Wednesday, March 8, 2023

FYI: 4th Cir Holds Alleged Violation of State Common Law and Statutory Privacy Law Not Enough for Article III Standing

The U.S. Court of Appeals for the Fourth Circuit recently reversed a trial court's contrary ruling in a putative class action relating to a data breach, and remanded the case back to state court for lack of Article III standing.

 

In so ruling, the Fourth Circuit held that a plaintiff providing six (6) digits of his Social Security Number in alleged violation of state common law and statutory law was not a concrete injury sufficient to warrant Article III standing.

 

A copy of the opinion is available at:  Link to Opinion

 

The plaintiff alleged that the defendant company (Company) was a subsidiary of a credit reporting agency that suffered a data breach. The credit reporting agency engaged its subsidiary company to inform customers they were impacted by the data breach.  The defendant company's website prompted the impacted individuals to enter six (6) digits of their Social Security Number ("SSN") without requiring a password or other security precautions. The plaintiff alleged that the Company shared the six (6) digits of his SSN with the credit reporting agency who experienced the data breach.

 

Plaintiff filed a putative class action against Company in state court alleging that Company's practice of requiring six (6) digits of consumers' SSNs violated South Carolina's common-law right to privacy and South Carolina's Financial Identity Fraud and Identity Theft Protection Act (the "Act"). The Act prohibits "requir[ing] a consumer to use his social security number or a portion of it containing six digits or more to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet web site." S.C. Code Ann. § 37-20-180(A)(4).

 

Plaintiff argued that Company violated the Act by requiring him to provide more than five (5) digits of his SSNs. The Company removed the case to federal court under the federal Class Action Fairness Act ("CAFA"). Plaintiff filed an amended complaint which added a claim of negligence.

 

Company moved to dismiss under Fed. R. Civ. Pro. 12(b)(6) for failure to state a claim. While the motion to dismiss was pending, the Supreme Court of the United States issued its ruling in TransUnion LLC v. Ramirez.  Plaintiff openly questioned whether or not he had standing.  Ultimately, the trial court held Plaintiff adequately alleged an intangible concrete injury in the manner of an invasion of privacy, which gave the trial court subject matter jurisdiction. However, the trial court granted the Company's motion to dismiss holding that Plaintiff did not plausibly state a claim under the Act or under common law principles of privacy or negligence.

 

Plaintiff appealed only the trial court's decision to dismiss his claim under the Act and requested the Appellate Court affirm the trial court's ruling affirming that he suffered a concrete injury sufficient to give him standing under Article III. 

 

As you may recall, under Article III, a federal court only hears cases or controversies in which (1) a plaintiff "suffered an injury in fact that is concrete, particularized, and actual or imminent," (2) "the injury was likely caused by the defendant," and (3) "the injury would likely be redressed by judicial relief." TransUnion, 141 S. Ct. at 2203. In examining whether the Plaintiff properly alleged an Article III injury in fact, the Fourth Circuit noted that there was no case law interpreting the Act under the Article III framework. However, the Appellate Court examined other jurisdictions involving the federal Fair and Accurate Credit Transactions Act ("FACTA").

 

FACTA forbids merchants from printing more than the last five digits of a credit card number or the card's expiration date on receipts offered to customers. Even though FACTA contains specific restrictions, federal courts still independently determine ether the plaintiff alleging a FACTA violation suffered a concrete injury. For example, the Eleventh Circuit Court of Appeals previously held that a plaintiff receiving a receipt containing the first six and last four digits of his sixteen-digit credit card number was not enough to establish a concrete injury because the plaintiff did not plausibly allege a material risk of or realist danger of identity theft. See Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917, 921. However, the D.C. Circuit Court held that a plaintiff receiving a receipt that exposed the entire credit card number and expiration date constituted a concrete injury because it was sufficient information for a criminal to defraud. See Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1066 (D.C. Cir. 2019).

 

The Fourth Circuit also examined its own precedent where plaintiffs whose personal information was compromised in a data breach had not shown an Article III injury based on an alleged "increased risk of future identity theft and the cost of measures to protect against it. See Beck v. McDonald, 848 8 F.3d 262, 267 (4th Cir. 2017). The Fourth Circuit also noted that it previously held that a plaintiff did have Article III standing when the plaintiff was victims of identity theft traceable to the defendant's data breach. See Hutton v. National Board of Examiners in Optometry, Inc.892 F.3d 613, 621–22 (4th Cir. 2018).

 

The Fourth Circuit noted that Article III excludes plaintiffs who rely on an abstract statutory privacy injury unless it came with a nonspeculative increased risk of identity theft. Here, Plaintiff did not allege that that entering six digits of his SSN on the Company's website or sharing the information with the credit reporting agency somehow raised his risk of identity theft. Because Plaintiff alleged a violation that relied entirely on a procedural violation of a statute, the Fourth Circuit held that this was not sufficient under Article III.

 

Plaintiff argued further that under the Act he had a privacy interest in his SSN and this right was violated when he gave six (6) digits of his SSN to the Company to determine if he was impacted by the credit reporting agency's data breach.  However, the Fourth Circuit distinguished Plaintiff's allegations of a general right to privacy in his Social Security Number coupled with a speculative connection to potential identity theft from other cases where receiving an unwanted telephone call or text message was considered invading the privacy interest in the home. See generally Krakauer v. Dish Network, L.L.C., 925 F.3d 643, 653 (4th Cir. 2019) and Gadelhak v. AT&T Servs., Inc., 950 F.3d 458, 462 (7th Cir. 2020).

 

The Fourth Circuit held that the Plaintiff did not adequately plead that that he was injured by the alleged statutory violation of the Company at all and he fell short of averring a concrete injury in fact. The Appellate Court did not determine whether Plaintiff stated a claim under the Act.

 

Because it determined that Plaintiff did not have standing under Article III, the Fourth Circuit vacated and remanded the trial court's judgment with instructions to remand this case to state court, where the state court could separately determine the merits of Plaintiff's claims. 

 

 

 

Ralph T. Wutscher
Maurice Wutscher LLP
The Loop Center Building
105 W. Madison Street, 6th Floor
Chicago, Illinois 60602
Direct:  (312) 551-9320
Fax: (312) 284-4751

Mobile:  (312) 493-0874
Email: rwutscher@MauriceWutscher.com

 

Admitted to practice law in Illinois

 

 

 

Alabama   |   California   |   Florida   |   Illinois   |   Massachusetts   |   New Jersey   |   New York   |   Ohio   |   Pennsylvania   |   Tennessee   |   Texas   |   Washington, DC

 

 

NOTICE: We do not send unsolicited emails. If you received this email in error, or if you wish to be removed from our update distribution list, please simply reply to this email and state your intention. Thank you.


Our updates and webinar presentations are available on the internet, in searchable format, at:

 

Financial Services Law Updates

 

and

 

The Consumer Financial Services Blog

 

and

 

Webinars

  

 

 

 

Monday, March 6, 2023

FYI: 6th Cir Holds FDCPA SOL Triggered on Date of Last Violation, Not Date Faulty Collection Action Was Filed

The U.S. Court of Appeals for the Sixth Circuit recently reversed a trial court's dismissal of a consumer's federal Fair Debt Collection Practices Act ("FDCPA") claim, and held that the FDCPA claim actually fell within the statute of limitations.

 

In so ruling, the Sixth Circuit held that, because the FDCPA creates an independent statute of limitations for each discrete violation of the FDCPA, and even though the alleged FDCPA violation occurred in a collection lawsuit that was filed more than one year before the filing of the FDCPA action, the specific alleged FDCPA violation at issue occurred later in the collection lawsuit and within the FDCPA's one-year statute of limitation.

 

A copy of the opinion is available at:  Link to Opinion

 

The consumer financed a furniture purchase through a retail installment contract ("RIC"). The RIC was sold to a financing company. The consumer defaulted, and the financing company, through its attorney, sued in state court to recover the debt and attorney's fees.

 

The RIC attached to the complaint did not establish a transfer to the financing company. The court ordered the financing company to file proof of assignment, and the company filed an updated RIC that listed the previous creditor's store manager as assigning the debt to the financing company. The trial court then granted the financing company summary judgment, but the state appellate court found that the financing company had not sufficiently demonstrated a valid transfer. The state appellate court remanded the case, and the financing company eventually filed a voluntary dismissal.

 

Then, 380 days after the financing company originally filed its lawsuit in state court, the consumer sued the financing company's attorney in federal court under the FDCPA, alleging that the attorney doctored the RIC mid-litigation to make it look like the assignment was proper.

 

Upon the attorney's motion, the federal trial court dismissed the complaint as untimely under the FDCPA's one-year limitations period. The consumer filed a motion for reconsideration, and the attorney filed a motion for attorney's fees. The trial court denied both motions, and the parties timely appealed.

 

Meanwhile, the consumer and the financing company entered into a settlement agreement that released the company, later clarifying in an addendum that the company's attorney was not released. Three months before the court denied the motions for reconsideration and attorney's fees, the attorney learned of the settlement agreement.

 

Before the parties briefed the merits of their appeals, the attorney moved to dismiss the consumer's appeal for lack of jurisdiction based on the settlement agreement. The consumer argued that the attorney had forfeited this argument or, alternatively, that the agreement did not go to the Sixth Circuit's jurisdiction to hear the case. And, producing the addendum to the agreement as well as the attorney's employment contract with the financing company, the consumer also argued that the attorney was not an intended third-party beneficiary of the settlement agreement.

 

The Sixth Circuit denied the attorney's motion to dismiss the consumer's appeal, holding that the settlement agreement did not moot the appeal because, in the context of the case, the agreement did not go to the Court's jurisdiction to hear the case. The Court then allowed the parties to proceed with their briefing on appeal.

 

The consumer argued that her claim fell within the FDCPA's one-year statute of limitations. The attorney challenged the consumer's Article III standing to bring the lawsuit because, according to him, she was only pleading a statutory harm related to the state-court lawsuit and, therefore, could not meet the injury-in-fact requirement. The attorney also argued that the consumer's claim was time-barred and that she released her claim against him through the settlement agreement.

 

As you may recall, to establish Article III standing, a plaintiff must have suffered an injury-in-fact that is fairly traceable to the defendant's conduct and would likely be redressed by a favorable decision from a court. Rice v. Vill. of Johnstown, 30 F.4th 584, 591 (6th Cir. 2022). For the injury-in-fact requirement, a plaintiff's allegations must establish that she has experienced an injury that is "concrete, particularized, and actual or imminent." Barber v. Charter Twp. of Springfield, 31 F.4th 382, 390 (6th Cir. 2022).

 

Here, the Sixth Circuit concluded that the consumer was not merely pleading a statutory violation because she also alleged that she suffered an injury from defending against a state lawsuit that the financing company had no right to bring in the first place. Thus, in the Court's view, that harm established a concrete injury that met the injury-in-fact requirement. See Hurst v. Caliber Home Loans, Inc., 44 F.4th 418, 423 (6th Cir. 2022).

 

Regarding the statute of limitations question, the Sixth Circuit noted that every alleged discrete FDCPA violation has its own statute of limitations. Slorp v. Lerner, Sampson & Rothfuss, 587 F. App'x 249, 259 (6th Cir. 2014). "[T]he date on which the violation occurs" determines when the one-year statute of limitations starts running. § 1692k(d).

 

The Court then found that the consumer's complaint did allege a timely FDCPA violation: that the attorney filed an updated RIC and moved for summary judgment on that basis, allegedly affirmatively misrepresenting to the trial court that the assignment of the debt occurred before the financing company filed suit against the consumer.

 

The attorney argued that the alleged FDCPA violation was a continuing effect of the financing company's initial filing of the state lawsuit and was therefore time-barred because the consumer did not file within a year of the company's initiation of the state suit. See Slorp, 587 F. App'x at 259.

 

However, the Sixth Circuit held that the consumer's single claim was independent of the financing company's initial filing of the lawsuit —- not a continuing effect of it -— because it was a standalone FDCPA violation. The allegation was that the consumer introduced an RIC with a false assignment of debt that occurred after the lawsuit was filed. The Court reasoned that if it was only to consider the date the company filed suit, without regard to subsequent FDCPA violations within that lawsuit, it would create a rule that disregards the fact that § 1692k(d) creates an independent statute of limitations for each discrete violation of the FDCPA. See Bender v. Elmore & Throop, P.C., 963 F.3d 403, 407 (4th Cir. 2020).

 

The attorney also argued that the consumer released her FDCPA claim in the settlement agreement. The Sixth Circuit noted that the attorney first invoked that agreement in support of his jurisdictional argument that the agreement mooted the consumer's suit. At that time, the Court rejected the attorney's jurisdictional argument in its earlier order denying the motion to dismiss the appeal.

 

Nevertheless, the Sixth Circuit remanded this case for the trial court to evaluate in the first instance any merits argument based on the settlement agreement. Additionally, the Court vacated the trial court's order denying attorney's fees since the litigation below was allowed to continue.

 

 

Ralph T. Wutscher
Maurice Wutscher LLP
The Loop Center Building
105 W. Madison Street, 6th Floor
Chicago, Illinois 60602
Direct:  (312) 551-9320
Fax: (312) 284-4751

Mobile:  (312) 493-0874
Email: rwutscher@MauriceWutscher.com

 

Admitted to practice law in Illinois

 

 

 

Alabama   |   California   |   Florida   |   Illinois   |   Massachusetts   |   New Jersey   |   New York   |   Ohio   |   Pennsylvania   |   Tennessee   |   Texas   |   Washington, DC

 

 

NOTICE: We do not send unsolicited emails. If you received this email in error, or if you wish to be removed from our update distribution list, please simply reply to this email and state your intention. Thank you.


Our updates and webinar presentations are available on the internet, in searchable format, at:

 

Financial Services Law Updates

 

and

 

The Consumer Financial Services Blog

 

and

 

Webinars