The U.S. District Court for the District of New Jersey recently concluded that a putative class representative did not have standing under Spokeo to sue for a technical violation of the federal Fair and Accurate Credit Transactions Act, 15 U.S.C. § 1681, et seq. ("FACTA").
The Court identified the issue as whether the consumer alleges a sufficiently "concrete" harm to confer standing, based on a technical violation of FACTA when a retail store printed the first six numbers and last four numbers of his credit card on his transaction receipts. Relying on the Supreme Court's ruling in Spokeo Inc. v. Robins, 136 S. Ct. 1540, 1548 (2016), the Court identified two factors that determine whether an intangible harm is sufficiently concrete to confer standing under Article III.
The first factor, according to the Court, was "whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts."
The second factor was "whether Congress has expressed an intent to make an injury redressable." Even if a statute creates a statutory right and gives a person authority to have that right vindicated, the Court continued, Article III still requires concrete injury even if the statute has been violated.
Because the plaintiff did not adequately allege a concrete injury for the technical violation, the Court dismissed his Second Amended Complaint.
A copy of the opinion is available at: Link to Opinion
The defendants here were a conglomerate of clothing stores and manufacturers. On three occasions, plaintiff purchased clothes from the defendants and defendants printed the first six and last four digits of plaintiff's credit card.
As you may recall, under FACTA, "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number . . . upon any receipt provided to the cardholder at the point of the sale or transaction." See 15 U.S.C. § 1681c. The statute creates a private cause of action for "any actual damages . . . or damages of not less than $100 and not more than $1,000" for each violation. See 15 U.S.C. § 1681n(a).
Plaintiff filed his original, single-count FACTA complaint in January of 2015 and his first amended complaint ("FAC") in March of 2015, seeking statutory damages of $100 to $1000 per violation, as well as attorney's fees and punitive damages. In August of 2015, the Court denied defendants' motion to dismiss under Fed. R. Civ. P. 12(b)(6). In December of that year, the Court granted defendants' motion to stay the proceedings pending the outcome of Spokeo.
In May of 2016, the Supreme Court of the United States in Spokeo held that a plaintiff does not automatically "satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right." Applying Spokeo, the Court determined that it lacked subject matter jurisdiction and dismissed plaintiff's FAC without prejudice.
Plaintiff then filed a second amended complaint ("SAC"). Defendants again moved to dismiss for lack of standing. While the defendants' motion to dismiss was pending, the Third Circuit decided In re Horizon Healthcare Servs. Data Breach Litig., 846 F.3d 625 (3d Cir. 2017) ("Horizon"), which applied Spokeo in the context of an alleged data breach that led to the disclosure of the plaintiff's personal information.
The Court first identified the issue as "whether [plaintiff] alleges a sufficiently 'concrete' harm to confer standing." Next, the Court analyzed the two recent cases, Spokeo and Horizon, addressing issues of concreteness and standing.
First, the Court quoted extensively from the findings in Spokeo related to concrete injuries. "'Concrete' injuries may be 'intangible' or non-economic, but, like other cognizable injuries, they must be 'actual or imminent, not conjectural or hypothetical.'" Spokeo, 136 S. Ct. at 1548. The Court then identified two factors from Spokeo that determine whether an intangible harm is sufficiently concrete. The first is "whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Id. If so, "it is likely to be sufficient to satisfy the injury-in-fact element of standing." Horizon, 846 F.3d at 637 (3d Cir. 2017).
The second consideration, according to the Court, is "whether Congress has expressed an intent to make an injury redressable;" for, "even if an injury was previously inadequate in law, Congress may elevate it to the status of [a] legally cognizable injur[y]." Id. (quoting Spokeo, 846 F.3d at 637).
The Court continued, "a plaintiff does not automatically satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right. Article III standing requires a concrete injury even in the context of a statutory violation.'" See Spokeo, 136 S. Ct. at 1549.
Next, the Court analyzed the findings from Horizon. In that case, two laptop computers containing unencrypted personal information of over 800,000 health insurance customers were stolen from defendant's headquarters. The breach ultimately led to a fraudulent tax return being filed in plaintiff's name and to an attempted credit card fraud. Plaintiff was also denied credit because his social security number had been associated with identity theft. The plaintiff's complaint alleged several violations of the federal Fair Credit Reporting Act ("FCRA"), including the unauthorized furnishing of personal information.
Applying Spokeo, the Third Circuit denied the defendant's facial challenge, holding that the alleged injuries were sufficiently "concrete" to confer constitutional standing. The Court acknowledged that, under Anglo-American law, the "unauthorized disclosures of information have long been seen as injurious," and, by passing the FCRA, Congress clearly intended to establish "that the unauthorized dissemination of personal information by a credit reporting agency causes an injury in and of itself—whether or not the disclosure of that information increased the risk of identity theft or some other future harm."
The Third Circuit concluded that the alleged injury in Horizon was "concrete" because it sufficiently resembled a common law injury (invasion of privacy), such that Congress could "elevat[e] [it] to the status of legally cognizable injur[y]." Id at 640. The New Jersey District Court acknowledged that the Horizon majority declined to consider "the full reach of congressional power to elevate a procedural violation to an injury in fact," because the case before it "[did] not strain that reach." Id. at 638.
Relying on the findings from Spokeo and Horizon, the Court turned its attention to the facts of this case, where plaintiff attempted to identify two "concrete" injuries: (1) disclosure of information considered by law to be intrinsically private, and (2) the increased risk of identity theft or credit card fraud in the future. According to the Court, neither theory alleged an adequate "concrete" injury, so plaintiff failed to satisfy the injury-in-fact element of constitutional standing.
Applying the factors from Spokeo, the Court determined that there was no meaningful relationship between defendants' conduct and any privacy interest historically recognized at common law. "Unlike in Horizon, plaintiff's personal information was not disclosed to third parties or used to perpetrate credit-card or tax fraud." According to the Court, the defendants did not "disclose" plaintiff's personal information. Instead, he gave his credit card to defendants and they printed some of the numbers on his receipt. "[P]rinting a card's first six and last four digits—rather than only the last five digits—does not implicate the historic 'right to be let alone,' particularly when the first six digits do not pertain to the customer's individual bank account."
As to the second factor under Spokeo, "the judgment of Congress," the Court concluded that it did not support plaintiff's argument. "[I]t does not follow that Congress contemplated private actions by individuals who have not sustained any actual harm."
The Court next addressed plaintiff's allegation of increased risk of identity theft in the future. The Court acknowledged that, based on the holdings from Spokeo, "if [plaintiff] adequately alleges that [defendants'] statutory violation creates a material risk of future harm, then [plaintiff] likely has constitutional standing." The Court, however, quickly concluded plaintiff had not sufficiently alleged a risk of future harm.
The Court observed that credit card numbers are 16 digits long, with the first six relating to the issuing bank and the last 10 referring to the card holder. Thus, by printing the first six and last four, the defendants did not increase the risk of future harm because the personal information given – the last four digits – did not exceed the five digits permitted by Congress.
Next, the Court addressed plaintiff's allegations that "dumpster divers" or "sophisticated criminals" could use the receipts to perpetrate fraud. According to the Court, plaintiff had not presented sufficient information to establish these alleged harm-causing scenarios were anything other than hypothetical and too remote. Accordingly, the Court rejected those allegations.
Finally, the Court summarized its findings: "Congress cannot empower individuals to manufacture a 'case' or 'controversy' where none exists. As Spokeo explained and Horizon acknowledged, the 'congressional power to elevate intangible harms into concrete injuries is not without limits.' Those limits are established by Article III of the Constitution, as interpreted by the Supreme Court. This Court finds that [defendants'] technical violation of FACTA lies beyond these limits."
Accordingly, the Court granted the defendants' motion to dismiss and dismissed plaintiff's SAC.
Ralph T. Wutscher
Maurice Wutscher LLP
The Loop Center Building
105 W. Madison Street, 18th Floor
Chicago, Illinois 60602
Direct: (312) 551-9320
Fax: (312) 284-4751
Mobile: (312) 493-0874
Email: rwutscher@MauriceWutscher.com
Admitted to practice law in Illinois
Alabama | California | Florida | Georgia | Illinois | Indiana | Maryland | Massachusetts | Michigan | New Jersey | New York | Ohio | Pennsylvania | Texas | Washington, DC | Wisconsin
NOTICE: We do not send unsolicited emails. If you received this email in error, or if you wish to be removed from our update distribution list, please simply reply to this email and state your intention. Thank you.
Our updates and webinar presentations are available on the internet, in searchable format, at:
Financial Services Law Updates
and
The Consumer Financial Services Blog™
and
and
California Finance Law Developments
