Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 1 of 14 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF FLORIDA CASE NO.: JENNIFER ORSI, individually and on behalf of all others similarly situated, v. Plaintiff, CLASS ACTION JURY DEMAND SP PLUS CORPORATION, a Delaware corporation, Defendant. / CLASS ACTION COMPLAINT 1. Everyday thousands of consumers travel through airports across the United States. Many times during these travels, consumers pay for goods or services with their debit or credit cards. Those consumers paying by debit or credit card entrust the merchants they pay with sensitive financial information, in turn, they expect the merchants to protect their financial information from identity thieves. 2. With sophisticated tools at their disposal, identity thieves seize upon a merchant s lack of protection. According to a recent study, 16.7 million consumers were victims of identity fraud resulting in the loss of approximately $16.8 billion dollars. (See 2018 Javelin Strategy & Research, Identity Fraud Study). As of 2018, nearly 60 million Americans have been affected by identity theft. (See https://www.lifelock.com/learnidentity-theft-resources-how-common-is-identity-theft.html (Last Viewed: October 16, 2018)). 1
Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 2 of 14 3. Congress enacted the Fair and Accurate Credit Transactions Act ( FACTA ) to protect consumers from identity theft. Specifically, FACTA provides, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last five (5) digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction. 15 U.S.C. 1681c(g). 4. Defendant, SP Plus Corporation s ( SP Plus ), is one of the leading providers of parking management and other ancillary services at airports across the United States, including Ft. Lauderdale, Florida. SP Plus accepts credit card and debit card payments from consumers for these services. 5. Plaintiff, Jennifer Orsi ( Plaintiff ), on behalf of herself and all others similarly situated, alleges SP Plus knowingly or recklessly ignored its credit card truncation duties by printing receipts with more than five (5) digits of their credit or debit card numbers. As a result, SP Plus violated their trust and exposed them to a heightened level of identity theft. 6. Recently, the Eleventh Circuit Court of Appeals held that producing transaction receipts that fail to truncate all but the last five digits of a credit or debit card number causes consumers to incur multiple concrete harms. See Muransky v. Godiva Chocolatier, Inc., 16-16486, --- F.3d ---, 2018 WL 4762434 (11th Cir. Oct. 3, 2018). 7. SP Plus has willfully violated FACTA causing Plaintiff and the other class members concrete injuries, which entitles them to statutory damages between $100 and $1,000, as well as attorney s fees and costs. 15 U.S.C. 1681n(a)(1), (a)(2). 2
Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 3 of 14 JURISDICTION AND VENUE 8. This Court has jurisdiction under 28 U.S.C. 1331 because this action arises under a federal statute. 9. Venue is proper in this District under 28 U.S.C. 1391 because a substantial part of the events or omissions giving rise to the claim occurred here, SP Plus does business in this district, and its contacts here are sufficient to subject it to personal jurisdiction. PARTIES 10. Plaintiff is a natural person, residing in the State of Florida. 11. SP Plus is a Delaware corporation whose principal address is 200 E. Randolph Street, Suite 7700, Chicago, IL 60611, and whose registered agent for service of process is CT Corporation System, 1200 South Pine Island Road, Plantation, FL 33324. 12. SP Plus is in the business of providing parking management services, including, but not limited to, operating private and public parking facilities for itself, its subsidiaries, affiliates and others. FACTA S BACKGROUND 13. In 2003, Congress enacted FACTA, which President George W. Bush signed into law. At signing, President George W. Bush remarked that [s]lips of paper that most people throw away should not hold the key to their savings and financial secrets. 39 Weekly Comp. Pres. Doc. 1746, 1757 (Dec. 4, 2003). President Bush added that the government, through FACTA, was act[ing] to protect individual privacy. Id. 14. Codified at 15 U.S.C. 1681c(g), FACTA s truncation provision states the following: Except as otherwise provided in this subsection, no person that accepts credit 3
Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 4 of 14 cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of sale or transaction. (hereinafter the Receipt Provision ). 15. After enactment, FACTA provided three years in which to comply with its requirements, mandating full compliance with its provisions no later than December 4, 2006. The requirement was widely publicized among retailers and the Federal Trade Commission. 16. For example, in response to earlier state legislation enacting similar truncation requirements, on March 6, 2003, the CEO of Visa USA, Carl Pascarella, explained that Today, I am proud to announce an additional measure to combat identity theft and protect consumers. Our new receipt truncation policy will soon limit cardholder information on receipts to the last four digits of their accounts. The card s expiration date will be eliminated from receipts altogether. The first phase of this new policy goes into effect July 1, 2003 for all new terminals.. (Visa USA Announces Account Truncation Initiative to Protect Consumers from ID Theft; Visa CEO Announces New Initiative at Press Conference With Sen. Dianne Feinstein, PR Newswire, March 6, 2003). 17. Within 24 hours, MasterCard and American Express announced they were imposing similar requirements. 18. The card issuing organizations then proceeded to require compliance with FACTA by contract, in advance of FACTA s mandatory compliance date. 4
Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 5 of 14 19. After its enactment, Congress gave merchants a second chance. Congress passed a law absolving all past violations of FACTA. See The Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241, 122 Stat. 1565 (2008). 20. Card processing companies continued to alert merchants, including SP Plus, of FACTA s requirements. According to a Visa Best Practice Alert in 2010: Some countries already have laws mandating PAN truncation and the suppression of expiration dates on cardholder receipts. For example, the United States Fair and Accurate Credit Transactions Act (FACTA) of 2006 prohibits merchants from printing more than the last five digits of the PAN or the card expiration date on any cardholder receipt. (Please visit http://www.ftc.gov/os/statutes/fcrajump.shtm for more information on the FACTA.) To reinforce its commitment to protecting consumers, merchants, and the overall payment system, Visa is pursuing a global security objective that will enable merchants to eliminate the storage of full PAN and expiration date information from their payment systems when not needed for specific business reasons. To ensure consistency in PAN truncation methods, Visa has developed a list of best practices to be used until any new global rules go into effect. (See Visa Alert, attached hereto as Exhibit A.) 21. Most of SP Plus s business peers and competitors readily brought their credit card and debit card receipt printing process into compliance. They programmed their card machines and devices to comply with the truncation requirement. SP Plus could have readily done the same, but didn t. 22. To be clear, since 2003 the processing companies have required merchants to truncate consumer s credit card number. For example, American Express required: Pursuant to Applicable Law, truncate the Card Number and do not print the Card's Expiration Date on the copies of Charge Records delivered to Card Members. Truncated Card Number digits must be masked with replacement characters such as x, *, or #, and not blank spaces or numbers. 5
Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 6 of 14 (See Exhibit B, attached hereto.) 23. MasterCard adopted the same policy: A Transaction receipt generated by an electronic POI Terminal, whether attended or unattended, must not include the Card expiration date. In addition, a Transaction receipt generated for a Cardholder by an electronic POI Terminal, whether attended or unattended, must reflect only the last four digits of the primary account number (PAN). All preceding digits of the PAN must be replaced with fill characters, such as "X," "*," or "#," that are neither blank spaces nor numeric characters. (See Exhibit C, attached hereto) 24. Identity theft is so problematic that the three major credit reporting agencies, Experian, Equifax, and Trans Union set up a free website to comply with FACTA s requirements. 25. FACTA clearly prohibits the printing of more than the last 5 digits of the card number to protect persons from identity theft. PLAINTIFF S ALLEGATIONS 26. On September 17, 2018, Plaintiff landed at the Fort Lauderdale International Airport on a return flight. 27. Plaintiff s car was parked in a garage at the Fort Lauderdale International Airport, which was operated and maintained by SP Plus. 28. Plaintiff paid SP Plus for parking services at the aforementioned garage using her personal credit card. 29. After Plaintiff made the payment, SP Plus printed a receipt that displayed the last eight digits of her credit card number and provided it to Plaintiff at the point of sale. (Exhibit D). 6
Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 7 of 14 30. Plaintiff and members of the class entrusted SP Plus with the sensitive financial information on her credit card. In disseminating receipts with more than the last five credit or debit card digits, SP Plus violated Plaintiff s and others trust and subjected them to an unnecessary heightened risk of identity theft. 31. SP Plus had knowledge of FACTA s requirements. In a 2008 Form 10-K Statement filed with the United States Securities and Exchange Commission, SP Plus (formerly known as Standard Parking Corporation ) stated: We are also subject to consumer credit laws and credit card industry rules and regulations relating to the processing of credit card transactions, including the Fair and Accurate Credit Transactions Act and the Payment Card Data Security Standard. This law and these industry standards impose substantial financial penalties for non-compliance. A purported class action was recently filed against us alleging violations of the Fair and Accurate Credit Transactions Act. Similar complaints have been filed against many credit card processors. (http://ir.spplus.com/secfiling.cfm?filingid=1047469-09-2583&cik) (Last visited October 7, 2014) (emphasis added). 32. Moreover, consumers have placed SP Plus on notice for violating FACTA by filing multiple lawsuits against the company In the past few years. 33. At all times relevant, SP Plus was acting by and though their agents, servants and/or employees, each of which were acting within the course and scope of their agency or employment, and under the direct supervision and control of SP Plus. 34. At all times relevant, the conduct of SP Plus, as well as that of their agents, servants and/or employees, was in willful and reckless disregard of federal law and the rights of the Plaintiff. 35. It is SP Plus s policy and procedure to print receipts at the point of sale i.e., immediately upon receiving a credit or debit card payment. 7
Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 8 of 14 36. Consistent with SP Plus s policy and procedure, SP Plus knowingly and intentionally includes more than the last five (5) digits of the card number on its electronically printed receipts. 37. The digits appearing on the receipt are not printed accidentally; the equipment and software used to print the receipts and electronically store an image of same must be programmed to display certain information, and likewise, programmed not to display certain information. 38. Notwithstanding the fact that it has had years to comply, SP Plus continues to issue point of sale receipts, which contain more than the last five (5) digits of the card number, in direct violation of the Receipt Provision of the FCRA. 39. Notwithstanding the Receipt Provision, SP Plus continues to deliberately, willfully, intentionally, and/or recklessly violate FACTA by issuing receipts which do not comply with the FCRA. 40. Notwithstanding the fact that SP Plus had years to comply with FACTA s requirements and the fact that SP Plus was previously sued for violating the exact same federal statute, SP Plus continues to act in conscious disregard for the rights of others. See Redman v. RadioShack Corp., --- F.3d ----, 2014 WL 4654477, *14 (7th Cir. Sept. 19, 2014) (explaining that issue of willfulness in FACTA class action lawsuit was straightforward wherein defendant violated a parallel state statute years earlier). 41. SP Plus has engaged in conduct that creates an unjustifiably high risk of harm that is either known or so obvious that it should be known Id. at *2. 8
Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 9 of 14 CLASS ALLEGATIONS 42. This matter is brought as a Class Action under Fed. R. Civ. P. 23. Plaintiff proposes the following class, defined as follows, subject to modification by the Court as required: (i) All persons in the United States (ii) who, when making payment to a facility operated or maintained by SP Plus (iii) made such payment using a credit or debit card (iv) and were provided with a point of sale receipt (v) which displayed more than the last five (5) digits of said credit or debit card (vi) within the two (2) years prior to the filing of the complaint. 43. The named Plaintiff falls within the class definition and is a member of the class. Excluded from the class are SP Plus and any entities in which SP Plus has a controlling interest, SP Plus s agents and employees, Plaintiff s attorneys and their employees, the Judge to whom this action is assigned and any member of the Judge s staff and immediate family, and claims for personal injury, wrongful death, and/or emotional distress. A. Certification Under Either Rule 23(b)(2) or (b)(3) is Proper. 44. The members of the class are capable of being described without managerial or administrative problems. The members of the class are readily ascertainable from the information and records in the possession, custody or control of SP Plus. 45. SP Plus operates or maintains parking garages throughout the United States. Therefore, it is reasonable to conclude that the class is sufficiently numerous such that individual joinder of all members is impractical. The disposition of the claims in a class action will provide substantial benefit to the parties and the Court in avoiding a 9
Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 10 of 14 multiplicity of identical suits. The Class can be identified through SP Plus s records or its agents records. 46. There are common questions of law and fact that predominate over any questions affecting only the individual members of the class. The wrongs alleged against SP Plus are statutory in nature and common to each and every member of the putative class. 47. This suit seeks only statutory damages and injunctive relief on behalf of the class and it expressly is not intended to request any recovery for personal injury and claims related thereto. Plaintiff reserves the right to expand the class definition to seek recovery on behalf of additional persons as warranted as facts are learned in further investigation and discovery. 48. There is a well-defined community of interest in the questions of law and fact involved affecting the parties to be represented. The questions of law and fact to the class predominate over questions that may affect individual class members, including the following: a. Whether, within the (2) two years prior to the filing of this Complaint, SP Plus and/or its agents accepted payment by credit or debit card from any consumer and subsequently gave that consumer a printed receipt upon which more than the last five (5) digits of the card number was printed; b. Whether SP Plus s conduct was willful and/or reckless; c. Whether SP Plus is liable for damages, and the extent of statutory damages for each such violation; and 10
Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 11 of 14 d. Whether SP Plus should be enjoined from engaging in such conduct in the future. 49. As a person that utilized SP Plus s parking service and received a receipt upon which more than the last five (5) digits of the card number was printed, Plaintiff is asserting claims that are typical of the proposed class. Plaintiff will fairly and adequately represent and protect the interests of the class in that Plaintiff has no interests antagonistic to any member of the class. 50. The principal question is whether SP Plus violated section 1681c(g) of the FCRA by providing class members with electronically printed receipts in violation of the Receipt Provision. The secondary question is whether it is SP Plus s policy and practice to provide such electronically printed receipts to consumers that make payment using a credit or debit card, despite having been sued previously for similar violations, constitutes willful and/or reckless conduct. 51. Plaintiff and the members of the class have all suffered irreparable harm as a result of SP Plus s unlawful and wrongful conduct. Absent a class action, the class will continue to face the potential for irreparable harm. In addition, these violations of law would be allowed to proceed without remedy and SP Plus would undoubtedly continue such illegal conduct. Because of the size of the individual class members claims, few class members could afford to seek legal redress for the wrongs complained of herein. 52. SP Plus s defenses are and will be typical of and the same or identical for each of the members of the class and will be based on the same legal and factual theories. There are no unique defenses to any of the class members claims. 11
Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 12 of 14 53. A class action is a superior method for the fair and efficient adjudication of this controversy. Class-wide damages are essential to induce SP Plus to comply with federal law. The interest of class members in individually controlling the prosecution of separate claims against SP Plus is small. The maximum statutory damages in an individual action for a violation of this statute are minimal. Management of these claims is likely to present significantly fewer difficulties than those presented in many class claims. 54. SP Plus has acted on grounds generally applicable to the class, thereby making appropriate final injunctive relief and corresponding declaratory relief with respect to the class as a whole. COUNT I VIOLATIONS OF 15 U.S.C. 1681(c)(g) 55. 15 U.S.C. 1681c(g) states as follows: Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of sale or transaction. 56. This section applies to any device that electronically prints receipts (hereinafter Devices ) for point of sale transactions. 15 U.S.C. 1681c(g)(3). 57. SP Plus employs the use of said Devices for point of sale transactions at the various locations it operates and maintains. 58. On or before the date on which this complaint was filed, Plaintiff and members of the class were provided receipts by SP Plus that failed to comply with the Receipt Provision. 59. At all times relevant to this action, SP Plus was aware, or should have been aware, of both the Receipt Provision as well as the need to comply with said provision. 12
Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 13 of 14 60. Notwithstanding the three year period to prepare for FACTA and its accompanying provisions, including but not limited to the Receipt Provision; having previously been sued for violating FACTA; and knowledge of the Receipt Provision and FACTA as a whole; SP Plus knowingly, willfully, intentionally, and/or recklessly violated and continues to violate the FCRA and the Receipt Provision. 61. As a direct result of SP Plus s willful violations of the FCRA, Plaintiff and members of the class continue to be exposed to an elevated risk of identity theft. 62. As a direct result of SP Plus s willful violations of the FCRA, Plaintiff took action to safeguard her receipt. 63. The printing of more than the last five digits of her credit card account number invaded Plaintiff s privacy, as it exposed her private financial information. 64. The printing of more than the last five digits of her credit card account number breached Plaintiff s confidence, and SP Plus s mishandling of her private financial information breached an implied bailment. See Muransky, 2018 WL 4762434. 65. As a result of the foregoing, SP Plus is liable to Plaintiff and members of the class pursuant to 15 U.S.C. 1681n for statutory damages, attorney s fees and costs. WHEREFORE, Plaintiff respectfully requests that this Court enter judgment in her favor and the class, and against SP Plus for: a. Statutory damages; b. Injunctive relief; c. Attorneys fees, litigation expenses and costs of suit, and d. Such other and further relief as the Court deems proper. 13
Case 0:18-cv-62589-UU Document 1 Entered on FLSD Docket 10/27/2018 Page 14 of 14 JURY DEMAND Plaintiff demands a trial by jury on all counts. Respectfully Submitted, /s/ J. Dennis Card, Jr. J. Dennis Card, Jr. Fla. Bar No.: 487473 Dennis@cloorg.com Darren R. Newhart, Esq. Fla. Bar No.: 115546 Darren@cloorg.com CONSUMER LAW ORGANIZATION, P.A. 721 US Highway 1, Ste. 201 North Palm Beach, FL 33408 Office: 561-822-3446 Christopher W. Legg, Esq. Fla. Bar No.: 44460 Chris@theconsumerlawyers.com CHRISTOPHER W. LEGG, P.A. 499 E. Palmetto Park Rd., Ste. 228 Boca Raton, FL 33432 Office: 954-962-2333 Attorneys for Plaintiff and the Putative Class 14