Standing to Sue under the Fair and Accurate Credit Transactions Act after Spokeo

After paying for groceries with a credit card or debit card, the clerk hands the receipt to the customer. In addition to the last four digits of the card number, it contains the first digit. Or perhaps it contains the first six digits. Or maybe the expiration date. Is this a concrete injury that provides the customer standing to sue the grocery store?

That is the question federal courts have grappled with since the Supreme Court decided Spokeo, Inc. v. Robins[1] in May 2016. The Fair and Accurate Credit Transactions Act (“FACTA”)[2] regulates retailers’ conduct in printing card number information on customers’ receipts and provides a private right of action for alleged violations. But, as discussed below, a customer may not have standing to sue in federal court or even in certain state courts just because a violation may have occurred.

Background
FACTA—a 2003 amendment to the Fair Credit Reporting Act—requires the truncation of card numbers and expiration dates on printed cardholder receipts. Specifically, section 113 of FACTA provides that “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any [electronically-printed] receipt provided to the cardholder at the point of the sale or transaction.”[3] Consumers may bring a civil claim for negligent or willful violation of the statute; a willful violation can give rise to statutory and punitive damages.[4]

If consumers sue in federal court,[5] they must establish standing, including an “injury in fact,” to maintain a claim.[6] Although an intangible statutory injury may suffice under some circumstances, this “does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.”[7] Thus, as the Supreme Court held in Spokeo, “a bare procedural violation, divorced from any concrete harm,” does not “satisfy the injury-in-fact requirement.”[8] Courts have wrestled with how to apply this aspect of Spokeo to FACTA cases.

Despite Initial Decisions in Favor of Plaintiffs, the Majority View is Now to the Contrary
In mid-2016, district courts in the Eleventh Circuit issued a series of five decisions that applied Spokeo to FACTA claims and rejected challenges to the plaintiffs’ standing. The rulings reasoned that the alleged failure to truncate a card number,[9] or the alleged printing of a card expiration date,[10] was a “substantive” violation of a statutory right, rather than “a bare procedural violation.” According to these courts, the violation itself constituted a concrete injury, and thus the plaintiffs did not need to plead any further facts regarding harm suffered.

District courts outside of the Eleventh Circuit, however, began developing a contrary view of the application of Spokeo to FACTA claims. These courts concluded that certain alleged violations of the FACTA card number truncation requirement were “technical violation[s]” that “create[] no ‘concrete’ harm of the type sought to be prevented by Congress.”[11] For instance, in Noble v. Nevada Checker CAB Corp., the District of Nevada reasoned that FACTA’s “more than the last 5 digits” language creates ambiguity when viewed in the context of the card industry standard that the first six digits of a card number identify the card issuer, not the cardholder.[12] And because FACTA does not preclude the printing of the card issuer’s name on the receipt, the printing of the first digit and last four digits presents no greater risk of harm to the cardholder than what the statute permits.[13] Thus, absent separate allegations of “actual harm,” such as resulting credit card fraud, the cardholder lacks an injury-in-fact and thus standing.[14] Other district courts in the Ninth Circuit adopted similar reasoning,[15] as did district courts in the Second,[16] Third,[17] Seventh,[18] and Eighth[19] Circuits.

In September 2017, the Second Circuit validated the reasoning of the district courts in the developing majority. In Katz v. Donna Karan Co., the court ruled that the alleged violation was a “bare procedural violation” and proceeded to consider how district courts should “determine whether a bare procedural violation presents a material risk of harm to a concrete interest.”[20] The Second Circuit held that the district court had not clearly erred in finding that the printing of the card issuer identification number (the first six digits) failed to produce concrete harm.[21] “While [plaintiff] may be correct that every additional digit increases the risk of a brute force cryptological attack, printing the first six digits … is the equivalent of printing the name of the issuing institution, information which need not be truncated under FACTA.”[22]

Courts have also ruled that printing an expiration date on a receipt, without more, is a mere technical violation of FACTA that does not support standing. In Meyers v. Nicolet Restaurant of De Pere, LLC, for example, the Seventh Circuit reasoned that because the plaintiff “discovered the violation immediately and nobody else ever saw the non-compliant receipt,” “it is hard to imagine how the expiration date’s presence could have increased the risk that [the plaintiff’s] identity would be compromised.”[23] Additionally, in passing the Credit and Debit Card Receipt Clarification Act of 2007 (the “Clarification Act”),[24] Congress “specifically declared that failure to truncate a card’s expiration date, without more, does not heighten the risk of identity theft.”[25] Thus, the court concluded that “without a showing of injury apart from the statutory violation, the failure to truncate a credit card’s expiration date is insufficient to confer Article III standing.”[26]

Subsequently, district courts in the Second,[27] Fifth,[28] Ninth,[29] and Tenth[30] Circuits have followed Meyers. Several decisions acknowledge and rely on the congressional declaration, expressed through the Clarification Act, that the mere failure to truncate an expiration date does not increase the risk of identity theft.[31] And in Crupar-Weinmann v. Paris Baguette America, Inc., the Second Circuit joined the Seventh Circuit, determining the impact of the Clarification Act was “dispositive.”[32] The Second Circuit explained that “[w]hile we acknowledge that the Clarification Act maintained FACTA’s prohibition on this practice, we decline to draw plaintiff’s proposed inference” that the prohibition necessarily recognizes a “concrete harm.”[33]

Even some district courts in the Eleventh Circuit have now adopted the majority approach. In Gesten v. Burger King Corp.,[34] the Southern District of Florida dismissed FACTA claims because the plaintiff had not alleged a concrete injury under Spokeo.[35] The Gesten court recognized that “the Second Circuit and several district courts have held that the printing of the first six digits of a credit card account number on a receipt does not constitute an injury in fact because the first six digits merely identify the institution that issued the card, and are not part of the consumer’s unique account number.”[36] The court also recognized that “the Seventh and Second Circuits, as well as multiple district courts, have held that under Spokeo, a plaintiff does not have standing to pursue a FACTA claim if the plaintiff has not suffered any actual harm or a material risk of harm.”[37]

Remand and State Court Jurisprudence
Without standing to pursue a FACTA claim in federal court, a consumer might try to assert such a claim in state court.[38] Yet, some states have standing jurisprudence that mirrors that of federal law. In those states, a successful challenge to the concreteness of the plaintiff’s alleged injury under Spokeo may serve as grounds to dismiss FACTA claims in state court (whether in the first instance or upon remand) or in a case removed to federal court, to oppose remand to state court under the “futility exception.”[39]

A recent trial court decision out of North Carolina is illustrative. In Miles v. Company Store, Inc., the plaintiff alleged that the defendant violated FACTA by printing both the first six digits and last four digits of his credit card number on his customer copy receipt, thereby purportedly exposing him “to an increased risk of identity theft.”[40] Recognizing that North Carolina’s standing doctrine incorporates an injury-in-fact requirement “imported from federal standing doctrine,” the North Carolina state court looked to recent federal court decisions for guidance.[41] Without citing to Spokeo, the court identified and followed several post-Spokeo decisions where “federal courts have determined that the exact injury alleged here does not meet the concreteness requirement.”[42] It remains to be seen if more state courts apply a Spokeo-type concreteness analysis to alleged FACTA claims and, if so, in which states Spokeo-type challenges result in dismissal.

Conclusion
Although a clear majority trend—that an alleged FACTA violation by itself does not establish a concrete injury under Spokeo—has developed, upcoming decisions from the courts of appeals could change the legal landscape. The Ninth Circuit will likely be the next federal appellate court to address the intersection of FACTA and Spokeo. On November 17, 2017, a Ninth Circuit panel heard oral argument in the Noble appeal, focusing largely on whether the printing of the card issuer identification portion of a card number can give rise to concrete injury when FACTA does not prohibit the printing of the issuer’s name on the same receipt. Depending on how the court rules, it could create a split with the Second Circuit’s decision in Katz. Appeals are also underway in the Third and Fifth Circuits.[43]

Absent a circuit split, it does not appear that the Supreme Court will review the application of Spokeo to FACTA claims any time soon. In June 2017, for example, the Court denied certiorari in the Meyers case.[44] And the parties did not seek certiorari in Crupar-Weinmann or Katz. It remains to be seen how other federal courts—including the courts of appeals before which appeals are pending—and other state courts view the issue, as well as whether it eventually makes its way to the Supreme Court. Businesses that generate printed cardholder receipts—like our hypothetical grocery store—should remain alert to developments in this area of the law.

Notes:

[1] 136 S. Ct. 1540 (2016).
[2] Pub. L. No. 108-159, 117 Stat. 1952.
[3] 15 U.S.C. § 1681c(g).
[4] 15 U.S.C. § 1681n-1681o.
[5] 15 U.S.C. § 1681p.
[6] Spokeo, 136 S. Ct. at 1547 (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)).
[7] Id. at 1549.
[8] Id.
[9] See Altman v. White House Black Market, Inc., No. 1:15-cv-2451-SCJ, 2016 WL 3946780, at *3-5 (N.D. Ga. July 13, 2016); Guarisma v. Microsoft Corp., 209 F. Supp. 3d 1261, 1264-67 (S.D. Fla. 2016).
[10] See Wood v. J Choo USA, Inc., 201 F. Supp. 3d 1332, 1337-40 (S.D. Fla. 2016) (applying Guarisma to FACTA claim regarding expiration date truncation); Bouton v. Ocean Props., Ltd., 201 F. Supp. 3d 1341, 1351-52 (S.D. Fla. 2016) (same); Flaum v. Doctor’s Assocs., Inc., 204 F. Supp. 3d 1337, 1339-42 (S.D. Fla. 2016) (same)
[11] Noble v. Nevada Checker CAB Corp. No. 2:15-cv-02322-RCJ-VCF, 2016 WL 4432685, at *3 (D. Nev. Aug. 19, 2016), appeal argued, No. 16-16573 (9th Cir. Nov. 17, 2017).
[12] Id. at *2.
[13] See id.
[14] Id. at *3.
[15] Stelmachers v. Verifone Sys., Inc., No. 5:14-cv-04912-EJD, 2016 WL 6835084, at *2-4 (N.D. Cal. Nov. 21, 2016) (concluding alleged printing of more than last five digits “make[s] out only a bare procedural violation of FACTA” because “the risk that Plaintiff will be subjected to the type of ‘low tech’ identity theft identified in the [first amended complaint] is too attenuated to constitute a qualifying injury in fact for standing”); Stelmachers v. Verifone Sys., Inc., No. 5:14-cv-04912-EJD, 2017 WL 3968871, at *3-5 (N.D. Cal. Sept. 7, 2017) (dismissing second amended complaint “because Plaintiff still has not plausibly identified a concrete, certainly impending injury resulting from the non-compliant receipt”), appeal stayed pending decision in Noble, No. 17-17010 (9th Cir. Dec. 12, 2017).
[16] Katz v. Donna Karan Int’l, Inc., No. 14 Civ. 740 (PAC), 2017 WL 2191605, at *3-7 (S.D.N.Y. May 17, 2017) (“there is no evidence that Congress, in enacting FACTA, intended to create for consumers a substantive right to receive a redacted copy of their credit card receipt”), aff’d sub nom. Katz v. Donna Karan Co., 872 F.3d 114 (2d Cir. 2017).
[17] Kamal v. J. Crew Group, Inc., No. 2:15-0190 (WJM), 2016 WL 6133827, at *2-4 (D.N.J. Oct. 20, 2016) (reasoning that Clarification Act reflects Congress’s recognition that improper truncation in and of itself is not actual harm); Hendrick v. Aramark Corp., --- F. Supp. 3d ----, 2017 WL 1397241, at *3-5 (E.D. Pa. Apr. 18, 2017) (following Kamal); Kamal v. J. Crew Group, Inc., No. 2:15–0190 (WJM), 2017 WL 2587617, at *2-5 (D.N.J. June 14, 2017) (dismissing second amended complaint because alleged printing of first six digits and last four digits of card number was a “bare procedural violation”), appeal docketed, No. 17-2345 (3d Cir. June 22, 2017). But see Gennock v. Kirkland’s, Inc., No. 2:17-cv-00454-DSC-RCM, slip op. at 4-11 (W.D. Pa. Nov. 29, 2017) (magistrate report recommending denial of motion to dismiss on grounds that since Spokeo, Third Circuit has recognized standing in context of both Fair Credit Reporting Act and Telephone Consumer Protection Act claims that implicate similar privacy rights as FACTA (citing In re Horizon Healthcare Services, Inc. Data Breach Litigation, 846 F.3d 625 (3d Cir. 2017), and Susinno v. Work Out World, Inc., 862 F.3d 346, 351 (3d Cir. 2017)), predicting that the Third Circuit will reverse Kamal on appeal, and rejecting Katz as “tak[ing] a circuitous route through FACTA” that ignores the statute’s plain language), adopted slip op. at 1 (W.D. Pa. Jan. 4, 2018).
[18] Paci v. Costco Wholesale Corp., No. 16-cv-0094, 2017 WL 1196918, at *2-3 (N.D. Ill. Mar. 30, 2017) (granting defendant’s motion for summary judgment because plaintiff had not created triable issue of fact as to existence of concrete injury as a result of printing first six digits and last four digits on receipt where only evidence of harm was that plaintiff secured receipt in a file cabinet as opposed to her normal practice of placing receipt in a box).
[19] Thompson v. Rally House of Kan. City, Inc., No. 15–00886–CV–W–GAF, 2016 WL 8136658, at *2-5 (W.D. Mo. Oct. 6, 2016) (plaintiff alleged “no real risk of harm as the improper receipt has only been in Plaintiff’s possession since receiving it from Defendants”).
[20] 872 F.3d 114, 119 (2d Cir. 2017).
[21] See id. at 119-20 (concluding that the defendant’s challenge to the plaintiff’s standing was a factual challenge, as opposed to a facial one).
[22] Id. at 120. The court limited its holding, however, “emphasiz[ing] … that we do not here resolve whether other bare procedural violations of FACTA should or will meet a similar outcome, a question for lower courts to determine in the first instance, on a case- and fact-specific basis.” Id. at 121; cf. Katz v. Metropolitan Transp. Auth., No. 17-CV-472(KAM), 2017 WL 6734185, at *6-10 (E.D.N.Y. Dec. 29, 2017) (dismissing card number truncation claim for lack of standing and rejecting plaintiff’s argument that Katz v. Donna Karan Co. was not dispositive).
[23] 843 F.3d 724, 727-29 (7th Cir. 2016), cert. denied 137 S. Ct. 2267 (2017).
[24] Pub. L. No. 110-241, 122 Stat. 1565. Pursuant to the Clarification Act, the printing of an expiration date on a cardholder receipt subject to FACTA between December 4, 2004, and June 3, 2008, was not a willful violation. 15 U.S.C. § 1681n(d); see Clarification Act, § 3, 122 Stat. 1565, 1566 (2007).
[25] Meyers, 843 F.3d at 727-28.
[26] Id. at 728-29. Although Meyers concerned the printing of an expiration date as opposed to more than the last five digits of the card number, in Paci, a case concerning the card number, the district court concluded that Meyers “is both instructive and dispositive.” 2017 WL 1196918, at *2.
[27] Fullwood v. Wolfgang’s Steakhouse, Inc., No. 13 Civ. 7174 (KPF), 2017 WL 377931, at *6 (S.D.N.Y. Jan. 26, 2017); Crupar-Weinmann v. Paris Baguette Am., Inc., 235 F. Supp. 3d 570, 574-77 (S.D.N.Y. Jan. 30, 2017) (“plaintiff has failed to allege facts demonstrating that the violation in question put her at an increased risk of identity theft”), aff’d 861 F.3d 76 (2d Cir. 2017).
[28] Gant v. Fondren Orthopedic Group LLP, No. 4:16-cv-00648, 2017 WL 4479955, at *1-2 (S.D. Tex. May 22, 2017) (“a violation of FACTA, in and of itself, does not establish standing”), appeal docketed, No. 17-20407 (5th Cir. June 23, 2017); Batra v. RLS Supermarkets LLC, 3:16-CV-2874-B, 2017 WL 3421073, at *2-8 (N.D. Tex. Aug. 9, 2017) (“a violation of 15 U.S.C. § 1681c(g) is not one where the violation, alone, constitutes a concrete injury”), appeal docketed, No. 17-11014 (5th Cir. Sept. 7, 2017).
[29] Llewellyn v. AZ Compassionate Care Inc., No. CV-16-04181-PHX-DGC, 2017 WL 1437632, at *2-6 (D. Ariz. Apr. 24, 2017) (“Plaintiff alleges a bare technical violation of FACTA, without satisfying his burden of alleging concrete harm.”). But see Deschaf v. Am. Valet & Limousine Inc., 234 F. Supp. 3d 964, 967-70 (D. Ariz. Feb. 15, 2017) (“A person or entity who prints an expiration date on a receipt, therefore, does not simply violate a procedural provision of FACTA but creates a real risk of identity theft—the very harm that FACTA was enacted to combat.”).
[30] Weinstein v. Intermountain Healthcare, Inc., No. 2:16–cv–00280–DN, 2017 WL 1233829, at *3-4 (D. Utah Apr. 3, 2017) (plaintiff “has not alleged any actual harm but has only alleged a violation of FACTA by having the expiration date of his credit card printed on a receipt”).
[31] See Llewellyn, 2017 WL 1437632, at *5; Batra, 2017 WL 3421073, at *6-7; Weinstein, 2017 WL 1233829, at *4 & n.46. But see Wood, 201 F. Supp. 3d at 1338-40 (rejecting argument that Clarification Act established that Congress did not recognize printing of card expiration date by itself as a cognizable injury).
[32] 861 F.3d 76, 81-82 (2d Cir. 2017), reh’g denied (2d Cir. Aug. 24, 2017) (“Congress did not think that the inclusion of a credit card expiration date on a receipt increases the risk of material harm of identify theft.” (emphasis original)); see O’Shea v. P.C. Richard & Son, LLC, No. 15 Civ. 9069 (KPF), 2017 WL 3327602, at *4-7 (S.D.N.Y. Aug. 3, 2017) (“Crupar-Weinmann II makes clear that Plaintiffs lack Article III standing. Just as in that case, Plaintiffs here allege only that the expiration dates of their cards were printed on their receipts. Neither alleges that their identities were stolen or that credit card fraud was perpetrated against them.”); Fullwood v. Wolfgang’s Steakhouse, Inc., No. 13 Civ. 7174 (KPF), 2017 WL 5157466, at *3-6 (S.D.N.Y. Nov. 3, 2017) (same; dismissing third amended complaint).
[33] Id.
[34] No. 17-22541-Civ-Scola, 2017 WL 4326101 (S.D. Fla. Sept. 27, 2017).
[35] Id. at *1, *2-6; see also Tarr v. Burger King Corp., No. 17-23776-Civ-Moreno, 2018 WL 318477. at *3-4 (S.D. Fla. Jan. 5, 2018) (agreeing with Gesten and adopting majority approach).
[36] 2017 WL 4326101 at *2 (citing Katz, Kamal, and Noble).
[37] Id. at *3 (citing Crupar-Weinmann, Meyers, Hendrick, Paci, Stelmachers, and Thompson).
[38] Indeed, some federal courts have remanded, rather than dismissed, FACTA claims upon finding that the plaintiff failed to allege a concrete injury under Spokeo. See Edelstein v. Westlake Wellbeing Properties, LLC, No. CV 17-06488-AB (JEMx), 2017 WL 5495153, at *2-3 (C.D. Cal. Nov. 15, 2017); Lindner v. Roti Restaurants, LLC, No. 17-cv-935, 2017 WL 3130755, at *2-4 (N.D. Ill. July 24, 2017); Everett v. Memphis Light Gas & Water Division, No. 16-cv-2810-SHL-tmp, 2017 WL 1830165, at *2-4 (W.D. Tenn. Apr. 18, 2017); Mocek v. Allsaints USA Ltd., 220 F. Supp. 3d 910, 912-14 (N.D. Ill. 2016). But see Collier v. SP Plus Corp., No. 16 CV 10587, 2017 WL 4585572, at *2-5 (N.D. Ill. Apr. 28, 2017) (denying plaintiff’s motion to remand FACTA claim that defendant removed and moved to dismiss for lack of standing because even though plaintiff did not suffer injury under Spokeo, FACTA claim arose under federal law subject to federal court subject matter jurisdiction), appeal docketed No. 17-2431 (7th Cir. July 14, 2017). One such court even sanctioned a defendant for removing a FACTA case from state court and then moving to dismiss it for lack of Article III standing. See Mocek, 220 F. Supp. 3d at 914-15 (awarding plaintiff her attorneys’ fees “incurred as a result of removal”).
[39] The “futility exception” allows a federal court to decline to remand a case for which it lacks subject matter jurisdiction where the state court to which the case would be remanded lacks subject matter jurisdiction “for the very same reason.” See Lindner, 2017 WL 3130755, at *4 (discussing whether to apply “futility exception”).
[40] No. 16-CVS-2346, slip. op at 1-2 (N.C. Super. Ct. Nov. 9, 2017) (noting that the plaintiff did “not allege that the receipt was seen by anyone other than himself or that he suffered identity theft”).
[41] Id. at 2-3.
[42] Id. (citing Hendrick, Kamal, Stelmachers, and Thompson).
[43] The Third Circuit has scheduled Kamal for argument in February 2018. The Fifth Circuit has noted the relatedness of the Gant and Batra appeals. It remains to be seen if they will be consolidated for argument, decision, or both.
[44] 137 S. Ct. 2267 (2017).