Filed: Oct. 28, 2020
Latest Update: Oct. 28, 2020
Summary: USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 1 of 148 [PUBLISH] IN THE UNITED STATES COURT OF APPEALS FOR THE ELEVENTH CIRCUIT _ No. 16-16486 & 16-16783 _ D.C. Docket No. 0:15-cv-60716-WPD DR. DAVID S. MURANSKY, individually and on behalf of all others similarly situated, Plaintiff - Appellee, JAMES H. PRICE, ERIC ALAN ISAACSON, Interested Parties - Appellants versus GODIVA CHOCOLATIER, INC., a New Jersey corporation, Defendant - Appellee. _ Appeals from the United States District Court fo
Summary: USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 1 of 148 [PUBLISH] IN THE UNITED STATES COURT OF APPEALS FOR THE ELEVENTH CIRCUIT _ No. 16-16486 & 16-16783 _ D.C. Docket No. 0:15-cv-60716-WPD DR. DAVID S. MURANSKY, individually and on behalf of all others similarly situated, Plaintiff - Appellee, JAMES H. PRICE, ERIC ALAN ISAACSON, Interested Parties - Appellants versus GODIVA CHOCOLATIER, INC., a New Jersey corporation, Defendant - Appellee. _ Appeals from the United States District Court for..
More
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 1 of 148
[PUBLISH]
IN THE UNITED STATES COURT OF APPEALS
FOR THE ELEVENTH CIRCUIT
________________________
No. 16-16486 & 16-16783
________________________
D.C. Docket No. 0:15-cv-60716-WPD
DR. DAVID S. MURANSKY,
individually and on behalf of all others similarly situated,
Plaintiff - Appellee,
JAMES H. PRICE,
ERIC ALAN ISAACSON,
Interested Parties - Appellants
versus
GODIVA CHOCOLATIER, INC.,
a New Jersey corporation,
Defendant - Appellee.
________________________
Appeals from the United States District Court
for the Southern District of Florida
________________________
(October 28, 2020)
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 2 of 148
Before WILLIAM PRYOR, Chief Judge, WILSON, MARTIN, JORDAN,
NEWSOM, BRANCH, GRANT, LUCK, LAGOA, ED CARNES,* Circuit
Judges.**
GRANT, Circuit Judge, delivered the opinion of the Court, in which WILLIAM
PRYOR, Chief Judge, NEWSOM, BRANCH, LUCK, LAGOA, and ED
CARNES, Circuit Judges, joined.
GRANT, Circuit Judge:
In Spokeo, Inc. v. Robins, the Supreme Court took on a standing question
that had bedeviled litigants, scholars, and lower courts—whether pleading that a
statutory requirement was violated is enough to establish standing, even if the
plaintiff suffered no injury from the alleged violation. The answer was a
resounding no: a party does not have standing to sue when it pleads only the bare
violation of a statute.
That holding left the class action litigants here in an awkward spot. Years
ago, the named plaintiff pleaded this case as a pure statutory violation. He alleged
that Godiva chocolate stores had printed too many credit card digits on hundreds of
thousands of receipts over the course of several years, and pointed out that those
extra numbers were prohibited under a federal law aimed at preventing identity
theft. His complaint disclaimed any recovery for actual damages, and why not—
with per-violation statutory damages of up to $1,000, the potential class recovery
*
We heard this case en banc while Judge Ed Carnes was an active judge, and he elected to
continue to participate in the decision of this case after becoming a senior circuit judge. See
Eleventh Circuit Rule 35-9 (“Senior circuit judges of the Eleventh Circuit . . . may continue to
participate in the decision of a case that was heard or reheard by the court en banc at a time when
such judge was in regular active service.”); see also Gogel v. Kia Motors Mfg. of Ga., Inc., 967
F.3d 1121, 1125 n.** (11th Cir. 2020) (en banc).
**
Judge Rosenbaum and Judge Jill Pryor are recused. Judge Andrew Brasher joined the Court on
June 30, 2020, and did not participate in this decision.
2
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 3 of 148
was staggering even if no one actually suffered any harm. Godiva, it seems, also
found the potential damages staggering, and the parties agreed on a class
settlement not too long after the lawsuit was filed.
So why are the litigants in an awkward spot? As they admitted in the district
court, Spokeo was on the horizon during settlement talks, but had not yet been
decided; it formed an ominous backdrop for their negotiations. Both parties had an
interest in settling before that case was decided, because the Supreme Court’s
decision was likely to shift the bargaining calculus dramatically. So they settled.
And having reached a deal in the shadow of Spokeo, neither side was ready to start
all over after it was decided. Together, they pushed through the class fairness
hearing, and landed here for a fairness review after a few class members objected
to the settlement.
But even if the parties wish to bargain around Spokeo, we cannot indulge
them. Federal courts retain our constitutional duty to evaluate whether a plaintiff
has pleaded a concrete injury—even where Congress has said that a party may sue
over a statutory violation. Having shut his eyes and closed his ears to the
requirements of Spokeo while his claims were still at the district court, the named
plaintiff now tries to say that those claims surely show concrete injury under
Spokeo in any event. He has done his best to argue that the statutory violation he
alleged carries with it both harm and risk of harm—and does so every time. But
the emperor still has no clothes; the bare procedural violation the plaintiff alleges is
just as bare as it ever was. Because the plaintiff alleged only a statutory violation,
and not a concrete injury, he has no standing. That means we cannot evaluate the
3
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 4 of 148
fairness of the parties’ settlement, and we vacate the district court’s order
approving it.
I.
A.
Before turning to why alleging the violation of a statute is not enough to
establish standing, we should say a few words about the statute at issue here. The
Fair and Accurate Credit Transactions Act sets out a wide range of protections and
procedures. Pub. L. No. 108-159, 117 Stat. 1952 (2003). One of the (many) stated
goals of the legislation is “to prevent identity theft.” Id. In support of that goal,
FACTA forbids merchants from printing more than the last five digits of the card
number (or the card’s expiration date) on receipts offered to customers.
Id. sec.
113, § 605(g), 117 Stat. at 1959 (codified at 15 U.S.C. § 1681c(g)(1)). A willful
violation exposes a company to liability for actual damages—if any were
sustained—or statutory damages ranging from $100 to $1,000 per violation. 15
U.S.C. § 1681n(a)(1)(A). Punitive damages and attorney’s fees are also available.
Id. § 1681n(a)(2)–(3).
Several years after the passage of FACTA, in response to “hundreds” of
lawsuits seeking damages because credit card expiration dates had been printed on
receipts—lawsuits that otherwise contained no “allegation of harm to any
consumer’s identity”—Congress enacted what’s known as the Clarification Act.
Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241
§ 2(a)(4)–(5), 122 Stat. 1565, 1565 (2008). That law retroactively eliminated
liability for merchants who had printed credit card expiration dates on receipts but
4
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 5 of 148
complied with the other receipt-printing limitations. Id. sec. 3, § 616(d), 122 Stat.
at 1566 (codified at 15 U.S.C. § 1681n(d)). The Clarification Act offered a
subsequent Congress’s view that some technical FACTA violations caused
consumers no harm: the statute’s stated “purpose” was to protect “consumers
suffering from any actual harm” while also “limiting abusive lawsuits” that would
drive up costs to consumers without offering them any actual protection.
Id.
§ 2(b), 122 Stat. at 1566.
B.
With that background, we return to the allegations in front of us. Dr. David
Muransky used his credit card to spend $19.26 at a Godiva retail store in Florida.
He was handed a receipt containing the first six and last four digits of his sixteen-
digit credit card number—too many digits under FACTA.
Muransky got busy, filing a class action complaint against Godiva less than
a week later. He alleged that Godiva had willfully printed more digits than the law
allowed and that the excess digits were a national problem for the company.
Muransky’s complaint made clear that the alleged FACTA violations were
“statutory in nature” and that the suit was expressly “not intended to request any
recovery for personal injury.” He alleged the class’s harm, and risk of harm, from
those statutory violations in broad terms: “Plaintiff and the members of the class
have all suffered irreparable harm as a result of the Defendant’s unlawful and
wrongful conduct,” and “Plaintiff and members of the class continue to be exposed
to an elevated risk of identity theft.” No additional details were offered.
5
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 6 of 148
The class of injured persons that Muransky proposed consisted of anyone in
the United States who, in the two preceding years, received a point-of-sale receipt
from Godiva that displayed more than the last five digits of their credit or debit
card number. He sought statutory damages, punitive damages, and costs—as well
as attorney’s fees. Because of the size of the putative class, Godiva faced a
startling liability of more than $342 million.
After a few motions to dismiss were rejected, Godiva’s answer to the
complaint included a standing argument: “Neither Dr. Muransky nor any member
of the proposed class has suffered any injury in fact. They therefore lack standing
to prosecute their alleged claims.”
Given the dramatic size of the potential damages, it is no surprise that the
parties soon began settlement negotiations. They tried to move quickly—both
Muransky and Godiva admit that one of the driving forces in those negotiations
was the Supreme Court’s impending decision in Spokeo, Inc. v. Robins, 136 S. Ct.
1540 (2016). As Muransky later told the trial court, “the class faced considerable
uncertainty with regard to the Supreme Court’s anticipated decision in Spokeo, Inc.
v. Robins which, depending on the outcome, could have resulted in the case’s
dismissal for failure to present an injury in fact.” Godiva’s briefing acknowledged
the same—the potential outcome of Spokeo factored heavily into the settlement
negotiations.
The flush of negotiations led to an agreement in principle to settle the case:
Godiva would pay $6.3 million instead of the $342 million initially sought.
Almost a third of the pot, $2.1 million, would go to the class attorneys, with an
6
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 7 of 148
additional $10,000 going to Muransky “for his service as Class Representative.”
The average class member, according to Muransky, would net about $60 when all
was said and done.
With Spokeo still outstanding, the district court certified the class, granted
preliminary approval of the settlement, and directed notice to the class members.
Four class members filed various objections after they heard about the suit—
including Appellants James Price and Eric Isaacson—though none of the objectors
initially argued that Muransky lacked standing.
But by the time the district court held a fairness hearing on the proposed
settlement, things had changed: the Supreme Court had issued its decision in
Spokeo. Objector Isaacson took notice, and argued to the district court that it had
an obligation to examine whether Muransky’s claim satisfied the requirements of
Article III standing as described in Spokeo. Muransky, he said, bore the burden of
establishing the elements of standing as the party invoking federal jurisdiction—
and in the absence of standing, the district court “would have no choice” but to
dismiss the case. Neither Godiva nor Muransky offered anything in response.
Roughly a week later, the district court—without addressing Spokeo or
Article III standing—approved the class settlement. The court instead offered a
general conclusion that it had “jurisdiction over the subject matter of this
litigation,” before going on to approve the settlement. Isaacson and Price
appealed.
Objector Price raised the same issues he raised below—the contents of the
class notice, the attorney’s fee award, and the incentive award to Muransky.
7
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 8 of 148
Objector Isaacson, in addition to several other objections, offered the one we face
here today: that the court lacked Article III jurisdiction to approve the settlement
because Muransky had not suffered an injury in fact.
A panel of our Court disagreed, affirming the settlement’s approval after
concluding that Muransky had satisfied the requirements of Article III—even
considering Spokeo. A few months later, the panel vacated its first opinion and
issued a new one in its place. Although the superseding opinion contained a
revised standing analysis, it reached the same conclusions as the first: Muransky
had Article III standing, the objections failed on the merits, and the class settlement
was properly approved.
The panel’s new standing analysis resulted in a categorical rule: “if Congress
adopts procedures designed to minimize the risk of harm to a concrete interest,
then a violation of that procedure that causes even a marginal increase in the risk of
harm to the interest is sufficient to constitute a concrete injury.” Muransky v.
Godiva Chocolatier, Inc., 922 F.3d 1175, 1188 (11th Cir.), reh’g en banc granted,
opinion vacated,
939 F.3d 1278 (11th Cir. 2019). The level of risk required was
alternatively described as “no more than an identifiable trifle.”
Id. at 1186
(quotation marks and citation omitted). So in the panel’s view, by setting out a
statutory requirement for the number of digits on a receipt, Congress had judged
that any violation of that requirement would increase the consumer’s risk of
identity theft—and this Court was bound to accept that congressional assessment
of injury. See
id. at 1188.
8
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 9 of 148
In response, the full Court ordered rehearing en banc and vacated the panel
opinion. In a testament to the complications of this case, the four parties offer
different perspectives on Muransky’s Article III standing. Objector Isaacson
maintains that Muransky lacks standing because he was not injured and says this
case should be dismissed. Muransky and Objector Price both argue that Muransky
has standing (though they disagree about the merits of the settlement approval).
For its part, Godiva declines to offer the Court any perspective at all, claiming that
it is “prevented from answering this question” by the settlement agreement.
II.
Whether the plaintiffs have standing to sue is a threshold jurisdictional
question that we review de novo. Debernardis v. IQ Formulations, LLC, 942 F.3d
1076, 1083 (11th Cir. 2019).
III.
At the heart of this case is one question: whether the judiciary must assume
that whenever Congress creates a legal entitlement, any violation of that
entitlement causes a concrete injury. Although courts “sometimes make standing
law more complicated than it needs to be,” a well-trod path leads us to the answer
here. Thole v. U.S. Bank N.A., 140 S. Ct. 1615, 1622 (2020). The Supreme Court
“has rejected the argument that ‘a plaintiff automatically satisfies the injury-in-fact
requirement whenever a statute grants a person a statutory right and purports to
authorize that person to sue to vindicate that right.’”
Id. at 1620
(quoting
Spokeo,
136 S. Ct. at 1549). And that rejection is derived from the now-familiar
admonition that alleging a “bare procedural violation, divorced from any concrete
9
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 10 of 148
harm” is not enough to support standing. Spokeo, 136 S. Ct. at 1549. So, even
considering the welter of standing doctrines that can clutter our analysis, we know
one thing to be true—alleging a statutory violation is not enough to show injury in
fact.
Why not? Article III of the Constitution limits federal courts to deciding
“Cases” or “Controversies.” U.S. Const. art. III, § 2. The existence of a case or
controversy is a “bedrock requirement” of our jurisdiction; we cannot exercise
judicial power without it. Raines v. Byrd, 521 U.S. 811, 818 (1997) (quoting
Valley Forge Christian Coll. v. Ams. United for Separation of Church and State,
Inc.,
454 U.S. 464, 471 (1982)). So in order to find out if we can hear a party’s
claim, we need to consider whether that party has a case or controversy rather than,
say, a strong and abiding interest in an issue, or a desire to obtain attorney’s fees.
Standing, ripeness, and mootness are three traditional doctrines governing
whether a case or controversy exists. Standing—“perhaps the most important of
the jurisdictional doctrines”—is the only one at issue here. FW/PBS, Inc. v. City of
Dallas, 493 U.S. 215, 231 (1990) (quoting Allen v. Wright,
468 U.S. 737, 750
(1984)) (alterations adopted). For a party to have standing to bring a lawsuit, it
must have “(1) suffered an injury in fact, (2) that is fairly traceable to the
challenged conduct of the defendant, and (3) that is likely to be redressed by a
favorable judicial decision.”
Spokeo, 136 S. Ct. at 1547 (citing Lujan v. Defs. of
Wildlife,
504 U.S. 555, 560–61 (1992)). In plainer language, the plaintiff needs to
show that the defendant harmed him, and that a court decision can either eliminate
the harm or compensate for it. That standard applies equally in the class action
10
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 11 of 148
setting; a district court is “powerless to approve a proposed class settlement” if “no
named plaintiff has standing.” Frank v. Gaos, 139 S. Ct. 1041, 1046 (2019).
Our inquiry becomes narrower as we move down the standing decision tree;
injury is the only element we need to consider here. At the pleading stage of a
case, “general factual allegations of injury” can suffice. Lujan, 504 U.S. at 561.
But that is not a free pass—these general factual allegations must “plausibly and
clearly allege a concrete injury.”
Thole, 140 S. Ct. at 1621; see also Ashcroft v.
Iqbal,
556 U.S. 662, 678–79 (2009); Bell Atl. Corp. v. Twombly,
550 U.S. 544,
555–56 (2007); Salcedo v. Hanna,
936 F.3d 1162, 1168 (11th Cir. 2019). “[M]ere
conclusory statements do not suffice.”
Iqbal, 556 U.S. at 678 (punctuation
omitted). Although Iqbal and Twombly have put a finer point on it, this standard is
not new—it’s long been known that even at the pleading stage, the “litigant must
clearly and specifically set forth facts” to satisfy the requirements of Article III.
Whitmore v. Arkansas, 49
5 U.S. 149, 155 (1990). We will not “imagine or piece
together an injury sufficient to give [a] plaintiff standing when it has demonstrated
none,” and we are powerless to “create jurisdiction by embellishing a deficient
allegation of injury.” Miccosukee Tribe of Indians of Fla. v. Fla. State Athletic
Comm’n,
226 F.3d 1226, 1229–30 (11th Cir. 2000) (citing
Whitmore, 495 U.S. at
155).
What is required, then? A plaintiff needs to plead (and later support) an
injury that is concrete, particularized, and actual or imminent, rather than
11
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 12 of 148
conjectural or hypothetical.1 See Spokeo, 136 S. Ct. at 1548 (quoting
Lujan, 504
U.S. at 560). Our inquiry narrows again; we only consider concreteness here. A
lot of ink has been spilled to explain what concrete means, but the best word may
also be the simplest—“real.”
Id. And statutory violations do not—cannot—give
us permission to offer plaintiffs a wink and a nod on concreteness. Plaintiffs must
show, and the courts must ensure, that an alleged injury is concrete, or else we
have no jurisdiction to consider it.
Id. at 1548–49.
As the parties recognized—or, less charitably, feared—during their
settlement negotiations, the Supreme Court’s Spokeo, Inc. v. Robins decision is
central to our concreteness analysis. That’s because Spokeo was not only about
concreteness; it was also about Congress. Spokeo cautioned that “Congress’ role in
identifying and elevating intangible harms does not mean that a plaintiff
automatically satisfies the injury-in-fact requirement whenever a statute grants a
person a statutory right and purports to authorize that person to sue to vindicate
that right.”
Id. at 1549. So although a congressional judgment may be “instructive
and important” to this Court’s analysis, we need to come to our own conclusion
that the alleged harm is concrete before we can find that a plaintiff has standing.
Id.
1
We note that the burden of establishing these elements of standing continues—and, in fact,
increases—all the way through the litigation.
Lujan, 504 U.S. at 561. The elements need to be
supported “with the manner and degree of evidence required at the successive stages of the
litigation”—though what that means at the class settlement stage has been the subject of some
debate.
Id. Because Muransky has not offered any allegations beyond those in his complaint,
and because we can resolve the case on the basis of his deficient pleadings, we do not need to
wrestle with that question here.
12
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 13 of 148
Echoing Lujan v. Defenders of Wildlife, the Spokeo decision also
acknowledged that Congress may “elevate to the status of legally cognizable
injuries concrete, de facto injuries that were previously inadequate in law” and that
“Congress has the power to define injuries and articulate chains of causation that
will give rise to a case or controversy where none existed before.” Spokeo, 136 S.
Ct. at 1549 (citation omitted and alterations adopted). Congress can certainly
create new legal entitlements, the denial of which will constitute a concrete injury.
See, e.g., FEC v. Akins, 524 U.S. 11, 21–24 (1998) (inability to obtain information
is an injury in fact); Pub. Citizen v. U.S. Dep’t of Justice,
491 U.S. 440, 449 (1989)
(same). It can also recognize and provide legal remedies for concrete injuries that
already exist, but for which there is no cause of action. But this is a limited
authority to provide legal process relating to actual harms, not a blanket power to
authorize suit in the absence of harm: Congress “cannot erase Article III’s
standing requirements by statutorily granting the right to sue to a plaintiff who
would not otherwise have standing.”
Spokeo, 136 S. Ct. at 1548 (quoting
Raines,
521 U.S. at 820 n.3). 2
A.
Now to the mechanics of pleading. Plaintiffs can show a concrete, or “real,”
harm in two ways. The first is to show that the statutory violation itself caused a
harm. It’s safe to say that pointing to a direct harm is the most straightforward way
2
Our dissenting colleague’s long discussion of the public-private rights theory is interesting to
consider as a matter of first principles. See Jordan Dissent at 115–47. But it is also irrelevant to
the work that we have to do as an inferior court in this appeal. That work is to apply the binding
caselaw of the Supreme Court, which does not currently endorse the theory pressed by our
colleague.
13
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 14 of 148
to show a concrete injury—in fact, it’s probably what most people think of
naturally. Such harms can be tangible or intangible. Tangible harms are the most
obvious and easiest to understand; physical injury or financial loss come to mind as
examples.
Claims of intangible harm, on the other hand, can be tricky: some are
concrete, some are not. Violations of the rights to free speech or free exercise, for
instance, are intangible harms that are also both direct and concrete. Spokeo, 136
S. Ct. at 1549 (collecting cases). “[C]onscientious objection” to a law or “fears of
hypothetical future harm”? Not so much. See Diamond v. Charles,
476 U.S. 54,
67 (1986); Clapper v. Amnesty Int’l USA,
568 U.S. 398, 416 (2013). And
questions of whether alleged intangible harms are concrete have an extra wrinkle
when the plaintiff’s claim stems from the violation of a statute.
Shedding some light on how to draw that difficult line, Spokeo instructs that
we may consider “both history and the judgment of Congress.” Spokeo, 136 S. Ct.
at 1549. History first—by looking to history, we can discern a concrete injury
where the “intangible harm has a close relationship to a harm that has traditionally
been regarded as providing a basis for a lawsuit in English or American courts.”
Id. The fit between a new statute and a pedigreed common-law cause of action
need not be perfect, but we are called to consider at a minimum whether the harms
match up between the two. Likewise, congressional judgment may illuminate a
concrete injury because, as a body, Congress “is well positioned to identify
intangible harms that meet minimum Article III requirements.”
Id. But as we have
already explained, congressional judgment only goes so far, and does not relieve
14
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 15 of 148
the judiciary of our constitutional duty to independently determine whether the
plaintiff has suffered a concrete injury.
Our own post-Spokeo precedent illustrates how both history and
congressional judgment can fit into the concreteness analysis. In several cases, we
have concluded that a plaintiff had standing because the statutory violation at issue
led to a type of harm that has historically been recognized as actionable. For
example, we held that CNN’s dissemination of a plaintiff’s news-viewing history
to a third-party, in violation of the Video Privacy Protection Act, could constitute a
concrete injury because it was analogous to torts that were well-established in
American courts—namely, invasion of privacy and intrusion upon seclusion.
Perry v. Cable News Network, Inc., 854 F.3d 1336, 1340–41 (11th Cir. 2017). We
reached a similar conclusion when we held that an agency’s violation of the Fair
Credit Reporting Act—offering an allegedly inaccurate statement in a plaintiff’s
credit report—was analogous to the longstanding tort for publication of defamatory
material. Pedro v. Equifax, Inc.,
868 F.3d 1275, 1279–80 (11th Cir. 2017).
We have also relied on the judgment of Congress to discern concrete
injuries. In Debernardis v. IQ Formulations, LLC, for instance, we considered the
plaintiffs’ claim that they were sold an adulterated dietary supplement as defined
by the Food, Drug, and Cosmetic Act because the manufacturer failed to provide
notice to the Food and Drug Administration that a new dietary ingredient was safe.
942 F.3d at 1080–82. Although the plaintiffs suffered no physical harm from the
supplement, we concluded that they were sold a worthless product “that Congress
judged insufficiently safe for human ingestion.”
Id. at
1085. That deprived the
15
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 16 of 148
plaintiffs of the benefit of their bargain and amounted to a direct economic loss
that supported standing.
Id. at
1085–86. In short, a variety of approaches can
demonstrate direct harm to a plaintiff.
Even without any direct harm, a plaintiff can establish an injury in fact by
showing that a statutory violation created a “risk of real harm.” Spokeo, 136 S. Ct.
at 1549 (citing Clapper,
568 U.S. 398). But while very nearly any level of direct
injury is sufficient to show a concrete harm, the risk-of-harm analysis entails a
more demanding standard—courts are charged with considering the magnitude of
the risk. That means we evaluate whether the claimed “procedural
violations . . . entail a degree of risk sufficient to meet the concreteness
requirement.”
Id. at
1550.
If some degrees of risk are called sufficient, that means others must be
insufficient. Although Spokeo did not trace a numerical line between the two, it
did explain that the risk must be “material.” Id. That’s a familiar word that, in this
context, means “important; essential; relevant.” New Oxford American Dictionary
(3d ed. 2010); see also The American Heritage Dictionary of the English Language
(5th ed. 2018) (“Being both relevant and consequential; crucial.”). We recognize
that “material risk of harm” is a somewhat indefinite term.
Spokeo, 136 S. Ct. at
1550; Nicklaw v. CitiMortgage, Inc.,
839 F.3d 998, 1002–03 (11th Cir. 2016). One
thing is definite, however. Whatever “material” may mean, conceivable and
trifling are not on the list.
And for all the things that Spokeo broke new ground on, the high standard
for risk of harm was not one of them. The Supreme Court has long indicated that
16
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 17 of 148
standing predicated on a risk of harm must be based on something more than a
minor or theoretical risk—“a ‘substantial risk’ that the harm will occur,” for
example. Clapper, 568 U.S. at 414 n.5 (citation omitted). Other cases use slightly
different formulations to describe a significant or substantial risk, but they are
consistent in recognizing a high standard for the risk-of-harm analysis, and a robust
judicial role in assessing that risk. See, e.g.,
Thole, 140 S. Ct. at 1622
(“substantially increased risk”); Dep’t of Commerce v. New York,
139 S. Ct. 2551,
2565 (2019) (“a substantial risk that the harm will occur” (quoting Susan B.
Anthony List v. Driehaus,
573 U.S. 149, 158 (2014))); Monsanto Co. v. Geertson
Seed Farms,
561 U.S. 139, 153, 155 (2010) (“substantial risk” or “significant
risk”); Pennell v. City of San Jose, 48
5 U.S. 1, 8 (1988) (“realistic danger of
sustaining a direct injury” (citation omitted)); Blum v. Yaretsky,
457 U.S. 991,
1000 (1982) (a “sufficiently substantial” threat). We do not see, we should add, a
“material” or “substantial” difference among these terms, and the Supreme Court
has not suggested one.
Our Court has already put this standard to work. In Nicklaw v.
CitiMortgage, Inc., we concluded that a plaintiff had suffered neither direct harm
nor a “material risk of harm” when his mortgage company recorded the discharge
of his debt later than it should have. 839 F.3d at 1000, 1003. The plaintiff, after
all, had brought his lawsuit two years after the lender had finally (albeit tardily)
fulfilled its duty, and there was no allegation that the lender’s earlier failure had
already injured him or would pose any risk in the future.
Id. at
1003. With neither
17
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 18 of 148
a direct harm nor a material risk of harm, the plaintiff had suffered no concrete
injury. See id.
We add that the lack of a numerical standard governing the quantum of risk
that is sufficient to support standing does not mean that the standard is zero, that
the standard is minimal, or that we simply defer to Congress. And the limits on
congressional authority do not disappear when the statutory right at issue protects
against a risk of future harm; it would be backwards to say that Congress gets less
than complete deference when it seeks to identify actual harm, but is due blind,
unreviewable deference if it seeks to protect against a risk of actual harm. The
same is true for pleading requirements. A conclusory statement that a statutory
violation caused an injury is not enough, so neither is a conclusory statement that a
statutory violation caused a risk of injury.
B.
To boil down the lessons above, we consider two things when we evaluate
whether concrete harm flows from an alleged statutory violation—and thus
whether the plaintiff has standing. First, we ask if the violation itself caused harm,
whether tangible or intangible, to the plaintiff. If so, that’s enough. If not, we ask
whether the violation posed a material risk of harm to the plaintiff. If the answer to
both questions is no, the plaintiff has failed to meet his burden of establishing
standing.3
3
We will confess that we find ourselves somewhat perplexed by our dissenting colleague’s
repeated assertions that we believe only identity theft can cause injury under FACTA. See
Wilson Dissent at 36, 42–43, 47. Both identity theft and a material risk of identity theft plainly
qualify as injuries under that statute and under this opinion. Nor do we see how interpreting the
18
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 19 of 148
The heart of Muransky’s claim is that “he was provided with an
electronically printed receipt” that “displayed the last four digits of his credit card
as well as the first six digits of his account number” and that, because of this type
of violation, he and other class members “have all suffered irreparable harm” and
“continue to be exposed to an elevated risk of identity theft.” And, as we have
explained, the complaint emphasizes that the wrongs committed by Godiva are
“statutory in nature” and expressly disclaims any recovery for “personal injury”
arising from the violations.
Relying on these allegations, all of which are grounded in the statute,
Muransky now argues that the extra digits on his receipt can be counted as a
concrete injury in four different ways. Three of his arguments suggest that the
statutory violation itself—his receipt of the receipt—caused him a direct harm. His
alternative argument is that the violation exposed him to an increased risk of
identity theft. But Muransky’s efforts to recharacterize the statutory violation he
pleaded to fit within Spokeo’s limits demonstrate, if anything, a commitment to the
idea that the violation alone must somehow be enough.
1.
His first argument is that he had a “substantive right” to a properly truncated
receipt, and that the violation of that right, “by itself, is a concrete injury.” This
interest protected by FACTA as avoidance of “risk of identity theft” moves the ball. To begin,
this opinion makes clear that anyone who properly pleads a material risk of identity theft would
have standing. Second, if the harm the statute protects against is “risk of identity theft” rather
than “identity theft,” that would mean that we would need to consider whether a statutory
violation led to a material risk of a risk of identity theft. We fail to see how that word-soup
analysis would help plaintiffs in any event—either they suffer a material risk of harm or they do
not.
19
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 20 of 148
argument gets at the core of his complaint’s allegations—statutory-violation-qua-
injury was the predominant theory of harm throughout the litigation. Muransky
also presses a new argument that the (unpleaded) efforts he took to safeguard his
receipt qualify as an injury in fact. Finally, he pivots to historical analogue,
asserting that the mishandling of his account information is actionable because it
bears a close resemblance to a common-law breach of confidence. None of these
direct-injury claims holds up.
i.
We have already explained the key holding from Spokeo: a “bare procedural
violation, divorced from any concrete harm” is not enough to establish an Article
III injury. Spokeo, 136 S. Ct. at 1549. But we restate the point here to explicitly
reject any argument that the complaint’s conclusory statement that “Plaintiff and
the members of the class have all suffered irreparable harm as a result of the
Defendant’s unlawful and wrongful conduct” is enough to show concrete injury;
that claim would be so flimsy after Spokeo (not to mention Iqbal) that Muransky
himself does not raise it. Nothing in FACTA suggests some kind of intrinsic worth
in a compliant receipt, nor can we see any. So it makes little sense to suggest that
receipt of a noncompliant receipt itself is a concrete injury.
To resist the force of that intuition, Muransky attempts to reframe the nature
of his injury by relying on a fuzzy distinction between “substantive” and
“procedural” rights. He argues that Godiva’s statutory violation deprived him of a
substantive right to receive “a properly truncated receipt,” and that the violation of
a substantive right, unlike a procedural right, automatically inflicts an injury in
20
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 21 of 148
fact—even if it causes no harm. This, it turns out, is a dressed up version of the
same argument that the Eighth Circuit accepted before Spokeo, but had to walk
back after it: “Our prior statement that ‘[i]njury in fact may thus be shown solely
by the invasion of a legal right that Congress created,’ is no longer good law in
light of the Supreme Court’s subsequent holding in Spokeo, Inc. v. Robins [that]
‘Article III standing requires a concrete injury even in the context of a statutory
violation.’” Golan v. FreeEats.com, Inc., 930 F.3d 950, 957–58 (8th Cir. 2019)
(quotation marks and citations omitted).
In an attempt to resuscitate that argument, Muransky contends that the
holding in Spokeo applies only to what he calls “procedural” statutory violations,
and not to what he calls “substantive” ones. He argues that Spokeo confirms his
view when it says that even a procedural violation “can be sufficient in some
circumstances to constitute injury in fact.” Spokeo, 136 S. Ct. at 1549. Muransky
is absolutely right that Spokeo makes this point, but he’s absolutely wrong that it
saves his claim.
Spokeo’s statement stands for the unremarkable proposition that, in some
cases, the violation of a procedural right set out in a statute will necessarily result
in the harm that Congress was trying to prevent. A prime example is the illegal
deprivation of information: “a plaintiff suffers an ‘injury in fact’ when the plaintiff
fails to obtain information which must be publicly disclosed pursuant to a statute.”
Akins, 524 U.S. at 21 (citation omitted); see also Havens Realty Corp. v. Coleman,
455 U.S. 363, 373 (1982) (denial of “legal right to truthful information about
available housing” is an Article III injury). That, the Supreme Court has already
21
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 22 of 148
made clear, is not a “bare” procedural violation, or one that is “divorced from any
concrete harm”; if a statute protects against a lack of information, the denial of
access to information is a concrete injury. For FACTA, on the other hand, a
violation of the statute does not directly result in the harm Congress was trying to
prevent. That is, no one’s identity is stolen at the moment a receipt is printed with
too many digits. See Pub. L. No. 108-159, 117 Stat. at 1952 (a goal of FACTA is
“to prevent identity theft”).
So while some statutory violations, by their very nature, will be coextensive
with the harm that Congress was trying to prevent, labels do not control our
analysis. We are not the first court to recognize that arguments grounded in a
distinction between substantive and procedural rights miss the point and are
“unconvincing” because they depend “entirely on the framing of the right.”
Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 782 (9th Cir. 2018); see also
Meyers v. Nicolet Rest. of De Pere, LLC,
843 F.3d 724, 727 n.2 (7th Cir. 2016).
The question, always, is whether an injury in fact accompanies a statutory
violation.
Confronting this argument again also feels a little like Groundhog Day,
because we already rejected it in Nicklaw. There, the plaintiff claimed that,
because “the New York legislature intended to create a substantive right to have
the certificate of discharge timely recorded,” the plaintiff automatically suffered a
concrete injury when the discharge was untimely filed. 839 F.3d at 1002
(emphasis added). There too, we held that the “relevant question” was “whether
Nicklaw was harmed when this statutory right was violated.”
Id. The point is that
22
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 23 of 148
for standing purposes, no matter what label you hang on a statutory violation, it
must be accompanied by a concrete injury.
We thus continue to adhere to our decision in Nicklaw. Muransky’s
assertion that he does not need to show anything more than a noncompliant receipt
because his statutory right was “substantive” cannot be squared with our
precedent—or with the central holding of Spokeo. To avoid “alleging a bare
procedural violation,” the plaintiff must show either some harm caused by the
violation or a material risk of harm. Spokeo, 136 S. Ct. at 1550. What Muransky
has missed is that the word “bare” is just as important as the word “procedural.”
ii.
Perhaps suspecting that a statutory violation alone would no longer be
sufficient after we considered Spokeo, Muransky claims on appeal that the time he
spent safeguarding his receipt also constitutes a direct injury in fact.
Although we have held that “allegations of wasted time can state a concrete
harm for standing purposes,” we have also declined to find standing when no such
allegations were pleaded. Salcedo, 936 F.3d at 1173. In Salcedo, we rejected the
plaintiff’s assertion at oral argument that receiving unwanted text messages caused
him to waste time.
Id. at
1168. We did so for a simple reason: his complaint
lacked any “specific time allegation.”
Id. So too here. Muransky never alleged
that he treated his Godiva receipt differently than any other, or that he spent any
additional time safeguarding it.
But even if Muransky had alleged that he spent additional time destroying or
safeguarding his receipt, he would not succeed on this theory. Where a
23
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 24 of 148
“hypothetical future harm” is not “certainly impending,” plaintiffs “cannot
manufacture standing merely by inflicting harm on themselves.” Clapper, 568
U.S. at 416, 422. Muransky is no different than the Clapper plaintiffs in this
respect—his management-of-risk claim is bound up with his arguments about
actual risk. If his Godiva receipt would not offer any advantage to identity thieves,
we could hardly say that he was injured because of the efforts he took to keep it out
of their hands. To be fair, we have not yet addressed Muransky’s risk-of-harm
claims, but any assertion of wasted time and effort necessarily rises or falls along
with this Court’s determination of whether the risk posed by Godiva’s FACTA
violation, as pleaded by Muransky, is itself a concrete harm.
iii.
In his final attempt to show a direct harm, Muransky argues—for the first
time—that Godiva’s FACTA violation is analogous to a common-law breach of
confidence tort. To succeed on this theory, he needs to show that the violation
bears “a ‘close relationship’ to a traditionally redressable harm.” Salcedo, 936
F.3d at 1172 (quoting
Spokeo, 136 S. Ct. at 1549). His argument proceeds along
the following lines: FACTA requires merchants to keep credit card information
secret. By handing him a receipt with too many digits of his credit card number
exposed, Godiva “disclosed” information that he provided in confidence and gave
criminals “easy access” to it. Because that disclosure (to him) bears a close
relationship to the common-law breach of confidence tort, he says, it qualifies as a
concrete harm.
24
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 25 of 148
Not so fast. As an initial matter, the parties dispute whether a breach of
confidence tort can fairly be said to have “traditionally been regarded as providing
a basis for a lawsuit in English or American courts.” Spokeo, 136 S. Ct. at 1549.
There is arguable support for both views in academic literature and caselaw. As a
1982 note cited by both Muransky and Isaacson explains, following its recognition
in 1849, “the breach of confidence tort has become the basis of an extensive body
of law” in England. Alan B. Vickery, Note, Breach of Confidence: An Emerging
Tort, 82 Colum. L. Rev. 1426, 1452–54 (1982). But that same source goes on to
state that the “law of breach of confidence in the United States, at least with
respect to personal information, has not enjoyed a similar development,” and that
the tort was “emerging” in a “rudimentary” form after initially dying “out in its
infancy.”
Id. at
1451–52, 1454. The observation that the tort was “emerging” in
the 1980s is consistent with the Second Circuit’s 1989 description of a breach of
confidence as “a relative newcomer to the tort family.” Young v. U.S. Dep’t of
Justice,
882 F.2d 633, 640 (2d Cir. 1989).
One of the unexpected consequences of the common-law-analogy approach
to identifying harms is the growing insistence on hammering square causes of
action into round torts. Litigants and courts alike can be drawn into overthinking
what was really a simple instruction: see if a new harm is similar to an old harm.
Another risk is that courts will be unnecessarily drawn into an arcane evaluation of
a tort’s origins. Fortunately, we are not put to that test today. We need not resolve
whether breach of confidence is sufficiently ancient, because even if we assume
25
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 26 of 148
that a breach of confidence was traditionally redressable in English and American
common-law courts, we are unpersuaded by its analogy to the facts of this case.
A breach of confidence, at least as defined by the article cited by the parties,
involves “the unconsented, unprivileged disclosure to a third party of nonpublic
information that the defendant has learned within a confidential relationship.”
Vickery, supra, at 1455; see also Kamal v. J. Crew Grp., Inc.,
918 F.3d 102, 114
(3d Cir. 2019); Vassiliades v. Garfinckel’s,
492 A.2d 580, 591 (D.C. 1985).
Godiva’s FACTA violation shares very little with this definition. Two key
elements of a breach of confidence are completely absent from the violation he
complains of. To begin, there was no “disclosure to a third party.” Muransky was
handed a receipt that bore his own information, and he does not allege that anyone
else ever saw it. To describe this act as a “disclosure” would distort the meaning
of the term.
Nor can we see how Muransky could have had a confidential relationship
with the Godiva retail store. A breach of confidence “is rooted in the concept that
the law should recognize some relationships as confidential to encourage
uninhibited discussions between the parties involved.” Young, 882 F.2d at 640; see
also David A. Elder, Privacy Torts § 5:3 (2019). Given this understanding, it is
unsurprising that breach of confidence claims traditionally arise in the context of
close professional relationships—those involving physicians, therapists, financial
institutions, and the like. See, e.g., Suburban Tr. Co. v. Waller,
408 A.2d 758, 764
(Md. Ct. Spec. App. 1979) (bank); Doe v. Roe,
400 N.Y.S.2d 668, 676 (N.Y. Sup.
Ct. 1977) (psychiatrist); Horne v. Patton,
287 So. 2d 824, 829 (Ala. 1973) (medical
26
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 27 of 148
doctor). Handing a common form of payment to a cashier at a retail store is simply
not equivalent to these kinds of vulnerable, confidential relationships.
Because no information was disclosed, and no confidential relationship
existed, the relationship between Godiva’s conduct and a breach of confidence is
anything but “close”: a Godiva clerk handed Muransky a receipt containing a
portion of his own credit card information. The fit between a traditionally
understood harm and a more recent statutory cause of action need not be perfect,
but the association here is too strained. Accordingly, we cannot say—at least
based on a breach-of-confidence theory—that Muransky has pleaded the kind of
injury that “has traditionally been regarded as providing a basis for a lawsuit.”
Spokeo, 136 S. Ct. at 1549.
2.
Because Muransky failed to allege that the FACTA violation caused him a
direct harm, we move on to consider whether he pleaded that the extra digits
caused him to suffer a material risk of harm. In arguing that he did, Muransky
returns, really, to the same point we dismissed earlier: that the inquiry begins and
ends with deference to congressional judgment. As he sees it, by requiring the
truncation of all but the last five digits of a credit card, Congress has decided that
printing additional digits creates a real risk of identity theft. End of story; there is
no role for the courts.
What Muransky asks is for us to abandon our judicial role by merging the
ordinary steps in the analysis—concluding that because the statute protects a
concrete interest, any violation automatically threatens that interest and thus
27
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 28 of 148
supports standing. Although that approach would simplify our job, it is
inconsistent with Spokeo and with what the Constitution demands of us. But first,
as a practical matter, there is good reason to doubt that Congress has deemed every
violation of FACTA to pose a material risk of identity theft. FACTA did not
specifically address the kind of partial truncation that occurred in this case—an
observation made by the Third Circuit when it noted (with respect to an identical
FACTA violation) that the “congressional findings of risk are not tailored to the
FACTA violation . . . pleaded.” Kamal, 918 F.3d at 115–16 n.5. Moreover,
Congress expressly recognized in the Clarification Act that not all violations of the
truncation requirement pose a serious threat to consumers. See Pub. L. No. 110-
241 § 2(b), 122 Stat. at 1566. So Congress itself has made clear that not every
FACTA violation carries with it a risk of harm.
Still, even if Congress had explicitly stated in the text of the statute that
every FACTA violation poses a material risk of harm, that alone would not carry
the day. Although the judgment of Congress is an “instructive and important” tool
to identify Article III injuries, we cannot accept Muransky’s argument that once
Congress has spoken, the courts have no further role. Spokeo, 136 S. Ct. at 1549.
“Congress cannot erase Article III’s standing requirements by statutorily granting
the right to sue to a plaintiff who would not otherwise have standing.”
Id. at
1547–
48 (citation omitted). And as Spokeo emphasized, deciding whether a given risk of
harm meets the materiality threshold is an independent responsibility of federal
courts. See
Kamal, 918 F.3d at 115 (“But the lesson of Spokeo is that we must
confirm a concrete injury or material risk exists even when Congress confers a
28
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 29 of 148
right of action.”). Indeed, the Spokeo majority’s ultimate instruction to the Ninth
Circuit on remand was to determine “whether the particular procedural violations
alleged in this case entail a degree of risk sufficient to meet the concreteness
requirement.” Spokeo, 136 S. Ct. at 1550. That instruction applies equally here.
It thus falls to us to consider Muransky’s claim. The question is whether
Muransky has alleged a material risk of harm, one that is “sufficient to meet the
concreteness requirement.” Id. Factual allegations that establish a risk that is
substantial, significant, or poses a realistic danger will clear this bar—but
Muransky gives us very little to go on. In his complaint, he offers the naked
assertion that he “and members of the class continue to be exposed to an elevated
risk of identity theft.” Nothing indicates how much risk this might be, however,
and no facts alleged in the complaint provide insight into what degree of “elevated
risk” Muransky faced, or why.
That kind of conclusory allegation is simply not enough. Muransky did not
plead facts that, taken as true, plausibly allege a material risk, or significant risk, or
substantial risk, or anything approaching a realistic danger. See Iqbal, 556 U.S. at
678–79. The thing is, contrary to our dissenting colleague’s assertion, Muransky
did not offer “a general factual contention subject to proof or disproof with
evidence at later stages of litigation.” Jordan Dissent at 101. In fact, he was not
trying to do so, and his own brief headings tell us why. Muransky’s argument to
this Court—still—is that Congress determined that he was put at risk and that
Congress’s judgment of risk is sufficient. And he later adds that he is relieved of
any duty to plead facts supporting a risk of harm because “Congress already found
29
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 30 of 148
the risk substantial.” So instead of actually pleading a material risk of harm, he has
provided us with a threadbare allegation that he was exposed to an increased risk
of identity theft. But an allegation of risk is not excused from the ordinary bar on
conclusory allegations—it would not be (indeed is not here) enough to plead that
“the defendant broke the law and injured me in doing so.” That is, again, merely a
reiteration of the statutory violation. If this pleading is enough to show standing,
then there is no violation of FACTA that would not be.
Late-breaking allegations in unsworn briefs before this Court do not change
that. According to Isaacson (and various amici), the extra numbers on Muransky’s
receipt merely contain information that is already allowed to be printed on it
elsewhere—the card issuer, for example. This observation was credited by the
Second Circuit, which has said that printing “the first six digits of a credit card
. . . is the equivalent of printing the name of the issuing institution.” Katz v. Donna
Karan Co., LLC, 872 F.3d 114, 120 (2d Cir. 2017). For his part, Muransky argues
that the six digits do contain information that can be exploited by identity thieves,
such as the card level or industry program, and that access to it enables identity
thieves to conduct “phishing” inquiries.4 But all of that is really beside the point.
Maybe these facts are true; perhaps they are not. Neither scenario would change
our ruling, which is based on Muransky’s pleading of a statutory violation. He
pleaded nothing about any specific risks from the sequence of numbers included on
his receipt, and did not address the issue before the district court at any time. It
4
Muransky, we note, does not offer this factual assertion to show that he has or can plead an
elevated risk of identity theft, but as support for his argument that we should defer to Congress’s
judgment of risk.
30
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 31 of 148
was his burden to satisfy the court that standing exists, and thus to plead something
more than a conclusory allegation of harm. If anything about Godiva’s violation
subjected him to an increased risk of identity theft, it was Muransky’s burden to
tell the court about it.
Perhaps before Spokeo there was an argument that Muransky’s claim could
have survived as pleaded, but now his allegation—consisting of nothing more than
a “bare procedural violation, divorced from any concrete harm”—is too thin to
survive. Spokeo, 136 S. Ct. at 1549.
3.
The conclusion we reach here—that Muransky has alleged neither a harm
nor a material risk of harm—is in accord with the majority of other circuits to
consider this same question. The Second, Third, and Ninth Circuits have each
considered FACTA violations involving partially truncated credit-card numbers.
All three concluded that the violation created neither a harm nor a material risk of
harm. See Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 106, 119 (3d Cir. 2019);
Noble v. Nevada Checker Cab Corp., 726 F. App’x 582, 583–84 (9th Cir. 2018)
(unpublished); Katz v. Donna Karan Co., LLC,
872 F.3d 114, 117, 121 (2d Cir.
2017). Two out of the three, we should add, were dismissed on the pleadings
without considering extrinsic evidence—just like this case will be. Similarly, after
Spokeo, every circuit to have considered a FACTA violation involving an
undeleted expiration date has held that, without more, it does not confer standing.
See Bassett v. ABM Parking Servs., Inc.,
883 F.3d 776, 783 (9th Cir. 2018);
31
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 32 of 148
Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 81–82 (2d Cir. 2017);
Meyers v. Nicolet Rest. of De Pere, LLC,
843 F.3d 724, 727 (7th Cir. 2016).5
The only circuit to conclude that a bare violation of FACTA’s receipt
requirements could support standing reached that conclusion on significantly
different facts. Last year, the D.C. Circuit considered a case where a merchant
printed the entire credit card number, as well as the expiration date, on a
customer’s receipt. Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1066 (D.C.
Cir. 2019). Because the merchant “printed all of the information in both
categories” it created “the nightmare scenario FACTA was enacted to prevent” and
provided “sufficient information for a criminal to defraud her.”
Id. That factual
scenario is different than the violation Muransky complains about, and we do not
consider it here.
4.
Because Muransky has failed to allege either a harm or a material risk of
harm stemming from the FACTA violation, he lacks standing to bring this lawsuit.
And because federal courts are “powerless to approve a proposed class settlement”
if “no named plaintiff has standing,” we necessarily conclude that the district court
acted without jurisdiction. Frank, 139 S. Ct. at 1046. Accordingly, “we have
jurisdiction on appeal, not of the merits but merely for the purpose of correcting
the error of the lower court in entertaining the suit.” Steel Co. v. Citizens for a
5
Contrary to our dissenting colleague’s assertion, neither we nor our sister circuits have
“misread[] FACTA” any more than the Supreme Court misread FCRA when it required the
plaintiff in Spokeo to plead something beyond the violation of that statute. Wilson Dissent at 36.
We seek only to ensure that the plaintiff has, as he must under the Constitution, an actual
controversy rather than a theoretical one.
32
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 33 of 148
Better Env’t, 523 U.S. 83, 95 (1998) (citation omitted). The proper remedy is for
us to remand to the district court for a dismissal without prejudice. Stalley ex rel.
United States v. Orlando Reg’l Healthcare Sys., Inc.,
524 F.3d 1229, 1232, 1234–
35 (11th Cir. 2008).
Muransky complains that at “no time in the district court proceedings was
standing challenged” and suggests that standing was only “mentioned . . . at the
final approval hearing.” Those statements are not completely right. But even if
they were, our decision would not change. As we have said before, it “is not unfair
to require every plaintiff to file a complaint which contains sufficient allegations of
standing.” Church v. City of Huntsville, 30 F.3d 1332, 1336 (11th Cir. 1994).
That lack of unfairness is particularly acute here, where the plaintiff was
aware from the very beginning that his standing was in question and was critical to
the success of his claim. In its answer to the complaint, one of Godiva’s defenses
was that “[n]either Dr. Muransky nor any member of the proposed class has
suffered any injury in fact” and that they “lack standing to prosecute their alleged
claims.” With this defense in the backdrop, both Muransky and Godiva admitted
that Spokeo was a driving force in their settlement negotiations. Muransky himself
admitted that the impending decision in Spokeo, “depending on the outcome, could
have resulted in the case’s dismissal for failure to present an injury in fact.” And
of course, Isaacson raised the Spokeo decision at the fairness hearing and urged the
district court to exercise its obligation to assure itself of standing. Indeed, though
it is rare, from time to time plaintiffs have even filed affidavits in this Court to firm
33
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 34 of 148
up standing allegations. See Ouachita Watch League v. Jacobs, 463 F.3d 1163,
1170 (11th Cir. 2006). No such attempt was made here.
At any point in this series of events, Muransky could have confronted the
standing issue head on, or requested leave to amend his complaint. We do not
think it is too much to ask that litigants who are aware that their allegations may
not satisfy constitutional standing requirements take the time to firm up those
allegations—if it is possible to do so—before an en banc circuit court confirms
their suspicions of inadequacy. This is not a case where a surprise standing issue
was thrust upon an unaware plaintiff.
Because no court has had the opportunity to consider any facts supporting
Muransky’s conclusory allegation of harm, we cannot say that no one could ever
show standing for a similar procedural violation. In fact, Muransky himself could
try to do so, because we are dismissing his claim without prejudice. But for now,
Muransky has not alleged any facts to support his claim beyond that of a bare
procedural violation. That is not enough.
We close with this. One of our dissenting colleagues suggests that
Muransky and his counsel should have yet another opportunity on remand to plead
or demonstrate harm—one last bite at the apple. See Jordan Dissent at 97, 100.
The problem with that solution—even setting aside that the parties have been
aware of the potential standing infirmities from the start—is that Muransky has
never asked for it. Not before the panel, and not before our full Court. Instead, he
and his counsel have pressed for their preferred theory of standing: “the violation
of Dr. Muransky’s substantive FACTA rights, by itself, is a concrete injury.”
34
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 35 of 148
Muransky, for whatever reason, has never sought to replead or prove standing
under a different theory. We defer to the parties on how to litigate their claims,
and decline to offer them a solution they have not sought. Because, under Spokeo,
the bare statutory violation pleaded by Muransky on behalf of the class is not
sufficient, we dismiss his claims.
* * *
Muransky has alleged that a cashier handed him a receipt containing some of
his own credit card information printed on it. Although the receipt violated the law
because it contained too many digits, Muransky has alleged no concrete harm or
material risk of harm stemming from the violation. Because this amounts to
nothing more than a “bare procedural violation, divorced from any concrete harm,”
Muransky has failed to allege that he has standing to bring this lawsuit. Spokeo,
136 S. Ct. at 1549. And in the absence of a named plaintiff with standing, neither
this Court nor the district court has jurisdiction over this case. We therefore
VACATE the order of the district court and REMAND with instructions to
dismiss without prejudice.
35
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 36 of 148
WILSON, Circuit Judge, dissenting:
The Fair and Accurate Credit Transactions Act is a bipartisan marvel. Built
in the shadow of the credit-card boom, the Act—known as FACTA—passed in
Congress with staggering support. Days later, President George W. Bush lauded
the bill in the Roosevelt Room for “protecting our citizens by taking the offensive
against identity theft.” Credit Transactions Act Signing, C-SPAN (Dec. 4, 2003),
https://www.c-span.org/video/?179442-1/credit-transactions-act-signing. The
bill’s “offensive” includes the truncation requirement, which made it the law that
no business may print more than the last five digits of their customers’ credit or
debit card number on store receipts. President Bush extolled that the truncation
requirement “will help prevent identity theft before it occurs.” Id. (emphasis
added). To enforce the new rule, FACTA imposed steep statutory penalties for
businesses that play fast and loose with this sensitive information.
Today this court misreads FACTA and dilutes core protections provided by
Congress. FACTA’s truncation requirement protects against both actual identity
theft and a consumer’s interest in using a credit or debit card without incurring any
heightened risk of identity theft. By assuming that the truncation requirement
redresses only actual identity theft and nothing more, the majority overlooks that
FACTA protects against a point-of-sale harm—the consumer suffers a heightened
risk of identity theft the moment the business prints an untruncated receipt. The
36
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 37 of 148
court’s mistake all but ensures that consumers in the Eleventh Circuit must now
allege, support, and prove that they suffered actual identity theft (or at least soon
will) because of a defendant’s FACTA violation in order to avail themselves of the
law’s protections. It is tough, though—and sometimes impossible—to trace an
identity thief. As a result, the majority’s decision essentially eviscerates this
statute in our circuit, stripping thousands of consumers who receive untruncated
receipts of a universally championed remedy.
Neither Article III nor Spokeo compel this result. Because Muransky
plausibly alleged that Godiva’s FACTA violation elevated his risk of identity theft
the moment the receipt was printed, he has shown that the violation harmed a
concrete interest that FACTA protects. That is enough to satisfy standing at this
phase of the case, so I dissent.
I.
Article III standing has three well-worn requirements: injury in fact,
causation, and redressability. See Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61
(1992). This case turns on injury in fact. To satisfy that prong, the plaintiff must
show, among other things, that he has suffered an injury that is “concrete.”
Id. at
560. A concrete injury is a real one; it is not “hypothetical or speculative,” but in
fact exists. Salcedo v. Hanna,
936 F.3d 1162, 1167 (11th Cir. 2019). The standard
for establishing concrete injury climbs higher as the case inches forward. Lujan,
37
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 38 of 148
504 U.S. at 561. But when we analyze the plaintiff’s injury using only the
allegations in the plaintiff’s complaint, we take those allegations as true.
McElmurray v. Consol. Gov’t of Augusta-Richmond Cnty.,
501 F.3d 1244, 1251
(11th Cir. 2007). The allegations need not be specific; when we rely on the
complaint, “general factual allegations . . . will suffice.” MSPA Claims 1, LLC v.
Tenet Fla., Inc.,
918 F.3d 1312, 1318 (11th Cir. 2019). 1 The question is whether,
taking his allegations as true, the plaintiff has plausibly alleged a concrete injury.
Trichell v. Midland Credit Mgmt., Inc.,
964 F.3d 990, 996 (11th Cir. 2020).
For a while, many debated whether the violation of a statute inherently
creates a concrete injury under Article III. Compare Edwards v. First Am. Corp.,
610 F.3d 514, 517 (9th Cir. 2010) (holding that a statutory violation alone is
enough), with David v. Alphin,
704 F.3d 327, 338–39 (4th Cir. 2013) (holding that
a statutory violation alone is not enough). Spokeo, Inc. v. Robins put that debate to
bed. 578 U.S. ___,
136 S. Ct. 1540 (2016). As the majority explains, Spokeo held
that the violation of a statute does not always cause a concrete injury; “bare
1
The majority says that Muransky must “clearly and specifically” allege facts to survive a
standing analysis at the pleading stage. Majority Op. at 11. But that view neglects Lujan’s
statement that, “[a]t the pleading stage, general factual allegations of injury” can suffice, “for on
a motion to dismiss we presume that general allegations embrace those specific facts that are
necessary to support the
claim.” 504 U.S. at 561 (alteration accepted) (internal quotation mark
omitted). True, Muransky must provide specific facts when pressed at summary judgment.
Id.
But when we scan his standing based on just his complaint, we presume that his general factual
allegations contain the specific facts he needs.
38
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 39 of 148
procedural violation[s],” without more, are not enough. Id. at 1549. Rather, a
statutory violation must cause concrete harm.
Id. at
1548–49.
When does that happen? At first blush, it seems simple: a statutory violation
causes a concrete harm when it causes a real harm or a material risk of real harm.
See id. at 1548–50. But that simple statement begs a trickier question: What is a
“real harm”?
Spokeo states that there are two types of real harm: tangible and intangible.
See id. at 1549. A tangible harm is a palpable one, something that most would
know hurts without much thought. It is a harm painfully obvious—often
physically obvious—to the common observer (like losing money, a benefit, or a
job). See, e.g., Young Apartments, Inc. v. Town of Jupiter,
529 F.3d 1027, 1038
(11th Cir. 2008) (holding that a lost rent payment was a concrete injury for
standing purposes). These harms are almost always concrete. See Spokeo, 136 S.
Ct. at 1548–49.
An intangible harm, in contrast, is harder to define yet still offensive; it is
one that infringes on a person’s interests or rights (like infringement of your
freedom of speech or exercise of religion). See id. at 1549. Due to their
conceptual nature, not all intangible harms are “real” enough to be concrete.
In the statutory context, Spokeo explains how we should decide whether an
alleged intangible harm is concrete. See id. at 1549–50. First, we ask whether the
39
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 40 of 148
statute protects “concrete interests (as opposed to purely procedural rights).” See,
e.g., Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017) (Spokeo II)
(applying Spokeo), cert. denied,
138 S. Ct. 931 (2018) (mem.); see also Kamal v. J.
Crew Grp., Inc.,
918 F.3d 102, 112–13 (3d Cir. 2019) (same). Second, we ask if
the violation “actually harm[ed]” or “present[ed] a material risk of harm” to a
concrete interest that the statute protects. Spokeo
II, 867 F.3d at 1113; see also
Kamal, 918 F.3d at 112. If the answer to both questions is yes, the statutory
violation causes a concrete injury. Spokeo
II, 867 F.3d at 1113;
Kamal, 918 F.3d
at 112. 2
Muransky has established concrete injury under this test. FACTA protects
his concrete interest in using his credit or debit card without incurring a heightened
risk of identity theft. And Muransky plausibly alleged that Godiva’s violation in
fact heightened his risk of identity theft, harming an interest that FACTA protects.
2
I agree with the majority that the distinction between “substantive” and “procedural” rights is
semantical. The question is simply whether the violation harmed (or created a material risk of
harm to) a concrete interest. See Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 n.2
(7th Cir. 2016) (“[W]hether the right is characterized as ‘substantive’ or ‘procedural,’ its
violation must be accompanied by an injury-in-fact. . . . That is one of the lessons of Spokeo.”).
Sometimes that happens innately—the violation always harms an underlying concrete interest.
See Nayab v. Capital One Bank (USA), N.A.,
942 F.3d 480, 490 (9th Cir. 2019) (holding that
when “every” statutory violation “offends the interests that the statute protects,” plaintiffs need
not allege more harm to establish standing); see also Havens Realty Corp. v. Coleman,
455 U.S.
363, 373–74 (1982) (holding that a violation of a statute establishing “an enforceable right to
truthful information [about] the availability of housing” was such a statute, since the violation
always harmed the concrete interest in truthful information). But that is not always the case, and
thus we must decide for ourselves whether a violation harmed a concrete interest.
40
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 41 of 148
Because the violation actually harmed Muransky’s concrete interest, we need not
analyze whether the violation presented a material risk of harm.
II.
First up is the concrete interest. To decide whether a statute protects a
concrete interest, we look to “history and the judgment of Congress.” Spokeo, 136
S. Ct. at 1549. An interest is more likely to be concrete if it has a “close
relationship to a harm that has traditionally been regarded as providing a basis for a
lawsuit in English or American courts.”
Id. So too is an interest that Congress has
identified and judged as important and worth protecting. See
id. But the interest
need not pass both litmus tests: a substantial showing in either category can suffice
to establish a concrete interest. See Dreher v. Experian Info. Sols., Inc.,
856 F.3d
337, 345–46 (4th Cir. 2017) (noting that the lack of a common-law analog is “not
fatal” to a plaintiff’s standing if Congress has judged the interest as concrete);
Jeffries v. Volume Servs. Am., Inc.,
928 F.3d 1059, 1068 (D.C. Cir. 2019) (Rogers,
J., concurring in part and concurring in judgment) (agreeing that the defendant’s
alleged FACTA violation harmed a concrete interest because Congress identified
the interest as concrete, no matter if a common-law analog exists).
But even if Muransky had to clear both hurdles, he does so with space to
spare. Both Congress and history have established that a consumer has a concrete
41
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 42 of 148
interest in using a credit or debit card without incurring a heightened risk of
identity theft. See Jeffries, 928 F.3d at 1064–65 (majority opinion).
A.
Let’s start in Congress. Statutory text, legislative history, and public policy
make clear that Congress, in passing FACTA, recognized that consumers have a
concrete interest in using their cards without fear that each swipe will raise their
risk of identity theft.
Statutory Text. The surest mark of what Congress meant is what Congress
wrote. Three aspects of FACTA make clear that Congress thought that consumers
have an interest in avoiding the heightened risk of identity theft in addition to
avoiding actual identity theft.
The first is FACTA’s damages structure. The statute allows a consumer to
recover statutory damages whenever a business willfully prints more than the last
five digits of the consumer’s card number. 15 U.S.C. § 1681n(a)(1)(A). These
damages have no tie to actual identity theft; the consumer can recover them no
matter if he “ever becomes the victim of any crime.” Jeffries, 928 F.3d at 1064.
That damages scheme clashes with the majority’s take on FACTA’s
purpose. The majority assumes that FACTA guards against only the harm of
identity theft. See Majority Op. at 22 (claiming that the “harm Congress was
trying to prevent” through FACTA was stolen identity). But why would the statute
42
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 43 of 148
allow damages divorced from identity theft if its sole purpose were to combat
identity theft? It wouldn’t; it would instead bind FACTA’s damages scheme to the
harm of identity theft. So there must be a more nuanced method to Congress’s
madness—we interpret statutes “to avoid constitutional difficulties,” not create
them. Off. of Senator Mark Dayton v. Hanson, 550 U.S. 511, 514 (2007). That
method becomes clear once we accept that Congress enacted the statutory-damages
remedy to address a broader aim: to “decrease the risk that a consumer would have
his identity stolen.”
Jeffries, 928 F.3d at 1064 (alteration accepted) (emphasis
added). Its presence tells us that actual identity theft is not the only concern
driving FACTA. Rather, this statutory scheme also protects another interest, one
prone to harm even without identity theft: the consumer’s interest “in using [a]
credit [or] debit card[] without incurring an increased risk of identity theft.”
Id.
(emphasis added).
The second statutory clue is FACTA’s point-of-sale trigger. The statute
“imposes a truncation duty at the point of sale when identity theft cannot yet have
occurred.”
Id. at
1067 n.3. The cause of action that Congress created does not
become complete when the consumer suffers identity theft; it is complete well
before that, the moment the business prints out too many card digits. See 15
U.S.C. § 1681c(g)(1). If FACTA were concerned with just identity theft, though,
its penalty would not accrue at the point of sale (before identity theft can occur); it
43
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 44 of 148
would accrue at the point of identity harm (when one suffers harm from identity
theft). The point-of-sale trigger thus reveals that Congress sought to protect an
immediately harmed interest—the interest in avoiding the heightened risk of
identity theft. See Jeffries, 928 F.3d at 1064, 1067 n.3.
The last indication—perhaps the most telling—is FACTA’s statute of
limitations. The statute of limitations turns on the untruncated receipt alone. The
limitations period for a FACTA violation is two years from the discovery of the
untruncated receipt but not later than five years from the printing of the
untruncated receipt. 15 U.S.C. § 1681p. Identity theft plays no role in this
sequence—the statute is indifferent to when or whether identity theft occurs. We
must ask, then: If the statute aims to redress only the harm of identity theft, why is
its limitations period apathetic to the harm of identity theft? Wouldn’t the
limitations period run sometime after the theft occurs?
Indeed, an example reveals the catch-22 that awaits a FACTA claimant
under the majority’s one-track view of FACTA’s protected interest. Suppose you
purchase a box of chocolates from a Godiva Chocolatier. After paying for the box
with your credit card, you notice that the cashier handed you a receipt showing
more than the last five digits of your card number. Although this act violated the
statute, the majority says you cannot sue yet; FACTA protects against only the
harm of identity theft, and you have not yet felt the hurt. But assume that the
44
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 45 of 148
cashier remembers your number, jots it down, and lays in wait. Two years and a
day later, you learn that the cashier, using the information on your receipt, has
stolen your identity, racking up thousands in credit card debt. Now that you have
suffered actual identity theft, the majority would say that you still cannot sue. The
statute of limitations began when you discovered the printed receipt, and now it
has run.
If FACTA’s sole aim were to redress the harm of identity theft, that
limitations scheme would make no sense—it operates without regard for when (or
even if) identity theft occurs. But the limitations scheme makes perfect sense once
we accept that FACTA also seeks to protect a consumer’s interest in using a credit
or debit card without incurring the heightened risk of identity theft. See Jeffries,
928 F.3d at 1064–65. In Congress’s eyes, that harm can occur at the point of sale,
the moment Godiva prints an untruncated receipt. Accordingly, Congress
reasonably chose to start the clock the moment the consumer discovers this point-
of-sale injury.
Legislative History. The legislative history also confirms that FACTA
sought to do more than just redress actual identity theft. When Congress passed
FACTA, the crime of identity theft had “reached almost epidemic proportions.”
H.R. Rep. No. 108-263, 25 (2003). Consumers were “increasingly concerned
about the risk of their personal financial information falling into the wrong hands.”
45
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 46 of 148
Id. (emphasis added). In fact, a “hotline established by the Federal Trade
Commission to field consumer complaints and questions about identity theft
logged over 160,000 calls in 2002 alone.”
Id.
To ease these concerns, Congress found it “vitally important to address
measures which will help prevent identity theft” before it occurs. S. Rep. No. 108-
166, 8 (2003). The result was FACTA: a law designed to lessen consumer worries
by “limit[ing] the number of opportunities for identity thieves to ‘pick off’ key
card account information.”
Id. at
13; see also In re Zappos.com, Inc.,
888 F.3d
1020, 1027 (9th Cir. 2018) (“Congress has treated credit card numbers as
sufficiently sensitive to warrant legislation prohibiting merchants from printing
such numbers on receipts—specifically to reduce the risk of identity theft.”).
President Bush confirmed this purpose at the bill’s signing, noting that FACTA
would “help prevent identity theft before it occurs.” Credit Transactions Act
Signing, C-SPAN (Dec. 4, 2003), https://www.c-span.org/video/?179442-1/credit-
transactions-act-signing.
Not a shred of legislative history suggests that Congress wrote FACTA to
remedy only actual or inevitably impending identity theft. The history says just the
opposite. Congress’s focus on preventing identity theft before it occurs shows that,
in passing FACTA, Congress was concerned with more than just the actual harm
of identity theft. It believed that consumers have an interest in participating in the
46
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 47 of 148
market without increasing their chances of suffering identity theft. See Jeffries,
928 F.3d at 1064–65 (respecting Congress’s judgment that consumers have “an
interest in using their credit and debit cards without facing an increased risk of
identity theft”). We must defer to this legislative prerogative. See Spokeo, 136 S.
Ct. at 1549.
The majority takes a different view. It says that a later Clarification Act
makes clear that Congress’s “‘purpose’ was to protect ‘consumers suffering from
any actual harm’” from identity theft. Majority Op. at 5. But all Congress
recognized in the Clarification Act is that the failure to truncate an expiration date
does not pose “actual harm” to any interest. See Credit and Debit Card Receipt
Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(4)–(6), (b) (2008). In
contrast, Congress reiterated that “proper truncation of the card number, by
itself . . . prevents a potential fraudster from perpetrating identity theft or credit
card fraud.” Id. § 2(a)(6) (emphasis added). As a result, Congress “left the
truncation requirement and enforcement mechanism untouched,” affirming that the
failure to hide customers’ credit or debit card numbers can still put them in harm’s
way: it can heighten their risk of identity theft, a harm FACTA sought to prevent.
See
Jeffries, 928 F.3d at 1068 (Rogers, J., concurring in part and concurring in
judgment).
47
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 48 of 148
Public Policy. Good policy often flows from good sense, and it makes
sense why Congress identified the heightened risk of identity theft as a concrete
interest. For one, a higher risk of identity theft can lead to another concrete harm:
actual identity theft. See Redman v. RadioShack, Corp., 768 F.3d 622, 626 (7th
Cir. 2014) (“[T]he less information the receipt contains the less likely is an identity
thief who happens to come upon the receipt to be able to figure out the
cardholder’s full account information and thus be able to make purchases . . . .”).
For another, consumers are less likely to use credit cards if their transactions are
unprotected, hamstringing economic efficiency and consumer spending. And a
higher risk of identity theft can divert consumer resources toward theft-prevention
measures, rather than typical economic goods and services. So Congress had good
reason to recognize that freedom from the heightened risk of identity theft is itself
a concrete interest.
*
It is worth reporting the violence that the majority’s logic does to this
statute. The holding hiding behind its reasoning is that a plaintiff can enforce a
FACTA violation only if it causes (or will soon cause) harm from identity theft.
That view decimates the class that this statute sought to protect. FACTA of course
provides a remedy for those who suffer identity theft. But it also provides a
remedy for those who do not—it lets consumers recover damages at the point of
48
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 49 of 148
sale well before identity theft could occur. 15 U.S.C. §§ 1681c(g)(1),
1681n(a)(1)(A). We are supposed to construe FACTA so that this feature is not
“inoperative or superfluous, void or insignificant.” Corley v. United States, 556
U.S. 303, 314 (2009). But by shrinking FACTA to cover just those that suffer or
will soon suffer identity theft, the majority ignores this directive, rewrites the
statute, and blinks FACTA as Congress knew it out of existence.
I would take a different route. Congress passed FACTA to fight identity
theft, but it did not elevate this interest to the exclusion of all others. Another
interest—one just as important—was encouraging consumers to use their credit or
debit cards without fear that their usage would raise their risk of identity theft.
Because Congress identified this interest as important and worth protecting, we
should defer to its determination and dub the interest concrete. See Spokeo, 136 S.
Ct. at 1549.
B.
Congress’s thoughts on the matter are enough to cement Muransky’s interest
in avoiding the heightened risk of identity theft. See id. But if there were any
doubt, history also “tilts toward concreteness.”
Jeffries, 928 F.3d at 1064 (majority
opinion). Again, an interest is more likely to be concrete if it has a “close
relationship to a harm that has traditionally been regarded as providing a basis for
a lawsuit.” Spokeo
II, 867 F.3d at 1115. A consumer’s interest in engaging in
49
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 50 of 148
commerce without heightening his risk of identity theft fits that bill: it bears a close
relationship to an interest harmed in a common-law breach-of-confidence claim. 3
The tort of breach of confidence historically allowed a plaintiff to recover
against a party who failed to adequately protect a plaintiff’s confidential
information. See Alan B. Vickery, Breach of Confidence: An Emerging Tort, 82
Colum. L. Rev. 1426, 1427–28 (1982). It “is rooted in the concept that the law
should recognize some relationships as confidential to encourage uninhibited
discussions between the parties involved.” Young v. U.S. Dep’t of Just., 882 F.2d
633, 640 (2d Cir. 1989). The plaintiff in a breach-of-confidence claim relies on an
“assurance of secrecy . . . . in forming the relationship, and thereafter in revealing
what [he] would otherwise hold back.”
Vickery, supra, at 1428. For that reason,
an interest harmed in a breach-of-confidence case is the plaintiff’s “general interest
in the security of the confidential relationship and his corresponding expectation of
secrecy.”
Id. at
1434. An interest harmed in a FACTA case is the same: the
consumer expects the business to comply with FACTA and keep his card number
confidential. The failure to do so undermines the “security of the confidential
relationship” and the consumer’s “expectation” that his card number will stay
hidden. See
Vickery, supra, at 1434; see also
Jeffries, 928 F.3d at 1065. And
3
The majority assumes that the breach-of-confidence tort is old enough to serve as a historical
analog. I do the same and note that there is good cause for that assumption. See Corliss v. E.W.
Walker Co.,
64 F. 280, 281–83 (C.C.D. Mass. 1894) (discussing the breach-of-confidence tort).
50
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 51 of 148
because of the breach, the consumer is more “likely to remain silent in
circumstances that would otherwise call for frankness,” see Vickery, supra, at
1434, precisely the type of economic inefficiency Congress sought to avoid
through FACTA. See, e.g., H.R. Rep. No. 108-263, 23 (noting that “[o]ne of the
hallmarks of the modern U.S. economy is quick and convenient access to
consumer credit”).
The majority fires two shots at this historical connection, but neither lands.
It first argues that a FACTA violation does not track the typical elements of a
breach-of-confidence claim, as a FACTA claim does not require disclosure to a
third party. See Majority Op. at 26. This argument fails on two levels.
To start, a statutory harm need not “exactly track[ a] common law” analog to
be concrete. See Spokeo II, 867 F.3d at 1115. Nor must the violation “give rise to
a cause of action under common law.” Susinno v. Work Out World Inc.,
862 F.3d
346, 351 (3d Cir. 2017). Rather, the harm need only bear a “close relationship to a
harm that has traditionally been regarded as providing a basis for a lawsuit,” so that
it is similar “in kind and in degree.”
Salcedo, 936 F.3d at 1171 (emphasis added).
If a plaintiff had “to satisfy every element of a common law cause of action before
qualifying for statutory relief, Congress’s power to ‘elevate intangible harms’ by
defining injuries and chains of causation” that create a “‘case or controversy where
none existed before’ would be illusory.”
Trichell, 964 F.3d at 1010 (Martin, J.,
51
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 52 of 148
concurring in part and dissenting in part) (alteration accepted) (quoting Spokeo,
136 S. Ct. at 1549); see also Spokeo
II, 867 F.3d at 1115; Steel Co. v. Citizens for a
Better Env’t,
523 U.S. 83, 102 (1998) (holding that judicial power extends to
“cases and controversies of the sort traditionally amenable to, and resolved by, the
judicial process” (emphasis added)). So even if “there are differences between
[FACTA’s] cause of action and those recognized at common law, the relevant
point is that Congress has chosen to protect against a harm that is at least closely
similar in kind to others that have traditionally served as the basis for lawsuit.” See
Spokeo
II, 867 F.3d at 1115. Assurance that a plaintiff’s confidential disclosure
will remain hidden and will not spike his risk of injury lies at the heart of both a
FACTA claim and a breach-of-confidence claim. So FACTA’s underlying interest
has a historical partner. See
id. (holding that the Fair Credit Reporting Act
protected against a harm bearing a close relationship to the harm suffered in a
defamation suit, even though the elements of the claims did not match).
Another reason: the element of third-party disclosure is not inextricably tied
to the harms underlying a breach-of-confidence claim. To the contrary, a
“seemingly innocuous or limited disclosure may nevertheless injure the wronged
party directly because of the special significance that the party attaches to the
information.” Vickery, supra, at 1434 n.29. And “even if the disclosure is
innocuous, the wronged party may well fear future disclosures of more damaging
52
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 53 of 148
information.” Id. In other words, the “harm in a breach-of-confidence case occurs
when the plaintiff’s trust in the breaching party is violated, whether or not the
breach has other consequences.”
Jeffries, 928 F.3d at 1064 (internal quotation
mark omitted). In the FACTA context, the business breaches that trust when it
prints more than five card digits, harming the consumer’s expectation that his
disclosure will not increase his chances that a thief will uncover his card number.
That harm occurs at the point of sale, no matter if a third party ever sees the
receipt. See
id. at 1064–65.
Next up, the majority says that the harms do not match because Muransky
does not have a confidential relationship with Godiva. Majority Op. at 27. In the
majority’s eyes, breach of confidence involves “close professional relationships,”
like that between a doctor and a patient. Id. The majority claims that a customer-
merchant relationship does not create similar secrecy duties.
Id.
That oversimplifies the situation. The exchange of card information
between a customer and merchant no doubt triggers a confidential relationship.
The “essential ingredients of what can be termed a ‘confidential relationship’” are
“the assurance of secrecy and the reliance it evokes.”
Vickery, supra, at 1428. A
consumer paying with a credit or debit card would naturally believe that the
merchant will keep his card number secret—a belief that FACTA codified. And
that belief spurs consumer spending, as it lets the consumer breathe easy knowing
53
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 54 of 148
that his card information will stay safe throughout the transaction. So a typical
card transaction has both assurance and reliance—the key triggers of
confidentiality.
Legal elements aside, that relationship stands on common sense. Few would
say that confidential financial information is less sensitive than confidential
medical or legal information. For this reason, scholars have noted that “given their
relationship to consumers, the holders of consumer data in commercial transactions
should be labeled with a distinct term: data confidants.” Alicia Solow-Niederman,
Beyond the Privacy Torts: Reinvigorating A Common Law Approach for Data
Breaches, 127 Yale L.J.F. 614, 625 (2018). So just as governing ethical standards
recognize a “relationship of trust” between a doctor and her patient or a lawyer and
her client, FACTA’s truncation requirement recognizes “a similar relationship of
trust between consumer and merchant, requiring the merchant to safeguard the
consumer’s credit or debit card information.” Jeffries, 928 F.3d at 1064–65.
Bottom line: customer and merchant do share a confidential relationship.
All things said, a FACTA violation and a breach-of-confidence tort each
concretely harm the plaintiff’s expectation that his confidential disclosure will be
protected. For FACTA specifically, the harmed interest is the consumer’s
expectation that his credit card purchase will not heighten his risk of identity theft.
See id. Because this interest is “similar in kind” and bears a “close relationship” to
54
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 55 of 148
the interest harmed in a breach-of-confidence case, see Spokeo II, 867 F.3d at
1115, history settles that this interest is concrete. See
Jeffries, 928 F.3d at 1064–
65.
III.
Since FACTA protects Muransky’s concrete interest in using his credit or
debit card without incurring the heightened risk of identity theft, all that’s left is
whether Muransky plausibly alleged that Godiva’s FACTA violation “actually
harm[ed]” or “present[ed] a material risk of harm” to this interest. See Spokeo II,
867 F.3d at 1113; see also
Kamal, 918 F.3d at 112. He did—he alleged that
Godiva’s violation in fact heightened his risk of identity theft. So he has pled
“actual[] harm” to an interest that FACTA protects. See Spokeo
II, 867 F.3d at
1113.
Muransky alleged two core facts in his complaint: (1) Godiva violated
FACTA when it printed 10 digits of his card number, and (2) this violation
“elevated his risk of identity theft.” Both statements are facts, not legal
conclusions. So we must accept them as true when analyzing standing at this
stage, because “[w]ithout the benefit of discovery, we are not in a position to
55
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 56 of 148
second guess the harm [he] allege[s].” See Debernardis v. IQ Formulations, LLC,
942 F.3d 1076, 1090 (11th Cir. 2019) (Sutton, J., concurring). 4
Accepting these facts as true, Muransky has alleged that Godiva’s FACTA
violation harmed his interest in avoiding a heightened risk of identity theft the
moment the violation occurred. His harm is not one that might happen in the
future (so that we would need to analyze whether he alleged a material risk of real
harm); it is a real harm to a concrete interest, one that Muransky adequately alleges
happened the moment Godiva printed the untruncated receipt. See Spokeo II, 867
F.3d at 1118 (explaining that the material-risk-of-harm standard plays no role
when the complaint alleges that “the challenged conduct and the attendant injury
have already occurred”). Whether Muransky can prove down the road that
Godiva’s FACTA violation heightened his risk of identity theft is another matter.
See
Lujan, 504 U.S. at 561 (noting that the plaintiff’s burden of proof increases as
the case advances). For now, it is enough that he alleged that the violation harmed
his interest in using his card without suffering a heightened risk of identity theft.
See
McElmurray, 501 F.3d at 1251.5
4
The majority is thus wrong to say that Muransky alleged a “pure statutory violation.” Majority
Op. at 2. If that were so, he would not have alleged another fact—that Godiva’s FACTA
violation raised his risk of identity theft. He would have instead said that Godiva printed the
receipt, violating FACTA—period. Because he alleged additional facts, we must take him at his
word that he suffered additional harm.
5
Because Muransky alleges a direct harm, the majority’s focus on whether Muransky alleged a
material risk of identity theft is irrelevant (and for the same reason, I diverge from my dissenting
56
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 57 of 148
To sidestep this conclusion, the majority calls Muransky’s complaint
conclusory. It says that it need not accept Muransky’s allegation that Godiva’s
violation increased his risk of identity theft because he has not given specific facts
to explain how the violation did so. But we have said time and again that a
plaintiff’s allegation of injury need not be specific at the pleading stage—“general
factual allegations . . . will suffice.” MSPA Claims, 918 F.3d at 1318. At this
stage, Lujan tells us to presume that Muransky’s “general allegations embrace
those specific facts that are necessary to support the
claim.” 504 U.S. at 561; see
also Wilding v. DNC Servs. Corp.,
941 F.3d 1116, 1124 (11th Cir. 2019) (applying
this rule), cert. denied, 590 U.S. ___,
140 S. Ct. 2828 (2020) (mem.).
Article III does not command Muransky to provide these facts at the
pleading phase; Lujan says that is what discovery is for. See 504 U.S. at 561; see
also
Debernardis, 942 F.3d at 1090 (Sutton, J., concurring). Based on this
principle, we routinely accept general factual allegations on the promise that
specific support will come later. See, e.g.,
Debernardis, 942 F.3d at 1085
colleague’s discussion of materiality). See infra at 75–78. Our job when analyzing a direct-
harm theory is not to decide whether the violation “materially” harmed the statutory interest; our
job is to decide whether the violation “actually harm[ed]” the statutory interest. See Spokeo
II,
867 F.3d at 1113, 1118. FACTA protects Muransky’s concrete interest in using his card
“without incurring an increased risk of identity theft,” see
Jeffries, 928 F.3d at 1066, and
Muransky claimed that he suffered an increased risk at the point of sale. That is an alleged
actual harm, not an alleged material risk of actual harm, so materiality plays no role. The only
question is whether he has alleged enough facts to plausibly establish direct harm at the pleading
stage.
57
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 58 of 148
(majority opinion) (accepting “at the motion to dismiss stage” the general
allegation that a “dietary supplement that is deemed adulterated and cannot
lawfully be sold has no value”). It is inconsistent that the majority demands those
specifics from Muransky right now.
IV.
To close, I note that the majority’s cases are not persuasive for a mix of
reasons. Some cases dealt with a different truncation failure: the failure to truncate
the expiration date—a violation that Congress judged as not creating concrete
harm. See, e.g., Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 777 (9th Cir.
2018); Crupar-Weinmann v. Paris Baguette Am., Inc.,
861 F.3d 76, 78 (2d Cir.
2017);
Meyers, 843 F.3d at 725. Another came with an evidentiary record (not on
an analysis of the complaint), in which the district court found that the violation
there did not harm or raise a material risk of harm to a concrete interest. Katz v.
Donna Karan Co., L.L.C.,
872 F.3d 114, 119–120 (2d Cir. 2017). And both Kamal
and Noble v. Nevada Checker Cab. Co., 726 F. App’x 582, 583–84 (9th Cir. 2018)
incorrectly determined that FACTA redresses only actual identity theft; the Ninth
Circuit also chose not to publish Noble, so the opinion is not precedential. See
Kamal, 918 F.3d at 115; Noble, 726 F. App’x at 583–84; see also
Jeffries, 928 F.3d
at 1067 n.3 (rejecting the Third Circuit’s position that “FACTA protects an interest
in avoiding actual identity theft, rather than increased risk of identity theft”).
58
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 59 of 148
Far more persuasive is the D.C. Circuit’s published opinion in Jeffries.
There, the D.C. Circuit considered most of the cases cited above and rejected their
reasoning. It held that FACTA protects a consumer’s interest in using a credit or
debit card without incurring an increased risk of identity theft. Jeffries, 928 F.3d at
1064–65. And then the court held that the FACTA violation alleged there harmed
that interest at the point of sale.
Id. at
1066–67. To be sure, the FACTA violation
there was worse than the one levied here: the defendant printed all 16 digits of the
plaintiff’s card number. But Jeffries did not turn on that fact; its reasoning extends
to this case just the same. As in Jeffries, the interest at issue is the consumer’s
interest in avoiding the increased risk of identity theft. And as in Jeffries, the
plaintiff has alleged that the FACTA violation in fact increased his risk of identity
theft, harming an interest that the statute protects. Like the court in Jeffries, we
should take the plaintiff at his word for now and hold that he has established
standing at this phase of the case.
* * *
The majority claims that Muransky “shut his eyes and closed his ears to the
requirements of Spokeo.” Majority Op. at 3. Yet the majority shuts its eyes and
closes its ears to the interest that FACTA protects. The statute protects
Muransky’s concrete interest in avoiding a heightened risk of identity theft. And
Muransky plausibly alleged that the moment Godiva printed the untruncated
59
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 60 of 148
receipt, he sustained an injury sufficient to confer standing to maintain a claim
under FACTA. The mistake the majority makes is to require anything more.
60
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 61 of 148
MARTIN, Circuit Judge, dissenting:
Not all statutory violations result in a concrete injury. The Supreme Court
told us so in Spokeo, Inc. v. Robins, 578 U.S. ___, 136 S. Ct. 1540 (2016).
Id. at
1547–48. Today, the majority extends this principle from Spokeo to conclude that
courts may ignore the judgment of Congress when assessing whether a party has
met the concreteness requirement of Article III. The majority opinion holds that a
receipt displaying ten digits of a customer’s credit card number does not pose a
material risk of identity theft, and therefore is not a concrete injury. The majority
says this means plaintiffs have no standing here, even though Congress established
the point of intolerable risk at more than the last five digits being displayed on a
receipt. Because Congress’s judgment is deserving of deference under these
circumstances, and because congressional judgment supports a finding of
concreteness, I respectfully dissent from the majority’s opinion.
Spokeo also tells us we may find concrete injury where a statutory violation
bears a close relationship to a type of harm that has traditionally been actionable at
common law. 136 S. Ct. at 1549. In contrast to the majority, I view Dr.
Muransky’s FACTA violation as bearing a close relationship to a common law
breach of confidence tort. I therefore respectfully dissent on this ground as well.
61
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 62 of 148
I.
In April 2015, Dr. David Muransky filed a class action lawsuit against
Godiva Chocolatier (“Godiva”), alleging that Godiva violated the Fair and
Accurate Transactions Act (“FACTA” or the “Act”), 15 U.S.C. § 1681c(g), when it
issued him a receipt containing the first six and last four digits of his card number.
His central claim is that by issuing him this receipt, Godiva willfully violated
FACTA, which, among other things, prohibits merchants from printing “more than
the last 5 digits of the credit card number . . . upon any receipt provided to the
cardholder at the point of the sale or transaction.” Id. § 1681c(g). He alleged in
his complaint that Godiva’s violation of FACTA’s truncation requirement exposed
him and the class members “to an elevated risk of identity theft.”
The majority opinion recounts the dense and winding path this case has
taken since filed. Maj. Op. at 5–9. I will briefly review this history as well. After
Dr. Muransky filed his complaint, the parties engaged in mediation, and reached an
agreement to settle the case for $6.3 million. Notice of the settlement was sent to
class members, and James H. Price and Alan Isaacson filed objections. At the
District Court’s fairness hearing, Mr. Isaacson, but not Mr. Price, challenged Dr.
Muransky’s standing. The District Court approved the settlement reached by the
class members and Godiva. Then, both Mr. Price and Mr. Isaacson challenged that
approval on appeal. Throughout this appeal, Mr. Isaacson has maintained his
62
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 63 of 148
argument that Dr. Muransky lacks standing, while Mr. Price has joined Dr.
Muransky in arguing that Dr. Muransky has standing.
For all its procedural complexity, this appeal presents only a simple
question. Did Dr. Muransky establish Article III standing by alleging a violation
of FACTA’s truncation requirement, based on a receipt showing 10 of the 16 digits
of his credit card? I believe he did.
II.
I begin, as I must, with the standard announced by the Supreme Court in
Spokeo. To satisfy the injury-in-fact requirement of Article III, a plaintiff must
allege an injury that is both “concrete and particularized,” as well as “actual and
imminent.” Spokeo, 136 S. Ct. at 1548. The discussion here is about the first of
these requirements: whether Dr. Muransky’s complaint alleges an injury that is
sufficiently concrete. The majority accurately recounts that an injury need not be
“tangible” to be concrete.
Id. at 1549. And even intangible injuries, such as the
“risk of real harm,” can satisfy Article III’s concreteness requirement.
Id. When
we are tasked with deciding whether an intangible injury is sufficiently concrete,
Spokeo tells us that “both history and the judgment of Congress” inform our
analysis.
Id. On this much, the majority and I agree.
Absent from the majority opinion, however, is the mention of another
command from Spokeo. It tells us that when a statutory right itself protects a
63
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 64 of 148
concrete interest, a plaintiff need not allege “any additional harm beyond the one
Congress has identified.” Id. In practical terms, a complaint alleging a statutory
violation, and nothing more, can be sufficient to establish standing at the pleading
stage, so long as the statutory violation itself protects a concrete interest. Strubel v.
Comenity Bank,
842 F.3d 181, 190–91 (2d Cir. 2016). And in determining
whether a statutory provision protects a concrete interest, we are guided by
congressional judgment and common law principles. See Perry v. Cable News
Network, Inc.,
854 F.3d 1336, 1340–41 (11th Cir. 2017) (holding that a plaintiff
alleging a violation of the Video Privacy Protection Act need not allege “any
additional harm beyond the statutory violation” because both congressional
judgment and common law support a finding of concreteness).
Focusing, for now, on Spokeo’s discussion of the role of Congress, the
Court recognized that congressional judgment is “instructive and important
because Congress is well positioned to identify intangible harms that meet
minimum Article III requirements.” Cordoba v. DIRECTV, LLC, 942 F.3d 1259,
1268 (11th Cir. 2019) (quotation marks omitted); see also Daniel Townsend, Who
Should Define Injuries for Article III Standing?, 68 Stan. L. Rev. Online 76, 81–83
(2015) (explaining that Congress is better positioned to gather facts and make
empirical judgments about whether a practice is injurious). And as the majority
recognizes, Congress may thus “elevat[e] intangible harms” by defining injuries
64
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 65 of 148
and chains of causation that will “give rise to a case or controversy where none
existed before.” Spokeo, 136 S. Ct. at 1549 (quotation marks omitted).
Where the intangible injury identified by Congress is a risk of harm, Spokeo
tells us that the risk must be “material.”
Id. at 1550. The majority “recognize[s]
that ‘material risk of harm’ is a somewhat indefinite term,” and says that in this
context, “material” means “important; essential; relevant.” Maj. Op. at 16 (citing
New Oxford American Dictionary (3d ed. 2010)). I agree. In Spokeo, the Court
gave us the example of including the wrong zip code on a credit report as one
insufficiently “material” risk of
harm. 136 S. Ct. at 1550. In the context of the
Fair Credit Reporting Act, which creates a statutory cause of action for
inaccuracies on credit reports, the Court puzzled about “how the dissemination of
an incorrect zip code, without more, could work any concrete harm.”
Id. Since the
concrete interest intended to be protected by the FCRA is avoiding the harms that
come from false credit reporting, it was not obvious to the Court how a mistaken
zip code was “essential” or “relevant” to that interest.
The majority suggests here that Spokeo did not “br[eak] new ground” on the
amount or type of risk required to establish standing. Maj. Op. at 16. I think it did.
Although several earlier Supreme Court decisions described the required level of
risk as “substantial” or “certainly impending,” Clapper v. Amnesty Int’l USA, 568
U.S. 398, 414 & n.5,
133 S. Ct. 1138, 1150 & n.5 (2013) (listing cases), Spokeo
65
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 66 of 148
did not include this description. See 136 S. Ct. at 1550. This was no accident.
The cases in which the Court described the necessary risk as “substantial” or
“certainly impending” did not address a statutory cause of action itself designed to
prevent future harm. See, e.g.,
Clapper, 568 U.S. at 401, 133 S. Ct. at 1143
(holding that certain attorneys and organizations did not have standing to challenge
the constitutionality of a provision of the Foreign Intelligence Surveillance Act of
1978). With this in mind, the Third Circuit recognized that the Supreme Court
decided in Spokeo to require a lesser magnitude of risk for statutory injuries in
order to “strike[] a balance between Congress’s power to define injuries . . . and
the requirement that—absent a statutory right of action—a threatened harm be
certainly impending or based on a substantial risk of harm to amount to injury in
fact.” Kamal v. J. Crew Grp., Inc.,
918 F.3d 102, 113 n.4 (3d Cir. 2019) (citation
and quotation marks omitted).
I also part ways with the majority in its explanation of how courts decide
whether the risk of harm identified by Congress is sufficiently material for Article
III purposes. While the majority acknowledges that congressional judgment plays
a role in identifying intangible injuries of the “direct” variety (for example,
interference with free speech or free exercise rights), it effectively concludes that
congressional judgment plays no role when identifying whether a prohibited
practice presents a risk of real harm. Maj. Op. at 27–29. The implication of this
66
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 67 of 148
holding is that when courts are confronted with prophylactic legislation designed to
reduce a risk of harm from occurring—like the statute at issue here—we operate
with a blank canvas in deciding whether the risk of harm is sufficiently material.
Id. at 16. I don’t think this approach can be reconciled with Spokeo’s command
that the “judgment of Congress” plays an important role in determining whether an
injury satisfies Article III’s concreteness
requirement. 136 S. Ct. at 1549. And
while it is surely the courts, and not Congress, that are ultimately responsible for
deciding whether an injury is sufficiently concrete under Article III, our role does
not require or allow us to ignore the judgment of Congress entirely.
It is these principles that frame the concreteness inquiry here. Dr.
Muransky’s complaint alleges that Godiva violated FACTA’s truncation
requirement when it issued him a receipt that displayed the first six and the last
four digits of his credit card number. He says he suffered irreparable harm from
Godiva’s violation of the truncation requirement because it “exposed [him] to an
elevated risk of identity theft.” This Court must therefore decide whether the risk
of identity theft that Dr. Muransky suffered on account of Godiva’s FACTA
violation constitutes a concrete injury. And in making this determination, this
Court must consider whether congressional judgment and the common law support
a finding of concreteness under these circumstances.
67
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 68 of 148
II.
A.
First, the judgment of Congress. When it enacted FACTA, Congress
prohibited merchants from printing “more than the last 5 digits of the card number
or the expiration date upon any receipt provided to the cardholder.” 15 U.S.C.
§ 1681c(g)(1). FACTA provides that any merchant willfully violating this
requirement is liable for “any actual damages sustained by the consumer . . . or
damages of not less than $100 and not more than $1,000.” Id. § 1681n(a)(1)(A).
While Congress’s creation of a statutory cause of action certainly evinces a
judgment that violations of the truncation requirement cause harm, Spokeo tells us
that this fact alone is not sufficient to satisfy Article III’s standing requirements.
See 136 S. Ct. at 1547–48. Congress’s decision to sanction lawsuits for violations
of the truncation requirement is therefore only the starting point of the inquiry into
Congress’s judgment.
We go next, then, to the history of FACTA. That history confirms that
Congress considered the violation at issue here—a receipt displaying the first six
and last four digits of the customer’s credit card—to pose a material risk of identity
theft. When it enacted FACTA, Congress sought to “protect[] consumers from
identity theft.” Harris v. Mexican Specialty Foods, Inc., 564 F.3d 1301, 1306
(11th Cir. 2009); see also S. Rep. 108-166 at *6 (Oct. 16, 2003) (observing that
68
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 69 of 148
FACTA was enacted to address “the emergence and impact of identity theft on the
credit granting and reporting systems”). FACTA was necessary, Congress found,
in light of the increased use of credit in the late 1990s and early 2000s, which
“create[d] a target-rich environment for . . . sophisticated criminals, many of whom
are organized and operate across international borders.” S. Rep. 108-166 at *8; see
also Credit and Debit Card Receipt Clarification Act of 2007 (“Clarification Act”),
Pub. L. No. 110-241, § 2(a)(1), 122 Stat. 1565, 1565 (finding that “the purpose[]”
of FACTA is to “reduce identity theft and credit card fraud”). When he signed
FACTA into law, President George W. Bush echoed Congress’s findings. He
stated that “this law will help prevent identity theft before it occurs, by requiring
merchants to delete all but the last five digits of a credit card number on store
receipts.” Remarks on Signing the Fair and Accurate Credit Transactions Act of
2003, 39 Weekly Comp. Pres. Doc. 1746, 1748 (Dec. 4, 2003); see also S. Rep.
108-166 at 6 (concluding that the truncation requirement “limit[s] the number of
opportunities for identity thieves to ‘pick off’ key card account information”).
The history of FACTA following its initial enactment confirms that
Congress considered the type of violation at issue here to pose a material risk of
harm. After FACTA’s truncation requirement went into effect, “hundreds of
lawsuits were filed” alleging that merchants violated FACTA by “fail[ing] to
remove the expiration date” as required by 15 U.S.C. § 1681c(g)(1). Clarification
69
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 70 of 148
Act § 2(a)(4). In June 2008, the Clarification Act became law, and gave amnesty
to merchants who printed a card’s expiration date in the years since FACTA was
enacted. Id. § 3(a). Congress gave this amnesty because a complaint alleging a
mere violation of the expiration date requirement did not “contain[] an allegation
of harm to any consumer’s identity.”
Id. § 2(a)(5). Notably, while Congress was
at it, it gave no amnesty to merchants who printed more than the allowed number
of digits. See
id. § 3(a). Rather, Congress observed that “[e]xperts in the field
agree that proper truncation of the card number, by itself as required by [FACTA],
. . . regardless of the inclusion of the expiration date, prevents a potential fraudster
from perpetrating identity theft or credit card fraud.”
Id. § 2(a)(6). By granting
amnesty only as to the expiration date, the Clarification Act sought to curtail
“abusive lawsuits” concerning a requirement that “do[es] not protect consumers.”
Id. at § 2(b).1
This demonstrates that, while Congress did not consider all violations of the
truncation requirement to pose a serious threat to consumers, it maintained its
concern about the violation pled here—a receipt showing more than the last five
digits of a card number—to entail material risk of identity theft. Congress’s view
1
The majority reads the Clarification Act to imply that the FACTA violation alleged here was
not concrete, because of its acknowledgment that some FACTA claims do not cause “actual
harm.” Maj. Op. at 28. To the contrary, the fact that the Clarification Act left the digit
truncation requirement in place while granting amnesty for violations of the expiration date
requirement indicates that Congress continued to view the former as a category of FACTA
violations that cause “actual harm.” Clarification Act § 2(b).
70
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 71 of 148
was based on a finding that “[e]xperts in the field agree that proper truncation of
the card number, by itself” minimizes the risk of identity theft. Clarification Act
§ 2(a)(6). Congress’s judgment thus supports a finding of concreteness here. See
Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1066 (D.C. Cir. 2019) (noting
that, while “every FACTA violation [does not] create[] a concrete injury in fact,” a
receipt displaying a card’s entire number and expiration date caused concrete
injury because it was the “nightmare scenario” Congress sought to prevent).
As I said at the start, when a statutory violation itself protects a concrete
interest, a plaintiff need not allege anything more than a violation of the statute
itself. See Perry, 854 F.3d at 1340. Because the judgment of Congress supports a
finding of concreteness here, Dr. Muransky was not required to allege any
additional harm beyond the statutory violation alleged in his complaint. On this
basis alone, I would hold that Dr. Muransky established Article III standing.
B.
The majority opinion takes a dramatically different path. It starts by
eschewing any deference to congressional judgment in determining whether Dr.
Muransky’s FACTA violation entailed a sufficiently high risk of identity theft.
See Maj. Op. at 27–28. We cannot defer to Congress, the majority reasons, so we
must instead look to Dr. Muransky’s complaint to see if he has alleged facts
establishing that a receipt showing ten digits of a credit card number poses a risk of
71
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 72 of 148
identity theft.
Id. at 28–29. Although Dr. Muransky alleged that he suffered an
elevated risk of identity theft as a result of the FACTA violation at issue here, the
majority says that allegation “is simply not enough.” In so holding, the majority
assumes, without offering any explanation, that Dr. Muransky did not face a
“material risk, or significant risk, or substantial risk, or anything approaching a
realistic danger” due to the receipt at issue.
Id. at 29. This analysis errs at every
step.
To begin, the majority starts on incorrect footing by effectively concluding
that congressional judgment is owed no deference in deciding whether a risk of
harm clears the concreteness bar.2 Maj. Op. at 27–28. The majority says it is
required to do so because (1) Spokeo tells us that the creation of a statutory cause
of action does not automatically confer standing, and (2) courts have an
independent responsibility to decide whether a risk of harm meets the materiality
threshold. Id. Both of these premises are true, but neither lead to the conclusion
that courts may ignore the judgment of Congress.
2
The majority notes, in passing, that there is “good reason to doubt” that Congress’s judgment
supports a finding of materiality because Congress did not “specifically address the kind of
partial truncation that occurred in this case.” Maj. Op. at 28 (citing
Kamal, 918 F.3d at 115–16
n.5). What Congress said was that proper truncation—i.e., revealing no more than the last five
digits of a card—prevents the risk of identity theft, and Dr. Muransky’s receipt revealed more
than the last five digits. See Clarification Act § 2(a)(6). That Congress did not separately
address every possible fact scenario that could constitute a violation of the truncation
requirement does not dilute its judgment supporting a finding of concreteness here.
72
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 73 of 148
First, it is true that Spokeo told us “Congress cannot erase Article III’s
standing requirements by statutorily granting the right to sue to a plaintiff who
would not otherwise have standing.” 136 S. Ct. at 1547–48. This premise does
not, however, erase Congressional judgment from the equation entirely. Indeed,
Spokeo says quite the opposite. It notes that Congressional judgment is
“instructive and important” in determining whether an injury is concrete because
Congress “is well positioned to identify intangible harms that meet minimum
Article III requirements.”
Id. at 1549. I have already walked through the
application of these principles here. A violation of the truncation requirement is
not a concrete harm merely because Congress gave litigants the right to sue. It is a
concrete harm, however, because congressional factfinding in the FACTA context
lends significant support to the idea that a failure to adhere to the digit truncation
requirement results in a material risk of harm.
Relatedly, the majority repeats throughout its opinion that deference to the
judgment of Congress would mean, in practical terms, that “there is no violation of
FACTA that would not be” “enough to show standing.” Maj. Op. at 30. This is
not so, and we need not travel far for an example of why this is wrong. As set out
above, when Congress passed the Clarification Act, it expressed a judgment that
the expiration date requirement “do[es] not protect consumers” and does not result
in “consumers suffering from any actual harm.” Id. at § 2(b). So even though
73
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 74 of 148
FACTA continues to provide a statutory cause of action for violating the expiration
date requirement, see 15 U.S.C. § 1681c(g)(1), the judgment of Congress would
not lend itself to a finding of concreteness. Every one of our sister circuits to
consider the question of expiration dates has reached the same conclusion. See
Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 783 (9th Cir. 2018); Crupar-
Weinmann v. Paris Baguette Am., Inc.,
861 F.3d 76, 82 (2d Cir. 2017); Meyers v.
Nicolet Rest. of De Pere, LLC,
843 F.3d 724, 728–29 (7th Cir. 2016).
The next reason the majority gives for rejecting congressional judgment in
its evaluation of the risk of harm, is that federal courts have an “independent
responsibility” to “decid[e] whether a given risk . . . meets the materiality
threshold.” Maj. Op. at 28. Again, this principle is accurate. After all, federal
courts must satisfy themselves of Article III standing even where a plaintiff alleges
a statutory violation. See, e.g., Summers v. Earth Island Inst., 555 U.S. 488, 497,
129 S. Ct. 1142, 1151 (2009) (observing that the “requirement of injury in fact is a
hard floor of Article III jurisdiction that cannot be removed by statute”). But as set
out above, there is nothing incompatible with the court satisfying itself of an
injury’s concreteness, and considering the judgment of Congress at the same time.
Deference to congressional judgment does not mean “no role for the courts.” Maj.
Op. at 27. To the contrary, I see at least a couple ways in which federal courts
might complement, rather than erase Congress’s judgment.
74
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 75 of 148
First, as discussed here, courts can and should determine whether the
judgment of Congress in fact supports the conclusion that a risk of harm was
sufficiently material. In that regard, the history of FACTA supports a finding of
materiality as to Dr. Muransky’s allegations. I recognize there are circumstances
in which congressional judgment would not support a finding of concreteness, as
with violations of FACTA’s expiration date requirement. And I agree with the
view of the majority that it is the responsibility of courts to make that evaluation,
even in the face of a statutory cause of action. See, e.g., Jeffries, 928 F.3d at 1066
(concluding that a FACTA violation presented a sufficiently material risk of harm
in part because it was the “nightmare scenario” Congress sought to prevent in
enacting the statute).
Second, I acknowledge there are instances in which courts must themselves
determine whether a risk of harm is sufficiently material. In Spokeo, for instance,
the Supreme Court noted that not all FCRA violations result in a material risk of
harm to the concrete interests the protected by that statute. 136 S. Ct. at 1550. The
example I have already given comes from the Court’s observation that “[i]t is
difficult to imagine how the dissemination of an incorrect zip code, without more,
could work any concrete harm.”
Id. Whether a credit report containing inaccurate
personal information creates a risk of concrete harm is precisely the type of
standing question that is susceptible to this sort of commonsense analysis by
75
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 76 of 148
federal courts. See Robins v. Spokeo, Inc., 867 F.3d 1108, 1117 (9th Cir. 2017) (in
the context of an FCRA violation, concluding that inaccuracies concerning “age,
marital status, educational background, and employment history” present a
material risk of harm because this is “the type [of information] that may be
important to employers or others making use of a consumer report”).
After rejecting consideration of or giving weight to Congress’s judgment,
the majority concludes that the FACTA violation alleged in Dr. Muransky’s
complaint does not entail a material risk of harm, and so is not a concrete injury. It
assumes, without explanation, that Dr. Muransky’s allegation that he suffered an
elevated risk of harm from Godiva’s FACTA violation is not enough to meet the
materiality threshold because a receipt showing 10 of a card’s 16 digits does not
pose “anything approaching a realistic danger” of identity theft. Maj. Op. at 29. I
think this weighing of the facts goes too far. Some questions of materiality, like
whether an incorrect zip code on a credit report can cause harm, lend themselves to
such commonsense judgments. However, questions about the number of digits of
a credit or debit card an identity thief needs in order to steal one’s identity is not
one of them. And aside from the majority’s intuition about what card information
is (or is not) useful to identity thieves, there is nothing in the record of this case to
suggest that Congress was wrong when it decided that a FACTA violation of this
76
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 77 of 148
sort creates a material risk of identity theft. 3 In circumstances such as these—
where neither commonly held understandings nor the record undermine
congressional factfinding—Spokeo suggests that courts should be guided in their
risk analysis by the judgment of Congress. 136 S. Ct. at 1549 (observing that
“Congress is well positioned to identify intangible harms that meet minimum
Article III requirements”). On the issue of the number of digits that create risk,
Congress’s judgment, after hearing from experts on the matter, was that printing
anything more than the last five digits of a credit card number poses an intolerable
risk of harm to consumers. This judgment supports the conclusion that Dr.
Muransky faced a material risk of harm, and thus a concrete injury, when Godiva
printed a receipt showing the first six and last four digits of his credit card number.
3
Perhaps cognizant that this record is bereft of any factfinding on whether the risk posed by
Godiva’s FACTA violation is sufficiently material, Mr. Isaacson sought to fill this gap in two
ways. First, he argues on appeal that the first six digits of a card number equates to printing the
name of the card’s issuing institution. But just as a plaintiff cannot raise “[l]ate-breaking
allegations in unsworn briefs” to shore up standing, Maj. Op. at 30, neither can a defendant raise
factual contentions in an unsworn brief to disprove standing. And Mr. Isaacson’s brief presents
the only factual offering in this record about what these digits stand for. Second, Mr. Isaacson
asks us to rely on opinions by our sister circuits recognizing that the first six digits of a card
number identifies the issuing institution. Br. of Appellant Isaacson at 3 (citing Katz v. Donna
Karan Co.,
872 F.3d 114, 118 (2d Cir. 2017) (observing that the district court found on a factual
challenge to standing that printing the first six digits of a credit card number poses no risk of
identity theft)). Mr. Isaacson effectively asks us to take judicial notice of facts found in another
court’s opinion. This we may not do. See McIvor v. Credit Control Servs., Inc.,
773 F.3d 909,
914 (8th Cir. 2014) (“Judicial notice of another court's opinion takes notice of the existence of
the opinion, which is not subject to reasonable dispute over its authenticity, but not of the facts
summarized in the opinion.” (quotation marks omitted)).
77
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 78 of 148
I accept that Congress’s judgment as to the materiality of a risk is not
infallible. An example of this is the Second Circuit’s decision in Katz, 872 F.3d
114, which also involved a FACTA claim based on a receipt showing the first six
and last four digits of a credit card number.
Id. at 116. There, the defendant raised
a factual challenge to standing in a Federal Rule of Civil Procedure 12(b)(1)
motion to dismiss.
Id. at 119–20. As part of that motion, the defendant presented
extrinsic evidence supporting its argument that the first six digits of a credit card
number revealed only the cardholder’s issuing institution, and thus presented no
material risk of identity theft.
Id. The district court found in favor of the
defendant, and the Second Circuit concluded that the district court’s factual
ruling—that the first six digits identify only the card’s issuer—was not clearly
erroneous.
Id. at 120. Katz thus demonstrates how the introduction of extrinsic
evidence in the District Court may, in some circumstances, work to undermine
Congress’s judgment. Here, however, neither Mr. Isaacson nor Godiva raised any
factual challenge to Dr. Muransky’s standing in the District Court. For that reason,
no record was developed in this case like that available to the Second Circuit in
Katz. In the absence of record evidence suggesting that Congress misjudged the
number of card digits necessary to cause a material risk identity theft, we are left to
conclude that the FACTA violation at issue constitutes a concrete injury.
78
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 79 of 148
At the final step of its analysis, the majority says Dr. Muransky failed to
establish standing in his complaint because he pled only that he suffered a FACTA
violation. Maj. Op. at 29–30. Thus, the majority reasons, Dr. Muransky violated
the requirement that pleadings must contain more than conclusory allegations of
harm. Id. (citing Ashcroft v. Iqbal,
556 U.S. 662, 678–79,
129 S. Ct. 1937, 1949–
50 (2009)). But again, when a statute itself protects a concrete interest, an
allegation that the defendant violated that statutory requirement is anything but
conclusory. See
Spokeo, 136 S. Ct. at 1549 (concluding that where the statutory
right at issue itself protects a concrete interest, a plaintiff need not allege
“additional harm” beyond the statutory violation). Because the FACTA violation
alleged by Dr. Muransky itself constitutes a concrete harm, he was not required to
plead additional facts showing how a receipt revealing the first six and last four
digits of a credit card creates a risk of identity theft. 4
4
Dr. Muransky argues for the first time on appeal that he suffered an injury because, as a result
of Godiva’s FACTA violation, he was forced to safeguard his receipt to keep it from falling into
the hands of identity thieves. Br. of Appellee Muransky at 39–42. I agree with the majority that
Dr. Muransky cannot raise this new theory of standing at this late stage. Maj. Op. at 23 (citing
Salcedo v. Hanna,
936 F.3d 1162, 1173 (11th Cir. 2019)). I also agree with the majority that the
viability of Dr. Muransky’s safeguarding theory is in any event bound up in whether he faced a
material risk of harm.
Id. However, because I would hold that Dr. Muransky did face a material
risk of identity theft stemming from Godiva’s FACTA violation, I would also hold that Dr.
Muransky could have proceeded on his safeguarding theory had he raised it in his complaint.
79
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 80 of 148
III.
I return now to the lesson from Spokeo that courts deciding whether an
injury is sufficiently concrete should be guided by “history and the judgment of
Congress.” Spokeo, 136 S. Ct. at 1543. I have set out how the judgment of
Congress alone supports a finding of concreteness in this case. I now address how
history also strongly suggests that Dr. Muransky’s alleged injury is concrete.
Spokeo says courts may find an injury to be sufficiently concrete if the
“alleged intangible harm has a close relationship to a harm that has traditionally
been regarded as providing a basis for a lawsuit in English or American courts.”
Id. at 1549. In this circumstance, it is sufficient for a plaintiff, at the pleading
stage, to allege only a violation of the statutory right bearing a close relationship to
the common law harm. See
Perry, 854 F.3d at 1340–41 (finding a close
relationship between violations of the Video Privacy Protection Act and the tort of
intrusion upon seclusion). The match between the statutory violation and the tort
traditionally recognized at common law need not be perfect. See Golan v.
FreeEats.com, Inc.,
930 F.3d 950, 958 (8th Cir. 2019) (“An alleged harm need not
actually have been actionable at common law to satisfy this inquiry, rather it must
have a ‘close relationship’ to the type of harm that has traditionally been
recognized as actionable.”); Eichenberger v. ESPN, Inc.,
876 F.3d 979, 983 (9th
Cir. 2017) (recognizing a close relationship between a statutory violation and
80
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 81 of 148
common law tort where the statute “codifies a context-specific extension of
the substantive right to privacy” (emphasis omitted)).
I agree with Dr. Muransky that the injury asserted here bears a close
relationship to a common law breach of confidence tort. A breach of confidence
lies where a person offers private information to a third party in confidence, and
the third party discloses that information. Alan B. Vickery, Breach of Confidence:
An Emerging Tort, 82 Colum. L. Rev. 1426, 1427–28 (1982). The basic elements
of this tort are: “(1) the plaintiff conveyed confidential and novel information to
the defendant; (2) the defendant had knowledge that the information was being
disclosed in confidence; (3) there was an understanding between the defendant and
the plaintiff that the confidence be maintained; and (4) there was a disclosure or
use in violation of the understanding.” Berkla v. Corel Corp., 302 F.3d 909, 917
(9th Cir. 2002) (quotation marks omitted). The tort of breach of confidence “‘is
rooted in the concept that the law should recognize some relationships as
confidential to encourage uninhibited discussions between the parties involved.’”
Jeffries, 928 F.3d at 1064 (quoting Young v. U.S. Dep’t of Justice,
882 F.2d 633,
640 (2d Cir. 1989)).
A breach of confidence tort is not a perfect analogue to the FACTA violation
at issue here. As the majority notes, the two ways in which a breach of confidence
tort is distinguishable from the violation alleged by Dr. Muransky are (1) that a
81
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 82 of 148
breach of confidence requires a disclosure, and Dr. Muransky has not alleged his
credit card information was disclosed to anyone; and (2) the relationship between
Dr. Muransky and Godiva is not the prototypical confidential relationship giving
rise to breach of confidence torts. Maj. Op. at 26–27. The majority seems to think
this these differences make a breach of confidence tort ill-suited to the FACTA
violation at issue here. I think not.
To begin, history may support a finding of concreteness even if a plaintiff
cannot satisfy all the elements of a closely related tort. That is because, under
Spokeo, congressionally proscribed “conduct [need not] give rise to a cause of
action under common law.” Susinno v. Work Out World Inc., 862 F.3d 346, 351
(3d Cir. 2017) (quotation marks omitted). “If a plaintiff were required to satisfy
every element of a common law cause of action before qualifying for statutory
relief, Congress’s power to ‘elevate intangible harms’ by defining injuries and
chains of causation which will ‘give rise to a case or controversy where none
existed before’ would be illusory.” Trichell v. Midland Credit Mgmt., Inc.,
964
F.3d 990, 1010 (11th Cir. 2020) (Martin, J., concurring in part and dissenting in
part) (alterations adopted) (quoting
Spokeo, 136 S. Ct. at 1549)).
As to Dr. Muransky’s failure to allege that Godiva disclosed his credit card
information to a third party, Spokeo also recognized that a material risk of
intangible harm is sufficient to establish a concrete injury in fact. 136 S. Ct. at
82
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 83 of 148
1549. Here, the FACTA violation alleged by Dr. Muransky posed a material risk
that his identity would be stolen, which is “the very harm the breach of confidence
tort makes actionable—an unauthorized disclosure of privileged information to a
third party.”
Jeffries, 928 F.3d at 1065. Thus, the fact that Dr. Muransky did not
actually fall victim to identity theft does not preclude our court from finding that
the violation he alleged here bears a close relationship to a breach of confidence
tort.
And with respect to the relationship between Dr. Muransky and Godiva, I
recognize that the breach of confidence tort has historically applied to traditional
confidential relationships, like that between a customer and his bank. See, e.g.,
Suburban Trust Co. v. Waller, 408 A.2d 758, 761 (Md. Ct. App. 1979). But I see
no reason why a relationship between a consumer and a point-of-sale merchant
should not be viewed as confidential. When a consumer makes a purchase using a
credit or debit card, he provides confidential identifying information to a merchant.
In doing so, the consumer places trust in the merchant to safeguard that
information from potential identity thieves. 39 Weekly Comp. Pres. Doc. 1746,
1748 (noting that receipts printed by merchants “should not hold the key to [a
consumer’s] savings and financial secrets”). I therefore view the confidential
relationship been a consumer and a merchant as an appropriate “context-specific
83
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 84 of 148
extension” of a traditional breach of confidence tort. See Eichenberger, 876 F.3d
at 983.
For these reasons, I believe Dr. Muransky has alleged a concrete injury that
is closely related to a harm traditionally protected at common law. Therefore, he
was not required to allege any further harm beyond the FACTA violation asserted
in his complaint.5
IV.
Congress enacted FACTA in an effort to reduce the risk of identity theft by
requiring merchants to truncate credit card numbers on printed receipts, and in
doing so, set the tolerable level of risk at no more than the last five digits of a card
number. Dr. Muransky alleges he suffered a concrete injury when Godiva printed
the first six and last four digits of his card number. Both the common law and the
judgment of Congress support a conclusion that the FACTA violation alleged in
Dr. Muransky’s complaint constitutes a concrete injury in fact. I believe Spokeo
5
As the majority points out, Maj. Op. at 25, the parties dispute whether a breach of confidence
tort was “traditionally . . . regarded as providing a basis for a lawsuit in English or American
courts.” Spokeo, 136 S. Ct. at 1549. Dr. Muransky notes that English courts recognized the tort
as early as 1849, see Prince Albert v. Strange, 41 Eng. Rep. 1171 (Ch. 1849), while American
courts recognized the tort as early as 1894, see Corliss v. E.W. Walker Co.,
64 F. 280 (C.C.D.
Mass. 1894). Mr. Isaacson, meanwhile, cites an article that (a) described the tort as “emerging”
as of 1982; and (b) described the tort as “dy[ing] out in its infancy” in the United States, while
forming the “basis of an extensive body of law” in England. Vickery, 82 Colum. L. Rev. at
1452–54. I believe Dr. Muransky has the better of this argument. The fact that a tort did not
gain prominence in the United States until the 1980s does not mean it was not traditionally
regarded as providing a basis for suit. And Mr. Isaacson has failed to cite a single court decision
refusing to recognize a breach of confidence tort as actionable.
84
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 85 of 148
commands us to find that Dr. Muransky has satisfied the injury in fact requirement
of Article III. I therefore respectfully dissent.
85
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 86 of 148
JORDAN, Circuit Judge, dissenting:
I join the dissents of Judges Wilson and Martin. They each demonstrate, for
different reasons, that Dr. Muransky has Article III standing based on the allegations
of his complaint. I write to make two additional points, one procedural and one
substantive.
The procedural point is that, regardless of what one thinks about the
disagreement between the majority and the dissents on Article III standing, this case
should not be dismissed outright, and at most should be remanded for further
proceedings. Assuming for the sake of argument that the majority’s view of standing
is correct, Mr. Isaacson did not raise his standing argument until the fairness hearing,
and even then, he did so only obliquely. Supreme Court precedent and procedural
fairness dictate that Dr. Muransky have an opportunity to amend his complaint or
present facts in support of standing.
Not only is dismissal unfair to Dr. Muransky, but it requires the majority to
make assumptions about the risks of identity theft without the benefit of a factual
record, expert reports, or adversarial testing of the issue in the district court. The
majority essentially relies on its common sense to conclude that when a vendor prints
a receipt displaying the first six and last four digits of a credit card number, the risk
of identity theft is “remote.” But that is a fact-based and value-laden judgment,
which appellate courts are ill-equipped to make in the abstract.
86
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 87 of 148
The result of dismissing in this procedural context is problematic for another
reason. The majority does not and cannot explain what analysis or assumptions lead
to its conclusion of remoteness, and it fails to describe the standard it applies or
delineate the boundaries of Article III jurisdiction. The majority’s “I know it when
I see it” approach to standing, cf. Jacobellis v. Ohio, 378 U.S. 184, 197 (1964)
(Stewart, J., concurring), is a problem for future litigants and courts, especially in
data privacy cases, where the harm is perhaps difficult to quantify and describe, but
which Congress has nonetheless identified and attempted to prevent by legislation.
The second point, the substantive one, concerns the doctrine of Article III
standing. That we need to resolve what is essentially a policy question to determine
the boundaries of our subject-matter jurisdiction reminds us how far standing
doctrine has drifted from its beginnings and from constitutional first principles.
Standing, as we know it today, was a twentieth-century innovation. But to the extent
that the current doctrine can be reconciled with the Constitution, it is designed to
safeguard the separation of powers between the branches of government and ensure
that courts hear—in the words of James Madison—cases only “of a Judiciary
Nature.” Cases like this one, involving the alleged invasion of a congressionally-
created private right by a private party against another private party, do not implicate
structural or institutional concerns. They are exactly the type of cases suited for
initial congressional judgment and ensuing judicial resolution.
87
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 88 of 148
There has been a long tradition—before the Founding and after—of English
and American courts hearing cases involving the invasions or violations of private
legal rights, including new private rights created by statute, regardless of whether
the plaintiff could allege some injury beyond the invasion of the right itself. The
Supreme Court’s standing cases, from the early twentieth century to the present,
have not upset that tradition.
The better way to understand standing here is not through the lens of injury-
in-fact, but under the rights-based model that Justice Thomas and others have
outlined. That framework is grounded in the traditional distinction between public
and private rights, which early American jurists understood well, and which
perseveres in other areas of law. Properly rooted in history and tradition, this rights-
based framework harmonizes modern standing doctrine with Article III. It also
offers a straightforward and consistent method for resolving difficult standing
questions, such as the one presented here, which have been unnecessarily
complicated by a narrow focus on the injury-in-fact requirement.
Under this rights-based framework, Dr. Muransky easily alleged the invasion
of a private legal right—the right to receive a receipt truncating all but the last five
digits of his credit card number. That right was supposed to inure to his benefit
under a law that Congress enacted, and the violation itself was something that a
vendor did directly to him. The violation, in other words, was personal to him. By
88
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 89 of 148
requiring Dr. Muransky to demonstrate a separate injury in this context, we turn
Article III on its head.
I
To justify dismissal, the majority argues that “[t]his is not a case where a
surprise standing issue was thrust upon an unaware plaintiff.” I strongly disagree.
Dr. Muransky never had any reason to doubt that he met his burden to establish
standing, and he was led to believe that subject-matter jurisdiction was not an issue,
even after the Supreme Court decided Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).
To see why, we must review the district court proceedings in detail and without the
benefit of hindsight.
A
Dr. Muransky filed his complaint in June of 2015. He alleged that Godiva
printed a receipt displaying the last four and first six digits of his credit card number.
He claimed, correctly, that Godiva violated the FACTA, 15 U.S.C. § 1681c(g)(1).
And he asserted that the violation burdened him and putative class members with an
“elevated risk of identity theft”—the very risk that Congress sought to mitigate when
it enacted the FACTA.
When Dr. Muransky made these allegations, he was justified in believing they
were sufficient to establish Article III standing. The majority appears to concede
this point, acknowledging that “[p]erhaps before Spokeo there was an argument that
89
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 90 of 148
[Dr.] Muransky’s claim could have survived as pleaded[.]” But this
acknowledgment is an understatement, for it was clear that standing existed. Our
own cases reiterated that “Congress may enact statutes creating legal rights, the
invasion of which creates standing, even though no injury would exist without the
statute.” Houston v. Marod Supermarkets, Inc., 733 F.3d 1323, 1330 (11th Cir.
2013) (internal quotation marks omitted). This was not surprising given cases like
Havens Realty Corp. v. Coleman,
455 U.S. 363, 373–74 (1982), which held that a
“tester” plaintiff who received false information in violation of the Fair Housing Act
had standing to sue, even though he did not intend to rent or purchase a home or
apartment and did not suffer an actual injury.
With respect to the FACTA, the Eighth Circuit had relied on Coleman to hold
that a violation of §1681c(g) was, by itself, sufficient for an Article III injury. See
Hammer v. Sam’s E., Inc., 754 F.3d 492, 498–99 (8th Cir. 2014) (“[T]he actual-
injury requirement may be satisfied solely by the invasion of a legal right that
Congress created. This is not a novel principle within the law of standing.”). Lower
courts, including one in in this circuit, had reached the same conclusion. See Amason
v. Kangaroo Exp., No. 7:09–CV–2117–RDP,
2013 WL 987935, at *6–7 (N.D. Ala.
Mar. 11, 2013); Armes v. Sogro, Inc.,
932 F. Supp. 2d 931, 938 (E.D. Wis. 2013);
90
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 91 of 148
Korman v. Walking Co., 503 F. Supp. 2d 755, 759 (E.D. Pa. 2007). The majority is
mistaken in suggesting that the law in 2015 was in a state of flux. 1
Understandably, then, Godiva did not make any real attempt to challenge Dr.
Muransky’s standing. The majority points to the fact that Godiva raised standing as
an affirmative defense in its answer to the complaint, but that defense was a mere
placeholder—a single, conclusory statement that “[n]either Dr. Muransky nor any
member of the proposed class has suffered any injury in fact.” Godiva did not say
anything more, and it is not clear whether this argument was even a facial attack on
the complaint or a factual attack. The defense therefore could have been stricken as
conclusory under Rule 12(f). See, e.g., Losada v. Norwegian (Bahamas) Ltd., 296
F.R.D. 688, 690 (S.D. Fla. 2013) (“Where an affirmative defense is ‘no more than
bare bones conclusory allegations, it must be stricken.’”) (quoting Microsoft Corp.
v. Jesse’s Computers & Repair, Inc.,
211 F.R.D. 681, 684 (M.D. Fla. 2002)). In any
event, Godiva never pursued the standing argument. It did not move to dismiss
under Rule 12(b)(1) for lack of jurisdiction, and instead sought to dismiss on the
merits under Rule 12(b)(6).
1
In 2016, the Eighth Circuit, in a case involving the Cable Communications Policy Act,
concluded that Spokeo had abrogated its decision in Hammer. See Braitberg v. Charter Commc’ns,
Inc., 836 F.3d 925, 930 (8th Cir. 2016). In light of the public-private rights framework that I
discuss below, I do not believe that Braitberg is correct. In any event, Braitberg was decided more
than a year after Dr. Muransky filed his complaint.
91
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 92 of 148
Likewise, the district court—which had an independent duty to ensure that it
had subject-matter jurisdiction—declined to take up standing on its own. Had the
district court considered standing to be an issue, it would have been required to give
Dr. Muransky an opportunity to present facts supporting standing and, if necessary,
to hold an evidentiary hearing. See Colonial Pipeline Co. v. Collins, 921 F.2d 1237,
1243 (11th Cir. 1991) (explaining that a district court may “hear conflicting evidence
and decide for itself the factual issues that determine jurisdiction,” but “a plaintiff
must have ample opportunity to present evidence bearing on the existence of
jurisdiction”); Bischoff v. Osceola Cnty.,
222 F.3d 874, 882 (11th Cir. 2000)
(faulting the district court for making findings regarding disputed facts related to
standing without holding an evidentiary hearing).
Dr. Muransky and Godiva negotiated toward a settlement after the close of
the pleadings. As the majority points out, they negotiated in the shadow of Spokeo,
which was pending before the Supreme Court at the time. The parties recognized
that the pending case could upend standing law in the consumer privacy area, and
they sought to mitigate risk and uncertainty, which cut both ways. But at no point
was there any guarantee about what the Supreme Court would say or hold in Spokeo.
Indeed, the Ninth Circuit in Spokeo had initially ruled that Article III standing
existed. See Robins v. Spokeo, Inc., 742 F.3d 409, 414 (9th Cir. 2014). So, even
though standing may have been a background issue for the parties, it was not a
92
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 93 of 148
contested matter in the case nor a jurisdictional problem under existing law. Any
suggestion that Dr. Muransky—and only Dr. Muransky—was trying to resolve the
case before the Supreme Court decided Spokeo is misleading. Just as class action
plaintiffs try to assess risk, so too do class action defendants like Godiva. See
generally Brian T. Fitzpatrick, The Conservative Case for Class Actions 107–08
(2019).
The parties eventually came to terms. In January of 2016, the district court
granted preliminary approval of their joint motion for class certification and class
settlement. But the court still did not ask Dr. Muransky to proffer facts supporting
standing, this time as part of its review of the settlement agreement. The court
provided topics to be addressed at a fairness hearing without mentioning any
jurisdictional concerns.
In May of 2016, four months after the preliminary approval of the class
settlement, the Supreme Court issued its decision in Spokeo. And here is the key
point: the parties—including Mr. Isaacson—and the district court still remained
silent. In the four months between Spokeo and the fairness hearing in September of
2016, no one thought to address Article III standing. Godiva did not seek to
withdraw from the settlement, move to dismiss under Rule 12(b)(1), or request
summary judgment. The court did not ask for supplemental briefing on Spokeo or
93
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 94 of 148
amend its preliminary approval order to include standing as a topic to be discussed
at the fairness hearing.
Significantly, Mr. Isaacson—the objector-appellant now challenging Dr.
Muransky’s standing on appeal—did not raise standing in his written objections to
the settlement, or in any of his other papers, all of which he filed months after Spokeo
was decided. So, by the time of the fairness hearing, standing was still entirely
uncontested, as though Spokeo had no effect on the case. Dr. Muransky had no
reason to amend his complaint or proffer additional facts to move the settlement
forward to completion.
Then, at the fairness hearing in September of 2016, Mr. Isaacson mentioned
standing for the first time. But he did not say much on the topic and certainly did
not present a fully formed argument that Spokeo precluded settlement. He pondered
whether further factual inquiry was necessary before the district court approved the
settlement, but he essentially conceded that Spokeo did not warrant dismissal on the
pleadings. When the court suggested that dismissal might harm the class members,
Mr. Isaacson responded: “Potentially. And I’m not saying necessarily that that’s
what should happen.” After this exchange, Mr. Isaacson quickly moved to the merits
of the settlement under Rule 23. The court did not subsequently ask the parties to
respond to Mr. Isaacson’s musings on standing, so Dr. Muransky still had no reason
to amend his complaint or proffer additional facts.
94
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 95 of 148
Within the broader legal landscape, it made sense not to take up standing.
After Spokeo came down, but before the district court approved the settlement in
September of 2016, two other district courts in this circuit concluded that the same
allegations that Dr. Muransky made against Godiva were sufficient to establish
standing under Spokeo. See Guarisma v. Microsoft Corp., 209 F. Supp. 3d 1261,
1264–67 (S.D. Fla. 2016); Altman v. White HouseBlack Mkt., Inc., No. 15-cv-2451-
SCJ,
2016 WL 3946780, at *4-7 (N.D. Ga. July 13, 2016). Two district courts in
that same time period also concluded that plaintiffs had standing based on FACTA
violations in which the vendor printed receipts displaying credit card expiration
dates. See Flaum v. Doctor’s Assocs., Inc.,
204 F. Supp. 3d 1337, 1339–42 (S.D.
Fla. 2016); Wood v. J Choo USA, Inc.,
201 F. Supp. 3d 1332, 1340 (S.D. Fla. 2016).
We addressed Spokeo only once in the four-month period leading up to the
final approval of the settlement. In Church v. Accretive Health, Inc., 654 F. App’x
990, 994–95 (11th Cir. 2016), an unpublished decision, we held that a plaintiff had
established a concrete injury based solely on an allegation that a debt collector sent
her a letter omitting required information under the Fair Debt Collection Practices
Act. The plaintiff “alleged an injury to her statutorily-created right to information,”
which was itself sufficient for Article III standing, without regard to whether she
alleged any additional injury. See id. This was not the type of “bare procedural
95
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 96 of 148
violation” discussed in Spokeo, but the invasion of a substantive right, which by
itself provided standing. See id. at 995 n.2.
Some district courts in our circuit eventually came to the opposite conclusion
regarding Article III standing and violations of the FACTA. But those cases were
decided after the settlement at issue here had been approved. See Tarr v. Burger
King Corp., No. 17-23776-CIV, 2018 WL 318477, at *1 (S.D. Fla. Jan. 5, 2018);
Gesten v. Burger King Corp., No. 17-22541-CIV,
2017 WL 4326101, at *4–6 (S.D.
Fla. Sept. 27, 2017). The same is true of the cases from our sister circuits that the
majority now cites as persuasive authority, three involving credit card numbers and
three involving expiration dates. All six decisions were handed down after
September of 2016. See Kamal v. J. Crew Grp., Inc.,
918 F.3d 102, 106, 119 (3d
Cir. 2019) (credit card number); Noble v. Nevada Checker Cab Corp., 726 F. App’x
582, 583–84 (9th Cir. 2018) (credit card number); Katz v. Donna Karan Co., LLC,
872 F.3d 114, 117, 121 (2d Cir. 2017) (credit card number); Bassett v. ABM Parking
Servs., Inc.,
883 F.3d 776, 783 (9th Cir. 2018) (expiration date); Crupar-Weinmann
v. Paris Baguette Am., Inc.,
861 F.3d 76, 81–82 (2d Cir. 2017) (expiration date);
Meyers v. Nicolet Rest. of De Pere, LLC,
843 F.3d 724, 727 (7th Cir. 2016)
(expiration date / decided December 13, 2016). We also had not yet issued Nicklaw
v. CitiMortgage, Inc.,
839 F.3d 998, 1000–03 (11th Cir. 2016) (decided October 6,
2016), a standing decision on which the majority also relies.
96
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 97 of 148
The district court approved the settlement shortly after the fairness hearing,
believing it had jurisdiction—correctly, given the existing legal landscape. Mr.
Isaacson appealed, and only then did he launch his full-throated attack against Dr.
Muransky’s standing (even though he had several months to make his arguments in
his written objections to the settlement). His initial brief was the first time that any
party briefed standing in this case or offered any meaningful argument as to why
Spokeo required dismissal of Dr. Muransky’s class complaint.2
B
Aware of this procedural history, the majority directs the dismissal of the
complaint, arguing that it was Dr. Muransky’s burden to prove standing and that he
should have known to “firm up” his jurisdictional allegations. That, I think, amounts
2
For the reasons I explained in my panel concurrence, see Muransky v. Godiva
Chocolatier, Inc., 922 F.3d 1175, 1197–99 (11th Cir. 2019) (Jordan, J., concurring), I continue to
doubt that Mr. Isaacson has standing on appeal to litigate for an outright dismissal of the case
based on lack of subject-matter jurisdiction. Although we have an independent duty to ensure our
jurisdiction and that of the district court, Mr. Isaacson decided not to opt out of the class and, rather
than use the appeal to fine-tune the settlement in his favor, he is now attempting to wipe out the
settlement entirely, even though it benefits him.
The fact that Mr. Isaacson omitted any mention of Article III standing in his written
objections to the settlement or in his other papers, all of which he filed several months after Spokeo,
makes me further question the propriety of his litigation strategy. Mr. Isaacson makes 52-pages-
worth of very specific arguments about Article III, Spokeo, and the FACTA in his initial brief, but
he did not make a single one of these points in his objections to the class settlement and waited
until the fairness hearing to raise only abstract concerns about standing. So either Mr. Isaacson is
attempting to sandbag Dr. Muransky by waiting until appeal to articulate his arguments—in which
case we should remand, if only to discourage such tactics—or he genuinely did not believe that
his arguments were winners at the time given the legal landscape—in which case we should also
remand because, just as Mr. Isaacson would have had no reason to raise the arguments, Dr.
Muransky would have had no reason to anticipate them.
97
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 98 of 148
to Monday-morning quarterbacking. The majority’s decision to dismiss, in this
procedural context, is mistaken.
For one, it is not fair to expect parties to anticipate changes in the law and then
dismiss their case if they fail to do so. The proper resolution in that scenario is to
remand. See Deffenbaugh-Williams v. Wal-Mart Stores, Inc., 188 F.3d 278, 282 (5th
Cir. 1999) (“When law changes in unanticipated ways during an appeal . . . this court
will generally remand for a new trial to give parties the benefit of the new law and
the opportunity to present evidence relevant to that new standard. The motivation
of this rule is fairness: to prevent injustice to a party who had no reason to expect a
changed rule at the time of trial.”). Although our law on the FACTA did not change
during the pendency of this appeal, it has now changed at the end of the appeal. That
is, the majority’s decision is itself an expansion of Spokeo, which Dr. Muransky (and
Godiva, the district court, and other district courts in this circuit) had no reason to
expect or predict. Spokeo did not involve § 1681c(g)(1), the provision of the
FACTA at issue here, and the Supreme Court did not even decide the standing issue
before it. The Supreme Court reversed the Ninth Circuit because it failed to address
“concreteness” as a distinct requirement of an Article III injury.
See 136 S. Ct. at
98
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 99 of 148
1550. But it remanded without deciding the issue of whether the plaintiff adequately
alleged an injury in fact. See
id. 3
We have reiterated that “a plaintiff must have ample opportunity to present
evidence bearing on the existence of jurisdiction.” Colonial Pipeline, 921 F.2d at
1243–44. The Supreme Court followed the same path in Alabama Legislative Black
Caucus v. Alabama,
575 U.S. 254, 268– 71 (2015). In that case, a three-judge district
court sua sponte held that an organizational plaintiff lacked standing to sue Alabama
for racial gerrymandering because it did not proffer evidence that its members
resided in the relevant voting districts. See
id. at 268–29. Alabama had only
challenged the individual co-plaintiffs’ standing, arguing that none claimed to live
in those districts. See
id. at 270. Based on this challenge to its co-plaintiffs’
standing, the organization probably should have been aware of potential problems
with its own standing. But it did not take the opportunity to obviate the issue with
evidence of where its own members resided.
Rather than dismiss, the Supreme Court reversed and remanded so that the
organization could establish its standing. See id. at 271. It noted that certain
deposition testimony supported an “inference” that the organization had members in
the relevant districts, and that the inference was “strong enough to lead the
3
The Ninth Circuit on remand concluded that the plaintiff alleged a concrete injury. See
Robins v. Spokeo, Inc., 867 F.3d 1108, 1118 (9th Cir. 2017).
99
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 100 of 148
[organization] reasonably to believe that, in the absence of a state challenge or a
court request for more detailed information, it need not provide additional
information such as a specific membership list.” Id. at 269–270. Had its standing
been directly challenged, i.e., “had it been asked,” then the organization could have
provided more evidence, such as a member residency list. See
id. at 270–71. But
“elementary principles of procedural fairness” mandated that the organization have
“an opportunity to provide evidence of” standing. See
id. at 271. I don’t understand
why those principles don’t warrant the same result here.
In two similar FACTA cases—Katz, 872 F.3d at 121, and
Crupar-Weinmann,
861 F.3d at 81–82—the Second Circuit had remanded to give the plaintiffs an
opportunity to replead or proffer additional facts after Spokeo came down. See
Cruper-Weinmann v. Paris Baguette Am., Inc., 653 F. App’x 81, 82 (2d Cir. 2016)
(remanding the consolidated cases “to allow the district courts to address any
standing questions in the first instance”). The plaintiffs “did not seek the opportunity
to supplement the record with additional evidence,” however, and failed to carry
their burden on remand, which is why the majority now cites to these cases as
persuasive authority. But the key point is that the Second Circuit first gave the
plaintiffs an opportunity to adapt to the shifting law of standing. Indeed, the Second
Circuit recognized that there was confusion after Spokeo and cautioned courts to put
plaintiffs on “renewed notice of both the right to introduce such evidence and the
100
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 101 of 148
plaintiff’s burden of proof to do so even at the motion-to-dismiss stage.” Katz, 872
F.3d at 121.
Dr. Muransky was not given adequate notice at any stage of the proceedings
that Spokeo undermined his standing. To the contrary, he was led to believe, by the
contemporaneous legal authority and the parties’ silence after Spokeo, that standing
was not an issue. Mr. Isaacson’s muted observations about standing at the fairness
hearing did not alter this reality. In sum, Dr. Muransky had no reason to amend his
complaint or proffer additional facts. Outright dismissal at this stage is wrong, and
the majority offers no persuasive reasons why remand is inappropriate.
C
In addition to ensuring procedural fairness, there are important institutional
and precedential reasons for us to remand rather than dismiss.
I focus here on Dr. Muransky’s allegation that he and class members face an
increased risk of identity theft, even though I do not believe that this is the only basis
for standing. As Judges Wilson and Martin correctly explain, and as I describe
further below, Dr. Muransky suffered a violation of a substantive legal right (that is,
a private, congressionally-created right), which is sufficient to establish standing.
But even assuming that Godiva’s FACTA violation was merely “procedural,” as the
majority contends, Dr. Muransky would still have standing because he faced a “risk
101
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 102 of 148
of real harm.” Spokeo, 136 S. Ct. at 1549 (citing Clapper v. Amnesty Int’l USA,
568
U.S. 398 (2013)).
The majority acknowledges this point, but still dismisses at the pleading stage
in the face of a plausible allegation of an increased risk of a real harm—identity
theft. Dr. Muransky’s allegation was not conclusory, as the majority states, but was
a general factual contention subject to proof or disproof with evidence at later stages
of litigation. The Supreme Court has made this point repeatedly, but the majority
acts as if the Court’s decisions were written in vanishing ink. See Lujan v. Defs. of
Wildlife, 504 U.S. 555, 561 (1992) (explaining that “general factual allegations of
injury” suffice at the pleading stage and that the plaintiff must substantiate general
claims with “specific facts” at later stages of litigation); Lucas v. S.C. Coastal
Council,
505 U.S. 1003, 1012–13 n.3 (1992) (“Lujan, since it involved the
establishment of injury in fact at the summary judgment stage, required specific facts
to be adduced by sworn testimony; had the same challenge to a generalized
allegation of injury in fact been made at the pleading stage, it would have been
unsuccessful.”); Steel Co. v. Citizens for a Better Environment,
523 U.S. 83, 103
(1998) (explaining that courts “must presume that the general allegations in the
complaint encompass the specific facts necessary to support those allegations” of
jurisdiction). See also Bennett v. Spear,
520 U.S. 154, 165–169 (1997) (explaining
102
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 103 of 148
that the burden for establishing jurisdiction at the pleading stage is “relatively
modest”).4
Dr. Muransky’s claim to an elevated risk of identity theft is plausible on its
face and bolstered by his allegations that identity theft is pervasive in his area and
that Godiva had already been the target of hackers. When we properly construe all
reasonable inferences in his favor, see, e.g., Hi-Tech Pharm., Inc. v. HBS Int’l Corp.,
910 F.3d 1186, 1193 (11th Cir. 2018), it is fair to conclude that a receipt displaying
the ten digits of a credit card number made it more likely that identity thieves
(concentrated in his area) could obtain that information and use it to steal his identity.
The majority may doubt that Dr. Muransky will be able to prove that the risks are
truly substantial, but that is not a reason to dismiss the complaint. See
Twombly, 550
U.S. at 556 (“[A] well-pleaded complaint may proceed even if it strikes a savvy
judge that actual proof of those facts is improbable[.]”).
The majority, in other words, fails to appreciate the distinction between a
substantive standing requirement—that the plaintiff must demonstrate a substantial
risk of a future injury—with the procedural principle that an allegation need only be
4
Several of our own cases—including some decided after Bell Atlantic Corp. v. Twombly,
550 U.S. 544 (2007)—make the same point. See Wilding v. DNC Servs. Corp.,
941 F.3d 1116,
1124 (11th Cir. 2019) (explaining that general factual allegations of an Article III injury suffice at
the pleading stage because we presume that the general allegations “embrace those specific facts
that are necessary to support the claim”) (internal quotation marks omitted). Accord Mulhall v.
UNITE HERE Local 355,
618 F.3d 1279, 1286 (11th Cir. 2010); Amnesty Int’l, USA v. Battle,
559
F.3d 1170, 1177 (11th Cir. 2009);
Bischoff, 222 F.3d at 878. But they too appear to mean little to
the majority.
103
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 104 of 148
plausible at the pleading stage. Indeed, not one of the cases that majority cites for
the proposition that a risk of harm must be “substantial” requires that a plaintiff
prove or describe substantiality at the pleading stage, or even allege the precise
degree of risk of harm. To the contrary, the cases either accept the general
allegations of an elevated risk at the pleading stage, or they accept or reject standing
at the summary judgment stage based on the record evidence. See Dep’t of
Commerce v. New York, 139 S. Ct. 2551, 2565 (2019) (relying on the district court’s
findings of fact at a bench trial to conclude that the plaintiffs had standing); Susan
B. Anthony List v. Driehaus,
573 U.S. 149, 161 (2014) (accepting standing at the
pleading stage based on the plaintiffs’ allegations that they intended to engage in
conduct proscribed by the challenged statute);
Clapper, 568 U.S. at 412 (holding
that the plaintiffs lacked standing because they “set forth no specific facts [at
summary judgment] demonstrating that the communications of their foreign contacts
will be targeted”); Pennell v. City of San Jose, 48
5 U.S. 1, 7–8 (1988) (accepting
standing based only on the allegation that the plaintiffs were “subject to the terms”
of the challenged ordinance); Blum v. Yaretsky,
457 U.S. 991, 1001 (1982)
(dismissing certain claims and explaining that “[n]othing in the record” shows that
the plaintiffs had been “threatened” with the alleged harm). Cf. Thole v. U. S. Bank
N.A,
140 S. Ct. 1615, 1621–22 (2020) (rejecting an increased-risk-of-harm theory of
104
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 105 of 148
standing offered by amici, as the plaintiffs did not assert that theory and did not
allege a substantially increased risk of harm in their complaint).
To dismiss at the pleading stage, the majority must fall back on its common
sense and intuition to conclude that Dr. Muransky’s risk of identity theft is “remote.”
But that conclusion is factual in nature and cannot be based on common sense. All
that common sense can really tell us at this point is that the more private information
is displayed, the more likely it is to be obtained and used to steal one’s identity. Cf.
Redman v. RadioShack, Corp., 768 F.3d 622, 626 (7th Cir. 2014) (“[T]he less
information the receipt contains the less likely is an identity thief who happens to
come upon the receipt to be able to figure out the cardholder’s full account
information and thus be able to make purchases[.]”). Common sense, no matter how
acute, cannot pinpoint the degree of elevated risk caused by a FACTA violation, nor
can it assist us in determining whether an elevated risk of identity theft is
“substantial.” When the majority concludes that Dr. Muransky’s risk is “remote,”
that conclusion must be based on some unknown underlying premise or assumed
facts. 5
5
The Supreme Court may have thought that it was helping courts apply Twombly by
allowing them to use their common sense at the pleading stage. See Ashcroft v. Iqbal, 556 U.S.
662, 679 (2009). But this case demonstrates that judicial common sense has its own problems.
See, e.g., David L. Noll, The Indeterminacy of Iqbal, 99 Geo. L.J. 117, 138 (2010) (“If judicial
experience and common sense constitutes a license to rely on broad new categories of extrinsic
information at a motion to dismiss, the critics’ fears that motion to dismiss practice will be unduly
influenced by individual judges’ differing views of life, the universe, and everything may be
105
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 106 of 148
The majority appears to recognize that its conclusion is fundamentally factual.
It points out, for example, that “[a]ccording to [Mr.] Isaacson . . . the extra numbers
on [Dr.] Muransky’s receipt merely contain information that is already allowed to
be printed on it elsewhere—the card issuer, for example.” The majority also
acknowledges Dr. Muransky’s counterargument, noting that, “[f]or his part, [Dr.]
Muransky argues that the six digits do contain information that can be exploited by
identity thieves, such as the card level or industry program, and that access to it
enables identity thieves to conduct ‘phishing inquiries.’” But the majority does not
resolve these competing factual claims because it cannot sit as a trier of fact on a
barren evidentiary record.
The majority also cites to Katz, 872 F.3d at 120, quoting it for the proposition
that the printing of “the first six digits of a credit card . . . is the equivalent of printing
the name of the issuing institution.” As Judge Martin explained in the second panel
majority opinion, however, we cannot impose factfinding from another district court
on Dr. Muransky: “Judicial notice of another court’s opinion takes notice of the
warranted.”) (internal quotation marks and citation omitted); Ion Meyn, The Haves of Procedure,
60 Wm. & Mary L. Rev. 1765, 1806 (2019) (“Iqbal instructs a judge to rely on her experience and
common sense in determining plausibility, inviting judicial bias to inform whether a case remains
on the docket.”); Access to Justice Denied: Ashcroft v. Iqbal: Hearing Before the Subcomm. on
the Constitution, Civil Rights, and Civil Liberties of the H. Comm. on the Judiciary, 111th Cong.
17 (2009) (statement of Arthur Miller, Professor, New York University School of Law) (“The
subjectivity at the heart of Twombly-Iqbal raises the concern that rulings on motions to dismiss
may turn on individual ideology regarding the underlying substantive law, attitudes toward private
enforcement of federal statutes, and resort to extra-pleading matters hitherto far beyond the scope
of a Rule 12(b)(6) motion to dismiss.”).
106
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 107 of 148
existence of the opinion, which is not subject to reasonable dispute over its
authenticity, but not of the facts summarized in the opinion.” Muransky, 922 F.3d
at 1190 (quoting McIvor v. Credit Control Servs., Inc.,
773 F.3d 909, 914 (8th Cir.
2014)). It has been the law of this circuit for at least 25 years that the factual findings
contained in a court order or opinion (1) cannot be judicially noticed by another
court, and (2) constitute inadmissible hearsay if they are offered for the truth of the
matter asserted. See United States v. Jones,
29 F.3d 1549, 1553–54 (11th Cir. 1994)
(“If it were permissible for a court to take judicial notice of a fact merely because it
has been found to be true in some other action, the doctrine of collateral estoppel
would be superfluous. . . . [T]he plain language of Rule 803(8)(C) [of the Federal
Rules of Evidence] does not apply to judicial findings of fact.”).
The majority’s fact-borrowing from Katz is especially problematic because
the Second Circuit “admitted[ ] [that] the fact-finding procedure below was more
abbreviated than might be conventionally expected,” and that “the plaintiff did not
seek the opportunity to supplement the record with additional evidence.” Katz, 872
F.3d at 120, 121. And, as Judge Martin explained in the first panel majority opinion,
this factual proposition originally came from one expert’s declarations submitted in
two district court cases more than a decade ago, which have not since been
challenged “in light of technological changes related to brute-force cryptological
attack on credit card numbers.” Muransky v. Godiva Chocolatier, Inc.,
905 F.3d
107
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 108 of 148
1200, 1213–14 (11th Cir. 2018) (citing Bateman v. Am. Multi-Cinema, Inc.,
252
F.R.D. 647, 651 (C.D. Cal. 2008), rev’d and remanded,
623 F.3d 708 (9th Cir. 2010),
and Lopez v. KB Toys Retail, Inc., 2:07–cv–00144, Dkt. No. 28 at 5 (C.D. Cal. July
17, 2007)).
It is not clear—at least to me—how these factual assertions influence the
majority’s assessment of the risks. For the majority quickly pulls back and says that
the factual dispute is “beside the point” because Dr. Muransky failed to plead the
“specific risks from the sequence of numbers included on his receipt, and did not
address the issue before the district court at any time.” But, again, Dr. Muransky
did not amend his pleadings or address the issue in the district court because he had
no opportunity or any reason to do so, either before or after Spokeo. And, in any
event, his general allegations suffice at the pleading stage.6
6
Assuming that it is correct in saying that the risk of identity theft is remote, the majority
fails to consider how damaging and costly identity theft can be to a victim. It is not unreasonable
to imagine losses in the hundreds or thousands of dollars, factoring in the value of lost time,
attorneys’ fees, and actual monetary loss. Even a 1 in 100 chance of that event occurring—i.e., a
remote risk—is still “substantial” because it could lead to a significant mathematical loss. See
Jonathan Remy Nash, Standing’s Expected Value, 111 Mich. L. Rev. 1283, 1297–98 (2013). See
also Nat. Res. Def. Council v. EPA,
464 F.3d 1, 7 (D.C. Cir. 2006) (concluding that a plaintiff
organization had standing to challenge an EPA rule: “The lifetime risk that an individual will
develop nonfatal skin cancer as a result of EPA’s rule is about 1 in 200,000 . . . Even if a
quantitative approach is appropriate—an issue on which we express no opinion—this risk is
sufficient to support standing.”). This is why people spend money, lots of it, to protect against
identity theft.
Of course, Dr. Muransky does not need to allege a hypothetical loss amount, as there is no
way for him to predict how much he would or could lose or spend due to identity theft. But if the
majority is going to rely on its non-empirical intuition to determine the materiality of threatened
injuries, it ought to incorporate other reasonable assumptions about the financial and psychological
magnitude of those threatened injuries.
108
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 109 of 148
This brings me to the institutional and precedential concerns with the
majority’s failure to remand. As an appellate court we are not suited to resolve
factual disputes bearing on jurisdiction in the first instance. See Lewis v. Cont’l Bank
Corp., 494 U.S. 472, 481 (1990) (“[W]henever possible . . . the evaluation of such
factual contentions bearing upon Article III jurisdiction should not be made by this
Court in the first instance.”); Connecticut v. Am. Elec. Power Co.,
582 F.3d 309, 347
(2d Cir. 2009) (noting that the causation prong of Article III standing “is an issue
best left to the rigors of evidentiary proof at a future stage of the proceedings, rather
than dispensed with as a threshold question of constitutional standing”), rev’d on
other grounds,
131 S. Ct. 2527 (2011). Yet this case clearly turns on factual
questions, as the majority seems to recognize. Whether the extra numbers on a
receipt reflect the credit card brand, or whether the digits can be exploited for
“phishing inquiries,” for example, are precisely the types of questions that must be
resolved prior to determining whether a risk of identity theft is substantial. These
questions should be addressed in an adversarial posture in the district court, with
evidence and experts, and an evidentiary hearing if necessary, but not on appeal in
the first instance.
The Second Circuit recognized as much in Katz, explaining that jurisdictional
discovery and evidentiary production would be necessary to resolve fact-based
standing challenges to FACTA claims. See 872 F.3d at 120–21. With respect to
109
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 110 of 148
information privacy statutes more generally, it noted that a “fact-finding hearing
with expert witness testimony may very well be appropriate, depending on the
novelty of the issue, the extent of the material dispute of facts, and the statutory
prohibition in question.” Id.
The majority ignores this lesson from Katz, as it confronts a complex and
novel question about credit card numbers and the risk of identity theft. The majority
tries to take the question head on, but without a factual record it can only venture a
guess in the abstract and therefore cannot explain the logic underlying its decision.
The result is that it cannot meaningfully describe the applicable standard or offer any
guidance for litigants or courts.
The majority tries to offer some suggestions, but they are vague and not of
any help to Dr. Muransky—should he decide to refile—or other litigants who may
sue for FACTA violations. For example, the majority asks for more “insight” into
the elevated risks of harm at the pleading stage. But how does one more precisely
describe a “risk” of something like identity theft, which is perpetrated by criminals,
and what level of detail is needed? Percentages? Anecdotal information? Empirical
data? Law-enforcement reports? Affidavits of IT consultants or reformed hackers?
The majority cannot say. By demanding more facts beyond the allegation of a risk
of harm, the majority comes close to returning us to the fact-pleading regime of a
bygone era. See Casillas v. Madison Ave. Assocs., Inc., 926 F.3d 329, 340 (7th Cir.
110
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 111 of 148
2019) (Wood, J., dissenting from denial of rehearing en banc) (“In demanding proof
of injury, we need to guard against pushing a merits judgment into the Article III
injury-in-fact inquiry [and] to be sure that we are not returning to a fact pleading
regime[.]”). Yet the Supreme Court has told us that Twombly and its progeny do not
require hyper-detailed allegations. See Johnson v. City of Shelby, 574 U.S. 10, 12
(2014) (“Having informed the city of the factual basis for their complaint, [the
plaintiffs] were required to do no more to stave off threshold dismissal for want of
an adequate statement of their claim.”).
As this all demonstrates, Dr. Muransky cannot possibly make his allegations
anymore “clearly and specifically,” as the majority requires. Detailed allegations
about who, what, when, or how his identity could be stolen in the future would be
speculation, as Dr. Muransky is alleging an injury, in part, based on a risk of a future
event. But Congress has already explained that “[e]xperts in the field agree that
proper truncation of the card number . . . prevents a potential fraudster from
perpetrating identity theft or credit card fraud,” Credit and Debit Card Receipt
Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(6), 122 Stat. 1565, and that is
exactly what Dr. Muransky is trying to prevent. See Spokeo, 136 S. Ct. at 1549
(explaining that Congress can “articulate chains of causation that will give rise to a
case or controversy where none existed before”). It is befuddling why the majority
111
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 112 of 148
treats Congress’ findings about the risk of identity theft in the FACTA with such
skepticism.7
The majority also suggests that Dr. Muransky should have “indicate[d] how
much risk” of identity theft the FACTA violation caused. But it does not and cannot
specify what probability standard would meet its threshold (nor does it incorporate
the magnitude of the injury into the mathematical loss, as noted above). Future
litigants will have to guess a number, and then hope that it matches the next panel’s
definition of “substantial.” So much for guidance.
And what is the precedential effect of this case? Assume that Dr. Muransky
estimates that his risks of identity theft increased by 25% due to the FACTA
7
In a number of cases, the Supreme Court has relied on and deferred to congressional
findings with respect to the harms caused by certain conduct. See Turner Broad. Sys., Inc. v.
F.C.C., 520 U.S. 180, 196 (1997) (“We owe Congress’ findings an additional measure of deference
out of respect for its authority to exercise the legislative power. Even in the realm of First
Amendment questions where Congress must base its conclusions upon substantial evidence,
deference must be accorded to its findings as to the harm to be avoided and to the remedial
measures adopted for that end, lest we infringe on traditional legislative authority to make
predictive judgments when enacting nationwide regulatory policy.”); Gonzales v. Carhart,
550
U.S. 124, 165 (2007) (deferring to congressional findings about the harms to society and the
medical profession caused by partial-birth abortion); Tennessee v. Lane,
541 U.S. 509, 526–28
(2004) (deferring to congressional findings regarding discrimination against persons with
disabilities in the provision of public services in support of its exercise of power under § 5 of the
Fourteenth Amendment). The Court has been especially deferential to congressional fact-finding
with regard to complex problems and empirical questions. See Columbia Broad. Sys., Inc. v.
Democratic Nat. Comm.,
412 U.S. 94, 103 (1973) (“[W]hen we face a complex problem with many
hard questions and few easy answers we do well to pay careful attention to how the other branches
of Government have addressed the same problem.”). That cautious deference ought to apply in
the standing context as well, particularly when standing is based on empirical questions about data
privacy. See Autolog Corp. v. Regan,
731 F.2d 25, 31 (D.C. Cir. 1984) (“[W]e must give great
weight to this congressional finding in our standing inquiry.”).
112
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 113 of 148
violation, and he refiles making that exact allegation. Would the district court still
be required to dismiss based on today’s holding that a receipt displaying the first six
and last four digits creates only a “remote” risk? And what if a future litigant alleges
that a vendor printed 12 out of 16 digits (or 14 out of 16 digits) of his credit card
number; would that allegation suffice? Apparently 16 out of 16 digits is enough at
the pleading stage, see Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1066 (D.C.
Cir. 2019), but then why not 15? And if not 15, then why not 14, 13, etc.? At what
point would the majority draw the line between Jeffries—where the identity thief
apparently had “sufficient information” to defraud the plaintiff—and a case where
the identity thief would not have sufficient information?
From my perspective, these are inevitable consequences of the standing
framework that the majority derives from Spokeo, a problem which I explain in more
detail below. But in a post-Spokeo world, if we are going to take on “a robust judicial
role” in assessing risks of harm to plaintiffs and push legislative findings to the side,
then we should endeavor to conduct a careful analysis with as much information as
possible. That is particularly necessary in complex areas like consumer and
informational privacy, where problems are not easily resolved by so-called common
sense. See Katz, 872 F.3d at 120–21.
There is no shame in admitting our institutional limitations and taking up these
issues at a later stage on a complete record. The Supreme Court frequently remands
113
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 114 of 148
when faced with these types of questions, recognizing that Article III standing is a
malleable and evolving area of law. In Frank v. Gaos, 139 S. Ct. 1041, 1043 (2019),
for example, the Supreme Court granted certiorari to review whether a cy pres class
settlement was “fair, reasonable, and adequate” under Rule 23. But the Court
determined that there were “substantial questions about whether any of the named
plaintiffs ha[d] standing to sue” in light of Spokeo. See
id. at 1043–44. The Court
requested supplemental briefing on the issue, but it concluded that the briefs raised
a “wide variety of legal and factual issues.”
Id. at 1046. Rather than pass on these
novel standing issues itself, the Supreme Court remanded for further proceedings.
See
id. The procedure that was good for the Supreme Court in Gaos should be good
enough for us.
Similarly, in Gill v. Whitford, 138 S. Ct. 1916, 1931–33 (2018), the Supreme
Court concluded that the plaintiffs in a voting rights case had not established an
Article III injury. But rather than direct dismissal, it remanded “so that the plaintiffs
may have an opportunity to prove concrete and particularized injuries using evidence
. . . that would tend to demonstrate a burden on their individual votes.”
Id. at 1934.
Even though those plaintiffs had been given an opportunity to develop the record
(unlike Dr. Muransky), the Court was still wary of dismissal because the case
involved an “unsettled kind of claim [it] ha[d] not agreed upon, the contours and
114
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 115 of 148
justiciability of which are unresolved.” Id. Why the Gill approach is inappropriate
here remains a mystery.
Whether the Supreme Court remands out of fairness or caution, or some
combination of both, we ought to proceed accordingly. If we do not affirm, we
should instead treat this case as having properly survived the pleading stage and give
Dr. Muransky an opportunity to support his Article III standing with additional
allegations or evidence. He may or may not be able to carry that burden, but he is
owed the chance. If we take up the standing issue at a later time, moreover, we can
do so on a developed factual record and with the benefit of adversarial framing of
the factual issues. This will lead to a more precise and detailed opinion on our part,
which will inure to the benefit of future litigants and courts, who may be wondering
what exactly we have decided.
II
Although remanding this case would mitigate some of the problems of the
majority’s decision, a better outcome would be to affirm based on the public-private
rights framework that Justice Thomas outlined in his concurrence in Spokeo and
others have echoed. “Private rights” are those “belonging to individuals, considered
as individuals.” Spokeo, 136 S. Ct. at 1551 (Thomas, J., concurring) (quoting 3
William Blackstone, Commentaries *2 (1768)). Public rights are those “owed ‘to
115
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 116 of 148
the whole community, considered as a community, in its social aggregate capacity.’”
Id. (quoting 4 William Blackstone, Commentaries *5 (1769)).
Dr. Muransky alleged that Godiva violated his congressionally-created private
right—the right of individual “cardholders” to receive receipts truncating all but the
last five digits of their credit card number. See 15 U.S.C. § 1681c(g)(1). Cf. Spokeo,
136 S. Ct. at 1553–54 (Thomas, J., concurring) (concluding that § 1681e(b) of the
Fair Credit Reporting Act arguably confers private rights because it requires
reporting agencies to “follow reasonable procedures to assure maximum possible
accuracy of the information concerning the individual about whom the report
relates”);
Gaos, 139 S. Ct. at 1047 (Thomas, J., dissenting) (concluding that the
Stored Communications Act confers a private right insofar as it prohibits electronic
service providers from “knowingly divulg[ing] . . . the contents of a communication’
sent by a ‘user,’ ‘subscriber,’ or ‘customer’ of the service”). For that reason alone,
Dr. Muransky has Article III standing to proceed with this lawsuit.
A
The Constitution provides that “[t]he judicial Power shall extend to all Cases,
in Law and Equity, arising under . . . the Laws of the United States[.]” U.S. Const.
Art. III, § 2. Because there was little discussion about this provision at the
Constitutional Convention, and because the text does not lead to any “linguistically
inevitable conclusion,” Antonin Scalia, The Doctrine of Standing as an Essential
116
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 117 of 148
Element of the Separation of Powers, 17 Suffolk U. L. Rev. 881, 882 (1983), the
Supreme Court has looked instead to the common law to define the scope of Article
III jurisdiction. See Coleman v. Miller, 307 U.S. 433, 460 (1939) (separate opinion
of Frankfurter, J.) (“Judicial power could come into play only in matters that were
the traditional concern of the courts at Westminster and only if they arose in ways
that to the expert feel of lawyers constituted ‘Cases’ or ‘Controversies.’”). Indeed,
in modern cases where the common law in the eighteenth century recognized a cause
of action, the Supreme Court has held that Article III standing exists. See Vt. Agency
of Nat. Res. v. U.S. ex rel. Stevens,
529 U.S. 765, 774, 777 (2000) (holding that a qui
tam relator has Article III standing in part because qui tam actions were “cases and
controversies of the sort traditionally amenable to, and resolved by, the judicial
process,” as evidenced by “the long tradition of qui tam actions in England and the
American Colonies”) (internal quotation marks omitted).
The common law provides a clear answer for this case. English courts at
common law heard suits involving private rights, regardless of whether the plaintiff
suffered actual damage, as was true, for example, in cases of trespass, assault, and
battery. See, e.g., Entick v. Carrington, 2 Wils. K. B. 275, 291, 95 Eng. Rep. 807,
817 (1765) (“[W]hen one man placed his foot on another’s property, the property
owner needed to show nothing more to establish a traditional case or controversy.”);
3 Blackstone, Commentaries *124 (explaining that with respect to assault, “no actual
117
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 118 of 148
suffering is proved, yet the party injured may have redress,” and as to battery, every
unlawful touching is actionable, whether “accompanied with pain . . . [or] attended
with none”).
That tradition continued in early America. Jurists understood that a plaintiff
alleging the violation of a private right had a justiciable case, regardless of whether
he could demonstrate actual damage. See Webb v. Portland Manufacturing Co., 29
F. Cas. 506, 509 (C.C.D. Me. 1838) (Story, J.) (explaining that “whenever there is a
clear violation of a right, it is not necessary in an action of this sort to show actual
damage” because “every violation imports damage; and if no other be proved, the
plaintiff is entitled to a verdict for nominal damages.”). The principle was repeated
in state courts and treatises throughout the nineteenth century. See, e.g., Parker v.
Griswold,
17 Conn. 288, 302–03 (1845) (explaining that where there has been a
violation of a right, a person is entitled at least to nominal damages “to vindicate the
right which has been invaded,” and for that reason, he may sustain an action of
trespass “although he shows no actual specific damage to have thereby accrued to
him”); Blanchard v. Baker,
8 Me. 253, 269 (1832) (“[O]ne commoner might
maintain an action against another, for an injury to his right, without proof of actual
damage.”); 1 Theodore Sedgwick, Measure of Damages 43–44 (5th ed. 1869)
(explaining that wherever “the invasion of a right is established, the English law
118
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 119 of 148
infers some damage to the plaintiff; and if no evidence is given of any particular
amount of loss, it declares the right by awarding what it terms nominal”).
It was also understood that Congress could create private rights by statute and
that a plaintiff could sue based on a violation of that statutory right without regard
to actual damages. See Thomas M. Cooley, The Law of Torts 271 (2d ed. 1888)
(explaining that where “statutes fix a minimum of recovery. . . there would seem to
be no doubt of the right of one who establishes a technical ground of action to
recover this minimum sum without any specific showing of loss”). As Theodore
Sedgwick explained in his influential treatise on damages, the question was whether
the statute “obviously prohibited [an act] for the protection of a particular party”; if
it did, “then it [was] not necessary [for the protected party] to allege special damage.”
1 Sedgwick, Measure of Damages, at 661 (quoting Chamberlaine v. Chester &
Birkenhead R. Co., 154 Eng. Rep. 371, 1 Exch. R. 870 (1848)).
In the Copyright Act of 1790, for example, the First Congress imposed
statutory damages on those infringing on an individual’s patent, even if the patent-
holder could not show monetary loss. See Act of May 31, 1790, ch. 15, § 2, 1 Stat.
124, 124–25. Justice Story, riding circuit, presided over a case in which the
defendant infringed on a patent by building a similar machine. See Whittemore v.
Cutter, 29 F. Cas. 1120 (C.C.D. Mass. 1813) (Story, J.). The defendant argued that
“the making of a machine cannot be an offence, because no action lies, except for
119
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 120 of 148
actual damage, and there can be no actual damages, or even a rule for damages, for
an infringement by making a machine.”
Id. at 1121. Justice Story rejected this
argument: “[W]here the law gives an action for a particular act, the doing of that act
imports of itself a damage to the party. Every violation of a right imports some
damage, and if none other be proved, the law allows a nominal damage.”
Id.
The Framers did not demonstrate any intent to depart from this common-law
understanding, which fit well within the broader idea that the judiciary was tasked
with protecting the rights of individuals. In Marbury v. Madison, 5 U.S. (1 Cranch)
137, 170 (1803), Chief Justice Marshall stated that “the province of the court is,
solely, to decide on the rights of individuals[.]” And in Osborn v. Bank of the United
States, 22 U.S. (9 Wheat.) 738, 819 (1824), he described the judicial power as
“capable of acting only when the subject is submitted to it by a party who asserts his
rights in the form prescribed by law.” Justice Story echoed Justice Marshall, and
described an Article III “case” as one “touching the Constitution, laws, or treaties of
the United States” and “submitted to the court by a party, who asserts his rights in
the form prescribed by law.” 3 Joseph Story, Commentaries on the Constitution of
the United States § 1640 (1833). The law professor and former antifederalist St.
George Tucker described the judiciary as “that department of the government to
whom the protection of the rights of the individual is by the constitution especially
confided.” 1 St. George Tucker, Blackstone’s Commentaries 140 (1803). And as
120
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 121 of 148
one state supreme court explained, “the very object of all suits, both at law and in
equity,” is “[t]o preserve and enforce the rights of persons, as individuals, and not as
members of the community at large.” Bigelow v. Hartford Bridge Co., 14 Conn.
565, 578 (1842).
In short, the Framers and contemporary jurists would have considered Dr.
Muransky’s lawsuit to be the quintessential “case or controversy” involving the
adjudication of private rights created by statute. The FACTA “obviously
prohibit[s]” acts for the protection of “particular parties”—i.e., cardholders—and so
had English or early American courts heard this case, I think they would not have
demanded damages beyond the statutory violation. I have not found any cases or
authorities around the time of the Founding that would have required a court to
evaluate Dr. Muransky’s separate “injury” in order to determine whether it had
subject-matter jurisdiction.
B
We are, of course, bound by Supreme Court precedent. But a review of
standing doctrine, from its infancy in the twentieth century to the present, leads me
to the same conclusion.
The Supreme Court has never cabined the redress of private wrongs through
its Article III jurisprudence. Standing grew out of public law litigation in the early
twentieth century, not out of private disputes. As Justice Douglas put it in 1942,
121
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 122 of 148
reflecting on the developments of the prior decades, “[r]epeated attempts of private
litigants to obtain a special stake in public rights have been consistently denied.”
Scripps-Howard Radio v. F.C.C., 316 U.S. 4, 20 (1942) (Douglas, J., dissenting)
(emphasis added) (collecting cases).
The same is true for the injury-in-fact requirement. It expressly emerged in
the 1970s and 1980s amidst a fast-growing administrative state and questions about
the extent to which citizens could challenge agency action as representatives of the
public. In that context, the Supreme Court began referring to injury in fact as part
of an “irreducible minimum” of Article III. See Valley Forge Christian Coll. v.
Americans United for Separation of Church & State, Inc., 454 U.S. 464, 472 (1982).
See also Simon v. E. Ky. Welfare Rights Org.,
426 U.S. 26, 64 (1976) (Brennan, J.,
concurring); Warth v. Seldin,
422 U.S. 490, 499 (1975). The phrase was cemented
in
Lujan, 504 U.S. at 560, and has been treated as gospel ever since. Yet the Supreme
Court could not have meant exactly what it said, as it has always allowed individuals
to sue upon the invasions of private rights, even without showing actual damages.
The Court’s “one-size-fits-all standing doctrine” for both public and private
rights cases, see F. Andrew Hessick, Standing, Injury in Fact, and Private Rights,
93 Cornell L. Rev. 275, 277 (2008), is therefore a conceptual mistake that needs
fixing. Either injury in fact is not a constitutional prerequisite, except when a
plaintiff purports to assert rights of the public at large, or, injury is a constitutional
122
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 123 of 148
requirement, but the concept encompasses invasions of private legal rights. See, e.g.,
Parker, 17 Conn. at 302–03 (“An injury, legally speaking, consists of a wrong done
to a person, or, in other words, a violation of his right.”); Hendrick v. Cook,
4 Ga.
241, 261 (1848) (“[W]henever there has been an illegal invasion of the rights of
another, it is an injury, for which he is entitled to a remedy by an action.”).
1
Modern standing doctrine began to take shape in the early twentieth century.
Some commentators argue that it was the brainchild of Justices Brandeis and
Frankfurter, who sought to “insulate progressive and New Deal legislation from
frequent judicial attack” and thwart “efforts by citizens at large to invoke the
Constitution to invalidate democratic outcomes.” Cass R. Sunstein, What’s Standing
After Lujan? Of Citizen Suits, “Injuries,” and Article III, 91 Mich. L. Rev. 163, 179
(1992). See also Maxwell L. Stearns, Standing and Social Choice: Historical
Evidence, 144 U. Pa. L. Rev. 309, 370 (1995); Steven L. Winter, The Metaphor of
Standing and the Problem of Self-Governance, 40 Stan. L. Rev. 1371, 1374 (1988).
In any event, the main issues in the early standing cases concerned public rights, not
the vindication of private rights. The seminal cases in the 1920s involved individuals
suing for proper administration of the law and basing “standing”—a word that had
not yet entered the legal lexicon—on their citizen or taxpayer status alone. See
Fairchild v. Hughes,
258 U.S. 126, 129–130 (1922) (dismissing a challenge to the
123
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 124 of 148
ratification process of the Nineteenth Amendment because the plaintiff “ha[d] only
the right, possessed by every citizen, to require that the government be administered
according to law and the public moneys not be wasted”); Frothingham v. Mellon,
262 U.S. 447, 488–89 (1923) (dismissing a challenge to social welfare legislation,
brought by a plaintiff who claimed the scheme would increase her tax burden,
because the suit would not involve “a judicial controversy,” but would require the
Court “to assume a position of authority over the governmental acts of another and
coequal department, an authority which plainly we do not possess”).
As the Court imposed limitations on the ability of citizens or taxpayers to sue
in the public interest, however, it did not deviate from the common-law rule that one
individual could sue another based on the violation of a private right. That remained
uncontroversial. See Aetna Life Ins. Co. of Hartford, Conn. v. Haworth, 300 U.S.
227, 241 (1937) (“[T]he judicial function may be appropriately exercised although
the adjudication of the rights of the litigants may not require the award of process or
the payment of damages.”). A private legal right was still the sine qua non of
justiciability. See Tenn. Elec. Power Co. v. Tenn. Valley Auth.,
306 U.S. 118, 137–
38 (1939) (denying standing where there was no invasion of a “legal right,”
including “one founded on a statute which confers a privilege”); Alabama Power
Co. v. Ickes,
302 U.S. 464, 479–80 (1938) (holding that an electric company had no
124
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 125 of 148
standing to challenge the legality of federal loans to competitors because it had not
suffered the deprivation of a private legal right).
In 1940s, the Court entered a relatively brief era of broad statutory standing.
In a landmark case, F.C.C. v. Sanders Bros. Radio Station, 309 U.S. 470, 477 (1940),
the Supreme Court permitted a radio station to sue to enjoin a Federal
Communications Commission order granting a license to a market competitor, even
though the station did not have a legal right to the grant or denial of the license, or a
common-law right to be free from market competition. See Tenn. Elec. Power
Co.,
306 U.S. at 140 (“[T]he damage consequent on competition . . . will not support a
cause of action or a right to sue.”). But Congress had included a provision in the
Communications Act permitting judicial review for any person “aggrieved” by an
FCC order. See 47 U.S.C. § 402(b). And the Court reasoned that Congress “may
have been of opinion that one likely to be financially injured by the issue of a license
would be the only person having a sufficient interest to bring to the attention of the
appellate court errors of law in the action of the Commission in granting the license.”
Id. at 477. In
Scripps-Howard, 316 U.S. at 14, the Court read Sanders Brothers as
permitting private litigants to stand in court, “only as representatives of the public
interest.” See also Associated Indus. of New York State v. Ickes,
134 F.2d 694, 704
(2d Cir.) (describing Sanders Brothers as holding that the Constitution allows
Congress to “empower[ ] any person, official or not, to institute a proceeding
125
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 126 of 148
involving such a controversy, even if the sole purpose is to vindicate the public
interest,” and coining the phrase “private Attorney Generals”), vacated, 320 U.S.
707 (1943).
The Court’s expansion of statutory standing to so-called private attorneys
general in the Sanders Brothers/Scripps-Howard era of course did not prevent
individuals from suing on private rights alone. To the contrary, the Court’s
substantial deference to Congress and its ability to create standing by statute would
have supported standing in the case before us. The FACTA, in addition to creating
a private right for cardholders to receive truncated receipts, includes a cause-of-
action provision. See 15 U.S.C. § 1681n(a) (“Any person who willfully fails to
comply with any requirement imposed under this subchapter with respect to any
consumer is liable to that consumer.”).8
8
The Supreme Court eventually interpreted these cases not as giving Congress carte
blanche to enlist private attorneys general, but as permitting plaintiffs to make merits arguments
in the public interest only after they had established standing based on economic injury. See Sierra
Club v. Morton, 405 U.S. 727, 737–38 (1972) (“Taken together, Sanders and Scripps-Howard thus
established a dual proposition: the fact of economic injury is what gives a person standing to seek
judicial review under the statute, but once review is properly invoked, that person may argue the
public interest in support of his claim that the agency has failed to comply with its statutory
mandate.”). That reading of Sanders Brothers and Scripps-Howard effectively ended the era of
individual standing as a representative of the public, and presaged the limitation on citizen-suit
provisions in cases like Lujan. For an interesting study about this era, see Elizabeth Magill,
Standing for the Public: A Lost History,
95 Va. L. Rev. 1131 (2009).
126
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 127 of 148
2
As Justice Thomas observed in his concurrence in Spokeo, the Court’s recent
decisions have “not required a plaintiff to assert an actual injury beyond the violation
of his personal legal rights to satisfy the ‘injury-in-fact’ requirement.” 136 S. Ct. at
1552 (Thomas, J., concurring). That is, even while the Court has assumed that injury
in fact is a universal requirement, it has not, in practice, denied standing to plaintiffs
who allege invasions of private rights.
Injury in fact traces back to Association of Data Processing Organizations v.
Camp, 397 U.S. 150, 153 (1970), a case in which the Court first shifted from a rights-
based to an injury-based standing framework. In 1946, Congress had enacted the
Administrative Procedure Act, which created statutory review for any person
“adversely affected or aggrieved by agency action.” 5 U.S.C. § 702. The Court in
Data Processing held that whether a plaintiff possessed any legal right regarding the
agency action went to the merits of his claim, and that the plaintiff only needed to
allege an “injury in fact, economic or otherwise” in order to sue under the APA. See
Data
Processing, 397 U.S. at 152. This was a novel interpretation of the APA at the
time, and the Court’s first use of the term “injury in fact” in the standing context.
See Scalia, The Doctrine of Standing, 17 Suffolk U. L. Rev. at 888; Magill, Standing
for the Public,
95 Va. L. Rev. at 1160–63.
127
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 128 of 148
We now think of the injury-in-fact requirement as an obstacle for plaintiffs.
But the Court at the time intended to “broaden[ ] access to federal courts” for
plaintiffs to sue the government. See E. Ky. Welfare Rights Org., 426 U.S. at 39.
See also Linda R.S. v. Richard D.,
410 U.S. 614, 616–17 (1973) (explaining that the
Court intended to “expand[ ] the types of ‘personal stake(s)’ which are capable of
conferring standing on a potential plaintiff”). Therefore, even if Congress had not
created a personal legal right in an agency decision or action, a plaintiff could still
obtain judicial review by demonstrating some harm, which the Court defined broadly
as including economic, aesthetic, conservational, recreational, and spiritual interests.
See Data
Processing, 397 U.S. at 154–55. This was perhaps the culmination of the
Warren Court’s loosening of standing restrictions, a trend that had begun in the
1940s with Sanders Brothers. See, e.g., Flast v. Cohen,
392 U.S. 83, 106 (1968)
(granting standing to a taxpayer seeking to enjoin government expenditures
allegedly in violation of the Establishment Clause).
Throughout the 1970s and 1980s, however, the Burger Court pulled back on
the previously liberalized standing doctrine. Justice Powell had expressed concern
particularly with taxpayer lawsuits, which he thought corresponded to “the
expansion of judicial power” and “a remarkably illogical system of judicial
supervision of the coordinate branches of the Federal Government.” United States
v. Richardson, 418 U.S. 166, 188–90 (1974) (Powell, J., concurring). And his
128
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 129 of 148
separation-of-powers theory of standing eventually carried the day. But instead of
returning to a rights-based model, the Court stuck with injury in fact. At the same
time, it narrowed the universe of cognizable injuries and imposed causation and
redressability requirements, thereby making the threshold obstacle of Data
Processing much more difficult to surpass. See Hessick, Standing, Injury in Fact,
and Private Rights, 93 Cornell L. Rev. at 297 (arguing that Data Processing had
created a “quasi-public model of standing,” but that the Court implicitly returned to
a private rights model by narrowing the category of acceptable injuries to those that
were “actual,” “distinct,” “palpable,” and “concrete,” rather than merely “abstract”)
(quoting Allen v. Wright, 468 U.S. 737, 750–51, 756 (1984)).
But again, the important cases in this era arose in the public law context. They
involved plaintiffs asserting (often generalized) grievances about alleged
government misconduct. See, e.g., Whitmore v. Arkansas, 495 U.S. 149, 160 (1990)
(denying standing in a lawsuit to prevent another prisoner’s execution based on “the
public interest protections of the Eighth Amendment”); Valley
Forge, 454 U.S. at
470 (denying standing to taxpayers seeking to enjoin the transfer of federal property
to a religious organization); United States v. Richardson,
418 U.S. 166, 170 (1974)
(dismissing a taxpayer suit challenging the government’s failure to disclose CIA
expenditures); Schlesinger v. Reservists Comm. to Stop the War,
418 U.S. 208, 209
129
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 130 of 148
(1974) (dismissing a taxpayer lawsuit seeking to prevent members of Congress from
serving in the Armed Forces Reserve).
In the private rights context, the Court continued to maintain that “Congress
may enact statutes creating legal rights, the invasion of which creates standing, even
though no injury would exist without the statute.” Linda R.S., 410 U.S. at 617 n.3.
See also Diamond v. Charles,
476 U.S. 54, 65 n.17 (1986) (“The Illinois Legislature
. . . has the power to create new interests, the invasion of which may confer
standing.”); E. Ky. Welfare Rights
Org., 426 U.S. at 41 n.22 (recognizing “Congress’
power to create new interests the invasion of which will confer standing”).
In Coleman, 455 U.S. at 373–74, for example, the Supreme Court held that
“tester” plaintiffs had standing to sue under the Fair Housing Act, even though they
did not intend to purchase homes and therefore did not experience any injury in fact
from the FHA violation. The FHA created private rights, imposing duties upon
private parties to act a certain way toward others. It made it unlawful for any
individual or firm covered by the statute “[t]o represent to any person because of
race, color, religion, sex, or national origin that any dwelling is not available for
inspection, sale, or rental when such dwelling is in fact so available,” or “[t]o
discriminate against any person in the terms, conditions, or privileges of sale or
rental of a dwelling, or in the provision of services or facilities in connection
therewith, because of race, color, religion, sex, or national origin.” 42 U.S.C. §
130
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 131 of 148
3604(b), (d) (emphases added). Individuals therefore had private rights
corresponding to the duties imposed upon realtors, and the plaintiffs were able to
sue without showing damage. See Coleman, 455 U.S. at 373–74. Accord Gladstone
Realtors v. Vill. of Bellwood,
441 U.S. 91, 100–09 (1979).9
3
One of the most important cases in the modern era is Lujan, in which the Court
denied standing to environmental plaintiffs challenging an Interior Department rule
allegedly promulgated in violation of the Endangered Species Act. See 504 U.S. at
578. The Court reiterated and cemented the tripartite Article III test of injury in fact,
causation, and redressability that had developed since Data Processing. It held that
9
The Supreme Court has also recognized that Congress can create enforceable private
rights vis-à-vis the government. For example, the Freedom of Information Act requires
government agencies to provide “any person” with unexempted records if that person requests
them. See 5 U.S.C.A. § 552(3)(A). The requester—qua individual—obtains the private right to
the information he requested from the government. Fittingly, the Supreme Court’s “decisions
interpreting the Freedom of Information Act have never suggested that those requesting
information under it need show more than that they sought and were denied specific agency
records.” Pub. Citizen v. U.S. Dep’t of Justice, 491 U.S. 440, 449 (1989) (collecting cases). See
also
Spokeo, 136 S. Ct. at 1549–50 (citing Public Citizen as the type of case in which a plaintiff
“need not allege any additional harm beyond the one Congress has identified”). The same has
been true for violations of constitutional rights, which do not require actual damage for vindication.
See Carey v. Piphus,
435 U.S. 247, 266 (1978); Al–Amin v. Smith,
511 F.3d 1317, 1335 (11th Cir.
2008). To be sure, this is a much easier case than the FOIA or § 1983 cases because it does not
involve the government as a defendant, but is merely a private dispute between private parties. Cf.
United States v. Jicarilla Apache Nation,
564 U.S. 162, 174 (2011) (“The distinction between
‘public rights’ against the Government and ‘private rights’ between private parties is well
established.”).
131
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 132 of 148
the plaintiffs did not assert a sufficiently imminent injury, or one that was redressable
by a favorable decision against the government. See id. at 562–67, 568–71.
More significant was the Court’s holding the plaintiffs’ alleged “procedural
injury” under a citizen-suit provision of the Endangered Species Act was insufficient
under Article III. See id. at 571–77. The question for our purposes is whether this
holding rejected the rule—which dated back to the common law and early American
cases like Whittemore v. Cutter—that Congress could fashion private legal rights,
the invasion of which created standing.
Lujan did not repudiate this rule, simply because the ESA provision at issue
did not create private legal rights, unlike, for example, the FHA. The citizen-suit
provision in the ESA created a cause of action for “any person” to sue for violations
of “this chapter.” See id. at 571–72 (quoting 16 U.S.C. § 1540(g)). But the actual
provision at issue—the one that the Secretary of the Interior allegedly violated—
required agencies to consult with one another on certain decisions. See
id. at 558,
571 (quoting 16 U.S.C. § 1536(a)(2)). It did not direct the agency, for example, to
provide information, funds, or benefits to designated individuals. Nor did it
“obviously prohibit[ ]” certain government conduct “for the protection of a particular
party.” 1 Sedgwick, Measure of Damages, at 661. The duty of consultation, in other
words, did not create a corollary private right “belonging to individuals, considered
as individuals.”
Spokeo, 136 S. Ct. at 1551 (Thomas, J., concurring) (quoting 3
132
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 133 of 148
Blackstone, Commentaries *2). The government’s compliance with the consultation
provision was a public duty “owed ‘to the whole community, considered as a
community, in its social aggregate capacity.’” Id. at 1551 (quoting 4 Blackstone,
Commentaries *5). As the majority in Lujan pointed out, “[t]his is not a case where
plaintiffs are seeking to enforce a procedural requirement the disregard of which
could impair a separate concrete interest of theirs”; the plaintiffs sought to enforce
the right of “all persons . . . to have the Executive observe the procedures required
by
law.” 504 U.S. at 572–73. In this way, the Court was channeling the observations
of Fairchild in the 1920s.
Lujan can therefore be seen as limited to the public rights context. And it can
be read as holding that, while Congress can create private rights (as it always has),
it cannot convert a public interest into a private right merely by including a citizen-
suit provision. To do so would allow Congress to “transfer from the President to the
courts the Chief Executive’s most important constitutional duty, to ‘take Care that
the Laws be faithfully executed.’” Id. (quoting U.S. const. Art. II, § 3). “It would
enable the courts, with the permission of Congress, to assume a position of authority
over the governmental acts of another and co-equal department, and to become
virtually continuing monitors of the wisdom and soundness of Executive action.”
Id. (internal quotation marks and citations omitted). But nothing in the opinion
133
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 134 of 148
suggests that these separation-of-powers concerns would arise when Congress
created a private right that a plaintiff sought to vindicate against a private defendant.
Notably, the major cases since Lujan that have denied standing based on
insufficient injury in fact have also done so in the public rights context. See, e.g.,
Clapper, 568 U.S. at 401–02 (denying standing to plaintiffs seeking a declaration
that § 702 of the Foreign Intelligence Surveillance Act of 1978 is unconstitutional);
Arizona Christian Sch. Tuition Org. v. Winn,
563 U.S. 125, 130 (2011) (dismissing
a taxpayer suit under the Establishment Clause); Summers v. Earth Island Inst.,
555
U.S. 488, 490 (2009) (denying standing to an environmental group that sought to
enjoin enforcement of regulations that “exempt[ed] small fire-rehabilitation and
timber-salvage projects from the notice, comment, and appeal process used by the
Forest Service”); Hein v. Freedom From Religion Found., Inc.,
551 U.S. 587, 592
(2007) (dismissing a taxpayer suit under the Establishment Clause). I have not found
a contemporary Supreme Court case in which a plaintiff had a private statutory right
but was denied standing.10
10
The majority quotes Thole, 140 S. Ct. at 1620, for the proposition that a plaintiff does
not automatically have standing “whenever a statute grants a person a statutory right and purports
to authorize that person to sue to vindicate that right.” But as Justice Thomas pointed out in his
Thole concurrence, the provision at issue in that case, a part of the Employee Retirement Income
Security Act of 1974, did not create private rights belonging to the plaintiffs; the plaintiffs sought
to enforce fiduciary duties under ERISA that were “owed to the plan, not [the plaintiffs].”
Id. at
1623 (Thomas, J., concurring).
134
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 135 of 148
4
At this point, I pause to examine Spokeo and explain why it does not conflict
with the public-private rights framework. For starters, the Court in Spokeo did not
issue a direct holding as to whether the plaintiff there had standing; it reversed the
Ninth Circuit for failing to consider separately the “concreteness” requirement under
the Court’s test for an Article III injury, and remanded for a new determination of
standing. See Spokeo, 136 S. Ct. at 1548, 1550.
Moreover, nothing that the Court said was inconsistent with the public-private
rights model. The Court advised the Ninth Circuit that the plaintiff could not obtain
standing based on a “bare procedural violation” divorced from factual injury. See
id. at 1549. But it also acknowledged Congress could still “elevat[e] to the status of
legally cognizable injuries concrete, de facto injuries that were previously
inadequate in law.”
Id. (quoting Lujan, 504 U.S. at 572). Not surprisingly, courts
have struggled to reconcile these two apparently conflicting statements. See, e.g.,
Hagy v. Demers & Adams,
882 F.3d 616, 623 (6th Cir. 2018) (“It’s difficult, we
recognize, to identify the line between what Congress may, and may not, do in
creating an ‘injury in fact.’”). But the two statements make more cohesive sense
when considered through a rights-based lens.
Recall that the Court in Lujan had suggested that a procedural requirement in
a statute could protect individuals (i.e., create private rights), rather than protect the
135
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 136 of 148
public at large. See 504 U.S. at 572 & n.7. But the plaintiffs in Lujan had not argued
that the “consultation” provision protected them individually. They argued that the
citizen-suit provisions, which applied to “all persons,” vested in them a procedural
right. See
id. at 571–72. In other words, they attempted to read the cause of action
into the substantive provision in order to manufacture a “procedural” right that
belonged to them individually. The Court rejected that theory. Because the
substantive provision imposed a public duty upon the agency to consult with other
agencies, Congress could not turn that public duty into a private right through a
citizen-suit provision. A “bare” procedural violation, in other words, was the
violation of a public duty, without any additional, particularized harm to the
individual. A bare procedural violation was not the same thing as an invasion of a
private right.
In that way, Spokeo—although not entirely clear on its face—may be in line
with Lujan. Just as Congress cannot confer blanket standing on “all persons” to
oversee the Department of the Interior’s duty to comply with the consultation
provision, it cannot delegate to the public what would otherwise be executive
authority to enforce general regulatory obligations of covered, third-party entities.
The decision to bring enforcement actions has traditionally been “committed to
agency discretion by law.” 5 U.S.C. § 701(a)(2). See also Heckler v. Chaney, 470
U.S. 821, 827–835 (1985). A plaintiff therefore has standing only if the procedural
136
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 137 of 148
duty was “obviously intended” to protect the particular plaintiff (i.e., created a
private right that he may vindicate), or if the procedural violation created a public
duty but also harmed the plaintiff in some concrete and particularized manner as
distinct from the general public (i.e., caused an “injury-in-fact”).11
The difficulty in Spokeo was that the statute at issue, the FCRA, creates a web
of regulatory obligations which arguably confer both private and public rights. For
example, § 1681e(b) requires reporting agencies to “follow reasonable procedures
to assure maximum possible accuracy of the information concerning the individual
11
For this reason, Fed. Election Comm’n v. Akins, 524 U.S. 11 (1998), may be wrongly
decided, at least under the public-private rights framework. There, the Court held that voters had
standing to challenge the FEC’s determination that an organization was not a “political committee”
as defined by the Federal Election Campaign Act. See
id. at 13. The FECA imposed disclosure
requirements upon political committees, and the plaintiffs asked the FEC, first, to find that the
organization had violated the FECA and, second, to order the organization to disclose the requisite
information. See
id. at 16. The Court rejected the government’s “prudential standing” argument,
as the FECA provided a cause of action for “[a]ny person who believes a violation of the [FECA]
. . . has occurred,” and has been “aggrieved” by the violation. See
id. at 19 (quoting 2 U.S.C. §
437g(a)(1)). It held that the voters suffered an Article III injury, insofar as they could not obtain
information that they needed to evaluate candidates for public office. See
id. at 21.
Viewing this case through the public-private rights lens, the FECA imposed a duty upon
the executive branch (1) to determine whether entities were “political committees,” and (2) to
enforce the disclosure of information. Under Lujan, Congress would not be able to convert that
public interest in administration of laws into a private right, lest any citizen be able to compel the
executive to enforce the law. Only if the plaintiffs had suffered an injury distinct from that of the
general public could they have standing to sue. But
Richardson, 418 U.S. at 166–67, had dismissed
for lack of standing a suit in which the plaintiff claimed to have been aggrieved by the
government’s refusal to disclose information to the public.
As a result, Akins may raise separation-of-powers problems. See 524 U.S. at 36 (Scalia, J.,
dissenting) (“A system in which the citizenry at large could sue to compel Executive compliance
with the law would be a system in which the courts, rather than the President, are given the primary
responsibility to ‘take Care that the Laws be faithfully executed.’”). The case is in that way
reminiscent of the bygone Sanders Brothers era. But, again, the fact that the Court may have
improperly expanded standing in Akins does not mean that Dr. Muransky lacks standing here.
137
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 138 of 148
about whom the report relates.” This provision, Justice Thomas pointed out, seems
to create private rights for the individual qua individual. See Spokeo, 136 S. Ct. at
1553–54 (Thomas, J., concurring). But the plaintiff in Spokeo alleged violations of
other FCRA provisions, such as one requiring reporting agencies to post toll-free
numbers on their website. See
Spokeo, 136 S. Ct. at 1545 (majority opinion) (citing
§ 1681j(c)(i)). See also First Amended Complaint, Robins v. Spokeo, Inc.,
2011 WL
7782796 (C.D. Cal. Feb. 17, 2011) (alleging that the defendant “failed to post a toll-
free telephone number on its website through which consumers can request free
annual file disclosures”). At oral argument, Justice Scalia expressed concern that
citizens could have roving standing to sue for violations of the defendant’s
regulatory obligations. See Oral Argument Tr., Spokeo, Inc., v. Robins, No. 13-1339,
at 26–27, 43 (Nov. 2, 2015). This makes sense under Lujan: a plaintiff should not
be able to pursue violations of an entity’s procedural duties (notwithstanding the
FCRA cause of action provision), unless (1) the procedural duty protected particular
individuals like the plaintiff, or (2) the violation was not “bare” and caused some
additional and unique harm to the plaintiff. It is otherwise the executive branch’s
role and duty to investigate and enforce violations of general regulatory obligations.
See
Chaney, 470 U.S. at 827–835.
The Court in Spokeo did not, in the end, untangle the statutory web of the
FCRA, and it remanded for further proceedings in the circuit court. But we are faced
138
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 139 of 148
with a much easier case here. The FACTA imposes a duty upon Godiva to truncate
the credit card numbers in its receipts, a duty clearly intended to protect individual
cardholders, like Dr. Muransky, who purchase goods from its stores. Dr. Muransky
alleged that Godiva did not provide him with a truncated receipt and therefore
violated his private statutory right. That allegation alone suffices for standing. 12
C
If the common-law tradition and contemporary Supreme Court cases are not
sufficiently convincing, then consider the characteristics of an Article III “Case or
Controversy” that justiciability doctrines aim to ensure.
First, there is adverseness—that the parties “face each other in an adversary
proceeding” and that their dispute “relates to legal rights and obligations[.]”
Haworth, 300 U.S. at 242. There must be an “honest and actual antagonistic
assertion of rights” by one individual against another, which is neither “feigned” nor
“collusive.” See United States v. Johnson,
319 U.S. 302, 305 (1943) (quoting
Chicago & G.T. Ry. Co. v. Wellman, 14
3 U.S. 339, 345 (1892)). See also Lord v.
Veazie, 49 U.S. (8 How.) 251, 254 (1850). “Concrete adverseness . . . sharpens the
12
Viewing Spokeo through the rights-based lens also leads to the conclusion that Dr.
Muransky’s injury was both “concrete” and “particularized.” The invasion of the private right was
concrete—i.e., real, and not abstract—insofar as Godiva engaged in affirmative conduct that
explicitly violated Dr. Muransky’s private right to a truncated receipt. The injury was also
particularized because Godiva printed a receipt specifically for Dr. Muransky and that receipt
displayed only his unique credit card number.
139
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 140 of 148
presentation of issues upon which the court so largely depends[.]” Linda R.S., 410
U.S. at 616 (internal quotation marks omitted).
Second, a court must not issue an “advisory opinion”—it must issue a “decree
of a conclusive character, as distinguished from an opinion advising what the law
would be upon a hypothetical state of facts.” Haworth, 300 U.S. at 242. See also 2
The Records of the Federal Convention of 1787, at 341 (M. Farrand ed. 1966)
(hereinafter “Farrand”) (describing the failed proposal at the Convention that would
have given Congress and the Executive the “authority to require the opinions of the
supreme Judicial Court upon important questions of law, and upon solemn
occasions”); 3 Correspondence and Public Papers of John Jay 486–89 (H. Johnston
ed. 1891) (relating that the Justices of the Supreme Court refused to offer an opinion
requested by the President and Secretary of State regarding foreign treaties, as such
advice would be “extra-judicial[ ]”). The final judgment should not be subject to
review or revision by another branch of government. See United States v. Ferreira,
54 U.S. (13 How.) 40, 52–53 (1851). See also Hayburn’s Case, 2 U.S. (2 Dall.) 408,
410 n* (1792) (opinion of Wilson and Blair, JJ., and Peters, D.J.) (“[R]evision and
control” of an Article III judgment by the legislature or executive officer is “radically
inconsistent with the independence of that judicial power which is vested in the
courts”).
140
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 141 of 148
Third, federal courts have traditionally avoided difficult political questions.
These include the validity of a foreign treaty or the lawful authority of a state
government. See Ware v. Hylton, 3 U.S. (3 Dall.) 199, 260 (1796) (Iredell, J.,
concurring) (explaining that to declare a foreign treaty void would turn on
“considerations of policy, considerations of extreme magnitude, [which are]
certainly entirely incompetent to the examination and decision of a Court of
Justice”); Luther v. Borden, 48 U.S. (7 How.) 1, 42 (1849) (“Congress must
necessarily decide what government is established in the State before it can
determine whether it is republican or not. . . . And its decision is binding on every
other department of the government, and could not be questioned in a judicial
tribunal.”). See also Marbury, 5 U.S. (1 Cranch) at 169–170 (explaining that there
are “peculiarly irksome” and “delicate” “[q]uestions, in their nature political” that
should not be resolved by federal courts). 13
Not even one of these concerns is present here. Dr. Muransky faces Godiva
as an adversary, hoping to vindicate the invasion of his private legal rights. The use
of “judicial power” to find the existence of a statutory right and violation, and then
13
I recognize that the Supreme Court’s political question checklist, see, e.g., Baker v. Carr,
369 U.S. 186, 217 (1962) (listing six factors), has been subject to criticism, but that does not
eliminate the reality that some matters are inappropriate for judicial resolution.
141
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 142 of 148
to provide a remedy by awarding statutory damages, would not require the court to
issue an advisory opinion or tackle a political question.14
For example, compare Dr. Muransky’s claim to that of the plaintiff in Jeffries,
who, as I mentioned above, alleged that a vendor printed a receipt with all 16 digits
of her credit card number and the expiration date. See Jeffries, 928 F.3d at 1062.
The D.C. Circuit found standing based on the allegations in the plaintiff’s complaint
because that was the “nightmare scenario” the FACTA was intended to prevent. See
id. at 1066. The majority here appears to accept Jeffries as correctly decided but
distinguishes it as having a different “factual scenario.” Although the plaintiff in
Jeffries perhaps faced a higher risk of identity theft, how could that difference be of
constitutional magnitude? The defendants in both cases violated the express terms
of a statute, which were intended to protect the plaintiffs in the same way. In terms
of adverseness, style of proceedings, type of judicial decision-making, and remedy,
the two cases are entirely indistinguishable.
The attempt to distinguish these two cases is in a way an “extra-judicial” act,
insofar as a court must draw lines beyond those already drawn by Congress. See
14
If the majority has some unstated concern that Dr. Muransky is not a sufficiently
motivated adversary to represent absent class members due to the unlikelihood of his experiencing
identity theft, then that should be dealt with under Rule 23, not Article III. In certifying the class
here, the district court found that Dr. Muransky was an adequate class representative. And for
Article III purposes, he is undoubtedly an adversary of Godiva’s. Godiva allegedly invaded his
private right, he seeks to vindicate that right, and the two parties do not have aligned interests.
There is no suggestion that this is a feigned or collusive suit.
142
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 143 of 148
Hollingsworth v. Perry, 570 U.S. 693, 700 (2013) (explaining that the threshold
standing requirement “ensures that we act as judges, and do not engage in
policymaking properly left to elected representatives”). The majority here in effect
amends the FACTA by denying its protections to a subgroup of plaintiffs—those
who received receipts displaying ten digits of a credit card number. Presumably the
FACTA still works for plaintiffs like the one in Jeffries, whose receipts included all
16 digits, and maybe even for other subgroups of plaintiffs whose receipts display
11 or more digits. But at the end of the day, there is no constitutional principle—
whether based on text, structure, or history—that can provide a manageable rule of
decision for distinguishing between any two cases involving explicit FACTA
violations. Cf. William Baude, Standing in the Shadow of Congress, 2016 Sup. Ct.
Rev. 197, 224 (arguing that the Supreme Court’s “so far unsuccessful quest to define
the limits of statutory standing is reminiscent of the path of another doctrine—that
of substantive due process”).
Consider how much damage the majority’s decision does to the actual text of
Article III, which limits the “judicial Power” to “Cases or Controversies.” If
anything, those terms import a qualitative notion about justiciability. See 2 Farrand,
at 430–32 (noting James Madison’s concern that the judicial power should extend
only “to cases of a Judiciary Nature”); Osborn, 22 U.S. (9 Wheat.) at 819 (Marshall,
C.J.) (describing cases and controversies as taking on a certain “form that the judicial
143
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 144 of 148
power is capable of acting on”). The words do not and cannot have any inherent
quantitative parameters. One would not think of a lawsuit alleging battery as being
any more or less of a “case” than another lawsuit alleging battery, simply based on
the extent of the plaintiff’s injuries or the amount of damages awarded.
The same is true for threatened injuries caused by violations of private rights.
In my view, there is no textual basis in Article III to distinguish between two
plaintiffs who experience a violation of the same statutory private right, even though
one might face a more imminent factual injury than the other as a result of the
violation. One, both, or neither of the two plaintiffs could eventually suffer the harm
that Congress sought to prevent; but the plaintiffs’ use of the courts to vindicate their
legal rights would be identical in character. There would be an assessment of the
legal right, a finding that it had been violated, and an imposition of a corresponding
remedy. This would be a typical case—the “regular course of judicial procedure.”
Muskrat v. United States, 219 U.S. 346, 356 (1911). It is not only unnecessary to
superimpose an injury-in-fact inquiry at the threshold of such a private rights
dispute, but, as we have seen, it turns Article III upside down.
I leave for another day the scope and role of injury in fact in public rights
litigation, which is part of an ongoing and important debate. But suffice it to say
that an injury in fact is not required for a private rights dispute, and Dr. Muransky
should have standing here.
144
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 145 of 148
D
There has been profound confusion about current standing doctrine. See, e.g.,
Robert J. Pushaw, Jr., Justiciability and Separation of Powers: A Neo-Federalist
Approach, 81 Cornell L. Rev. 393, 480 (1996) (describing the doctrine as
“theoretically incoherent”); Cass R. Sunstein, Standing and the Privatization of
Public Law, 88 Colum. L. Rev. 1432, 1458 (1988) (calling standing “manipulable”
and permeated with “doctrinal confusion”). This has only gotten worse since
Spokeo, as courts have been asked to address standing under complex data and
consumer privacy statutes. See, e.g. Beck v. McDonald, 848 F.3d 262, 273 (4th Cir.
2017) (summarizing a circuit split with respect to threatened injuries in data privacy
and security breach cases); Note, Cyberlaw-Data Breach Litigation, 133 Harv. L.
Rev. 1095, 1095, 1101 (2020) (describing a “pattern of lower courts struggling to
reconcile Supreme Court guidance with a theory of future injury” and a “pattern of
lower court confusion over how Clapper and Spokeo apply to data breaches”). Time
will tell whether the Supreme Court will step in to sort out the doctrinal incoherence.
See Bradford C. Mank, Data Breaches, Identity Theft, and Article III Standing: Will
the Supreme Court Resolve the Split in the Circuits?, 92 Notre Dame L. Rev. 1323,
1324 (2017).
In the meantime, Justice Thomas’ concurrence in Spokeo provides some
much-needed clarity in this area. His “framework,” to be sure, is not a new concept,
145
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 146 of 148
but merely an explanation of something that has been true since the common law
and which has persisted in contemporary standing jurisprudence: public rights and
private rights are treated differently for purposes of Article III justiciability.15
Because “the requirements of standing turn on whether the plaintiff seeks to
vindicate a private or public right, the first step in any standing case is to classify the
asserted right.” Springer v. Cleveland Clinic Employee Health Plan Total Care, 900
F.3d 284, 290 (6th Cir. 2018) (Thapar, J., concurring) (emphasis added). The
majority here fails to take that initial step, however, and blindly applies the injury-
in-fact requirement where it is not needed. That is not all the majority’s fault. As I
have explained, the Supreme Court has frequently, but incautiously, identified
factual injury as part of an “irreducible constitutional minimum,” and so naturally
the majority would think to apply it in any case where standing is at issue. But a
closer look at the Court’s decisions shows that this is not quite right. At most, an
injury in fact is only necessary when the plaintiff purports to stand on and vindicate
public rights.
The rights-based framework may not immediately resolve all of the difficult
questions in the public litigation context. See id at 290 (noting that “a lawsuit
15
The public-private rights distinction is also not unique to standing doctrine. See, e.g.,
Stern v. Marshall, 564 U.S. 462, 488–92 (2011) (discussing a category of “public rights,” dating
back to Murray’s Lessee v. Hoboken Land & Improvement Co., 59 U.S. (18 How.) 272 (1856),
which could be adjudicated outside of the Article III judicial branch).
146
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 147 of 148
seeking to vindicate a public right presents a harder question” with respect to
standing). But at least it gives us a starting point, and reminds us that an injury is
not a requirement for its own sake, but is instead a way for a plaintiff to distinguish
himself from the public at large and to demonstrate that he seeks to vindicate his
own particularized rights or injuries. Where a statute creates a private right, on the
other hand, the injury-in-fact inquiry serves little or no purpose. It does not preserve
any of the traditional characteristics of a “Case or Controversy,” which are already
present simply because the plaintiff is seeking to vindicate personal legal rights that
the defendant violated. With that basic understanding in mind, we should have a
much easier time navigating complex data and consumer privacy statutes, many of
which, like the FACTA, create straightforward private rights.
I close by acknowledging that I am not the first to express interest in
refocusing standing doctrine based on Justice Thomas’ concurrence in Spokeo.
Justice Gorsuch recently signed onto an opinion applying the rights-based rubric.
See Thole, 140 S. Ct. at 1622 (Thomas, J., concurring). And several other judges
and commentators have cited to, applied, or endorsed it. See Bryant v. Compass
Grp. USA, Inc., No. 20-1443,
2020 WL 2121463, at *5 (7th Cir. May 5, 2020)
(applying Justice Thomas’ “rubric” in the alternative for claims under the Biometric
Information Privacy Act, and having “no trouble concluding that [the plaintiff] was
asserting a violation of her own rights [which was] enough to show injury-in-fact
147
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 148 of 148
without further tangible consequences”); Huff v. TeleCheck Servs., Inc., 923 F.3d
458, 469 (6th Cir. 2019) (“The theory deserves further consideration at some point.
It seems to respect history and cuts a path in otherwise forbidding terrain.”);
Springer, 900 F.3d at 290 (Thapar, J., concurring) (“Since the founding, a lawsuit
seeking to vindicate an individual’s private rights has counted as a case or
controversy for purposes of Article III.”);
Robins, 867 F.3d at 1116 (citing Justice
Thomas’ Spokeo concurrence and noting that the plaintiff’s claim “clearly
implicates, at least in some way, [his] concrete interests in truthful credit reporting”);
Zink v. First Niagara Bank, N.A.,
206 F. Supp. 3d 810, 816 (W.D.N.Y. 2016)
(“Justice Thomas’s concurring opinion in Spokeo offers a reasonable (to me, at least)
resolution to the confusion” of modern standing doctrine.”); Baude, Standing in the
Shadow of Congress, 2016 Sup. Ct. Rev. at 229 (explaining that the public-private
rights framework “may need to be articulated more fully in the future,” but
concluding that it is more realistic and workable than other post-Spokeo attempts to
define a “platonic class of real injuries”). Hopefully, I also won’t be the last.
III
Dr. Muransky has standing to assert Godiva’s violation of the FACTA. But
even if I am mistaken on this point, we should remand to give him an opportunity to
satisfy the majority’s newly articulated Article III standard. With respect, I dissent.
148
