KIYO A. MATSUMOTO, District Judge.
In an amended complaint, plaintiff Yaakov Katz (the "plaintiff"), on behalf of himself and a putative class, alleges violations of the Fair and Accurate Credit Transactions Act ("FACTA") by the Metropolitan Transit Authority (the "defendant"), a New York public benefit corporation, which plaintiff asserts owns and/or operates transportation facilities throughout the New York region, including, in pertinent part, the Verrazano Narrows-Bridge and the Bronx-Whitestone Bridge. (Plaintiff's Amended Complaint ("Compl." or the "complaint"), ECF No. 15, at ¶¶ 1, 10.) Plaintiff asserts that defendant violated FACTA by issuing credit card transaction receipts that displayed improperly truncated credit card numbers. (See id. at ¶¶ 1-4.)
Before the court is defendant's motion to dismiss for failure to state a claim under Rule 12(b)(6) of the Federal Rules of Civil Procedure, and for lack of subject matter jurisdiction, presumably under Rule 12(b)(1), based on plaintiff's lack of standing under Article III of the United States Constitution. For the reasons that follow, the complaint is dismissed for lack of subject matter jurisdiction under Rule 12(b)(1) of the Federal Rules of Civil Procedure.
The following allegations from the complaint are taken as true for the purposes of a motion to dismiss. See Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009); Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555-56 (2007); see also Morrison v. Nat'l Australia Bank Ltd., 547 F.3d 167, 170 (2d Cir. 2008) (citations omitted) (discussing treatment of material factual allegations in complaint for purposes of Rule 12(b)(1) analysis), aff'd on other grounds, 561 U.S. 247 (2010). On August 12, 2015, plaintiff paid a toll using his Visa credit card on the Verrazano-Narrows Bridge, and on January 25, 2017, plaintiff paid a toll using his Visa credit card on the Bronx-Whitestone Bridge. (Compl. at ¶¶ 18-19.) After plaintiff paid for each toll with his Visa credit card, he received an electronically printed receipt. (Id.) Due to the manner in which defendant programmed its computer systems, both of these receipts (the "Toll Receipts") displayed the first six digits of plaintiff's Visa credit card number. (Id. at ¶ 20, 22.)
While not expressly stated in the complaint, subsequent briefing by plaintiff clarifies that the first six digits, which plaintiff asserts are prohibited, and the last four digits, which plaintiff asserts are permitted, of plaintiff's credit card number were printed on the Toll Receipts. (E.g., Plaintiff's Motion of Points and Authorities in Opposition to Motion to Dismiss the Amended Complaint ("Pl. Opp." or the "opposition"), ECF No. 19, at 15 and n.3.) Additionally, all other credit card transaction receipts generated by the same computer system in the seventeen-month period between the first Toll Receipt and the second Toll Receipt displayed the first six digits of the toll payer's credit card number. (Compl. at ¶¶ 21-22.)
Plaintiff contends that, at all relevant times, defendant, directly or through a subsidiary, was responsible for operating, and collecting tolls on, the Verrazano-Narrows and Bronx-Whitestone Bridges. (Compl. at ¶ 10.) Defendant disputes this allegation and contends that a distinct entity, the Triborough Bridge and Tunnel Authority, is responsible for the maintenance and operation of the Verrazano-Narrows and Bronx-Whitestone Bridges.
In its Notice of Motion, (ECF No. 21), defendant moves to dismiss under Rule 12(b)(6), under which a plaintiff's complaint must be dismissed if it fails to state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6). Additionally, defendant's Notice of Motion seeks dismissal for lack of subject matter jurisdiction.
A Rule 12(b)(1) challenge to subject matter jurisdiction may be facial, that is, based solely on the pleadings, in which case the court must determine whether the pleadings "allege facts that affirmatively and plausibly suggest that [the plaintiff] has standing to sue." Amidax Trading Grp. v. S.W.I.F.T. SCRL, 671 F.3d 140, 145 (2d Cir. 2011); accord Carter v. HealthPort Techs., LLC, 822 F.3d 47, 56 (2d Cir. 2016). A Rule 12(b)(1) motion may also be fact-based and rely on evidence beyond the pleadings, in which case a plaintiff must present controverting evidence unless the evidence is "immaterial because it does not contradict plausible allegations that are themselves sufficient to show standing." Carter, 822 F.3d at 57. A plaintiff must establish subject matter jurisdiction by a preponderance of the evidence. Makarova, 201 F.3d at 110.
In applying Rule 12(b)(1), "`the court must take all facts alleged in the complaint as true and draw all reasonable inferences in favor of plaintiff,' but `jurisdiction must be shown affirmatively, and that showing is not made by drawing from the pleadings inferences favorable to the party asserting it.'" Morrison, 547 F.3d at 170 (quoting Natural Res. Def. Council v. Johnson, 461 F.3d 164, 171 (2d Cir. 2006) and APWU v. Potter, 343 F.3d 619, 623 (2d Cir. 2003)). Additionally, the court "may consider affidavits and other materials beyond the pleadings to resolve the jurisdictional issue, but . . . may not rely on conclusory or hearsay statements contained in the affidavits." J.S. ex rel. N.S. v. Attica Cent. Sch., 386 F.3d 107, 110 (2d Cir. 2004) (citing Zappia Middle E. Const. Co. Ltd. v. Emirate of Abu Dhabi, 215 F.3d 247, 253 (2d Cir. 2000) and Kamen v. Am. Tel. & Tel. Co., 791 F.2d 1006, 1011 (2d Cir.1986)).
Under Article III of the Constitution, the plaintiff must establish standing to sue in order for a federal court to adjudicate a suit. See Spokeo Inc. v. Robins, 136 S.Ct. 1540, 1546-1548 (2016); accord Lujan v. Defenders of Wildlife, 504 U.S. 555, 559-60 (1992). "[T]he `irreducible constitutional minimum' of standing consists of three elements. The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, 136 S.Ct. at 1547 (internal citations omitted) (quoting and citing Lujan, 504 U.S. at 560-61).
To establish the first standing element, injury in fact, "a plaintiff must show that he or she suffered `an invasion of a legally protected interest' that is `concrete and particularized' and `actual or imminent, not conjectural or hypothetical.'" Id. at 1548 (quoting Lujan, 504 U.S. at 560). An injury is "particularized" when it affects the plaintiff in a "personal and individual way," Lujan, 504 U.S. at 560 n.1, and is "concrete" when it "actually exist[s]" in that it is "`real' and not `abstract.'" Spokeo, 136 S.Ct. at 1548 (citations omitted).
In the Second Circuit, a plaintiff suing on a "bare procedural violation of [a statute] . . . must satisfy a twopart test for such an allegation to constitute a concrete harm." Katz v. Donna Karan Co., 872 F.3d 114, 119 (2d Cir. 2017). First, the plaintiff must show "that `Congress conferred the procedural right to protect a plaintiff's concrete interests' as to the harm in question." Id. (quoting Strubel v. Comenity Bank, 842 F.3d 181, 190 (2d Cir. 2016)). Second, the plaintiff must show "that `the procedural violation presents a risk of real harm to that concrete interest.'" Id. (quoting Strubel, 842 F.3d at 190). If a plaintiff suing on a bare procedural violation cannot satisfy this test, he or she cannot establish injury in fact, and the court has no jurisdiction because the plaintiff has no standing.
FACTA provides, in pertinent part and subject to a limitation that is inapplicable here, that "[n]o person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of sale or transaction." 15 U.S.C. § 1681c(g)(1). In other words, FACTA generally imposes a requirement that merchants truncate or redact all but the last five digits of a credit card number when they issue receipts for credit card transactions (the "Truncation Requirement"). The parties do not dispute that FACTA's Truncation Requirement was in force at the time the Toll Receipts were issued.
After the close of briefing on defendant's motion to dismiss, the Second Circuit issued its opinion in Katz v. Donna Karan Co., 872 F.3d 114 (2d Cir. 2017). In that case, as here, the plaintiff sued under FACTA after making two payments by credit card to the defendants
At the motion to dismiss stage in Donna Karan, the district court concluded that FACTA's Truncation Requirement "is a means to the end goal of identity theft prevention," and not a substantive right. Katz v. Donna Karan Int'l, Inc., No. 14-CV-740 (PAC), 2017 WL 2191605, at *4 (S.D.N.Y. May 17, 2017), aff'd and remanded sub nom. Katz v. Donna Karan Co., L.L.C., 872 F.3d 114 (2d Cir. 2017). Accordingly, to establish constitutional standing and subject matter jurisdiction, a plaintiff suing on a violation of the Truncation Requirement must establish that the violation presents a material risk of harm to the interest of identity theft prevention. Id.
The district court in Donna Karan found that the first six digits of a credit card number, also known as the "issuer identification number" or "IIN," identify the institution that issued the card and disclose no personal information about the cardholder. Id. at *1 (citing Bin List & Bin Ranges: List of Issuer Identification Numbers, Bin Database—Industry Standard Fraud Prevention, https://www.bindb.com/bin-list.html); accord Donna Karan, 872 F.3d at 116. Because FACTA does not prohibit identifying a card's issuer on a transaction receipt, the district court concluded that failure to redact the first six digits of a credit card number was, standing alone, insufficient to establish a material risk of harm to the interest of identity theft protection. Donna Karan, 2017 WL 2191605 at *5-6 (citations omitted). The district court also noted that the plaintiff had "not allege[d] any facts showing that he experienced the Congressionally-proscribed harm: identity theft," id. at *5, and rejected the plaintiff's argument that FACTA gives rise to a privacy right in the information required to be truncated. Id. at *6. Accordingly, the district court found that the plaintiff had not demonstrated a risk of injury sufficient to establish standing. Id.
The Second Circuit affirmed the district court's determination that the plaintiff had not established subject matter jurisdiction. In setting forth the applicable legal standards, the Second Circuit characterized the printing of the first six digits of a credit card number on a receipt as a "procedural" violation of FACTA and stated that the interest implicated by FACTA and the Truncation Requirement is the prevention of identity theft. Donna Karan, 872 F.3d at 120. The Second Circuit then applied a "clear error" standard of review to the district court's finding that printing the first six digits of a credit card number does not create a material risk of harm sufficient to confer Article III standing. Id.
After discussing the district court's analysis of the significance and importance of the first six digits of a credit card number, id. at 116, the Second Circuit found that the district court did not clearly err "as to the specific material facts in dispute." Id. at 120. The Second Circuit accordingly affirmed the district court's finding that "the bare procedural violation in question did not raise a material risk of harm of identity theft," as well as the district court's dismissal of the case for lack of subject matter jurisdiction. Id. at 121.
Plaintiff asserts that Donna Karan is not dispositive in the instant action because the "fact-based aspects of the [Donna Karan] decision . . . have no more precedential force than an affirmed jury verdict." (Plaintiff's Supplemental Letter Brief ("Pl. Supp." or the "plaintiff's supplement"), ECF No. 31, at 3.) Plaintiff further asserts that information that was not of record in Donna Karan demonstrates that disclosure of the first six digits of a credit card number "carr[ies] immense additional risk beyond the disclosure of the final five digits permitted by FACTA." (Id. at 2.)
The purportedly new information presented in the instant action, but not in Donna Karan, consists of two assertions by the plaintiff. First, plaintiff submits that "the typical major credit card issuer uses not one but many different initial six digit combinations, with one major bank using nearly 250 combinations." (Id. (citing www.creditcardvalidator.org/bank-of-america and https://www.cardbinlist.com/bin-list-united-states.html?page=12 ("Card Bin List")).) According to plaintiff, this means that identifying a card's issuer does not provide information sufficient to determine the first six digits of the card number even though the first six digits are sufficient to determine the card's issuer. Plaintiff thus contends that printing the first six digits of a card number is not strictly equivalent to identifying the issuer in that printing the first six digits reveals more information than printing the identity of the issuer would.
Second, and in part following from his first assertion, plaintiff submits that "disclosure of the first six digits diminishes the challenge of `cracking' a credit card number by a factor of one hundred thousand." (Id.) Plaintiff arrives at this conclusion by positing that "competent identity thieves know that Visa card numbers begin with 4." (Id.) According to plaintiff, if a receipt shows that a Visa card was used, then, a would-be identity thief would be able to determine the first digit of the credit card, but not necessarily the second through sixth digits. (See id.) There are 10
Plaintiff asserts that these facts establish a "radically increased concrete risk to [his] congressionally protected privacy and interests [sic] — which [risk] was not fully raised or considered in Donna Karan — [and] amply satisfies all applicable standing tests." (Id. at 3.) Therefore, plaintiff contends, the proper application of Donna Karan to the facts in this case "requires that the instant motion be denied, or at [a] minimum that appropriate discovery and fact-finding on dispositive jurisdictional issues be allowed to go forward before the motion is decided." (Id. at 4.)
Defendant asserts that Donna Karan is dispositive. (See generally Defendant's Supplemental Letter Brief ("Def. Supp."), ECF No. 30.) Defendant contends that plaintiff's arguments regarding increased risk resulting from printing the first six digits of a credit card number are misguided because the Second Circuit's decision held that FACTA does not prohibit printing a credit card's issuer on a transaction receipt. (Id. at 2.) Further, although defendant acknowledges that Donna Karan suggests that jurisdictional discovery might be appropriate depending on the issue, facts, and statute in question, this case involves "the very same purported violation of the very same statutory prohibition on identical facts." (Id. at 2 n.1.) Even if this were not the case, defendant asserts that plaintiff has had "ample opportunity . . . to submit whatever extrinsic evidence regarding `the enhanced risk of identity theft' he claims exists" but has not done so. (Id. at 2.)
Plaintiff's argument that the record here compels a different result than that in Donna Karan is without merit. Donna Karan makes clear that the violation that plaintiff alleges here is procedural. 872 F.3d at 120. Plaintiff does not dispute that only he and his attorneys have seen the Toll Receipts since they were issued to him. (See Pl. Opp. at 18 (acknowledging plaintiff "safeguarded his own receipts").) Plaintiff's action is predicated on a bare procedural violation and he must therefore plead facts that establish that the violation presents a material risk of harm to the underlying concrete interest of identity theft prevention. See Donna Karan, 872 F.3d at 117-18 (citations omitted); see also Crupar-Weinmann v. Paris Baguette, 861 F.3d 76, 80-81 (2d Cir. 2017). Plaintiff fails to allege facts to make such a showing.
Plaintiff purports to submit "additional information not of record in Donna Karan" that he contends suffices to establish subject matter jurisdiction, (Pl. Supp. at 2), but a review of Donna Karan makes abundantly clear that all information that plaintiff submits here was before both the district court and the Second Circuit in Donna Karan, albeit in a slightly different form.
In Donna Karan, the district court cited a website maintained by BinDB LLC for the proposition that the first six digits of a credit card number merely identify the institution that issued the card and reveal no information about the card's holder. 2017 WL 2191605 at *1 (citing Bin List & Bin Ranges: List of Issuer Identification Numbers, Bin Database—Industry Standard Fraud Prevention, https://www.bindb.com/bin-list.html ("BinDB List")). The Second Circuit expressly referenced this portion of the district court's opinion, including the BinDB LLC website citation, in its own opinion. 872 F.3d at 118. Even a cursory review of the source material establishes that major credit card companies use a number of different issuer identification numbers. The relevant BinDB LLC webpage includes a conspicuously-placed list indicating that, for instance, American Express card numbers start with "37," Visa card numbers start with "4," and MasterCard numbers start with "51 through 55." (BinDB List (last accessed 11/17/2017)). The page also lists a number of issuer identification numbers. By way of example, at least thirteen of the first fifteen issuer identification numbers listed are American Express combinations, and the list includes numerous issuer identification numbers attributable to Bank of America. Id.
From this information, a reader can easily infer that any given network, such as Visa or MasterCard, or issuing institution, such as a bank, could be associated with multiple initial six-digit combinations. The record before both the district court and the Second Circuit in Donna Karan, therefore, clearly indicated that although the first six digits of a credit card number reveal the card's issuer, the issuer does not necessarily reveal the first six digits. Indeed, the websites plaintiff cites in support of his argument here contain information that is substantially similar to that set forth on the BinDB LLC webpage. (See Pl. Supp. at 2 (citing www.creditcardvalidator.org/bank-of-america and Card Bin List); compare BinDB List (last accessed 11/17/2017) with Card Bin List (last accessed 11/17/2017) (each listing IINs, or beginning portions thereof, and corresponding card types and issuers).) Therefore, the relevant core facts regarding the significance of the issuer identification number were before both the district court and the Second Circuit in Donna Karan.
The court notes that on a record virtually identical to this record, the district court in Donna Karan found that the IIN did not reveal any information "pertaining to the plaintiff," 2017 WL 2191605 at *5, and the Second Circuit affirmed. Plaintiff here does not actually challenge or question the Donna Karan court's findings and does not allege that the IIN reveals any personal information about him. Instead, he argues that printing the IIN reveals information about the credit card number, but that merely revealing the issuer would not reveal this information.
Plaintiff here contends that the "mathematical fact" that "disclosure of the first six digits [of a credit card number] diminishes the challenge of `cracking' a credit card number by a factor of one hundred thousand" was not before the district court or the Second Circuit in Donna Karan. (Pl. Supp. at 2.) This mathematical fact follows from four propositions. First, when a merchant "properly" truncates a credit card number, eleven digits are redacted. (See id. at 2-3.) Second, defendant here truncated the credit card number such that only six digits were redacted. (Id. at 3.) Third, when eleven digits are redacted, the true credit card number can be one of 10
Of those four propositions, three were clearly before the Second Circuit in Donna Karan. First, the Donna Karan plaintiff-appellant clearly argued that a "properly" redacted receipt reveals, at most, five digits. See Donna Karan, 872 F.3d at 118 (stating that plaintiff contends that printing each digit beyond the five permitted by FACTA increases risk to plaintiff); see also Plaintiff's Post-Argument Letter Brief ("Letter Br."), Katz v. Donna Karan Co., Case No. 15-464 (2d Cir. June 23, 2017), ECF No. 120, at 4 (arguing that all but the last five digits of a card number must be masked under FACTA). Because a credit card number contains sixteen digits and a digit must be either redacted or unredacted, arguing that no more than five digits should be revealed is the equivalent of arguing that at least eleven digits should be redacted.
Second, the Donna Karan plaintiff-appellant clearly asserted that the receipts at issue in that case "identified not only the last four digits of his credit card number, but also the first six digits." Donna Karan, 872 F.3d at 116; see also Letter Br. at 5 (stating that the receipts at issue disclosed the first six and last four digits, for a total of ten). Once again, because a credit card number contains sixteen digits, asserting that ten digits were revealed is the equivalent of asserting that only six digits were redacted.
Third, the Donna Karan plaintiff-appellant argued before the Second Circuit that, when all but six digits of a credit card number are revealed, there remain "[one] million possible combinations of six integers," which "[a] computer can try . . . in seconds." (Letter Br. at 6 n.2.) Although this information and argument were contained in a footnote in the plaintiff-appellant's letter brief, the Second Circuit cited the relevant pages and footnote in its opinion. See 872 F.3d at 118.
The two pieces of "information" presented here that were not directly presented in Donna Karan, then, are first, the proposition that when all but five digits of a credit card number are redacted (or, put another way, eleven digits are redacted), there are one hundred billion possible card number combinations, and second, the comparison between one hundred billion and one million.
The problem for plaintiff here is that the proposition and comparison that he argues were not "of record" in Donna Karan are, as plaintiff concedes, "mathematical facts." (Pl. Supp. at 2). Moreover, these mathematical facts necessarily follow from information that was clearly before the Second Circuit in Donna Karan. To reiterate, the Donna Karan plaintiff-appellant argued that the Donna Karan defendant should have redacted all but five digits of the plaintiff's credit card number, (Letter Br. at 6 n.2), leaving eleven digits unknown. It is a mathematical fact that there are 10
The "fact" that a FACTA-compliant receipt leaves one hundred billion possible credit card number combinations and the "fact" that this represents one hundred thousand times the number of possible combinations that the receipts at issue presented, which the Donna Karan plaintiff-appellant did not expressly present to the Second Circuit, therefore follow directly from information that the plaintiff-appellant did present in Donna Karan. As demonstrated above, to accept plaintiff's argument in this action would be to find that where information was before the Second Circuit, mathematical facts necessarily flowing from that information were not before the Second Circuit.
Furthermore, plaintiff-appellant's briefing in Donna Karan argued that "each additional known digit beyond the five permitted by FACTA, regardless of its informational significance, increases a card number's vulnerability to bruteforce cryptological attack, i.e. computer-assisted guessing."
All of the "additional information" that plaintiff claims was "not of record in Donna Karan" was expressly presented to the Second Circuit, necessarily followed from information presented to the Second Circuit, or illustrates argument that was presented to the Second Circuit. Additionally, the district court in Donna Karan considered information regarding issuer identification numbers that is materially identical to the information plaintiff presents here. The record here is therefore substantially identical to that in Donna Karan insofar as plaintiff alleges that plaintiff violated the same statute in the same way and offers an identical theory of harm in an effort to establish Article III standing.
On a substantially identical record, as set forth above, plaintiff asks that the court reach a different result than the Donna Karan courts. To briefly restate plaintiff's burden, because failure to comply with FACTA's Truncation Requirement is a bare procedural violation, plaintiff must establish that defendant's failure to comply gave rise to a material risk of identity theft. See, e.g., Donna Karan, 872 F.3d at 116. Here, defendant refers to facts outside the pleadings in support of its motion to dismiss that reveal factual problems in the assertion of jurisdiction. (See Def. Supp. at 1-2 (referring to Donna Karan district court's findings of fact).) Plaintiff must therefore "come forward with evidence of [his] own to controvert that presented by the defendant," or demonstrate that the facts put forward by the defendant are "immaterial because[they] do not contradict plausible allegations that are themselves sufficient to show standing." Carter 822 F.3d at 57 (citation omitted). Plaintiff has done neither.
Plaintiff does not dispute that after he received the Toll Receipts, only he and his lawyer saw them. (See Pl. Opp. at 19.) Over two years have passed since the first Toll Receipt was issued to plaintiff, yet he alleges no tangible harm as a result. As in Donna Karan, these realities weigh against a finding of "injury in fact." See 2017 WL 2191605 at *5.
Furthermore, the issuer identification number merely identifies the card's issuer. Donna Karan makes clear that FACTA does not prohibit disclosure of the card's issuer, 872 F.3d at 120, and disclosure of the card's issuer does not in turn disclose any personally identifying information. 2017 WL 2191605 at *5. Accordingly, printing a card's IIN on a transaction receipt does not give rise to a material risk of identity theft. Donna Karan, 2017 WL 2191605 at *5-6.
To the extent plaintiff contends that printing the IIN reveals the issuer in a way that makes him materially more susceptible to identity theft, his argument is unavailing. Plaintiff essentially argues that the Toll Receipts at issue heighten the risk that his identity will be stolen relative to the risk he would face if provided a FACTA compliant-receipt. (See Pl. Supp. at 2-3.) The Second Circuit expressly rejected this argument in Donna Karan, writing that "while Katz may be correct that every additional digit increases the risk of a brute force cryptological attack, printing the first six digits — the IIN — is the equivalent of printing the name of the issuing institution, information which need not be truncated under FACTA, and thus the district court did not clearly err in concluding that printing the IIN does not increase the risk of real harm." 872 F.3d at 120. Reiterating substantially the same argument, only this time with additional numerical illustrations that are matters of mathematical fact, does not give the argument new vitality.
At oral argument regarding the motion to dismiss, plaintiff suggested that the Second Circuit in Donna Karan had been laboring under a misimpression that revealing the IIN was strictly equivalent to identifying the issuing institution. As discussed above, plaintiff is correct that the two pieces of information are not strictly equivalent because knowing a card's issuing institution does not necessarily allow one to determine the card's IIN. However, as discussed above, the BinDB List source upon which both the district court and the Second Circuit in Donna Karan relied, when discussing the significance of the IIN, is strikingly similar to plaintiff's website sources here.
Further, even assuming plaintiff is correct and the Second Circuit misunderstood the record before it, particularly as to the significance of the IIN, plaintiff still has not met his burden of establishing a material risk of harm by a preponderance of the evidence. See, e.g., Makarova, 201 F.3d at 113 ("A plaintiff asserting subject matter jurisdiction has the burden of proving by a preponderance of the evidence that it exists.") To meet this burden, even assuming the Second Circuit was mistaken, plaintiff would have to plead facts or present evidence demonstrating that revealing all six IIN numbers creates a material risk of harm not present where only the issuer is revealed. See Carter, 822 F.3d at 56-57 (noting that to defeat a fact-based challenge to subject matter jurisdiction, a plaintiff must present controverting evidence or demonstrate that the defendant's evidence is immaterial in light of wellpleaded allegations); see also Katz, 872 F.3d at 120 (stating that relevant inquiry for 12(b)(1) purposes is whether "printing the first six digits of plaintiff's credit card number[] raised a material risk of identity theft absent other allegations of harm."). Plaintiff does not plead any such facts in his complaint or present any such evidence to the court.
To the contrary, plaintiff's briefing concedes that even a properly redacted receipt would narrow the number of possible issuer identification numbers significantly. As discussed above, each IIN is a six-digit number, and it is a mathematical fact that there are 10
To conclude that plaintiff has established subject matter jurisdiction, the court would have to conclude that plaintiff could prove by a preponderance of the evidence, or based on properly and sufficiently alleged facts, that identifying a single IIN creates a material risk of identity theft over and above the risk that exists where a receipt permissibly identifies the credit card issuer, which plaintiff concedes significantly reduces the universe of possible IINs, possibly to two hundred fifty or fewer. See Carter, 822 F.3d at 56-57. Plaintiff alleges no facts and submits no evidence or argument that would enable the court to conclude that this incremental contraction of the universe of possible credit card numbers gives rise to a material risk of identity theft. On the record before it, the court cannot find, based on the facts alleged in the complaint, that a would-be fraudster could more readily ascertain the credit card number such that plaintiff has been subjected to a material risk of identity theft. See Carter, 822 F.3d at 56-57 (discussing ability to establish subject matter jurisdiction through evidence and/or well-pleaded allegations); Makarova, 201 F.3d at 112 (stating that a plaintiff must prove subject matter jurisdiction by a preponderance of the evidence).
Similarly, plaintiff makes no showing, or sufficient allegation, that narrowing the universe of possible credit card numbers from one hundred billion, the number of possible combinations with eleven digits redacted, to one million, the number of possible combinations with six digits redacted, creates a material risk of identity theft. Clearly one hundred billion is larger than one million — specifically, one hundred thousand times larger — but even incorrectly assuming that these "mathematical facts" were not of record in Donna Karan, it is not enough for plaintiff to merely point them out. The court must have some basis to find, or conclude that plaintiff has properly pleaded, that the difference between redacting eleven digits and redacting six digits is such that redacting only six creates a material risk of identity theft that would otherwise not be present. This requires some information as to the practical significance of the difference, and no such information is before the court in the complaint or in subsequent briefing.
The court therefore finds that the plaintiff has not met his burden to plead sufficient facts or submit sufficient evidence to establish subject matter jurisdiction by a preponderance of the evidence. See Carter, 822 F.3d at 56-57 (discussing ability to establish subject matter jurisdiction through evidence and well-pleaded allegations); see also Makarova, 201 F.3d at 112 (stating that a plaintiff must prove subject matter jurisdiction by a preponderance of the evidence).
As to plaintiff's contention that the court should "permit further development of the record," (Pl. Supp. at 3), the court is mindful that the Second Circuit in Donna Karan noted that the plaintiff-appellant there "did not seek the opportunity to supplement the record with additional evidence after defendants included in their motion papers extrinsic evidence suggesting that printing the IIN did not increase the risk of harm," and expressed its confidence that "that district courts will oversee the appropriate extent of fact-finding necessary to resolve the contested issue" where there is a factbased Rule 12(b)(1) challenge to jurisdiction. 872 F.3d at 121. However, the court also notes that the Second Circuit then commented that "parties should be on renewed notice of both the right to introduce such evidence and the plaintiff's burden of proof to do so even at the motion-to-dismiss stage." Id.
Here, plaintiff should have been on notice of his burden to establish subject matter jurisdiction as early as February 22, 2017, when defendant filed a letter on the docket in this case requesting a pre-motion conference with respect to the instant motion. (Defendant's Letter Requesting Pre-motion Conference, ECF No. 6). The defendants' letter clearly stated that it would seek dismissal for lack of Article III standing, and would argue that plaintiff did not suffer a concrete injury under Spokeo. (Id. at 1-2.) If that were not sufficient to put plaintiff here on notice, on May 17, 2017, while the parties were briefing the instant motion, the district court in Donna Karan dismissed that case for lack of subject matter jurisdiction. See 2017 WL 2191605 at *1. Given that plaintiff acknowledged to this court on February 27, 2017 that Donna Karan "raise[d] the precise standing issue [d]efendant would bring forward in this case," (Plaintiff's Letter Regarding Pre-motion Conference ("Pl. PMC Letter"), ECF No. 8, at 1), the district court's opinion in Donna Karan certainly should have put plaintiff here on notice.
Plaintiff's references to introducing evidence and developing the record, particularly those made following the Second Circuit's decision in Donna Karan, suggest that he has understood his burden from an early stage, though the substance of these pleadings casts doubt on plaintiff's ability to develop a record on which the court could find subject matter jurisdiction, and on his diligence in developing such a record.
In the parties' joint letter submitted in response to the court's September 27, 2017 order, plaintiff generally referred to his desire to introduce additional evidence without any specific indication as to what the substance of that evidence might be, even though the instant motion was pending at the time. (See Letter in Response to September 27, 2017 Court Order, ECF No. 27, at 2-3.). Although plaintiff's supplement purports to develop the record by presenting "facts" that were "not of record" in Donna Karan, (see Pl. Supp. at 2-3), plaintiff instead repackages information that clearly was either directly in the record, or necessarily followed from information in the record, in Donna Karan. Plaintiff's supplement also argues that the court should allow "appropriate discovery and fact-finding" to "go forward," (Pl. Supp. at 4), but contains no explanation as to what that discovery would consist of or the information that plaintiff would seek to obtain through it.
Finally, at oral argument on November 8, 2017, in response to a question from the court, plaintiff suggested that he might be able to establish the concrete significance of printing additional digits through an expert report and/or expert testimony. This is plaintiff's most specific and compelling example of the kind of record development he wishes to achieve should the court refrain from dismissing this case. Nothing, however, prevented plaintiff from consulting with such an expert well before the November 8, 2017 argument. As discussed above, plaintiff had ample notice that defendant intended to litigate subject matter jurisdiction given that defendant raised that issue in its letter initiating the instant motion. The district court in Donna Karan issued its opinion on May 17, 2017, and on June 23, 2017, the Donna Karan plaintiffappellant raised the argument that each additional digit of a credit card number that is revealed "increases a card number's vulnerability to brute-force cryptological attack, i.e. computer-assisted guessing" in a letter brief to the Second Circuit and co-authored by counsel for the plaintiff in this action. (Pl. Letter Br. at 6 n.2.)
Courts in this circuit have looked favorably upon efforts to supplement the record absent prejudice or bad faith. See, e.g., Nat'l Union Fire Ins. Co. of Pittsburgh, PA v. BP Amoco P.L.C., No. 03-CV-0200 (GEL), 2003 WL 1618534 at *1 (S.D.N.Y. Mar. 27, 2003) (authorizing defendants to file supplemental affidavit regarding jurisdictional issue presented to court); Spano v. V & J Nat'l Enterprises, LLC, No. 16-CV-06419-EAW-MWP, ___ F. Supp. 3d ___, 2017 WL 3738555, at *8 (W.D.N.Y. Aug. 30, 2017) (quoting National Union) (authorizing plaintiff to file supplemental declaration), appeal docketed, No. 17-3055 (2d. Cir. Sept. 28, 2017); cf. Taylor v. Schaffer, No. 14-CV-123-JGM, 2015 WL 541058, at *4 (D. Vt. Feb. 10, 2015) (taking judicial notice of public records annexed to plaintiff's motion for leave to file supplemental pleadings as no prejudice would result to defendant). Cases in which courts have authorized parties to supplement the record, however, have generally involved parties who have come to the court with the actual supplemental information in hand. See National Union, 2003 WL 1618534 at *1 ("[T]he Court will consider the evidence contained in defendants' supplemental affidavit."); Spano, 2017 WL 3738555 at *8 ("The additional evidence submitted in Plaintiff's motion presents a Declaration by Plaintiff's counsel, the Demand, and [certain correspondence relevant to the issues before the court]."); Taylor, 2015 WL 541058 at *3 ("[Plaintiff] moves for leave to file supplemental pleadings supporting her status as administratrix, attaching documents from [state court].")
Additionally, the Second Circuit has indicated that, "[a]lthough a motion to dismiss for lack of jurisdiction cannot be converted into a Rule 56 motion, a court may nonetheless look to Rule 56[(d)] for guidance in considering the need for discovery on jurisdictional facts." Gualandi v. Adams, 385 F.3d 236, 244 (2d Cir. 2004) (citations omitted). "To request discovery under Rule 56[(d)], a party must file an affidavit describing: (1) what facts are sought and how they are to be obtained; (2) how these facts are reasonably expected to raise a genuine issue of material fact; (3) what efforts the affiant has made to obtain them; and (4) why the affiant's efforts were unsuccessful." Id. at 244-45 (citation omitted).
Here, to the extent plaintiff merely seeks to supplement the record, he has not indicated that he actually seeks or possesses any evidence that he would like to introduce, much less come to the court with evidence in hand. Further, despite multiple opportunities to articulate the nature of the information plaintiff would seek to introduce into the record, the most specific indication from plaintiff consists of an eleventh-hour suggestion that expert testimony could shed light on the concrete impact that redacting eleven digits of a credit card number instead of redacting six digits would have on a would-be identity thief. Plaintiff, therefore, does not properly seek leave to supplement the record. Instead, he seeks to have this court deny, or hold in abeyance, the instant motion, with respect to which he has not carried his burden, so that he may pursue avenues of fact-finding that are either unidentified or have been available to him for months, and are in any case speculative.
To the extent plaintiff seeks discovery, he has not identified the information he seeks to obtain from it, and because he has not identified such information, he necessarily has not shown how this unidentified information would elucidate the extent to which defendant exposed him to a material risk of identity theft. See Gualandi, 385 F.3d at 245 (analogizing request for discovery as to jurisdictional facts to Rule 56(d) discovery). Further, plaintiff has not made any showing as to his efforts to obtain the information he seeks. Accordingly, the court finds that plaintiff is not entitled to discovery, and the court will not deny the instant motion or delay ruling on it so that plaintiff may pursue discovery for which he has not sufficiently articulated a need. Plaintiff has not demonstrated that he has been subjected to an increased risk of identity theft as a result of defendant's failure to comply with the Truncation Requirement, and his complaint must be dismissed for lack of subject matter jurisdiction as a result.
Finally, plaintiff has not indicated in his opposition or in his supplement that he would be inclined to seek leave to amend his complaint, and the Court therefore affords him no opportunity to do so. Schwartz v. HSBC Bank USA, N.A., No. 14-CV-9525 (KPF), 2017 WL 95118, at *8 (S.D.N.Y. Jan. 9, 2017) (citations omitted); see also, e.g., Shields v. Citytrust Bancorp, Inc., 25 F.3d 1124, 1132 (2d Cir. 1994) ("Although federal courts are inclined to grant leave to amend following a dismissal order, we do not deem it an abuse of the district court's discretion to order a case closed when leave to amend has not been sought.").
For the foregoing reasons, the complaint is dismissed for lack of subject matter jurisdiction pursuant to Rule 12(b)(1) without leave to amend.
