The Illinois Supreme Court has overturned rulings from two lower courts that granted class certification in a Fair Credit Reporting Act case involving the printing of more than the last five digits of a debit card number on a receipt provided to a consumer.
The background: The plaintiff filed suit after receiving two receipts at a retail store that showed the first six and last four digits of a prepaid debit card. She alleged the retailer willfully violated the truncation requirement in the Fair and Accurate Credit Transactions Act, which prohibits printing more than the final five digits of a card number and is part of the FCRA.
- The complaint asserted that this disclosure elevated her risk of identity theft, exposed private information to individuals who may have handled the receipts, and forced her to take steps to safeguard the receipt. She sought statutory damages, punitive damages, attorney fees, and costs under the FCRA’s willful violation provision.
- The case proceeded through discovery, and the plaintiff moved to certify a nationwide class with more than 1.5 million members.
- Both the circuit court and an appellate court concluded the plaintiff had standing, relying heavily on earlier Illinois decisions that treated statutory violations as sufficient to proceed.
The ruling: The Illinois Supreme Court disagreed with both lower courts, holding that the plaintiff lacked standing because she did not suffer a concrete injury.
- The court emphasized that FCRA does not expressly grant a private right of action to all consumers, which means common-law standing requirements apply. That standard requires an injury that is distinct and palpable, fairly traceable to the defendant’s conduct, and likely to be redressed by the relief sought.
- After reviewing the record, the court found no such injury. The plaintiff conceded in discovery that she had never been a victim of identity theft and was unaware of any harm to her credit or identity. She also acknowledged that only a few individuals, mostly herself, ever saw the receipt.
- Expert testimony showed the first six digits printed on the receipt represented only a bank identification number, not personally identifying information. At most, the plaintiff demonstrated an increased risk of identity theft, which the court deemed a speculative future harm.
