we conclude that when a person willfully fails to comply with FACTA’s truncation requirements, the statute provides a private cause of action for statutory damages and does not require a consumer to suffer actual damages before seeking recourse.”
In supporting its decision to reverse and remand, the panel cited another Great America case that started in Berrones’ courtroom, Rosenbach v. Six Flags Entertainment Corp., which ultimately landed with the Illinois Supreme Court in January 2019. That case centered on allegations Six Flags violated the Illinois Biometric Information Privacy Act by requiring customers to scan their fingerprints to prove their identity when using a season pass to the park, without first obtaining written authorization from the season pass holders to scan the fingerprint. In that case, the Illinois Supreme Court found a Second District panel improperly ended a class action by ruling the plaintiffs never proved the fingerprint scans actually harmed them, whether or not Six Flags first obtained authorization or provided certain notices.
Essentially, the state Supreme Court ruled the requirements under BIPA weren't just "technical," but that violations of those provisions were the actual injury that could justify class action lawsuits worth potentially many millions or billions of dollars.
“Defendants argue that most federal courts view a violation of FACTA’s truncation requirements as merely ‘technical’ or ‘procedural’ and hold that such failure is insufficient to establish the actual harm necessary for standing under federal law,” McLaren wrote. However, Six Flags also acknowledged through its “efforts to distinguish the cases, that some federal courts have held that FACTA does not require a plaintiff to plead an ‘actual injury’ in addition to a statutory violation to have standing.”
Though Six Flags argued printing the first six digits “was a harmless technical violation,” McLaren wrote, the panel said that “assertion ignores FACTAS’s prohibition against printing more than the last five digits of a consumer’s card number.” Since damages are not a prerequisite to seeking recourse, the panel reversed Berrones’ dismissal.
Turning to the issue of whether Six Flags willfully violated FACTA, which the panel said “is certain to arise on remand,” McLaren wrote the justices rejected “the suggestion that only harmful violations can be willful and further note that the question of whether printing the first six digits was harmful has not been resolved at this pleading stage.”
The Sotos alleged Six Flags acted willfully since the contested receipts were printed well after FACTA compliance was mandated by Dec. 4, 2006, and further alleged Six Flags failed to audit point-of-sale terminals after software changes or after annual rule and regulation updates from card issuers like MasterCard and Discover. They further said Six Flags’ contracts with those issuers required FACTA compliance, putting the company on adequate notice of the standards it failed to meet.
The panel decided the Sotos “adequately alleged a knowing violation or a reckless disregard of FACTA’s truncation requirements.”