Lawsuits target KFC, Taco Bell over credit card data on receipts

By Alex Davis
alexdavis@courier-journal.com
The Courier-Journal

Fast-food chains KFC and Taco Bell failed to comply with a law that limits the amount of credit card information companies can print on customers' receipts, two lawsuits filed earlier this month claim.

Both chains are part of Yum! Brands Inc. of Louisville. In a filing with the Securities and Exchange Commission, Yum acknowledged the lawsuits and said it would "vigorously defend against all claims" in both cases.

Officials at KFC Corp.'s headquarters on Gardiner Lane also issued a statement yesterday in response to questions about the lawsuits.

"Like other retailers, we regard the security of our customers' credit card information as very important, and we expect all company and franchise restaurants to be in full compliance with the law," the statement said.

Claims made in lawsuits tell only one side of a story.

The suit against KFC was filed July 11 in U.S. District Court in New Jersey. It claims that Melissa Peraria, of Shamong, N.J., made a purchase in May at a local KFC and the restaurant illegally printed the expiration date of her credit card on the receipt.
The lawsuit alleges that a skilled hacker could use the expiration date, along with the last four digits of a credit card number, to engage in fraud or identity theft.

Citing a congressional act called the Fair and Accurate Credit Transactions Act, the lawsuit claims retailers may not print more than the last five digits of a person's account number, or the card's expiration date, on a receipt. The law was passed in 2003, but most retailers had until December 2006 to comply.

The lawsuit involving Taco Bell was filed July 5 in federal court in Illinois. The plaintiff, computer programmer Doran Phillips of Chicago, alleges that a Taco Bell restaurant printed the expiration date from his credit card on a receipt after a June 12 purchase.
Attorneys in both cases are seeking class-action status, with damages of up to $1,000 for each affected customer on top of expenses and attorney fees.

Thomas A. Zimmerman Jr., the plaintiff's attorney in the Taco Bell case, said his firm is involved in about 20 similar cases with other retailers, including Darden Restaurants, which owns the Olive Garden chain. While there is no evidence that Phillips' financial data have been used in a theft, Zimmerman said the law still provides for $100 in damages per person simply because the expiration date was printed on the receipt. He said the law firm plans to seek the records of other Taco Bell customers -- potentially thousands of people -- who may have been similarly affected.

Reporter Alex Davis can be reached at (502) 582-4644.

Tuesday, July 24, 2007