The U.S. Court of Appeals for the District of Columbia Circuit held that where a company provided a consumer with a receipt that displayed her entire sixteen-digit credit card number and credit card expiration date in violation of the federal Fair and Accurate Credit Transactions Act of 2003 ("FACTA"), the consumer alleged a concrete injury in fact sufficient for standing under Spokeo, notwithstanding the fact that the consumer noticed the violation immediately and kept the receipt in a safe location.
Accordingly, the D.C. Circuit reversed the judgment of the trial court granting the defendant company's motion to dismiss, and remanded the matter for further proceedings.
A copy of the opinion is available at: Link to Opinion
A consumer ("Consumer") made a credit card purchase at a company ("Company") location and received a receipt that displayed her sixteen-digit credit card number, the credit card expiration date, and her credit card provider.
The Consumer immediately recognized that the receipt contained her personal information, and held onto it for safekeeping. She then filed a class action lawsuit against the Company alleging a willful violation of FACTA, which prohibits printing "more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of sale or transaction."
The Consumer alleged that the Company's conduct violated her statutory right and, as a result, exposed her to an increased risk of identity theft. She also alleged that she was forced to take steps to safeguard the noncompliant receipt.
The Company moved to dismiss the complaint for lack of standing under Spokeo. The district court granted the motion, determining that the Consumer did not suffer an increased risk of identity theft because only she viewed the receipt containing her credit card information. The district court also concluded that the burden of safeguarding the noncompliant receipt was insufficiently concrete to support standing.
The trial court therefore held that the Consumer lacked standing, and dismissed the case for lack of subject-matter jurisdiction.
The Consumer appealed.
On appeal, the D.C. Circuit first discussed the Spokeo ruling, wherein the Supreme Court held that plaintiff must meet three elements for standing: "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision."
The Court noted that "[c]ausation and redressability are not in dispute," rather "[t]he issue is whether [the Consumer] alleged an adequate injury in fact."
The Consumer argued that a violation of her statutory right under FACTA constitutes an injury in fact without any additional showing of harm, and under Spokeo, "the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact."
However, the D.C. Circuit noted that "[f]or a statutory violation to constitute an injury in fact, . . . the statute must protect the plaintiff's concrete interest – i.e., afford the putative plaintiff a right to be free of a harm capable of satisfying Article III."
The Consumer argued that FACTA is such a statute and vests consumers with a concrete interest in using their credit and debit cards without incurring an increased risk of identity theft.
The D.C. Circuit agreed, noting that "FACTA itself does not prohibit the crimes of identity theft or fraud," rather "its truncation requirement is a 'procedure[] designed to decrease th[e] risk' that a consumer would have his identity stolen."
Thus, the truncation requirement that a merchant not print more than the last five digits of a credit card number or expiration date "vests consumers with an interest in using their credit card and debit cards without facing an increased risk of identity theft."
As a result, the Court held, the question "becomes whether the interest protected by FACTA – avoiding an increased risk of identity theft – is concrete." And, in determining whether an intangible injury is concrete, "both history and the judgment of Congress play important roles."
In determining that "[h]istory tilts toward concreteness," the D.C. Circuit compared FACTA's truncation requirement to a common law breach of confidence claim where a person offers private information to a third party in confidence and the third party reveals that information to another. There, the harm "occurs when the plaintiff's trust in the breaching party is violated, whether or not the breach has other consequences." Further, "FACTA protects against the risk of the very harm the breach of contract tort makes actionable – the unauthorized disclosure of privileged information to a third party."
The D.C. Circuit also gave "weight to Congress's determination that printing too much credit card information on a receipt creates a 'real' or 'de facto' harm."
Having determined that FACTA protects a concrete interest, the D.C. Circuit explained that it "must also determine whether the challenged violation of [the Consumer's] statutory right harmed or created a 'risk of real harm' to the concrete interests protected by FACTA."
The D.C. Circuit observed that "not every violation of FACTA's truncation requirement creates of identity theft," noting that "our sister courts, applying Spokeo, have unanimously concluded that a FACTA violation based solely on a failure to truncate an expiration date does not qualify as a concrete injury in fact."
However, "none of these courts encountered a FACTA violation as egregious as the one committed by [the Company]," which printed the Consumer's entire credit card number and expiration date, "creating the nightmare scenario FACTA was enacted to prevent."
The D.C. Circuit therefore held that "[a]lthough not every FACTA violation creates a concrete injury in fact, . . . the alleged violation of [the Consumer's] right does."
Thus, the Consumer "pleaded enough facts to establish standing." Accordingly, the D.C. Circuit reversed the judgment of the trial court, and remanded the matter for further proceedings.
Ralph T. Wutscher
Maurice Wutscher LLP
The Loop Center Building
105 W. Madison Street, 18th Floor
Chicago, Illinois 60602
Direct: (312) 551-9320
Fax: (312) 284-4751
Mobile: (312) 493-0874
Email: rwutscher@MauriceWutscher.com
Admitted to practice law in Illinois
Alabama | California | Florida | Georgia | Illinois | Massachusetts | New Jersey | New York | Ohio | Pennsylvania | Texas | Washington, DC
NOTICE: We do not send unsolicited emails. If you received this email in error, or if you wish to be removed from our update distribution list, please simply reply to this email and state your intention. Thank you.
Our updates and webinar presentations are available on the internet, in searchable format, at:
Financial Services Law Updates
and
The Consumer Financial Services Blog™
and
Webinars
and
California Finance Law Developments
