Edwards v. Toys" R" US

527 F. Supp. 2d 1197 (2007)

Nicola EDWARDS, et al., Plaintiffs,
v.
TOYS "R" US, et al., Defendants.

No. CV 06-08163 MMM (FMOx).

United States District Court, C.D. California.

November 5, 2007.

Chant Yedalian, Douglas A. Linde, Erica L. Allen, Linde Law Firm, Ira Spiro, James Mark Moore, Spiro Moss Barness, Los Angeles, CA, for Plaintiffs.

James Schley, pro se.

Katherine K. Ivers, Michael Dockterman, Richard M. Hoffman, Wildman Harrold Allen and Dixon, Chicago, IL, Kathleen M. Wood, Nicholas P. Connon, Connon Wood Scheidemantle, Los Angeles, CA, for Defendants.

ORDER DENYING SUMMARY JUDGMENT

MARGARET M. MORROW, District Judge.

On December 21, 2006, plaintiffs Nicola Edwards and James Schley filed a complaint against defendant Toys "R" Us ("Toys") for violation of the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. § 1681 et seq. Plaintiffs allege that Toys violated the statute's Fair and Accurate Credit Transactions Act ("FACTA"), which requires that "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last five digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or the transaction." 15 U.S.C. § 1681c(g). Plaintiffs have sued on behalf of a class of consumers who received receipts from Toys that did not comply with FACTA.^[1] On April 6, 2007, Toys filed an early motion for summary judgment. At a scheduling conference three days later, the parties agreed that the motion should be heard on July 30, 2007. On June 29, 2007, however, plaintiffs filed an ex parte application seeking an extension of the briefing schedule on the motion and a continuance of the hearing under Rule 56(f). The court granted the application and continued the hearing to September 24, 2007. This order addresses the merits of Toys' motion for summary judgment.

I. FACTUAL BACKGROUND

This case involves a period of time in 2006 during which Toys printed more than the last five digits of consumers' credit card numbers on its customer receipts. The facts of the case are largely undisputed; resolution of the motion turns on whether a reasonable jury could draw different inferences from the uncontroverted facts regarding the "willfulness" of Toys' conduct. Despite this fact, plaintiffs raise numerous objections to the evidence Toys has adduced in support of the motion. The court addresses these objections before turning to the substance of the motion.

A. Plaintiffs' Evidentiary Objections

Plaintiffs assert that the declarations of Dion Rooney, Leo Cammarota, and Dennis Gleason submitted in support of Toys' motion are "entirely inadmissible."^[2] Plaintiffs contend that all three declarants "expressly admit" that the information included in their declarations is derived either from absent business records "or— even worse—[from] . . . unidentified `other sources' which Toys says [it] `believe[s] to be true and correct.'"^[3] Based on this language, plaintiffs assert that all three declarations lack foundation. In particular, they contend that the declarants' reliance on "other sources" demonstrates that their testimony is impermissibly based on information and belief. They also object to the Gleason and Rooney declarations on relevance grounds.^[4]

1. Foundation

Under Rule 56(e), a declaration not based on personal knowledge is inadmissible at the summary judgment stage. See FED.R.CIV.PROC. 56(e) ("Supporting and opposing affidavits shall be made on personal knowledge, shall set forth such facts as would be admissible in evidence, and shall show affirmatively that the affiant is competent to testify to the matters stated therein"). Plaintiffs contend that Toys' declarations lack foundation because portions are based on a review of business or other records or on information and belief.

Were the only evidence of personal knowledge found in the declarations each declarant's statement that he has personal knowledge of the facts recited, or knowledge available from Toys' business records or from other sources that he believes to be true and correct, plaintiffs' objection would be well-taken. The disjunctive nature of this statement leaves the reader in doubt as to whether the declarant knows the facts set forth in the declaration or has merely been advised of them by others. See Block v. City of Los Angeles, 253 F.3d 410 (9th Cir.2001) ("The Menkus affidavit appears inadequate under Rule 56(e), made on personal knowledge, it did not set forth facts that would be admissible in evidence. It is clear from the affidavit that Menkus was not personally involved in any of the disciplinary suspensions, and that he did not personally review any business records containing information regarding such disciplinary suspensions. Menkus instead relied on information from (unsworn) departmental personnel officers, and the source of these officers' information is unclear. Rather than set forth facts that would be admissible in evidence, the affidavit was instead based on inadmissible hearsay"); see also Bank Melli Iran v. Pahlavi, 58 F.3d 1406, 1412 (9th Cir. 1995) ("Of course, had the Banks put in any evidence of substance, summary judgment might have been averted. But the Banks' response to Pahlavi's evidence was information and belief declarations from their counsel. Those were entitled to no weight because the declarant did not have personal knowledge"); Taylor v. List, 880 F.2d 1040, 1046 n. 3 (9th Cir.1989) ("One of the affidavits submitted by Taylor contained a statement to the effect that the affiant was informed and believed that Belleville was involved in depriving Taylor of access to law clerks and law books. The statement does not raise a triable issue regarding Belleville's involvement. To raise such an issue, the statement would have to be made on personal knowledge, not information and belief. Fed.R.Civ.P. 56(e)"); Heighley v. J.C. Penney Life Ins. Co., 257 F. Supp. 2d 1241, 1251 (C.D.Cal. 2003) ("Declarations on information and belief are insufficient to establish a factual dispute for purposes of summary judgment").

The mere fact that the declarants "use . . . the magic words `I believe,'" however, does not automatically render their testimony inadmissible. Rather, the question is whether their statements "lack[ ] the requisite proof of personal knowledge." Slade v. Baca, 70 Fed.Appx. 446, 449 (9th Cir. July 8, 2003) (Unpub. Disp.). Personal knowledge can be inferred from a declarant's position within a company or business. See In re Kaypro, 218 F.3d 1070, 1075 (9th Cir. 2000) ("Personal knowledge may be inferred from a declarant's position," citing Self-Realization Fellowship Church v. Ananda Church of Self-Realization, 206 F.3d 1322, 1330 (9th Cir.2000)); Barthelemy v. Air Lines Pilots Ass'n, 897 F.2d 999, 1018 (9th Cir.1990) (concluding that a CEO's personal knowledge of various corporate activities could be presumed). Each of the declarants occupies a position at Toys from which personal knowledge of the facts to which he testifies can be inferred. Rooney has been Toys' Chief Information Officer since 2006. Plaintiffs argue that Rooney has no personal knowledge of payment card industry standards or the software upgrades at issue; his position as CIO, however, raises an inference of personal knowledge. See Morgan v. Tenet, 9 Fed.Appx. 698, 700 (9th Cir. May 24, 2001) (Unpub. Disp.) (concluding that a CIA executive officer should be "deemed for evidentiary purposes to have personal knowledge of the CIA's affairs," and citing Barthelemy, 897 F.2d at 1018, for the rule that "a corporate officer's `personal knowledge and competence to testify are reasonably inferred from their position'"); see also AGI Realty Service Group, Inc. v. Red Robin Intern., Inc., 81 F.3d 160, 1996 WL 143465, *4 (6th Cir. Mar. 28, 1996) (Unpub. Disp.) ("Corporate officers are considered to have personal knowledge of the acts of their corporations and an affidavit setting forth those facts is sufficient for summary judgment"); Catawba Indian Tribe of South Carolina v. State of South Carolina, 978 F.2d 1334, 1342 (4th Cir.1992) ("We are of the opinion that, ordinarily, officers would have personal knowledge of the acts of their corporations").^[5] Plaintiffs have offered no evidence that rebuts the inference of personal knowledge flowing from Rooney's position. Consequently, their foundation objection to Rooney's testimony is overruled.^[6]

The same is true with respect to plaintiffs' foundation objections to the Gleason and Cammarota declarations. Plaintiffs assert that Gleason has no personal knowledge of the internal process for updating Toys' registers. Such knowledge, however, can be inferred from Gleason's position as a senior member of Toys' Point of Sale (POS) Systems for Toys. Gleason has held such a position since 1997, and currently oversees the software programming and maintenance of defendant's cash registers. Given his job responsibilities, it is appropriate to infer that Gleason has personal knowledge of the specific software upgrades Toys has made, and of the process it employs in completing the upgrades.^[7] Cammarota too has a position from which personal knowledge can be inferred. He is Toys' Director of Installation Services, responsible for "overseeing and directing the installation and maintenance of cash registers installed at the T[oys] store locations throughout the country."^[8] As a result, plaintiffs' foundation objections to Gleason's and Cammarota's declarations are overruled.

2. Relevance

To the extent that the court discusses and relies on evidence in this order, it finds that the evidence is relevant and overrules any objections to it under Rule 402 of the Federal Rules of Evidence. See Emery v. Wells Fargo Bank, NA, No. CV 05-01485 PHX (NVW), 2006 WL 410980, *3 (D.Ariz. Feb. 16, 2006) ("The court has only relied on relevant evidence in deciding these motions and to the extent it has relied on [defendant's] affidavits, they are relevant"); cf. Neal v. Juarez, No. CV 06-00055 J(JMA), 2007 WL 2140640, *2 (S.D.Cal. July 23, 2007) ("Disputes over irrelevant or unnecessary facts will not preclude a grant of summary judgment," quoting T.W. Elec. Serv., Inc. v. Pacific Elec. Contractors Ass'n, 809 F.2d 626, 630 (9th Cir.1987)).

B. Uncontroverted Facts

As noted, most of the relevant facts in this case are not in dispute. Over the last seven years, Toys has collaborated with NCR Corporation ("NCR") to implement upgrades to its cash register software.^[9] NCR is an outside consultant that works closely with Toys—so closely that NCR has stationed one of its employees in Toys' offices to assist with software issues.^[10] The parties do not dispute that by mid-2005, all of the cash register systems in Toys' stores were programmed to print only the last four digits of debit and credit card numbers and to omit expiration dates on electronically printed customer receipts.^[11] In mid-2006, purportedly to comply with Payment Card Industry ("PCI") Standards for internal records, Toys initiated a plan to truncate card numbers on all internal corporate displays so that only the first six and last four digits of customer card numbers were visible.^[12] The modification included displays on "call info chits" that are used internally for customer service purposes.^[13] In July 2006, Toys formed a team of Toys and NCR personnel to develop an appropriate software upgrade to modify the internal displays.^[14] The team generated a Change Request ("CR").^[15] Once the CR was approved by the Toys, NCR was engaged to develop software and implement the upgrade. completed this work by October 27, 2006.^[16]

In the process of upgrading Toys' cash register software to truncate the credit arid debit card information shown on internal displays, Jeanette Lee revised the CR to state that "all guest receipts [would] also contain the same masking of the first 6 and the last 4 digits."^[17] By making this revision, Lee effectively added information to external customer `receipts that had been previously suppressed. Lee is an employee of NCR who works exclusively from Toys' main office.^[18] Before implementing the software modification, Lee contacted two Toys employees and requested approval to apply the change to all receipts.^[19] Toy' POS Systems team held a meeting on August 24, 2006 at which the modification proposed by Lee was discussed. The minutes of that meeting state: "CR-815, this is the CR which masks the credit card on the referral chit. . . . The same masking change will also be used on other guest receipts."^[20]

Following Toys' protocol, before any change to the POS system could be implemented, the software program had to be tested both by NCR and by Toys' user acceptance testing group.^[21] Toys tested the CR and compared the test receipts against the software requirements;^[22] the receipts were never compared with the original conforming receipts.^[23] After the testing phase, the CR was implemented as modified by Lee; commencing in late October 2007, the software caused more than the last five digits of customer credit and debit card numbers to appear electronically on more than 29 million printed customer receipts.^[24] On December 27, 2007, Toys received a copy of plaintiffs' complaint.^[25] Toys promptly took action to cure the violation.^[26] It assembled a team to run tests on cash registers, which confirmed that the registers were printing more than the last four digits of customers' card numbers.^[27] The team developed and implemented a CR to correct the problem; by January 5, 2007, all of Toys' cash registers nationwide had been brought into compliance with FACTA.^[28]

C. Disputed Facts

The parties' primary dispute concerns proper characterization of Toys' violation of the FCRA. Toys asserts that its violation was inadvertent and that, once discovered, it was remedied immediately. Plaintiffs counter that a reasonable jury could find that Toys acted intentionally or "willfully" in altering the display on its register receipts.

Which party has the better of the argument turns, in part, on the role ascribed to Lee. It is undisputed that Lee is an NCR employee who was assigned to work exclusively with Toys from Toys' offices. Toys contends, however, that Lee is an outside contractor, while plaintiffs denominate her "a key participant—if not the key participant" in Toys' software upgrade process.^[29] In legal terms, the parties' dispute concerns whether Lee was Toys' agent and thus whether her intent may be imputed to Toys.

The parties also differ in their interpretation of Lee's telephone conversation With Amy Testino and Kevin Walton, in which she sought approval to change the CR. Toys contends Testino and Walton did not understand the question Lee asked, while plaintiffs assert that Lee told Walton and Testino that the change would apply to all customer receipts, and that they approved the change on Toys' behalf.^[30] Specifically, Toys contends that Walton and Testino understood Lee's description of the proposed change to refer to other internal receipts, and that they expected that. Lee would circulate any revisions prior to implementation.^[31]

The parties similarly dispute the import of the discussion regarding the change at the August 24, 2006 weekly POS Systems meeting. As noted, the minutes of that meeting state that the group was advised that the "same masking change [would] be used on other guest receipts."^[32] Plaintiffs note that the minutes reflect that twelve team members were present and took no action to stop implementation of the change.^[33] Toys counters that none of the participants in the meeting (including Lee, who prepared the minutes) recalls discussing application of the new masking policy to customer receipts.^[34] Rather, it asserts, the group discussed applying the new policy to other internal receipts, and understood that any change to customer receipts would require reapproval of the CR.^[35]

Finally, the parties dispute what knowledge should be imputed to Toys given the test receipts generated prior to implementation of the CR. It is undisputed that, in violation of FACTA, the test receipts displayed ten digits of customers' account numbers.^[36] Plaintiffs contend that the receipts show that Toys knew its registers were displaying card information not permitted by FACTA.^[37] Toys responds that the tests served the limited purpose of ensuring that printed receipts matched the changes effected by the CR, that its quality assurance personnel did not know the requirements of the FCRA, and that they were not responsible for ensuring compliance with the statute.^[38]

II. DISCUSSION

A. Standard Governing Motions for Summary Judgment

A motion for summary judgment must be granted when "the pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law." FED.R.CIV.PROC. 56(c). A party seeking summary judgment bears the initial burden of informing the court of the basis for its motion and of identifying those portions of the pleadings and discovery responses that demonstrate the absence of a genuine issue of material fact. See Celotex Corp. v. Catrett, 477 U.S. 317, 323, 106 S. Ct. 2548, 91 L. Ed. 2d 265 (1986). Where the moving party will have the burden of proof on an issue at trial, the movant must affirmatively demonstrate that no reasonable trier of fact could find other than for the moving party. On an issue as to which the nonmoving party will have the burden of proof, however, the movant can prevail merely by pointing out that there is an absence of evidence to support the nonmoving party's case. See id. If the moving party meets its initial burden, the nonmoving party must set forth, by affidavit or as otherwise provided in Rule 56, "specific facts showing that there is a genuine issue for trial." Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 250, 106 S. Ct. 2505, 91 L. Ed. 2d 202 (1986); FED.R.CIV.PROC. 56(e).

Evidence presented by the parties at the summary judgment stage must be admissible, FED.R.CIV.PROC. 56(e). In reviewing the record, the court does not make credibility determinations or weigh conflicting evidence. Rather, it draws all inferences in the light most favorable to the nonmoving party. See T.W. Electrical Service, Inc. v. Pacific Electrical Contractors Ass'n, 809 F.2d 626, 630-31 (9th Cir.1987). Conclusory, speculative testimony in affidavits and moving papers, however, is insufficient to raise genuine issues of fact and defeat summary judgment. See Falls Riverway Realty, Inc. v. Niagara Falls, 754 F.2d 49, 56 (2d Cir.1985); Thornhill Pub. Co., Inc. v. GTE Corp., 594 F.2d 730, 738 (9th Cir.1979).

B. Statutory Overview of FACTA

The Fair and Accurate Credit Transactions Act ("FACTA") provides that "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. § 1681 c(g)(1). When it enacted this provision, Congress decreed that it take effect in two phases. Cash registers installed on or after January 1, 2005 had to comply with the display requirement immediately. Companies having registers in use before that date, however, were required to comply by December 4, 2006. See id., § 1681c(g)(3). As noted, FACTA is part of a broader statutory scheme known as the Fair Credit Reporting Act, or FCRA. See id., §§ 1681 et seq. The FCRA creates a private right of action for violations of FACTA, see, e.g., Nelson v. Chase Manhattan Mortgage Corp., 282 F.3d 1057, 1059 (9th Cir.2002); it provides that plaintiffs can recover actual damages for negligent violations,^[39] and actual or statutory damages, as well as punitive damages, for "willful" violations.^[40]

Earlier this year, the Supreme Court defined "willful" for purposes of the FCRA. See Safeco Ins. Co. of America v. Burr, ___ U.S. ___, 127 S.Ct, 2201, 167 L. Ed. 2d 1045 (2007)^[41] Noting that "is a `word of many meanings whose construction is often dependent on the context in which it appears,'" id. at 2208 (quoting Bryan v. United States, 524 U.S. 184, 191, 118 S. Ct. 1939, 141 L. Ed. 2d 197 (1998)), the Court observed that "where willfulness is a statutory condition of civil liability, [it had] generally taken it to cover not only knowing violations of a standard, but reckless ones as well." Id. (citing McLaughlin v. Richland Shoe Co., 486 U.S. 128, 132-33, 108 S. Ct. 1677, 100 L. Ed. 2d 115 (1988)). Such a construction, the Court stated, "reflect[ed] common law usage, which treated actions in `reckless disregard' of the law as `willful' violations." Id. (citing 5 W. Keeton, D. Dobbs, R. Keeton, & D. Owen, PROSSER AND KEETON ON LAW OF TORTS, § 34 at 212).<sup>[42]</sup> The Court held that "willfully fails to comply," as used in the FCRA, should be read in accord with this "standard civil usage" of the term. Id. at 2209 ("The standard civil usage thus counsels reading the phrase `willfully fails to comply' in 1681n(a) as reaching reckless FCRA violations. . . . [T]his is so both on the interpretive assumption that Congress knows how we construe statutes and expects us to run true to form . . . and under the general rule that a common law term in a statute comes with a common law meaning, absent anything pointing another way").

After determining that "willful" included both knowing and reckless violations, the Court next described the standard for recklessness. It noted that, "[w]hile the term recklessness is not self-defining,' the common law has generally understood it in the sphere of civil liability as conduct violating an objective standard: action entailing 'an unjustifiably high risk of harm that is either known or so obvious that it should be known.'" Id. at 2215 (quoting Farmer v. Brennan, 511 U.S. 825, 836, 114 S. Ct. 1970, 128 L. Ed. 2d 811 (1994)).^[43] Applying this standard to § 1681n of the FCRA, it held that

"a company subject to FCRA does not act in reckless disregard of it unless the action is not only a violation under a reasonable reading of the statute's terms, but shows that the company ran a risk of violating the law substantially greater than the risk associated with a reading that was merely careless." Id.^[44]

This case presents a different situation than Safeco because § 1681c(g) is not ambiguous or susceptible of conflicting interpretations. Courts have consistently held that § 1681c(g)'s "plain language makes it clear that the statute prohibits both the printing of more than the, last five digits of the card number and the expiration date." Pirian In-N-Out Burgers, No. SA CV 06-1251 DOC (MLGx), 2007 WL 1040864, *3 (C.D.Cal. Apr. 5, 2007); see Korman v. Walking Co., 503 F. Supp. 2d 755, 760-61 (E.D.Pa.2007) (collecting cases that have found the requirements of the statute to be clear); Iosello v. Leiblys, Inc., 502 F. Supp. 2d 782, 785-87 (N.D.Ill.2007) (rejecting proposed alternative readings of the statute and finding its meaning clear); Lopez v. Gymboree Corp., No. C 07-00087 SI, 2007 WL 1690886, *3 (N.D.Cal. June 9, 2007) ("The Court finds that Section 1681 c(g) is not vague and ambiguous because the plain language of this section has only one reasonable meaning"); Arcilla v. Adidas Promotional Retail Operations, Inc., 488 F. Supp. 2d 965, 970 (C.D.Cal.2007) ("[Section 1681c(g)'s] words have only one reasonable meaning"). Toys, in fact, does not argue that it misinterpreted the statute or the requirements it imposed. Rather, it asserts that the actions it took that led to its violation of the statute cannot can be considered "willful"—i.e., reckless—under the standard delineated in Safeco.

C. Whether Triable Issues of Fact Remain as to the Willfulness of Toys' Actions

In deciding a motion for summary judgment, the court must, as noted, resolve all factual disputes and draw all inferences in favor of the non-moving party. Toys contends that plaintiffs have adduced no evidence that its violation of FACTA was willful. Drawing all inferences in favor of plaintiffs, the court concludes that triable issues of fact remain, and that this issue cannot be decided on summary judgment

Willfulness under the FCRA is generally a question of fact for the jury. See Guimond v. Trans Union Credit Information Co., 45 F.3d 1329, 1333 (9th Cir.1995) ("The reasonableness of the procedures and whether the [insurance] agency followed them will be jury questions in the overwhelming majority of cases," citing Cahlin v. General Motors Acceptance Corp., 936 F.2d 1151, 1156 (11th Cir.1991)); Lenox v. Equifax Information Services LLC, No. 05-01501-AA, 2007 WL 1406914, *6 (D.Or. May 7, 2007) ("the determination as to whether defendant's action or inaction rises to the level of willfulness so as to violate the statutory obligations of the FCRA is also a question of fact"); Cairns v. GMAC Mortgage Corp., No. CV 04-01840 PHX(SMM), 2007 WL 735564, *8 (D.Ariz. Mar.5, 2007) ("in this case, like in the overwhelming number of cases in which state of mind is dispositive, the issue of punitive damages is best left for the trier of fact to determine"); Centuori v. Experian Information Solutions, Inc., 431 F. Supp. 2d 1002, 1007 (D.Ariz.2006) (declining to enter summary judgment on the issue of willfulness in a case involving the reasonableness of consumer protection procedures). To determine that willfulness does not present a jury question in this case, the court would have to conclude that no reasonable jury could find that Toys' conduct created a "risk [of violation] substantially greater than that which is necessary to make [its] conduct negligent." See Safeco, 127 S.Ct. at 2215.^[45] This it cannot do.

Seeking a different result, Toys notes that Judge Klausner of this district recently entered summary, .judgment for defendant in an analogous case. See Najarian v. Charlotte Russe, Inc., No. CV 07-00501 RGK (CTx) (C.D.Cal. Aug. 16, 2007) (Docket No. 108). In Najarian, Judge Klausner found there were no triable issues of fact regarding plaintiff's claim that Charlotte Russe willfully violated FACTA by printing a card expiration date on a customer receipt. The defendant had purchased a software upgrade to suppress portions of the credit card numbers that appeared on its receipts, but did not know that the upgrade did not suppress card expiration dates. Judge Klausner appeared to reach two conclusions: (1) that defendant was not aware that the software upgrade did not bring it into compliance with FACTA (and thus did not knowingly violate the law), and (2) that defendant made a diligent and good faith effort to fix the problem once informed of it. The court respectfully disagrees with the reasoning in Najarian.^[46]

1. Knowledge and Recklessness

Whether or not Toys "knew" that implementing the CR would result in a violation of FACTA is in dispute.^[47] As noted earlier, this dispute turns on whether Lee's knowledge can be imputed to Toys. Toys asserts that "a corporation's scienter depends on the mental state of its directors and officers,"^[48] and that a corporation cannot be found to have acted willfully if the actions in question were those of an unauthorized third party.^[49] Courts, however, have held that corporations can be vicariously liable for FCRA violations committed by their employees. See Jones v. Federated Financial Reserve Corp., 144 F.3d 961, 966 (6th Cir.1998) ("Failure to impose vicarious liability on a corporation . . . would allow it to escape liability for `willful' or `negligent' violations of the statute. Because a company . . . can act only through its agents, it is difficult to imagine a situation in which a company would ever be found to have willfully violated the statute directly by obtaining a credit report for an impermissible purpose"); Yohay v. City of Alexandria Employees Credit Union, Inc., 827 F.2d 967, 973 (4th Cir.1987) (holding that an employer was liable for its agent's intentional acts because the agent had apparent authority to obtain a credit report); Del Aurora v. Metro Ford Sales and Service, Inc., 206 F. Supp. 2d 947, 951 (N.D.Ill. 2002) ("We agree with the Jones court that imposing vicarious liability under the FCRA is consistent with Congress's intent to protect consumers . . . ").

While the Ninth Circuit has not directly addressed this issue, district courts within the circuit have followed the rule set out in Jones. See Mahajan v. Kumar, No. CV F 06-1728 AWI SMS, 2007 WL 1279504, *5 (E.D.Cal. Apr. 30, 2007) (noting that Jones held that a corporation could be held vicariously liable under the FCRA); Myers v. Bennett Law Offices, 238 F. Supp. 2d 1196, 1202 (D.Nev.2002) (finding that an employee had apparent authority to order a credit report, and concluding that application of such a theory was consistent with FACTA's statutory purpose).

The court finds the reasoning in Jones persuasive. As the court there notes, without vicarious liability under the FCRA (and FACTA in particular), it would be very difficult to hold a corporation liable under the statute. See Jones, 144 F.3d at 966 ("The FCRA's deterrence goal would be subverted if a corporation could escape liability for a violation that could only occur because the corporation cloaked its agent with the apparent authority"). The Jones court identified three theories of vicarious liability that may apply under the FCRA. Jones, 144 F.3d at 965 (discussing express authorization, respondeat superior, and apparent authority). First, "a principal may be vicariously liable for an agent's tortious conduct if the principal expressly or implicitly authorized the conduct." Id. (citing In re Atlantic Fin. Mgmt. Inc., 784 F.2d 29, 31 (1st Cir.1986)). "[A] principal [may also be] held liable for torts committed by an agent when the agent acts for the benefit of his principal in the scope of his employment." Id.; see also Mullahon v. Union Pacific R.R., 64 F.3d 1358, 1362 (9th Cir.1995) (holding, in the FE LA context, that "an employer is liable for the intentional assaults committed by its employee in furtherance of the employer's business"). Finally, "a principal may be vicariously liable for an agent's tortious conduct . . . if the principal . . . held the agent out to third parties as possessing sufficient authority to commit the particular act in question and there was reliance on the apparent authority." Id. (citing RESTATEMENT (SECOND) AGENCY § 8, p. 30 (1958)).

Although Lee is an NCR employee, she works full time in Toys' offices, and was at least in part responsible for the software upgrades. Whether this is sufficient to make her Toys' agent is question of fact that would typically be determined by the jury. Krueger By and Through Krueger v. Mammoth Mountain Ski Area, Inc., 873 F.2d 222, 223 (9th Cir.1989) ("Whether this [master-servant] relationship exists is a question of fact left for the trier of fact"); Bradbury v. Phillips Petroleum Company, 815 F.2d 1356, 1360 (10th Cir.1987) ("the relationship of principal and agent is ordinarily a question of fact"); Oyster Software, Inc. v. Forms Processing, Inc., No. C-00-00724 JCS, 2001 WL 1736382, *11 (N.D.Cal. Dec. 6, 2001) (quoting Bradbury). Toys relies on Lee's status as an independent contractor in arguing that there is no material issue of fact regarding her agency. This alone, however, does not conclusively establish that Lee was not Toys' agent. See Dearborn v. Mar Ship Operations, Inc., 113 F.3d 995, 998 (9th Cir.1997) ("But an independent contractor, no less than a servant may be an agent in that he is employed as a fiduciary, acting for the principal with the principal's consent and subject to the principal's overall control and direction in accomplishing some matter undertaken on the principal's behalf," citing RESTATEMENT (SECOND) OF AGENCY § 14); RESTATEMENT (SECOND) OF AGENCY § 1, cmt. (e) ("An agent may be one for whose physical acts the employer is not responsible and who is called an independent contractor in order to distinguish him from a servant"); see also Rutherford Food Corp. v. McComb, 331 U.S. 722, 730, 67 S. Ct. 1473, 91 L. Ed. 1772 (1947) (holding, in the FLSA context, that independent contractor status is not dispositive and that "determination of the relationship does not depend on such isolated factors but rather upon the circumstances of the whole activity"); Costa v. U.S. Dept. of Veteran's Affairs, 845 F. Supp. 64, 68 (D.R.I.1994) (holding that a doctor serving as an appointed consultant was "equivalent to [a] full-time employee[ ] during the periods [he] provided care to VA patients," given the degree of control the hospital exercised over his work).

Applying the rule delineated in these cases, and drawing all inferences in favor of plaintiffs, the court concludes that triable issues of fact remain regarding Toys' vicarious liability for Lee's actions. Given evidence that Lee worked in Toys' offices, served as a member of Toys' POS team, and was responsible for developing the POS software, a reasonable jury could find that she was an agent of Toys for vicarious liability purposes. Alternatively, a reasonable jury could conclude that Toys vested Lee with actual or apparent authority to revise and implement the CR, thus causing it to violate FACTA.^[50]

There are also triable issues regarding the extent to which Toys' employees were advised and knew of the software change. A reasonable jury could infer from Lee's telephone call to Testino and Walton, and the minutes of the POS Systems team meeting, that Toys' employees knew of Lee's modification, and either approved or overlooked it.^[51] This is particularly true since under Safeco, Toys could be found to have acted willfully if its employees' misunderstanding or inaction created "`an unjustifiably high risk of harm that [was] either known or so obvious that it should be known.'" Safeco, 127 S.Ct. at 2215 (quoting Farther, 511 U.S. at 836, 114 S. Ct. 1970).

Toys asserts that it cannot be held responsible for Lee's actions because she did not follow established company protocol and thus did not give Toys the opportunity to abort the change, i.e., discover the violation at the testing stage.^[52] Toys contends its testing personnel did not know FACTA's requirements and checked the receipts only to ensure that they conformed to the document generated by Lee.^[53] A reasonable jury, however, could conclude that Toys recklessly failed to train its quality assurance personnel on the requirements of FACTA and also that Toys' established procedures for implementing new POS software posed an "unjustifiably high risk" that Toys would violate FACTA.^[54]Safeco, 127 S.Ct. at 2215; see Guimond, 45 F.3d at 1333 (holding under the FCRA that "the reasonableness of [a company's credit reporting] procedures and whether the agency followed them will be jury questions in the overwhelming majority of cases"); Ottiano v. Credit Data Southwest, Inc., 54 Fed.Appx. 640, 640 (9th Cir.2003) (Unpub. Disp.) (holding that the district court erred in granting summary judgment given the parties' dispute regarding the reasonableness of credit reporting procedures).^[55] Furthermore, a reasonable jury could conclude that the fact that Toys did not discover the violation until suit was filed indicates that its monitoring processes (or lack thereof) created an "unjustifiable risk" that it would violate the statute.^[56] Consequently, summary judgment cannot be entered in favor of Toys.

2. Good Faith

In entering summary judgment in defendant's favor on the issue of willfulness in Najarian, Judge Klausner relied in part on the fact that defendant made a diligent and good faith effort to bring itself into compliance with FACTA once it discovered the violation. See Najarian, No. CV 07-00501 at *3. Citing this aspect of Judge Klausner's reasoning, Toys asserts that it is entitled to summary judgment on willfulness both because it was in compliance with FACTA prior to implementation of the CR, and because it swiftly remedied the violation once it learned that it had fallen out of compliance. In concluding that the defendant's good faith efforts to remedy its violation warranted the entry of summary judgment on willfulness, Judge Klausner relied in part on Reynolds. Reynolds held, in relevant part, that

"[a] company will not have acted in reckless disregard of a consumer's rights if it has diligently and in good faith attempted to fulfill its statutory obligations and to determine the correct legal meaning of the statute and has thereby come to a tenable, albeit erroneous, interpretation of the statute," Reynolds, 435 F.3d at 1099 (emphasis added).

As can be seen, Reynolds involved a defendant that attempted in good faith to comply with the FCRA, but failed to do so because it misinterpreted the statutory requirements. Drawing all inferences in favor of plaintiffs, this case involves a defendant that knowingly or recklessly committed a statutory violation, and then took prompt action to cure that violation. Reynolds does not address such a situation, and provides no guidance in assessing whether prompt corrective action is probative of a lack of willfulness. Other courts, however, have viewed prompt remedial action or the lack thereof as relevant in assessing whether a defendant's conduct was willful. See, e.g., DiPrinzio v. MBNA America Bank, N.A., No. 04-872, 2005 WL 2039175, *8 (E.D.Pa. Aug. 24, 2005) (holding that triable issues of fact remained as to whether a defendant's violation of the FCRA was willful, inter alia, because there was evidence that credit reporting errors "were `not promptly cured'"); see also New Line Cinema Corp. v. Russ Berrie & Co., Inc., 161 F. Supp. 2d 293, 300 (S.D.N.Y.2001) (declining to find that copyright infringement was willful, in part because defendant promptly responded to cease and desist letter, requesting more details regarding the alleged infringement). Although evidence of Toys' prompt efforts to cure the violation may be relevant in assessing whether it acted willfully, the court cannot say that those efforts prove, as a matter of law, that its conduct was not knowing or reckless. Rather, Toys' remedial actions are one of many factors that will bear on the jury's willfulness inquiry.^[57]

III. CONCLUSION

For the reasons stated, defendant Toys "R" Us's motion for summary judgment is denied.

NOTES

[1] At the April 9, 2007 the court set October 29, 2007 as the last date for the filing of a motion for class certification.

[2] Plaintiffs Opposition to Motion for Summary Judgment ("Pls.' Opp.") at 14; see also Declaration of Dion Rooney in Support of Defendant's Motion for Summary Judgment ("Rooney Decl."); Declaration of Leo Cammarota in Support of Defendant's Motion for Summary Judgment ("Cammarota Decl."); Declaration of Dennis Gleason in Support of Defendant's Motion for Summary Judgment ("Gleason Decl.").

[3] See Pls.' Opp. at 14: The declarations contain similar, but not identical, language. See Rooney Decl., ¶ 2 ("I have personal knowledge of the facts set forth herein, or knowledge available to me from the business records of T[oys `R' Us] or from other sources which I believe to be true and correct"); Cammarota Decl., ¶ 2 ("I have either personal knowledge of the facts set forth herein, or knowledge available to me from the business records of T[oys `R' Us] or from other sources which I believe to be true and correct"); Gleason Decl., ¶ 2 (same).

[4] See Plaintiffs' Objections to Defendant's "Evidence" in Support of Motion for Summary Judgment ("Pls.' Objections") at 2, 7, 9-10

[5] It is also permissible to infer from a declarant's position within a company or business that he has personal knowledge of the contents of the company's business records. See E.E.O.C. v. Peabody Coal Co., 214 F.R.D. 549, 562 (D.Ariz.2002) (applying Barthelemy to a general counsel's personal knowledge of corporate agreements), rev'd on other grounds, 400 F.3d 774 (9th Cir.2005). Such a declarant may properly testify to information contained in the business records so long as it is within his personal knowledge. See, e.g., Dow v. Abercrombie & Kent International, Inc., No. 99 C 6923, 2000 WL 688949, *8 n. 4 (N.D.Ill. May 24, 2000) ("The Dows contend Fitche's declaration fails to meet the requirements of Fed.R.Civ.P. 56(e) because it is not based on his personal knowledge and is instead based on speculation and conjecture. However, the statements regarding A K International's lack of knowledge of prior attacks concerns information in A & K International's business records and within the personal knowledge of a vice-president, and Fitche reviewed those records in preparing his affidavit. . . . Such statements are admissible," citing Jenkins v. Heintz, 124 F.3d 824, 831 (7th Cir.1997) (stating that the head of a law firm "can and has permissibly made statements under oath concerning the firm's numerous business records, as well as his own knowledge as a firm partner who dealt chiefly with the bank")).

[6] To the extent plaintiffs advance additional objections to portions of Rooney's testimony on which the court relies below, it addresses those objections infra.

[7] Plaintiffs dispute this, asserting that Gleason's deposition testimony shows he was only tangentially involved in Toys' software upgrade. Gleason testified that he "was aware that [Toys was upgrading its software], and [that he] was on some of the e-mails and reviewed the CR's at the time." (Plaintiffs' Objection at 2 (citing Declaration of J. Mark Moore in Support of Opposition to Defendants' Motion for Summary Judgment ("Moore Decl."), Exh. 4 ("Gleason Depo.") at 61)). Although it appears that Gleason was not intimately involved in effecting the software upgrade, his testimony demonstrates that he was involved in overseeing and monitoring the process. This shows that he has sufficient personal knowledge to testify to the facts recited in his declaration.

[8] Cammarota Decl., ¶ 1.

[9] See Defendant Toys' Statement of Uncontroverted Facts in Support of Motion for Summary Judgment ("Def.'s Facts"), ¶ ¶ 15-27.

[10] Id. ¶ 15. Plaintiffs object to Toys' assertion that NCR has "substantial expertise in programming cash register systems." The extent of NCR's expertise is not material to the outcome of the motion, however.

[11] Id. ¶ 26. The parties dispute the reason Toys decided to upgrade its system. Toys asserts it initiated the upgrade to comply with the Payment Card Industry Data Security Standard ("PCI Standard") set by major credit card companies. (See Def.'s Facts, ¶ ¶ 1-8.) Edwards counters that evidence of compliance with industry standards is irrelevant in assessing Toys' liability in this case. (See Pls.' Objections at 9.) The court agrees with plaintiffs that the reason Toys elected to initiate an upgrade is not material in deciding this motion. The fact of its prior compliance, however, is relevant to the question of willfulness. Cf. United States v. Daraio, 445 F.3d 253, 264-65 (3d Cir.2006) (holding that evidence of a defendant's prior non-compliance with the tax laws was relevant in proving willfulness); see also Nationwide Jewelry & Pawn, Inc. v. United States, 455 F. Supp. 2d 1379 (M.D.Ga.2006) (prior non-compliance with the Gun Control Act was relevant to willfulness).

[12] Def.'s Facts, ¶ 28. Plaintiffs object to this evidence as lacking foundation. (See Pls.' Objections at 5.) For the reasons stated supra, the court overrules this objection.

[13] Def.'s Facts, ¶ 29. Call info chits are documents printed by customer service personnel when a credit or debit card transaction is denied; the chits are not provided to the customer and are used strictly for internal purposes. (Def.'s Facts, ¶ ¶ 30-33.) FACTA's requirement that no more than five numbers be printed on a customer receipt is applicable only to external receipts produced for customers.

[14] Id., ¶ 34. As part of the evidence supporting its motion, Toys described "the internal protocol it uses in making this type of change. Although not directly relevant to the court's decision, the protocol provides useful context. To effect a modification, Toys and NCR form a team to develop and approve the planned modification. (Id., ¶ 18.) The team creates a Change Request ("CR") and reviews it. (Id.) Once the CR is approved, it is forwarded to the programmers at NCR, who develop new software codes. (Id., ¶ 19.) Before implementing the changes, Toys tests the software both internally and at selected stores to ensure that there are no problems with the upgrade. (Id.) Once the upgrade has passed in-store testing, it is implemented in phases so that the management information services ("MIS") department can provide necessary assistance and support to stores if they encounter problems. (Id., ¶ 20.)

[15] Id., ¶ 35. Toys cites Gleason's declaration for the proposition that "this software update was not intended to impact the way in which Toys printed credit and debit card numbers on customer receipts." (Id.) Plaintiffs dispute this, and contend that Gleason's statement lacks foundation and is controverted by other evidence in the record. (Plaintiffs' Statement of Genuine Issues ("Pls.' Facts"), ¶ 35.) Plaintiffs' foundation objection is overruled for the reasons previously stated. The court agrees with plaintiffs, however, that the evidence in the record gives rise to conflicting inferences regarding Toys' intent.

[16] Def.'s Facts, ¶ 36.

[17] Id., ¶ 39; Pls.' Facts, ¶ 39. The parties dispute regarding Lee's modification of the protocol is addressed further below.

[18] Moore Decl., Exh. 2 (Deposition of Jeanette Lee ("Lee Depo."), 19:14-19). See Def. Facts, ¶ 15 (noting that one NCR employee is stationed at Toys' offices full time).

[19] See Defendant Toys "R" Us—Delaware Inc.'s Response to Plaintiffs Statement of Genuine Issues ("Def.'s Response Facts") at 26. Toys does not dispute that Lee contacted Amy Testino and Kevin Walton, two members of the "cross-functional" teams responsible for the CR. Id. It does, however, dispute the import and effect of the calls as discussed infra.

[20] Pls.' Facts, ¶ 42 (citing Moore Decl., Exh. 6). All parties agree on the text of the minutes, although their meaning is in dispute.

[21] Def.'s Response Facts at 47.

[22] Id. at 48. While the parties dispute the inferences to be drawn from the manner in which the test was conducted, there is no dispute regarding the nature of the test itself.

[23] See id. Toys represents that the sole purpose of the testing process is to determine whether the software produces the receipt it is designed to produce. Thus, if the software itself is flawed, the test receipt process will not catch that flaw.

[24] Def.'s Facts, ¶ 42; Moore Decl., Exh. 1 (Defendant's Responses to Interrogatory No. 1; Set One) at 4. The parties do not state clearly when the first violating receipts were printed, but it appears that the new software was implemented on October 27, 2007. (Def.'s Facts, ¶ 36.)

[25] Def.'s Facts, ¶ 43. Toys contends (and plaintiffs dispute) that service of the complaint was the first notice Toys received of the change in information appearing on the customer receipts.

[26] Id., ¶ 44. Toys asserts that it took action to correct an "error" caused by the CR and Lee's modification. Plaintiffs dispute Toys' use of the word "error" because it implies that the company's conduct was not intentional. There is no dispute, however, that Toys took action to ensure that the receipts being printed by its registers complied with FACTA.

[27] Id., ¶ ¶ 45-46.

[28] Id., ¶ ¶ 48-49. Gleason asserts that the speed of the turnaround reflects the "extraordinary effort" Toys mounted to bring itself into compliance with FACTA. Plaintiffs contend that this statement constitutes improper expert opinion. This objection is overruled. Given his position with Toys and his knowledge of the industry, Gleason is competent to offer the lay opinion or characterization that Toys' effort to achieve compliance with FACTA was extraordinary.

[29] See Defendant Toys "R" Us—Delaware, Inc.'s Reply Memorandum in Support of Its Motion for Summary Judgment ("Def.'s Reply") at 14; Pls.' Opp. at 9.

[30] Pls.' Opp. at 10.

[31] Def.'s Reply at 7. Toys argues in reply that, by failing to circulate her revisions to the team before implementation, Lee did not follow protocol. See, e.g., id. at S (noting that circulating revisions to the CR is "part of the mandatory process developed by Toys for implementing changes to the POS system"). In support of this argument, Toys proffers supplemental declarations from Amy Testino, Kevin Walton, Dominic Cutillo and Rowena Lochner. Testino and Walton also offer their version of the telephone call with Lee in the supplemental declarations. Plaintiffs have moved to strike the Testino, Walton and Cutillo declarations on the basis that they constitute new matter first offered in reply.

New evidence submitted in reply should not be considered without affording plaintiffs an opportunity to respond. See Provenz v. Miller, 102 F.3d 1478, 1483 (9th Cir.1996) ("We agree with the Seventh Circuit, which held that [w]here new evidence is presented in a reply to a motion for summary judgment, the district court should not consider the new evidence without giving the [non-]movant an opportunity to respond,'" quoting Black v. TIC Inv. Corp., 900 F.2d 112, 116 (7th Cir. 1990)); see also Green v. Baca, 219 F.R.D. 485, 487 n. 1(C.D.Cal.2003) (exercising discretion to consider evidence presented in reply but affording plaintiff the opportunity to depose a key declarant).

Evidence is not "new," however, if it is submitted in direct response to proof adduced in opposition to a motion. See Terrell v. Contra Costa County, 232 Fed.Appx. 626, 629 n. 2 (9th Cir. Apr. 16, 2007) (Unpub. Disp.) (reply evidence is not new where "[t]he Reply Brief addressed the same set of facts supplied in Terrell's opposition to the motion but provides the full context to Terrell's selected recitation of the facts"). Rather than offering new facts, the declarations, to which plaintiffs object offer a characterization of the telephone conversation between Lee and Testino and Walton that is different than that plaintiffs offered in their opposition. Plaintiffs' motion to strike is thus denied. The court notes that, even if plaintiffs were correct that the declarations constitute new evidence, it would deny the motion as moot, since the declarations the do not alter the court's conclusion that triable issues of fact remain as to whether Toys acted "willfully" in violating the FCRA. See E.E.O.C. v. Go Daddy Software, No. CV-04-02062 PHX (DGC), 2006 WL 1791295, *10 (D.Ariz. June 27, 2006) (denying a motion to strike new evidence in reply as moot where court "did not rely on these exhibits in resolving the issues addressed in this order"); Allender v. Huesman, No. IP01-718-C-T/K, 2003 WL 23142184, *3 n. 4 (S.D.Ind. Apr. 14, 2003) ("In any event, consideration of the evidence offered by the Plaintiffs on surreply would not change the outcome of the dispositive motion, as discussed below").

[32] Moore Decl., Exh. 6

[33] Pls.' Opp. at 12.

[34] Def.'s Reply at 8.

[35] Id. Toys' internal protocol demands adherence to certain formalities and procedures, and Toys contends that Lee's failure to follow those procedures demonstrates that it could not have known of or prevented her mistake.

[36] Id.

[37] Pls.' Opp. at 13.

[38] Def.'s Reply at 9.

[39] See id., § 16810 ("Any person who is negligent in failing to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer in an amount equal to the sum of . . . any actual damages sustained by the consumer as a result of the failure; and . . . the costs of the action together with reasonable attorney's fees as determined by the court").

[40] See 15 U.S.C. § 1681n ("Any person who willfully fails to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer in an amount equal to the sum of . . . any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000; . . . such amount of punitive damages as the court may allow; and . . . the costs of the action together with reasonable attorney's fees as determined by the court").

[41] The dispute in Safeco concerned interpretation of a notice provision in the FCRA that requires an insurance company to notify an affected consumer if it takes any "adverse action" regarding the consumer "`that is based in whole or in part on any information contained in a consumer report.'" Safeco, 127 S.Ct. at 2206 (quoting 15 U.S.C. § 1681 m(a)). At issue was whether an insurer acted "willfully" in misinterpreting the meaning of the statute's reference to "adverse action." Id. at 2207. The Court agreed with the Ninth Circuit that the district court had misinterpreted "adverse action," but held that the statutory language was "less-than-pellucid," and that the insurer's interpretation had been reasonable. Id. at 2216.

[42] The Court distinguished the manner in which "willful" is used in civil and criminal statutes. As used in criminal statutes, "willful" and "willfully" have been understood to "limit[ ] liability to knowing violations." Id. at 2209 n. 9 ("This reading of the term, however, is tailored to the criminal law, where it is characteristically used to require a criminal intent beyond the purpose otherwise required for guilt," citing Ratzlaf v. United States, 510 U.S. 135, 136-37, 114 S. Ct. 655, 126 L.Ed.2d 6,15 (1994)). "Civil use of the term, however typically presents neither the textual nor the substantive reasons for pegging the threshold of liability at knowledge of wrongdoing." Id.; see also Farmer v. Brennan, 511 U.S. 825, 836-37, 114 S. Ct. 1970, 128 L. Ed. 2d 811 (1994) (comparing the civil and criminal standards of recklessness).

[43] The Court also cited the Restatement (Second) of Torts. See Safeco, 127 S.Ct. at 2215 ("`The actor's conduct is in reckless disregard of the safety of another if he does an act or intentionally fails to do an act which it is his duty to the other to do, knowing or having reason to know of facts which would lead a reasonable man to realize, not only that his conduct creates an unreasonable risk of physical harm to another, but also that such risk is substantially greater than that which is necessary to make his conduct negligent,'" quoting RESTATEMENT (SECOND) OF TORTS § 500, p. 587 (1963-1964)).

[44] The Court therefore affirmed the Ninth Circuit's interpretation of "willfulness." See id. at 2216 ("The Court of Appeals correctly held that reckless disregard of a requirement of FCRA would qualify as a willful violation"). The circuit court's definition of the standard for recklessness appears to be slightly more expansive than that set forth in Safeco, however. The Ninth Circuit holds that "`willfully' entails a `conscious disregard' of the law, which means `either knowing that policy [or action] to be in contravention of the rights possessed by consumers pursuant to the FCRA or in reckless disregard of whether the policy [or action] contravened those rights.'" Reynolds v. Hartford Financial Services Group, Inc., 435 F.3d 1081, 1098 (9th Cir.2006) (quoting Cushman v. Trans Union Corp., 115 F.3d 220, 227 (3d Cir.1997)), rev'd on other grounds by Safeco, 127 S. Ct. 2201.

[45] Toys argues that under Safeco, summary judgment can properly be entered on the issue of willfulness. This, of course, is true in cases where no reasonable jury could find willfulness based on the facts presented. The cases Toys on which Toys relies, however, do not support the entry of summary judgment here. In Murray v. GMAC Mortgage Corp., 2007 WL 2317194, *3 (N.D.Ill., July 23, 2007), the court affirmed the entry of summary judgment in defendant's favor, concluding that defendant's interpretation of the FCRA could not be considered reckless. The reasonableness of a defendant's legal interpretation of an ambiguous statute does not turn on the inferences that can be drawn from undisputed facts to the same extent that the reckless nature of a clear statutory violation does, and consequently does not control the outcome here. A second case cited by Toys—Gorman v. Wolpoff & Abramson, LLP, 435 F. Supp. 2d 1004 (N.D.Cal.2006)—does not address whether willfulness can be decided at the summary judgment stage, as the court there concluded that plaintiff had not adduced evidence raising triable issues of fact as to whether a credit charge was disputed, or whether a credit reporting agency's investigation of the matter was unreasonable. See id. at 1009. In the final case on which Toys relies, the court found that summary judgment on willfulness was appropriate but provided no substantive discussion of its reasoning in this regard. It merely noted that "[p]laintiff ha[d] . . . not come forward with evidence sufficient to permit a reasonable trier of fact to find that defendant's reporting of the obsolete account was willful." See Batdorf v. Trans Union, No. C-00-00501 CRB, 2002 WL 1034048, *5 (N.D.Cal. May 15, 2002). In none of these cases was the court presented with evidence from which reasonable jurors could draw conflicting inferences regarding defendant's intent in violating the FCRA.

[46] Toys cites a series of cases from this district in which courts have denied class certification in FACTA cases analogous to this one. See Marian Evans v. U-Haul Co. of California, No. CV 07-02097 JFW (JCx) (Aug. 14, 2007); Torossian v. Vitamin Shoppe Indus., No. CV 07-00523 ODW (SSx) (Aug. 9, 2007); Papazian v. Burberry Limited, CV 07-01479GPS(RZx), 2007 WL 4812280 (C.D.Cal. Aug. 3, 2007); Najarian v. Charlotte Russe, Inc., No. CV 07-00501 RGK (CTx), 2007 U.S. Dist. LEXIS 59879 (C.D.Cal. June 12, 2007); Soualian v. Int'l Coffee & Tea LLC, No. CV 07-00502 RGK (JCx), 2007 U. S Dist. LEXIS 44208 (C.D.Cal. June 11, 2007); Najarian v. Avis Rent A Car Sys., No. CV 07-00588 RGK (Ex), 2007 WL 4682071, 2007 U.S. Dist. LEIS 59932 (C.D.Cal. June 11, 2007); Spikings v. Cost Plus, Inc., No. CV 06-08125 JFW (AJWx), 2007 U.S. Dist. LEXIS 44214 (C.D.Cal. May 25, 2007). These cases do not foreclose the individual plaintiffs from pursuing FACTA claims; rather, they merely deny class certification. See, e.g., Spikings, 2007 U.S. Dist. LEXIS 44214 at *15 ("any individual who feels that his rights under FACTA have been violated but who has not suffered any actual harm tan, as Plaintiff has, file a lawsuit to recover statutory damages and, if successful, attorney's fees"). To the extent that the decisions refer to defendants' good faith remedial action once notified of a FACTA violation, they find that the good faith nature of the remedial action bears on class certification, not on the merits of the claim. See id. at *14 ("Defendant's immediate action to comply with FACTA's requirements once becoming aware of Plaintiff's Complaint also supports denial of class certification in this case").

[47] While the Najarian court considered the fact that defendant did not knowingly violate FACTA, the order did not address whether defendant's conduct could be characterized as reckless. Here, assuming, without deciding, that Toys did not "know" that the software modification would result in a violation of FACTA, this does not end the willfulness inquiry. Rather, the court must examine whether Toys' action created an "unjustifiably high risk" of harm. See Safeco, 127 S.Ct. at 2215.

[48] Def. Reply at 13 (citing Peltz v. Polyphase Corp., 36 Fed.Appx. 316, 319 (9th Cir.2002) (Unpub. Disp.), and Nordstrom, Inc. v. Chubb & Son, Inc., 54 F.3d 1424, 1436 (9th Cir. 1995)). Toys reiterated this argument again at the hearing. The cases Toys cites, however, arise in the securities fraud context, where the word "scienter" has been specifically defined. See Tellabs, Inc. v. Makor Issues & Rights, Ltd., ___ U.S. ___, 127 S. Ct. 2499, 2507, 168 L. Ed. 2d 179 (2007) ("To establish liability under § 10(b) and Rule 10b-5, a private plaintiff must prove that the defendant acted with scienter, `a mental state embracing intent to deceive, manipulate, or defraud,'" quoting Ernst & Ernst v. Hochfelder, 425 U.S. 185, 193-94 and n. 12, 96 S. Ct. 1375, 47 L. Ed. 2d 668 (1976)); see also Ernst & Ernst, 425 U.S. at 194 n. 12, 96 S. Ct. 1375 ("In this opinion the term `scienter' refers to a mental state embracing intent to deceive, manipulate, or defraud. In certain areas of the law recklessness is considered to be a form of intentional conduct for purposes of imposing liability for some act. We need not address here the question whether, in some circumstances, reckless behavior is sufficient for civil liability under § 10(b) and Rule 10b-5"). Both Peltz and Nordstrom are securities cases. See Peltz, 36 Fed.Appx. at 319 ("To establish scienter for Rule 10b-5 purposes, plaintiffs must show that Polyphase engaged in intentional, knowing, or reckless misconduct"); Nordstrom, 54 F.3d at 1435 (discussing the definition of "corporate scienter" for the purposes of assigning direct corporate liability under section 10(b) of the Securities and Exchange Act). The court has found no cases applying the Nordstrom rule outside the securities context; given the fact that courts have held corporations vicariously liable under the FCRA for acts within their agents' apparent authority, the court concludes that Nordstrom does not control the definition of "willfulness" under the FCRA. This is particularly true as Nordstrom suggests the rule it articulates is applicable only in assessing whether a corporation can be held directly liable for securities fraud. See Nordstrom, 54 F.3d at 1433-36 (addressing vicarious and direct liability under the Securities and Exchange Act separately). It does not consider whether the mental state of corporate officers and directors is relevant in determining whether the company can be held vicariously liable.

[49] Id. Toys cites Sweetland v. Bank of America Corp., 241 Fed.Appx. 92, 93 (4th Cir.2007) (Unpub. Disp.), for this proposition. There, however, a plaintiff who alleged that Bank of America employees had violated the FCRA failed to adduce evidence that the violators were in any way connected with Bank of America. See id. The evidence in this case establishes a connection between Lee and Toys. The question is how legally to characterize that connection.

[50] As noted, Toys asserts that Lee violated its internal protocol for software revisions. This fact may weigh against a finding of agency, but is insufficient to permit decision of the issue as a matter of law. Given other evidence in the record regarding Lee's role, it at best raises triable issues of fact that must be decided by a jury.

[51] Toys asserts that plaintiffs have not adduced evidence as to why Toys would its POS software in such a way as to subject itself to massive liability under FACTA. While this is true, and may ultimately cause a jury to conclude that Toys did not act willfully, the court must defer to the jury to make that analysis. It cannot simply conclude that no reasonable jury could find that Toys acted knowingly or recklessly in permitting the modification to go forward. Cf. Schuster v. Symmetricon, No. C9420024RMW, 2000 WL 33115909, *7 (N.D.Cal. Aug. 1, 2000) ("A motive for fraud, such as personal gain, is not a required element of scienter or of fraud in general," citing Cosmas v. Hassett, 886 F.2d 8, 13 (2d Cir.1989)).

[52] At the hearing, Toys asserted that Lee's violation of its internal protocol negated any suggestion that it had acted "willfully." The evidence does not clearly show that Lee violated Toys' protocol. First, both Testino and Walton refer to the protocol in the present tense, and do not expressly state that the protocol was in effect at the time the CR was modified. (See e.g. Declaration of Amy Testino in Support of Motion for Summary Judgment ("Testino Decl."), ¶ 4) ("Changes to TOYS' POS software systems are handled through change requests, or CRs. For each CR, a team member is assigned . . ."). In the absence of evidence that the protocol was in effect at the time of the modification, the court will not infer that it was. More tellingly, Lee's deposition testimony indicates that Toy's formal review protocol was not as formal or binding as the company suggests. Lee stated that, although she usually sought email confirmation of revisions to be safe, she did not think that she was required to go through formal channels to approve a revision. (See Declaration of Richard M. Hoffman in Support of Defendant Toys "R" Us's Motion for Summary Judgment ("Hoffman Decl."), Exh. A (Deposition of Jeanette Lee) at 58:2-6 ("I had never been told that I needed, [to] always have the written approval. I liked having the written approval and I typically will get the written approval, but there have been occasions where I go with the verbal").) At a minimum, this testimony raises a triable issue as to what Toys' revision protocol demanded at the time of the revision in question, and how it was understood by or communicated to Lee.

[53] Def. Reply at 9.

[54] As noted, corporations can be held vicariously liable for the reckless acts of their officers and employees. See Jones, 144 F.3d at 965. Where a corporate policy or procedure gives rise to a statutory violation, however, the corporation's liability for willful can be said to be direct rather than vicarious. See Pollard v. E.I. DuPont De Nemours, Inc., 412 F.3d 657, 665 (6th Cir.2005) (distinguishing between vicarious liability and corporate liability in the case where a corporation failed to respond to the culpable conduct by non-management employees); R.E. Davis Chemical Corp. v. Nako Chemical Co., 757 F. Supp. 1499, 1522 (N.D.Ill.1990) (where high level corporate directors engage in illegal activity, "the argument is really one for direct rather than vicarious liability," citing D & S Auto Parts, Inc. v. Schwartz, 838 F.2d 964, 967-68 n. 5 (7th Cir.1988)).

[55] Although these cases concern the reasonableness of a defendant's procedures under a negligence, rather than a willfulness, standard, they support the conclusion that whether Toys' procedures were reckless as defined in Safeco should also be a jury question. Stated differently, the fact that recklessness requires a "risk [ ] substantially greater than that which is necessary to make . . . conduct negligent" does not change the underlying factual nature of the inquiry. Safeco, 127 S.Ct. at 2215. Although the threshold showing required is higher, the nature of the inquiry regarding the reasonableness of the risk remains the same. See Hutchinson v. A.P. Green Industries, Inc., No. CIV.A. 90-05620, 2004 WL 1925512, *5 (h.D.Pa. Aug. 30, 2004) ("the distinctions between negligence, recklessness, and intent are obviously matters of degree, albeit subtle ones . . . ").

[56] As plaintiffs noted at the hearing, Toys' receipts were out of compliance with FACTA for more than a month before this suit was brought. Toys thus appears to have no monitoring procedure in place to ensure that it complied with the law. Toys adduced no evidence, moreover, that it would have discovered the mistake absent the initiation of litigation. The state of the record gives rise to an inference that Toys could have remained out of compliance indefinitely because it lacked an adequate or any monitoring system. A reasonable jury could find that the failure to monitor constituted more than mere negligence and rose to the level of recklessness.

[57] This conclusion is consistent with the general notion that "good faith is generally a question of fact." Bagdadi v. Nazar, 84 F.3d 1194, 1200 (9th Cir.1996) (quotation omitted); United States v. Vista Paint Corp., 976 F.2d 739, 1992 WL 236898, *4 (9th Cir. Sept. 24, 1992) ("Vista's good faith was a question of fact that should not have been decided on summary judgment").