ORDER
Honorable G. Murray Snow, United States District Judge.
Pending before the Court is the Motion to Dismiss of Defendants American Valet & Limousine, Incorporated, and American Valet Charters, LLC. (Doc. 13.) For the following reasons, the Court denies the motion.
BACKGROUND
According to Plaintiff Sheila Deschaaf's Complaint, Defendants "own, manage, maintain and or operate parking facilities throughout Arizona.1 (Doc. 1 at 5.) Deschaaf alleges that at some point on or after October 11, 2014,2 she received one or more receipts from Defendants, on which were "printed the expiration date of her credit card or debit card and the last four digits of her card number." (Id. at 9.)
Deschaaf alleges that this was a violation of the Fair and Accurate Credit Transactions Act ("FACTA"), 15 U.S.C. §§ 1681 et seq. Relevant here, FACTA provides that "no person that accepts credit cards or debit cards for the transaction of business shall print ... the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. § 1681c(g)(1). That requirement became effective on December 4, 2004 for any device installed on or after January 1, 2005; and effective on December 4, 2006 for any device in use prior to January 1, 2005. 15 U.S.C. § 1681c(g)(3). Deschaaf seeks relief on behalf of herself and a class of similarly situated individuals to be certified.
Defendants move to dismiss Deschaaf's Complaint under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). They contend that Deschaaf lacks standing to bring the suit because she has not suffered a concrete injury in fact; alternatively, they contend that she has not plausibly alleged that any violation was willful, as required by FACTA. For the following reasons, Defendants' motion is denied.
DISCUSSION
I. Legal Standard
"The party asserting jurisdiction has the burden of proving all jurisdictional facts." Indus. Tectonics, Inc. v. Aero Alloy, 912 F.2d 1090, 1092 (9th Cir. 1990) (citing McNutt v. Gen. Motors Acceptance Corp., 298 U.S. 178, 189, 56 S.Ct. 780, 80 S.Ct. 1135 (1936)). In effect, the court presumes lack of jurisdiction until the plaintiff proves otherwise. See Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377, 114 S.Ct. 1673, 128 L.Ed.2d 391 (1994). The defense of lack of subject matter jurisdiction may be raised at any time by the parties or the court. See Fed. R. Civ. P. 12(h)(3).
The Constitution grants the federal courts the power to hear only "Cases" and "Controversies." U.S. Const. art. III, § 2. To have standing under Article III, plaintiffs must satisfy three elements. First, "the plaintiff must have suffered an injury in fact" that is not "conjectural or hypothetical." Lujan v. Defs. of Wildlife, 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) (internal quotations omitted). This injury must be both "concrete and particularized." Spokeo, Inc. v. Robins, ___ U.S. ___, 136 S.Ct. 1540, 1548, 194 L.Ed.2d 635 (2016). Next, the injury must be "fairly traceable to the challenged action of the defendant." Lujan, 504 U.S. at 560, 112 S.Ct. 2130 (internal quotations omitted). Finally, "it must be likely ... that the injury will be redressed by a favorable decision." Id. (internal quotations omitted).
"A Rule 12(b)(6) motion tests the legal sufficiency of a claim." Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). "In deciding such a motion, all material allegations of the complaint are accepted as true, as well as all reasonable inferences to be drawn from them." Id. However, "the tenet that a court must accept as true all of the allegations contained in a complaint is inapplicable to legal conclusions." Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009).
To survive dismissal for failure to state a claim pursuant to Rule 12(b)(6), a complaint must contain more than "labels and conclusions" or a "formulaic recitation of the elements of a cause of action"; it must contain factual allegations sufficient to "raise a right to relief above the speculative level." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). A plaintiff must allege sufficient facts to state a claim to relief that is plausible on its face. Iqbal, 556 U.S. at 678, 129 S.Ct. 1937. "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. "The plausibility standard is not akin to a `probability requirement,' but it asks for more than a sheer possibility that a defendant has acted unlawfully." Id.
II. Analysis
a. Standing
This case is not the first to raise issues of standing under FACTA or its close statutory relative, the Fair Credit Reporting Act ("FCRA").3 Last year, the Supreme Court decided Spokeo, Inc. v. Robins, ___ U.S. ___, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016), which vacated and remanded a Ninth Circuit opinion finding that a plaintiff suing under FCRA had standing. Spokeo did not necessarily break new ground, but it did reaffirm two important principles that courts must apply when deciding questions of standing. First, an injury must be both concrete and particularized to suffice as an injury in fact. 136 S.Ct. at 1548. Concreteness and particularization are not synonymous; a court must analyze each individually. Second, a "bare procedural violation" of a statute, "divorced from any concrete harm," is not a concrete injury. Id. at 1549.
Spokeo did not purport to draw the line between a "bare procedural violation" lacking concrete harm and a concrete injury in fact. See id. at 1550 ("We take no position as to whether the Ninth Circuit's ultimate conclusion — that Robins adequately alleged an injury in fact — was correct."). But the Supreme Court did restate certain guiding principles. An injury is concrete if it is "de facto," that is, "it must actually exist." Id. at 1548 (citing Black's Law Dictionary 479 (9th ed. 2009)). Congress may, however, "elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law"; thus, in certain circumstances, alleged intangible injuries like the "risk of real harm" may establish concrete injury. Id. at 1548-49 (citations omitted). Nevertheless, "Congress' role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right." Id. at 1549.4
Courts around the country have grappled with the application of Spokeo to cases under FCRA and FACTA. As the numerous citations provided by Plaintiff and by Defendants indicate, thoughtful jurists have come to different conclusions in similar cases. Compare, e.g., Meyers v. Nicolet Rest. Of De Pere, LLC, 843 F.3d 724, 726 (7th Cir. 2016), with Wood v. J Choo USA, Inc., 201 F.Supp.3d 1332 (S.D. Fla. 2016). This Court recently applied Spokeo to an action under FCRA. See Mix v. Asurion Ins. Servs. Inc., No. CV-14-02357-PHX-GMS, 2016 WL 7229140, at *4-7 (D. Ariz. Dec. 14, 2016). Following the reasoning of several other district courts, this Court found that violations of the FCRA provisions at issue deprived the plaintiff of her substantive right to information, and created a risk of harm to her substantive right of privacy, thus causing concrete harm and satisfying the threshold for standing. See id. at *5-7.
More recently, and more bindingly, the Ninth Circuit found that violations of FCRA's requirements of disclosure and authorization deprived a plaintiff of, respectively, his rights to information and privacy, thus giving the plaintiff standing to bring suit. See Syed v. M-I, LLC, No. 14-17186, 2017 WL 242559, at *4 (9th Cir. Jan. 20, 2017). While there is no such binding authority on the FACTA violations at issue here, Syed confirms that this Court must approach the standing question here by analyzing whether the alleged violations deprive, or cause a real risk of depriving, consumers of substantive rights created by FACTA.
Congress enacted FACTA "[i]n an effort to combat identity theft." Bateman v. Am. Multi-Cinema, Inc., 623 F.3d 708, 717 (9th Cir. 2010). The provision of FACTA at issue here declares that "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. § 1681c(g)(1). The Seventh Circuit has explained what this provision — specifically, the truncation of expiration dates — does to combat identity theft:
The present cases concern the expiration date. The idea behind requiring its deletion is that, should the cardholder happen to lose the receipt of a transaction, the less information the receipt contains the less likely is an identity thief who happens to come upon the receipt to be able to figure out the cardholder's full account information and thus be able to make purchases that the seller will think were made by the legitimate cardholder.
A typical credit card has 16 digits and an expiration date that is the last day of a designated month and year. Even if the identity thief has all 16 digits, without the expiration date he may be unable to use the card. He can of course guess at the expiration date — the date is unlikely to be more than a few years in the future and there are only 12 months in a year; so if he guesses 60 times he's very likely to hit the jackpot. But if he guesses wrong the first few times that he places an order, the card issuer may well get suspicious and refuse to authorize his next order.... It's common in telephone and internet transactions for the consumer to be asked for an expiration date, and most systems will not allow the would-be customer to keep guessing at the date, as the guessing suggests that he may be an identity thief.
Additional reasons for requiring deletion of the expiration date include that "expiration dates combined with the last four or five digits of an account number can be used to bolster the credibility of a criminal who is making pretext calls to a card holder in order to learn other personal confidential financial information. Expiration dates are solicited by criminals in many e-mail phishing scams ..., are one of the personal confidential financial information items trafficked in by criminals ..., are described by Visa as a special security feature ..., [and] are one of the items contained in the magnetic stripe of a credit card, so it is useful to a criminal when creating a phony duplicate card." Don Coker, "Credit Card Expiration Dates and FACTA," HGExperts.com, www.hgexperts.com/article.asp?id=6665.
Redman v. RadioShack Corp., 768 F.3d 622, 626-27 (7th Cir. 2014); see also Bateman, 623 F.3d at 718 ("In fashioning FACTA, Congress aimed to `restrict the amount of information available to identity thieves.'" (quoting 149 Cong. Rec. 16,891 (2003) (statement of Sen. Shelby))).5
FACTA's subsequent amendment in 2008 further emphasizes Congress's intent to ensure that consumers did not receive receipts with printed expiration dates. When FACTA went into effect, "a significant number of merchants had erroneously concluded that merely truncating the account number down to the last five digits while leaving the expiration date would satisfy FACTA's requirements." Bateman, 623 F.3d at 717. Recognizing that this interpretation was not wholly unreasonable, Congress amended FACTA to "insulate from liability any person who printed an expiration date on a receipt between December 4, 2004, and June 3, 2008, so long as they otherwise complied with FACTA's requirements." Id. Notably, Congress did not eliminate the truncation requirement as to expiration dates,6 and after the temporary safe harbor period ended, merchants who printed expiration dates were not in compliance with FACTA.
A person or entity who prints an expiration date on a receipt, therefore, does not simply violate a procedural provision of FACTA but creates a real risk of identity theft — the very harm that FACTA was enacted to combat. There is a real risk that the customer's right to the privacy of their credit or debit card information is violated. Nor is this harm made harmless when, as here, the risk fails to materialize because no potential identity thief actually sees the receipt. Even in this situation, the consumer must take additional steps to ensure the safety of her identity; she may not simply crumple the receipt and throw it into a nearby trash can, but must review it to assess what was printed, hold on to it, and perhaps shred it or cut it up later. The inconvenience may be minor7; but the additional inconvenience that a consumer must undertake in order to secure their own rights, when a statute places that burden on others,8 is surely a concrete harm.
The injury that Deschaaf alleges is therefore a concrete injury in fact. She has standing to bring this action. Defendants' motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) is therefore denied.
b. Sufficiency of Pleading as to Willfulness
Deschaaf does not allege any actual damages. Rather, she seeks statutory and punitive damages. As her complaint acknowledges, she must therefore prove that Defendants violated FACTA willfully. See 15 U.S.C. § 1681n. "At the pleading stage, a plaintiff need not allege willfulness with specificity." Rivera v. Peri & Sons Farms, Inc., 735 F.3d 892 (9th Cir. 2013); see Fed. R. Civ. P. 9(b) ("Malice, intent, knowledge, and other conditions of a person's mind may be alleged generally.").
As before, there is no paucity of authority discussing the sufficiency of pleadings of willful violations of FACTA; the parties have provided numerous well-reasoned opinions coming to opposing conclusions. The parties cite to no binding authority on this specific issue, but the Ninth Circuit has, in addressing a class certification question, spelled out the likely bounds of a willful FACTA violation in a FCRA case:
A willful violation under the FCRA includes not only knowing violations of a standard, but reckless ones as well. A defendant acts in reckless disregard if the defendant's action is not only a violation under a reasonable reading of the statute's terms, but shows that the company ran a risk of violating the law substantially greater than the risk associated with a reading that was merely careless. That is, the defendant must have taken action involving an unjustifiably high risk of harm that is either known or so obvious that it should be known.
Bateman, 623 F.3d at 711 n.1 (internal quotation marks and citations omitted).
At this stage, under the general pleading requirements of Rule 9(b), Deschaaf has sufficiently alleged that Defendants' violation of FACTA was either knowing or reckless. She alleges that certain companies involved in the processing of card transactions informed Defendants of FACTA's requirements, (Doc. 1 at 9-10); that Defendants' bank informed Defendants of FACTA's requirements, (id. at 10); that credit card companies publicly announced steps they were taking (and requiring merchants to take) to comply with FACTA, (id.); and that the FTC notified businesses (including Defendants) of FACTA's requirements three times in 2007, (id.). These allegations, taken as true, plausibly suggest that Defendants knowingly violated FACTA by printing the expiration date on Deschaaf's receipt.9 It is perhaps odd, as Defendants note, that Defendants would knowingly comply with one provision of FACTA and knowingly not comply with another provision, but this oddity does not invalidate the plausible allegations Deschaaf makes as to Defendants' knowledge.
Deschaaf has adequately pled that Defendants willfully violated FACTA. Defendants' motion to dismiss on 12(b)(6) grounds is therefore denied.
CONCLUSION
Deschaaf has standing to bring this action and has stated a claim for relief. Defendants' motion to dismiss is denied in its entirety.
IT IS THEREFORE ORDERED that Defendants' Motion to Dismiss, (Doc. 13), is DENIED.
