The U.S. Court of Appeals for the Ninth Circuit recently affirmed the dismissal of a consumer's putative class action alleging willful violations of the federal Fair Credit Reporting Act (FCRA) for lack of standing under Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).
In so ruling, the Court held that merely printing a credit card receipt without redacting the card's full expiration date did not allege the concrete injury required, where no second receipt existed, the consumer did not lose the receipt, nobody stole the receipt, and nobody stole the consumer's identity.
A copy of the opinion is available at: Link to Opinion
A consumer used his credit card at a parking garage and received a receipt displaying the credit card's full expiration date. The consumer filed a putative class action lawsuit against the garage alleging willful violation of the FCRA. Specifically, the consumer alleged that failing to redact the card's full expiration date violated 15 U.S.C. § 1681c(g).
The consumer only alleged a statutory violation and the potential for actual injury. The consumer alleged that his injury was "exposure . . . to identity theft and credit/debit fraud," because he was at "imminent risk" that his "property would be stolen and/or misused by identity thieves." However, he did not allege that a second receipt existed, that someone stole his receipt, that he lost his receipt, or that anyone stole his identity. Instead, he claimed that "the risk of harm created in printing the expiration date on the receipt" was a "sufficiently concrete" injury.
The garage moved to dismiss the complaint arguing that the consumer lacked Article III standing. The trial court concluded that the consumer only alleged "possible risk of [identity] theft." Following Spokeo, the trial court noted that "[s]omething more is necessary" to allege a concrete injury as not every procedural violation gives rise to standing. Thus, the trial court granted the motion and dismissed the case with prejudice finding that the consumer did not allege a sufficiently concrete injury to establish standing.
This appeal followed.
The Ninth Circuit first examined the history of the relevant statutory framework because "the doctrine of standing derives from the case-or-controversy requirement, and because that requirement in turn is grounded in historical practice." Spokeo, 136 S. Ct. at 1549.
As you may recall, the Fair and Accurate Credit Transactions Act of 2003 (FACTA) amended the FCRA by limiting printed information on receipts:
[N]o person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.
115 U.S.C. § 1681c(g). The Ninth Circuit observed that the FCRA provides that "[a]ny person who willfully fails to comply with [that requirement] with respect to any consumer is liable to that consumer" for statutory damages of between $100 and $1,000 per violation or "any actual damages sustained by the consumer," costs and attorney's fees, and potential punitive damages. See 15 U.S.C. § 1681n.
Additionally, since FACTA, Congress enacted the Credit and Debit Card Receipt Clarification Act (Clarification Act), which reiterated that the FCRA prohibits printing "receipts bearing a card's expiration date." Id. However, the Ninth Circuit noted that Congressional findings found "hundreds of lawsuits were filed alleging that the failure to remove the expiration date was a willful violation of the [FCRA] even where the account number was properly truncated," and "[n]one of these lawsuits contained an allegation of harm to any consumer's identity." Congress also found that "[e]xperts in the field agree that proper truncation of the card number, by itself as required by the [FCRA], regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud."
Thus, the Court noted, the Clarification Act ensures "that consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuit." The Clarification Act also provided merchants with a temporary reprieve: "[A]ny person who printed an expiration date on any receipt . . . between December 4, 2004, and [June 3, 2008]," but otherwise complied with the statute, did not willfully violate the FCRA.
The Ninth Circuit next turned to whether the consumer had standing in this case. As you may recall, standing is "an essential and unchanging part of the case-or-controversy requirement of Article III." Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). The Ninth Circuit recognized that the appeal turned on whether the consumer alleged a concrete injury in fact.
To establish standing, the consumer must allege he (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision. Spokeo. 136 S. Ct. at 1547. Further a consumer suffers an injury where there is "an invasion of a legally protected interest" that is "concrete and particularized" and "actual or imminent, not conjectural or hypothetical." Id. at 1548 (quoting Lujan, 504 U.S. at 560).
The Ninth Circuit observed that both Spokeo and this case involved a putative consumer class action alleging willful violations of the FCRA. In Spokeo, the Supreme Court made clear that "Article III standing requires a concrete injury even in the context of a statutory violation." Id. at 1549. The plaintiff must establish that a concrete injury "actually exist[s]", and that it is "real, and not abstract." Id. at 1548. Intangible harms and a "risk of real harm" can demonstrate a concrete injury. Id. at 1549-50. However, "a bare procedural violation, divorced from any concrete harm," does not "satisfy the injury-in-fact requirement of Article III." Id. at 1549.
Thus, "[a] violation of one of the FCRA's procedural requirements may result in no harm" -- for example, "[i]t is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm." Id. at 1550. The Supreme Court therefore remanded to resolve "whether the particular procedural violations alleged . . . entail a degree of risk sufficient to meet the concreteness requirement." Id.
The Ninth Circuit noted that after Spokeo, two of its sister circuits dismissed identical consumer class actions that alleged violations of the FCRA's credit card expiration date redaction requirement for lack of standing. See Meyers v. Nicolet Restaurant of De Pere, 843 F.3d 724 (7th Cir. 2016) (consumer's allegations did satisfy the injury-in-fact requirement for Article III standing because printing the receipt did not harm the consumer and the violation did not create any appreciable risk of harm); Crupar-Weinmann v. Paris Baguette America, Inc., 861 F.3d 76 (2d Cir. 2017) (the alleged bare procedural violation did not create a material risk of harm to the underlying concrete interest Congress sought to protect in passing FACTA -- i.e., preventing identity theft and credit card fraud).
The Ninth Circuit agreed with its sister courts and found that the consumer failed to allege a concrete injury here. Specifically, the historical practice does not support the consumer's theory of injury because his alleged exposure to identity theft does not have "a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts."
The Consumer argued that a close historical relationship exists between his claimed injury and privacy torts involving a wrongful disclosure of information. The Ninth Circuit rejected this argument because the Garage did not disclose the consumer's information to anyone besides the consumer. Thus, it doesn't matter that "[a]ctions to remedy . . . invasions of privacy . . . have long been heard by American courts, and the right of privacy is recognized by most state" because this case does not involve any such privacy-based injury. Van Patten, 847 F.3d at 1043.
The Ninth Circuit declared that in adopting the FCRA's credit card expiration date requirement, Congress did not "elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law." Lujan, 504 U.S. at 578. Congress's creating a prohibition "does not mean that a plaintiff automatically satisfies the injury-in-fact requirement" just because "a statute grants [him] a statutory right and purports to authorize [him] to sue to vindicate that right." Id. Thus, the consumer cannot merely allege a FCRA violation "divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III." Id.
The Ninth Circuit also discerned that Spokeo made it clear that simply because the FCRA authorizes citizen suits and statutory damages, does not mean that allegations of a statutory violation meet the standing requirement. Although, "Congress did not eliminate the FCRA's card expiration date requirement in the Clarification Act," that does not confer standing here because "the Clarification Act's finding that a disclosed expiration date by itself poses minimal risk and the law's temporary elimination of liability for such violations counsel that [the consumer] did not allege a concrete injury." The Ninth Circuit therefore concluded that "[o]n balance, congressional judgment weighs against" finding standing here.
The Ninth Circuit next examined the consumer's claims that his statutory violation by itself establishes concrete harm. First, the consumer argued that the FCRA creates a "substantive right," and invading this right "is an injury that confers standing." See Eichenberger v. ESPN, Inc., 876 F.3d 979, 982-84 (9th Cir. 2017). Second, the consumer argued that the law at least "establishes a procedural right, the violation of which creates a material risk of harm sufficient to confer standing." The Ninth Circuit rejected both claims.
The Court held that the consumer's argument that Congress "created a substantive right that is invaded by a statutory violation" fails because even assuming the substantive right exists, it depends on disclosing a consumer's private financial information to third-parties. Here, the garage only disclosed the consumer's private information to the consumer, not to any third-party. Thus, the Ninth Circuit held, printing the receipt did not invade any substantive right.
The consumer's FCRA procedural violations claim also fails to confer standing, the Court continued, because it does not "entail a degree of risk sufficient to meet the concreteness requirement." Spokeo, 136 S. Ct. at 1550. Here, Ninth Circuit noted, the consumer did not adequately allege actual harm or a material risk of harm because no other copy of the receipt existed, he did not lose the receipt, nobody stole the receipt, and no thief stole his identity. The consumer also failed to allege any real risk of harm that was "not conjectural or hypothetical," because he could shred the receipt and eliminate any remaining risk of disclosure. Lujan, 504 U.S. at 560.
The Ninth Circuit also held that providing a credit card receipt to the card owner with the expiration date, without more, did not create "any concrete harm." Spokeo, 136 S. Ct. at 1550. Congress found that receipts like the consumers with the expiration date and a truncated credit card number "prevent a potential fraudster from perpetrating identity theft or credit card fraud." 122 Stat. at 1565. The consumer's potential identity theft exposure theory is therefore "too speculative for Article III purposes." See Missouri ex rel. Koster v. Harris, 847 F.3d 646, 654 (9th Cir. 2017) (quoting Lujan, 504 U.S. at 564 n.2).
The Ninth Circuit therefore affirmed the trial court's dismissal of the consumer's putative class action for lack of Article III standing.
Eric Tsai
Maurice Wutscher LLP
71 Stevenson Street, Suite 400
San Francisco, CA 94105
Direct: (415) 529-7654
71 Stevenson Street, Suite 400
San Francisco, CA 94105
Direct: (415) 529-7654
Fax: (866) 581-9302
Mobile: (714) 600-6000
Email: etsai@MauriceWutscher.com
Admitted to practice law in California, Nevada and Oregon
.png){kind=small}
ALABAMA | CALIFORNIA | FLORIDA | ILLINOIS | INDIANA | MARYLAND | MASSACHUSETTS | NEW JERSEY | NEW YORK | OHIO | PENNSYLVANIA | TEXAS | WASHINGTON, D.C.
