Van Straaten v. SHELL OIL PRODUCTS CO., LLC

813 F. Supp. 2d 1005 (2011)

Natalie VAN STRAATEN, Plaintiff,
v.
SHELL OIL PRODUCTS COMPANY LLC, Equilon Enterprises LLC, and Shell Oil Company, Defendants.

No. 09 C 1188.

United States District Court, N.D. Illinois, Eastern Division.

September 26, 2011. Statement Granting Motion for Certification of Appealability December 8, 2011.

John R. Wylie, Donaldson & Guin LLC, Martin Jay Oberman, Chicago, IL, for Plaintiff.

Ray G. Rezner, Rachael M. Trummel, Sarah B. Waxman, Shermin Kruse, Barack Ferrazzano Kirschbaum & Nagelberg LLP, Chicago, IL, for Defendants.

MEMORANDUM AND ORDER

BLANCHE M. MANNING, District Judge.

In 1950, Diners Club issued its first credit cards, crafted from cardboard, so diners could charge meals in 27 restaurants in New York City. One year later, nearly 20,000 Americans had a Diners Club card. In 1958, American Express and BankAmericard (now Visa) created credit cards that rapidly gained acceptance as the words "charge it!" became part of the American lexicon. See M.J. Stephey, A Brief History of: Credit Cards, TIME, Apr. 2009, available at http://www.time. com/time/magazine/article/0,9171,1893507, 00.html (last visited Sept. 26, 2011).

The ease and convenience of signing for purchases made on credit, however, had negative repercussions that likely were not contemplated back in the 1950s. Specifically, after credit card identity theft based on misappropriated credit card information became an unfortunate reality for many Americans, the Fair and Accurate Credit Transactions Act ("FACTA"), 15 U.S.C. § 1681c(g), was enacted. Among other things, FACTA prohibits merchants from printing the expiration date or more than the last five digits of a credit or debit card number on electronically printed receipts provided at the point of sale.

In this case, plaintiff Natalie Van Straaten seeks to represent a class of consumers who used Shell's proprietary credit and debit cards at Shell gas stations. Ms. Van Straaten contends that Shell Oil Products Company, Equilon, and Shell Oil (collectively Shell) improperly truncated the digits on Shell's payment cards by masking the wrong digits on the receipt. Shell's motion for summary judgment is before the court. For the following reasons, Shell's motion is denied.

I. Background

The following facts are undisputed unless otherwise noted.

A. The Magnetic Stripe

Credit and debit card transactions are overwhelmingly processed electronically. Electronic processing uses electronically encrypted data in the magnetic stripe on the back of a payment card, as opposed to the numbers that are embossed on the front of the card. International standards promulgated by the International Organization for Standardization and the International Electrotechnical Commission govern, among other things, the data contained in the magnetic stripe. The information in the magnetic stripe allows electronic point of sale terminals to read data and process transactions after a card is swiped. Thus, when a consumer uses a card, the data in the magnetic stripe is transmitted to an intermediate institution and then to the cardholder's bank, after which an electronic signal approving or rejecting the transaction is sent back to the merchant's point of sale terminal.

International standards mandate that every payment card's magnetic stripe must contain a series of digits called the primary account number, or PAN. The PAN consists of account and other numbers that are prescribed by international standards and recognized throughout the payment card industry. It consists of a maximum of 19 digits, and includes digits identifying the industry associated with the card, the card holder, and the card issuer. The following diagram illustrates the composition of the PAN:

ISO/IEC standard 7812-1, attached as Ex. C to the plaintiff's statement of facts.

For example, the PAN for a financial institution card such as Visa or MasterCard starts with a 5, a travel and entertainment card such as American Express starts with a 3, and a petroleum industry card starts with a 7. The PAN also contains digits constituting the "individual account identification" for the card holder. Next, the PAN contains a "check digit" that acts as an anti-fraud measure and is a number derived from an algorithm known as the "Luhn formula." See Joe Celko, Joe Celko's Thinking in Sets: Auxiliary, Temporal, and Virtual Tables in SQL § 8.3.3 (2008). The PAN may also include digits indicating the specific card issued to an account that has multiple cards (ex: Jane and John Doe's cards associated with their joint account may contain digits that indicate whether the card is Jane's or John's).

B. Numbers Embossed on the Front of a Payment Card

Because digits embossed on the front of a payment card are irrelevant to electronic processing, which relies on the data in the magnetic stripe, there are no international standards governing which numbers should be embossed onto the front of a payment card. As a general rule, the numbers embossed on the front of the card correspond to data in the magnetic stripe, as none of the data in the stripe (the PAN and other information) is visible to the naked eye.

Each type of card (Visa, MasterCard, etc.) has all or a part of the PAN embossed onto the front of the card. To the extent that PAN digits are omitted from the front of a card, those omitted digits are not at the end of the PAN. To illustrate, assume that the PAN for hypothetical payment card Z contains 18 digits. The front of that card has the last 15 of those digits embossed on its face, which means that the last five digits of the PAN and the last five digits on the front of the payment card are identical:

PAN = 1 2 3 4 5 6 7 8 9 A B C D E F G H I Face of the card = 4 5 6 7 8 9 A B C D E F G H I

C. Shell Payment Cards

With respect to Shell payment cards, the system governing the arrangement and labeling of the numbers embossed on the front was designed more than 50 years ago by a Shell employee whose name has been lost to the ages. The numbers embossed on the front are taken from the PAN. The digits are arranged in two groups labeled "account number" (on the left) and "card number" (on the right):

Dkt. No. 85, Page ID# 536. Each number has a designated significance.

The method Shell used to select the digits comprising Shell's so-called "card number" causes many of its payment cards to have the same digits in the area of the card designated as the "card number." According to Shell, this duplication (as opposed to the more unique sequence of digits in the "account number" section of a Shell payment card) makes it difficult for a merchant to use digits from Shell's "card number" to cross-reference receipts and other documents when performing returns, refunds, and chargebacks.

D. Electronically Printed Receipts and Masking

1. Pre-FACTA

The software controlling electronic processing of credit and debit card transactions dictates which PAN digits will be printed on the receipt. When electronic processing started, receipts contained the entire PAN, the card's expiration date, and the cardholder's name. This made things easy for identity thieves. To combat the growing problem of identify theft, Visa, by contract with its merchants, began to require the software to mask all but the last four digits of the PAN.

Turning back to hypothetical payment card Z, which has an 18-digit PAN with the last 15 digits of the PAN embossed on its face, the PAN, face of the card, and the electronically printed receipt issued following Visa's protocol are as follows:

PAN = 1 2 3 4 5 6 7 8 9 A B C D E F G H I Face of the card = 4 5 6 7 8 9 A B C D E F G H I Receipt = X X X X X X X X X X X F G H I

Due to Visa's size, its PAN masking protocol became the unofficial standard. In the meantime, states passed their own masking statutes to fight identity theft. These statutes often contained inconsistent terms. Eventually, Congress enacted FACTA in an effort to wipe out the patchwork of conflicting state laws and protect consumer credit information.

2. FACTA

The masking provisions in FACTA provide that:

(g) Truncation of credit card and debit card numbers

(1) In general

Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.

(2) Limitation

This subsection shall apply only to receipts that are electronically printed, and shall not apply to transactions in which the sole means of recording a credit card or debit card account number is by handwriting or by an imprint or copy of the card.

15 U.S.C.A. § 1681c(g) (emphasis added).

3. Shell's Masking Protocol

Shell designed its masking protocol before FACTA's enactment. After FACTA was enacted, Shell employees who are not attorneys analyzed the statute and related materials and decided that Shell's pre-FACTA masking protocol complied with FACTA. Under Shell's masking protocol, every digit embossed on the face of a payment card (which, the reader will recall, is a subset of the numbers comprising the PAN) is masked except the last 4 digits of what Shell calls the "account number," which is the first group of numbers embossed on the front of a Shell payment card. Thus, an electronically processed receipt from a purchase made with a Shell payment card looks like this:

XXX XX1234 XXXXX — ACCOUNT —CARD NUMBER— NUMBER— Exp Date: XXX

Ms. Van Straaten contends that Shell is masking the wrong numbers because the relevant numbers on a Shell card under FACTA consist of the entire sequence of digits on the front of a Shell's payment card, which corresponds with the PAN. Ms. Van Straaten then asserts that FACTA requires Shell to mask all of the numbers embossed on the front of the card except up to five digits at the end of the entire sequence of numbers on the front of the card. Under this interpretation of FACTA, an electronically processed receipt from a purchase made with a Shell payment card would look like this:

XXX XXX XXX 12345 —ACCOUNT —CARD NUMBER— NUMBER— Exp Date: XXX

II. Discussion

A. Standard for A Motion For Summary Judgment

Summary judgment is proper "if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed.R.Civ.P. 56(a); Celotex Corp. v. Catrett, 477 U.S. 317, 322, 106 S. Ct. 2548, 91 L. Ed. 2d 265 (1986). "The evidence of the nonmovant is to be believed, and all justifiable inferences are to be drawn in his favor." Valenti v. Qualex, Inc., 970 F.2d 363, 365 (7th Cir.1992). A court should grant a motion for summary judgment only when the record shows that a reasonable jury could not find for the nonmoving party. Id.

To successfully oppose a motion for summary judgment, however, the non-moving party must do more than raise a "metaphysical doubt" as to the material facts. Matsushita Electric Industrial Co. v. Zenith Radio Corp., 475 U.S. 574, 586, 106 S. Ct. 1348, 89 L. Ed. 2d 538 (1986). Instead, it must demonstrate that a genuine issue of fact exists. See id. at 587, 106 S. Ct. 1348; see also Fed.R.Civ.P. 56(e) ("If a party fails to properly support an assertion of fact or fails to properly address another party's assertion of fact" the court may: "(1) give an opportunity to properly support or address the fact; (2) consider the fact undisputed for purposes of the motion; (3) grant summary judgment if the motion and supporting materials—including the facts considered undisputed— show that the movant is entitled to it; or (4) issue any other appropriate order").

B. Shell's Masking Protocol

This case turns on the meaning of the words "card number." 15 U.S.C.A. § 1681c(g)(1) ("Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number"). However, Congress did not provide a definition of "card number."

It is well established that a statute's plain language is "the best indication of Congressional intent." Rodas v. Seidlin, No. 09-3760, 656 F.3d 610, 617 (7th Cir.2011); O'Kane v. Apfel, 224 F.3d 686, 688 (7th Cir.2000) ("When interpreting congressional statutes, we first look at the plain language of the statute because that is the best way to determine congressional intent"). In addition, a court must give the words chosen by Congress their "most natural reading." See McNeil v. United States, 508 U.S. 106, 112, 113 S. Ct. 1980, 124 L. Ed. 2d 21 (1993); see also Smith v. City of Jackson, Mississippi, 544 U.S. 228, 249, 125 S. Ct. 1536, 161 L. Ed. 2d 410 (2005) (discussing the plain language of a statute in terms of its "natural reading"); Commodity Trend Service, Inc. v. Commodity Futures Trading Com'n, 233 F.3d 981, 989 (7th Cir.2000) ("The [Act] does not define client, so we assume that Congress intended the word to have its ordinary meaning").

As the reader will recall, Shell's credit card layout and masking protocol is unique since it divides the numbers embossed on the front of the card into two groups, which it names the "account number" and the "card number." Shell masks all digits except the last four digits of the "account number." In contrast, payment cards such as Visa and Mastercard have a single series of numbers embossed on the front, and mask all digits except the last four.

Ms. Van Straaten argues that Shell must work backwards from all of the numbers on the front of a Shell payment card (i.e., a sequence consisting of Shell's so-called "account number" plus Shell's so-called "card number"). Under this world view, Shell would mask all digits except the last four digits of all of the numbers embossed on the front of the card. These last four numbers are the same as the last four digits of the PAN that is encrypted on the back of the card.

In contrast, Shell asserts that its so-called "account number" embossed on the front of its payment cards is the same thing as FACTA's "card number." It thus contends its practice of masking of all digits except the last four digits of its so-called "account number" complies with FACTA, even though Shell's "account number" digits are neither at the end of the entire sequence of numbers embossed on the front of a Shell card nor the same as the last four digits of the PAN encrypted on the back.

The court is unpersuaded by Shell's interpretation of the words "card number." First, the most natural definition of "card number" as those words are used in FACTA is "all of the numbers on the front of a card." A consumer purchasing a product on-line, when asked to input her card number, types in all of the numbers on the front of the card. If she only typed in a portion of the number, such as the digits corresponding to Shell's so-called "account number" (which Shell asserts is identical to the "card number" in FACTA), the transaction would be rejected.

Furthermore, a common sense understanding of payment cards is that information encrypted on the back of a payment card corresponds to the numbers on the front. See Gil v. Reed, 381 F.3d 649, 662 (7th Cir.2004) (the court "need not check [its] common sense at the door"). It is likely that anyone who uses payment cards has experienced the phenomena of the swipe that does not work, leading to the manual entry of the numbers on a card's front into a terminal. Once these numbers are entered, the transaction is processed and an electronic receipt is generated. The person manually entering the numbers does not type in a portion of the numbers on the front; she types in the entire sequence. The court thus concludes that the phrase "card number" most naturally refers to the entire sequence of numbers on the front of the card, which corresponds (as described above) to the PAN encrypted on the back.

Moreover, "[s]tatutory language only has meaning in context." Shlahtichman v. 1-800 Contacts, Inc., 615 F.3d 794, 802 (7th Cir.2010), quoting Graham County Soil & Water Conservation Dist. v. United States ex rel. Wilson, 545 U.S. 409, 415, 125 S. Ct. 2444, 162 L. Ed. 2d 390 (2005). FACTA was enacted to, among other things, safeguard against identity theft. See id. at 802, quoting Pub.L. 108-159, 117 Stat. 1952 (Dec. 4, 2003) (describing FACTA as "[a]n [a]ct [t]o amend the Fair Credit Reporting Act, to prevent identity theft, improve resolution of consumer disputes, improve the accuracy of consumer records, make improvements in the use of, and consumer access to, credit information, and for other purposes"). To achieve this purpose, Congress chose to focus on electronically printed receipts. See 15 U.S.C.A. § 1681c(g)(2) ("This subsection shall apply only to receipts that are electronically printed, and shall not apply to transactions in which the sole means of recording a credit card or debit card account number is by handwriting or by an imprint or copy of the card").

As noted above, the PAN corresponds to the numbers embossed on the front of a payment card. The PAN is encrypted onto the magnetic stripe on a payment card and is an essential part of the creation of electronically printed receipts. Indeed, international standards require the magnetic stripe to contain the PAN. Because FACTA only applies to electronically printed receipts and international standards require the magnetic stripe to contain the PAN, the phrase "the last 5 digits of the card number" necessarily must refer to the last five digits that can be read electronically. To hold otherwise would require the court to ignore Congress' expressed intent to regulate receipts produced electronically since swiped payment cards read the magnetic stripe, not the numbers on the face of a card. See Commodity Trend Service, Inc. v. Commodity Futures Trading Com'n, 233 F.3d 981, 989 (7th Cir.2000) (generally, "all words in a statute should, if possible, be given effect").

Similarly, the court must "avoid interpreting a statute in a way that renders a word or phrase redundant or meaningless." United States v. Berkos, 543 F.3d 392, 396 (7th Cir.2008). Congress did not authorize the printing of up to five digits of any portion of the card number. Instead, it specifically chose to adopt a uniform system based on printing of "the last 5 digits of the card number." 15 U.S.C.A. § 1681c(g)(1) (emphasis added). "Dictionaries are a helpful resource in ascertaining the common meaning of terms that a statute leaves undefined." Shlahtichman v. 1-800 Contacts, Inc., 615 F.3d at 799. "Last," instead, means "[f]ollowing all others; coming at the end." "Last, adj. (and n.) and adv." The Oxford English Dictionary (2d ed. 1989). Thus, a merchant may not, at its discretion, choose a subset of the numbers on the front of the card (which as noted above correspond to information encrypted on the back of the card) and then print up to the last five digits of that chosen sequence. See generally Sobitan v. Glud, 589 F.3d 379, 386 (7th Cir.2009) (rejecting party's interpretation of a statute because it would render words in the statute "superfluous, a result we try to avoid").

This conclusion is further supported by the fact that the existence of a patchwork of inconsistent masking protocols and the resulting potential for identify theft led to the enactment of FACTA. See Pub. L. No. 108-159, 117 Stat. 1952 (Dec. 4, 2003) (FACTA was enacted to provide a uniform standard, preempting all state laws, to "prevent identity theft"). The court declines to accept Shell's contention that FACTA permits it to mask numbers at the end of one of two sequences it has chosen to emboss on the front of Shell cards, as allowing a card issuer to choose the digits to mask would subvert the intent of Congress to provide a national standard. See id.; see also Creative Hospitality Ventures, Inc. v. U.S. Liability Ins. Co., 655 F. Supp. 2d 1316, 1333 (S.D.Fla.2009) (collecting authority concluding that FACTA was meant to address the "national concern" of identify theft).

Shell also appears to be contending that because it chose to call a series of numbers on the front of the card the "account number," it can disclose up to five digits of that series of numbers. This argument is based on Shell's position that its "account number" is the same as FACTA's "card number." The court has already rejected this idiosyncratic interpretation of the words "card number."

Shell next notes that the terms "card number" and "account number" are generally used interchangeably in the payment card industry. It then concludes that its practice of printing the last four digits of its "account number" complies with FACTA because "card number" and "account number" are the same thing. The court disagrees. For virtually all payment cards other than Shell cards, the terms "card number" and "account number" refer to the same series of numbers. Thus, they can be used interchangeably because regardless of what the series of numbers is called, the contents of the series remain the same. In contrast, Shell's focus on its so-called "account number," which is a sub-set of the "card number" as that term is used in FACTA, means it is an outlier. Since Shell chose not to follow the otherwise uniform industry standard when designing its payment cards and masking protocol, its current predicament is of its own making. It cannot, therefore, find refuge in the general interchangeability of the terms "card number" and "account number."

In addition, Shell argues that its so-called "account number" is the same as FACTA's "card number" because if FACTA's "card number" refers to a sequence of numbers contained in the PAN, a Shell card user would be unable to ascertain if Shell had complied with FACTA's masking protocol by looking at a receipt since the PAN can only be read electronically. This is unpersuasive; Shell chose to selectively place and group certain numbers on the front of its payment cards. To the extent that its protocol does not allow consumers to ascertain if a merchant properly masked "the last 5 digits of the card number," 15 U.S.C.A. § 1681c(g)(1), Shell is responsible and cannot use its own chosen protocol to support its interpretation of FACTA.

Finally, Shell notes that the method used to select the digits comprising the "card number" section on a Shell payment card (i.e., the second group of numbers on the front of a Shell card) causes many Shell payment cards to share the same Shell "card number." According to Shell, this duplication makes it difficult for a merchant to use digits from the Shell "card number" to cross-reference receipts and other documents when performing returns, refunds, and chargebacks.

This concern is at odds with FACTA, which allows merchants to choose between electronically printing the expiration date or up to the last five digits of the card number. 15 U.S.C.A. § 1681c(g). Congress thus explicitly allows merchants to print the month-year expiration date of a payment card (MM-YY or MM-YYYY) on an electronically produced receipt instead of up to five digits of the card number. The expiration date digits are far less distinctive than the last five digits of Shell's "card number" because a significant number of payment cards have an identical expiration date. Thus, the information on receipts associated with cards expiring in the same year would be identical. In contrast, the last five digits of FACTA's "card number" are more distinctive.

In sum, "[w]hen the statute's language is plain, the sole function of the courts—at least where the disposition required by the text is not absurd—is to enforce it according to its terms." Lamie v. United States Trustee, 540 U.S. 526, 534, 124 S. Ct. 1023, 157 L. Ed. 2d 1024 (2004) (internal quotations and citations omitted). Following the enactment of FACTA, Shell chose to keep its pre-FACTA card number arrangement scheme and elected to continue to mask based on the "account number" digits on the front of Shell payment cards. For the reasons discussed above, the court finds that this masking system fails to comply with FACTA.

C. Constitutionality of FACTA

Shell contends that if its interpretation of FACTA is wrong, then FACTA's masking provisions are unconstitutionally vague because they fail to give fair warning of what is prohibited. Ms. Van Straaten did not respond to this argument, but the court declines to strike down a provision in a federal statute as unconstitutional based on forfeiture.

A law is void for vagueness if it "fails to give fair warning of what is prohibited, if it fails to provide explicit standards for the persons responsible for enforcement and thus creates a risk of discriminatory enforcement, and if its lack of clarity chills lawful behavior." Anderson v. Milwaukee County, 433 F.3d 975, 978 (7th Cir.2006); see also Coe v. Cook County, 162 F.3d 491, 496 (7th Cir.1998) ("[s]tatutes and other enactments present a constitutional issue of vagueness when they deter constitutionally protected activity, fail to provide even minimum guidance as to people's legal obligations, or give law enforcers excessive discretion that might be exercised in arbitrary or invidious ways").

If a statute regulates economic activity, it "is subject to a less strict vagueness test [than criminal statutes] because its subject matter is often more narrow, and because businesses, which face economic demands to plan behavior carefully, can be expected to consult relevant legislation in advance of action." Iosello v. Leiblys, Inc., 502 F. Supp. 2d 782, 785 (N.D.Ill. 2007), quoting Village of Hoffman Estates v. Flipside, Hoffman Estates, Inc., 455 U.S. 489, 498, 102 S. Ct. 1186, 71 L. Ed. 2d 362 (1982). The court must thus consider whether FACTA's masking provisions are "sufficiently clear that [their] prohibitions would be understood by an ordinary person operating a profit-driven business." Id.

Numerous defendants who provided electronic receipts with the last four or five digits of a card number and the expiration date have unsuccessfully argued that FACTA's masking protocol is ambiguous. See, e.g., Ramirez v. Midwest Airlines, Inc., 537 F. Supp. 2d 1161, 1171 (D.Kan.2008) (collecting cases). Similarly, defendants have unsuccessfully argued that the prohibition against printing more than the last 5-digits or expiration date rule is unconstitutionally vague. See id. at 1172 (rejecting claim by defendant who printed last four digits and the expiration date); Follman v. Village Squire, Inc., 542 F. Supp. 2d 816, 820-21 (N.D.Ill.2007) (collecting cases). Merchants have also unsuccessfully tried to escape FACTA liability by contending that FACTA's statutory damages provision is unconstitutionally vague because it authorizes an award of damages ranging from $100.00 to $1,000.00 but does not specify criteria for assessing the amount of damages within that range. See, e.g., Harris v. Mexican Specialty Foods, Inc., 564 F.3d 1301, 1311-12 (11th Cir.2009). Shell, however, appears to be the first card issuer to contend that the phrase "the last 5 digits of the card number," 15 U.S.C.A. § 1681c(g)(1), is unconstitutionally vague.

As noted above, Shell's problems flow from its decision to emboss a subset of the PAN on the front of Shell payment cards as the so-called "account number" and then mask everything except the last four digits of that "account number." As discussed above, however, the court declines to find that FACTA, which was enacted to ensure that sensitive, private consumer information would be handled uniformly, permits merchants to select their own series of numbers to disclose. Without meaning to impugn the Shell employees responsible for Shell's masking policy, a person of common intelligence would grasp this and would not have chosen to eschew the otherwise universally accepted practice of having the numbers on the front of a card correspond to the PAN encrypted on the back and disclosing the numbers at the end of this sequence of numbers as opposed to a self-selected subset of those numbers. The court thus declines to strike down § 1681c(g) as unconstitutionally vague.

D. Willfullness

Ms. Van Straaten concedes that Shell's masking protocol has not caused her to incur any damages. Indeed she apparently continues to use her Shell payment card. Nevertheless, she seeks damages under 15 U.S.C. § 1681n(a)(1)(A), which allows actual damages or statutory damages of at least $100 but no more than $1,000 per occurrence. See 15 U.S.C. § 1681n(a)(1)(A) ("Any person who willfully fails to comply with any requirement imposed under this title with respect to any consumer is liable to that consumer in an amount equal to the sum of (1)(A) any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000"). Given the number of Shell payment cards in existence, even the low end of this range would be an extremely large number if this case were to proceed as a class action. If Shell's conduct is willful, it may also be liable for Ms. Van Straaten's costs and attorney's fees as well as punitive damages. See 15 U.S.C. § 1681n(a)(2)(3). In contrast, if Shell's conduct is negligent as opposed to willful, Shell may be liable only for actual damages, costs, and attorney's fees. See 15 U.S.C. § 1681o (a)(1)-(2).

A willful violation of FACTA can be either knowing or reckless. See Safeco Ins. Co. v. Burr, 551 U.S. 47, 57, 127 S. Ct. 2201, 167 L. Ed. 2d 1045 (2007). According to the Supreme Court, the Restatement (Second) of Torts is helpful in understanding what conduct is "reckless":

The actor's conduct is in reckless disregard of the safety of another if he does an act or intentionally fails to do an act which it is his duty to the other to do, knowing or having reason to know of facts which would lead a reasonable man to realize, not only that his conduct creates an unreasonable risk of physical harm to another, but also that such risk is substantially greater than that which is necessary to make his conduct negligent.

Id. at 69, 127 S. Ct. 2201, citing Restatement (Second) of Torts § 500 (1963-64).

Shell's decision to challenge the constitutionality of FACTA's masking provisions led to the court's finding that FACTA's reference to "the last five digits of the card number," 15 U.S.C. § 1681c(g), is "sufficiently clear that its prohibitions would be understood by an ordinary person operating a profit-driven business," Iosello v. Leiblys, Inc., 502 F.Supp.2d at 785. This does not, however, necessarily mean that Shell's conduct was willful. The court thus considers whether Shell is entitled to summary judgment in its favor as to willfulness.

Shell first contends that its conduct was not willful because no court has issued a decision stating that Shell's specific masking protocol violates FACTA. In support it directs the court's attention to Shlahtichman v. 1-800 Contacts, Inc., a recent Seventh Circuit decision holding that a defendant's masking protocol was not willful because "[t]o date, there has been no contrary opinion from a court of appeals or federal agency suggesting that the company's understanding of the statute is wrong." 615 F.3d at 794. In Shlahtichman, the Seventh Circuit went on to note that "even if its construction of the statute turns out to be mistaken, it is objectively reasonable nonetheless for all of the reasons we have discussed" so the defendant's inclusion of information prohibited by FACTA in an email receipt was not reckless. Id.

Critically, in Shlahtichman, the Seventh Circuit found that the defendant's interpretation of the statutory language at issue was objectively reasonable because the court agreed with that interpretation. In contrast, in this case the court did not find that Shell's conduct was objectively reasonable as it concluded that Shell's masking protocol violates FACTA. Moreover, the court declines to adopt a FACTA version of the age old proverb "every dog is allowed one bite" as the mere absence of authority contrary to Shell's position does not mean that as the first company to adopt this position, it gets an automatic free pass. See generally OXFORD DICTIONARY OF PROVERBS, at 79 (Jennifer Speake ed. 2003) ("The proverb [every dog is allowed one bite] is based on the old common law rule (dating at least from the seventeenth century) by which the keeper of a domestic animal was not liable for harm done by it unless he knew of its vicious propensities").

The court thus turns to the evidence presented by the parties that purportedly demonstrates that Shell was/was not willful. It is undisputed that Shell knew about FACTA's truncation requirements and decided (erroneously, as discussed above) that its protocol complied with FACTA. At Shell, Frankie McCuller, Shell's Rule 30(b)(6) witness, and two of her co-employees, Mike Iribarren and Elwood Holmes, were responsible for ensuring compliance with state truncation laws, and Ms. McCuller was responsible for deciding the truncation protocol used by Shell's software. None of these employees are lawyers. Ms. McCuller is thus Shell's key witness regarding wilfulness as Shell did not involve lawyers in its decisions about FACTA truncation and, in any event, the court previously held that Shell could not rely on an "advice of counsel" defense because it claimed during discovery that information about its communications with counsel were privileged. See Docket No. 71.

Ms. McCuller received communications stating that FACTA required merchants to mask digits at the end of the PAN. She nevertheless reviewed FACTA and decided that Shell's masking software, which masked digits from the "account number" section embossed on the front of the Shell cards, complied with it. Ms. Van Straaten characterizes this decision as reckless, especially given that Ms. McCuller is not an attorney. Shell, on the other hand, decries this position as "elitist" and contends that the facts surrounding Ms. McCullen's decision— including her review of documents that allegedly support her interpretation of FACTA—show that she was an experienced employee who made considered, educated decisions within her scope of expertise. This court declines to determine, as a matter of law based on the current record, whether Shell's conduct was reckless. This issue is a question of fact that must be considered by a jury.

III. Conclusion

For the above reasons, Shell's motion for summary judgment [84] is denied. In addition, Ms. Van Straaten's motions for leave to file a sur-reply [111] and supplemental authority [147] are granted. A joint status report summarizing the dates set by the magistrate judge for remaining pretrial matters and the parties' views regarding what further proceedings are necessary shall be filed by October 18, 2011. This matter is set for status on October 20, 2011, at 11:00 a.m.

STATEMENT

In this case, plaintiff Natalie Van Straaten seeks to represent a class of consumers who used Shell's proprietary credit and debit cards at Shell gas stations. Ms. Van Straaten contends that Shell Oil Products Company, Equilon, and Shell Oil (collectively Shell) improperly truncated the digits on Shell's payment cards by masking the wrong digits on the receipt. The court recently denied Shell's motion for summary judgment. Shell's motion to certify under § 1292(b) or, alternatively, to reconsider [161] followed. Plaintiff Natalie van Straaten has also filed a motion for leave to file supplemental materials in opposition to Shell's motion [171] and a motion to certify a class [166].

Section 1292(b) provides, in pertinent part, that "[w]hen a district judge, in making in a civil action an order not otherwise appealable under this section, shall be of the opinion that such order involves a controlling question of law as to which there is substantial ground for difference of opinion and that an immediate appeal from the order may materially advance the ultimate termination of the litigation, [s]he shall so state in writing in such order." Shell asks the court to certify the following two questions for interlocutory appeal:

(1) Whether Shell's interpretation of the phrase "card number" in FACTA and its resulting truncation protocol, even if wrong, could be reckless as a matter of law?

(2) Whether the undefined term "card number," as used in FACTA, refers exclusively to the card's "Primary Account Number" ("PAN") even though there is no reference to "PAN" in the statute or legislative history?

Dkt. 161, Page ID # 2276; Dkt. 162, Page ID # 2279. Alternatively, it asks the court to reconsider its ruling that Shell is not entitled to summary judgment on the question of willfulness.

The court begins by noting that it disagrees with Shells' characterization of the reasoning and holding in the summary judgment order sought to be appealed. For example, the court did not hold that "card number" equals 100% of the PAN. Instead, it analyzed the truncation requirements in FACTA and reached a conclusion about which digits must be truncated. The court also finds that Shell's questions are excessively adversarial and fail to fairly express the legal issues at the heart of this case. This is immaterial, however, as § 1292(b) provides for certification of orders for appeal, not questions. Edwardsville Nat'l Bank & Trust Co. v. Marion Labs., Inc., 808 F.2d 648, 650 (7th Cir. 1987) ("The question is the reason for the interlocutory appeal, but the thing under review is the order") (emphasis in original); see also 28 U.S.C. § 1292(b) (referencing "an immediate appeal from the order"); Rodgers v. Allen, No. 05 C 3540, 2009 WL 2872912, at *2 (N.D.Ill. Sept. 2, 2009) (collecting cases). The court thus turns to the § 1292(b) factors.

A petition for interlocutory appeal must be filed with the district court within a reasonable time after entry of the order sought to be appealed. Ahrenholz v. Board of Trustees of Univ. of Ill., 219 F.3d 674, 676 (7th Cir.2000). Moreover, the movant must satisfy "four statutory criteria.... there must be a question of law, it must be controlling, it must be contestable, and its resolution must promise to speed up the litigation." Id. at 675 (emphasis in original). Finally, interlocutory appeals under § 1292(b) are disfavored so certification is appropriate only in exceptional cases. See, e.g., Coopers & Lybrand v. Livesay, 437 U.S. 463, 473-74, 98 S. Ct. 2454, 57 L. Ed. 2d 351 (1978).

Timeliness

Shell filed its motion in a reasonable amount of time, as it filed its motion three weeks after the court issued its ruling denying summary judgment.

Question of Law

The phrase "question of law" in § 1292(b) refers to "a question of the meaning of a statutory or constitutional provision, regulation, or common law doctrine" Ahrenholz v. Board of Trustees of Univ. of Ill., 219 F.3d at 676. Thus, an interlocutory appeal is proper only when the contested issue is "a `pure' question of law rather than merely an issue that might be free from a factual contest." Id. at 677 ("`question of law' means an abstract legal issue rather than an issue of whether summary judgment should be granted").

It is undisputed that Ms. Van Straaten has not suffered any injury as a result of Shell's long-time truncation protocol. Moreover, as Shell recently stopped printing any card digits on receipts in response to the court's denial of summary judgment, she will not suffer any future harm. Thus, Ms. Van Straaten (and her fellow class members if a class is certified) may recover statutory damages only if Shell (1) violated FACTA's truncation provision, see 15 U.S.C. § 1681n(a)(1)(A) (based on a willful violation of FACTA, a plaintiff may recover actual damages or statutory damages of at least $100 but no more than $1,000 per occurrence) and (2) Shell did so in a knowing or reckless manner, see Safeco Ins. Co. v. Burr, 551 U.S. 47, 57, 127 S. Ct. 2201, 167 L. Ed. 2d 1045 (2007). The court found that Shell violated FACTA and that whether it acted willfully was a question of fact. The statutory interpretation question was at the heart of the court's order and is at the front of its mind as it considers certification under § 1292(b).

If Shell's interpretation of the words "card number" in FACTA is correct, it did not violate FACTA. If so, its truncation protocol by definition would be objectively reasonable and, hence, not a willful violation of FACTA. Determining the meaning of a statute is a question of law. See Ahrenholz v. Board of Trustees of Univ. of Ill., 219 F.3d at 676-77. Moreover, Ms. Van Straaten's characterization of the FACTA issue as fact-driven is incorrect; details about how payment cards are encrypted and processed are necessarily technical but this does not transform a question of statutory interpretation regarding which numbers to truncate into a fact-based question. Accordingly, the court finds that the interpretation of the words "card number" in FACTA is a question of law.

Controlling

"A question of law may be deemed `controlling' if its resolution is quite likely to affect the further course of the litigation, even if not certain to do so." Sokaogon Gaming Enterprise Corp. v. Tushie-Montgomery Associates, Inc., 86 F.3d 656, 659 (7th Cir.1996). If Shell's interpretation of "card number" carries the day, for all practical purposes, this case will be over.

In addition, in orders disposing of a large percentage of the plaintiff's recoverable damages, "the proper measure of damages is always a controlling question of law." In re Brand Name Prescription Drugs, No. 94 C 897, 1998 WL 808992, at *5 (N.D.Ill. Nov. 17, 1998); see also Hollinger Intern., Inc. v. Hollinger, Inc., No. 04 C 0698, 2005 WL 327058, at *2 (N.D.Ill. Feb. 3, 2005) (collecting cases). If Shell willfully violated FACTA's truncation provisions, it faces an extremely significant statutory damages award if this case proceeds as a class action as FACTA allows statutory damages between $100 and $1,000 per occurrence. See 15 U.S.C. § 1681n(a)(1)(A). Given the number of Shell payment cards in circulation and the associated number of transactions, even the low end of this range would be a very large number. The parties will doubtless have much to say about the propriety of that kind of statutory damages award if that issue is ever before the court. For the present, however, the court finds that the "controlling question" factor has been met.

Contestable

The third statutory criterion under § 1292(b) is that the question of law must be contestable; i.e., that "substantial grounds for a difference of opinion" on the issue exist. 28 U.S.C. 1292(b). Courts have adopted different definitions of "contestable." An issue may contestable if there is a "difficult central question of law which is not settled by controlling authority" and a "substantial likelihood" exists that the district court's ruling will be reversed on appeal. In re Brand Name Prescription Drugs Antitrust Litigation, 878 F. Supp. 1078, 1081 (N.D.Ill.1995). The existence of conflicting authority may indicate that an issue is contestable. See Hoffman v. Carefirst of Ft. Wayne, Inc., No. 1:09-CV-251, 2010 WL 3940638, at *2 (N.D.Ind. Oct. 6, 2010) (collecting cases); Federal Deposit Ins. Corp. v. First Nat'l Bank of Waukesha, Wisconsin, 604 F. Supp. 616, 620 (D.C.Wis.1985) ("§ 1292(b) was not intended merely to provide an avenue for review of difficult rulings in hard cases, and the mere fact that there is a lack of authority on a disputed issue does not necessarily establish some substantial ground for a difference of opinion under the statute"). On the other hand, the novelty of an issue may demonstrate that an issue is contestable. See City of Joliet v. Mid-City Nat. Bank, No. 05 C 6746, 2008 WL 4889038, at *2 (N.D.Ill. Jun. 13, 2008) (granting motion to certify appeal), aff'd sub nom. by City of Joliet, Ill. v. New West, L.P., 562 F.3d 830 (7th Cir.2009); Bayer Healthcare, LLC v. Norbrook Laboratories, Ltd., Nos. 08 C 953 & 09 C 108, 2010 WL 338089, at *5 (E.D.Wis. Jan. 20, 2010) (issue of first impression created a substantial ground for difference of opinion).

The court believes that its analysis of FACTA is correct. Nevertheless, the legal issues posed by Shell's recently abandoned truncation system, which was linked to its unique method of arranging the digits on the face of its payment cards, are novel and extremely interesting. While the court ultimately ruled against Shell, the FACTA issues in this case were difficult and thought provoking. Moreover, because to this court's knowledge Shell's system was an outlier, the absence of conflicting authority is not meaningful. Accordingly, "[w]hile the court is loath to determine that there is a `substantial likelihood' that it will be reversed on appeal" it nevertheless "determines that the issue presented ... is contestable." City of Joliet v. Mid-City Nat. Bank, 2008 WL 4889038, at *2.

On a related note, Shell contends that controlling authority shows that the order at issue is contestable because even if it violated FACTA, its conduct still could be objectively reasonable. This misconstrues the court's decision. In connection with Shell's void for vagueness challenge to FACTA, the court held that the statutory language is sufficiently clear that its prohibitions would be understood by an ordinary person operating a profit-driven business. This begs the question: given that holding, can Shell's now-former protocol be objectively reasonable since it is at odds with FACTA's clear language? This question is why the court considered whether Shell acted willfully or recklessly when it decided what digits to print on receipts. It also further demonstrates how central the FACTA interpretation question, which is at the heart of this court's decision to certify its order for interlocutory appeal and the lynchpin of Ms. Van Straaten's claims, is to this case. If Shell's reading of FACTA is correct, then many other issues potentially fall by the wayside. On the other hand, if Shell is wrong, the court can then consider other fact-based disputes which are easily severable from the FACTA interpretation issue, such as whether Shell acted willfully or recklessly.

Materially Advance

This brings the court to the final § 1292(b) prong: whether "an immediate appeal from the order may materially advance the ultimate termination of the litigation." 28 U.S.C. § 1292(b). Shell asserts that an immediate appeal will save everyone time and expense and thus materially advance the ultimate termination of this action. This can be said for virtually all interlocutory appeals presenting a potentially dispositive issue. The court also appreciates the inherent inefficiency as well as the extra time and expense associated with an interlocutory appeal. Nevertheless, the court believes that an immediate appeal would materially advance the litigation because a resolution in Shell's favor would essentially end the case and forestall extremely protracted, costly litigation and determination of multiple additional novel and complex issues.

Accordingly, for the foregoing reasons, Shell's motion for certification pursuant to 28 U.S.C. § 1292(b) is granted, and the court certifies its September 26, 2011, order denying Shell's motion for summary judgment [Dkt. Nos. 152, 153 & 154] for interlocutory review. To the extent that Shell seeks reconsideration of that order, its motion is denied.