ORDER

TROY L. NUNLEY, District Judge.

This matter is before the Court pursuant to Defendant Wal-Mart Stores, Inc.'s ("Defendant") Motion to Determine Whether Subject Matter Jurisdiction Exists pursuant to Federal Rule of Civil Procedure 12(h)(3) ("Rule 12(h)(3)"). (ECF No. 86.) Plaintiffs Amy Fraser and Paula Haug ("Plaintiffs") filed an opposition to Defendant's motion. (ECF No. 88.) Defendant also filed a reply. (ECF No. 89.) The Court has carefully considered the arguments raised in Defendant's motion and reply, as well as Plaintiffs' opposition. For the reasons set forth below, Defendant's motion is DENIED.

I. FACTUAL BACKGROUND

Plaintiffs assert claims under the Song-Beverly Credit Card Act of 1971 Section 1747.08(a)(2)1 (the "Act" or "Section 1747.08(a)(2)") arising out of Defendant's alleged requesting and recording of customers' ZIP codes in its California retail stores. (ECF No. 22.) Plaintiffs contend that Defendant has a company policy where, in each of its California retail stores, credit card customers are asked or even sometimes required to input their ZIP codes into the electronic pin pad device adjacent to the cashier at the checkout stand. (ECF No. 15-1 at 4.) Defendant acknowledged that it did request and record the ZIP codes from those customers using an American Express credit card for purchases exceeding $50. (ECF No. 15-1 at 4.) Furthermore, Defendant admits to requesting and recording the ZIP codes from customers using Discover credit cards for transactions exceeding $200. (ECF No. 15-1 at 4.)

Defendant explains that in order to allow credit cards as a form of payment, Defendant must enter into acceptance agreements with credit card companies. (ECF No. 16 at 5.) Defendant also explains that in furtherance of preventing criminal activity, many credit card companies have developed ZIP code verification protocols that systematically and instantaneously match the ZIP code entered at the point of sale with the billing ZIP code on the credit card account. (ECF No. 16 at 5.) Defendant states that it uses a customer activated terminal ("CAT") whenever a customer pays with a credit card. (ECF No. 16 at 6.) When a card is swiped, the CAT prompts the customer to provide any additional information needed depending on the card type. (ECF No. 16 at 6.)

II. PROCEDURAL BACKGROUND

On December 24, 2014, this Court granted Plaintiffs' Motion for Class Certification. (ECF No. 22.) The Court found that all four prerequisites of Rule 23(a) were met as well as at least one of the requirements of subpart (b), and therefore certified the Class. (ECF No. 22 at 14.) The Class was certified as follows:

(ECF No. 22 at 4.) Defendant filed a petition to appeal the certification order and that petition was denied by the Ninth Circuit on March 25, 2015. (ECF No. 46-1 at 1.)

Plaintiffs moved this Court for an order approving Class Notice. (ECF No. 46.) Defendant filed a motion to decertify the Class, alleging that the record before the Court established that: the Class was not ascertainable, that Defendant did not follow a uniform policy of requesting and recording ZIP codes from all of its credit card customers in California during the proposed class period, and that individual issues predominate over any common issues. (ECF No. 51-2 at 1.) Plaintiffs opposed the Defendant's Motion Requesting Decertification. (ECF No. 53.)

Plaintiffs, along with Defendant, filed a Joint Statement requesting that the Court defer judgment while the parties mediated. (ECF No. 71.) However, Plaintiffs and Defendant were unable to reach an agreement and filed a Joint Status Report concluding mediation. (ECF No. 85.)

Defendant now requests that this Court consider the United States Supreme Court holding in Spokeo, Inc. v. Robins, 136 S.Ct. 1540 (2016) to determine whether Plaintiffs continue to have Article III standing to pursue their claims. (ECF No. 86.) Defendant argues that if the Court finds that Spokeo applies and that Plaintiffs lack Article III standing, Rule 12(h)(3) requires the Court to dismiss the action. (ECF No. 86 at 8.) Plaintiffs argue that Spokeo does not apply to the facts of this case because the Supreme Court did not render any substantive decision that contains any new legal requirements. (ECF No. 88 at 4.)

III. STANDARD OF LAW

A party may bring a motion to challenge a court's subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1). Thornhill Publ'g Co. v. Gen. Tel. & Elec. Corp., 594 F.2d 730, 733 (9th Cir. 1979). The objection that a federal court lacks subject-matter jurisdiction may be raised by a party, or by a court on its own initiative, at any stage in the litigation, even after trial and the entry of judgment. Arbaugh v. Y&H Corp., 546 U.S. 500, 506 (2006). The challenge can be either facial or factual. White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000).

"When subject matter jurisdiction is challenged under Federal Rule of [Civil] Procedure 12(b)(1), the plaintiff has the burden of proving jurisdiction in order to survive the motion." Tosco Corp. v. Communities for a Better Env't, 236 F.3d 495, 499 (9th Cir.2001) (abrogated on other grounds by Hertz Corp. v. Friend, 559 U.S. 77 (2010)). "`Unless the jurisdictional issue is inextricable from the merits of a case, the court may determine jurisdiction on a motion to dismiss for lack of jurisdiction under Rule 12(b)(1)[.]'" Robinson v. U.S., 586 F.3d 683, 685 (9th Cir. 2009) (internal citations omitted). "A suit brought by a plaintiff without Article III standing is not a `case or controversy,' and an Article III federal court therefore lacks subject matter jurisdiction over the suit." Cetacean Community v. Bush, 386 F.3d 1169, 1175 (9th Cir.2004). If the court determines at any time that it lacks subject matter jurisdiction, "the court must dismiss the action." Fed. R. Civ. P. 12(h)(3).

IV. ANALYSIS

The question before the Court is whether Plaintiffs alleged a bare procedural violation of Section 1747.08 of the California Song-Beverly Credit Card Act and, if so, whether that is sufficient to confer Article III standing on Plaintiffs. (ECF No. 87 at 3.) Defendant argues that the Court in Spokeo held "that a plaintiff must allege something more than a bare procedural violation of the law to satisfy Article III." (ECF No. 86 at 7.) In the instant case, Plaintiffs assert that Defendant's actions "exposed [Plaintiffs] to the dangers the statute was designed to prevent" and this is enough to satisfy the requirements of Article III standing. (ECF No. 88 at 6.)

To satisfy Article III standing, a plaintiff must allege: (1) an injury-in-fact that is concrete and particularized, as well as actual or imminent; (2) that the injury is fairly traceable to the challenged action of the defendant; and (3) that the injury is redressable by a favorable ruling. Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139 (2010); Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180-81 (2000). "The party invoking federal jurisdiction bears the burden of establishing these elements [. . .] with the manner and degree of evidence required at the successive stages of the litigation." Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992). In class actions, "the named representatives must allege and show that they personally have been injured." Lierboe v. State Farm Mut. Auto. Ins. Co., 350 F.3d 1018, 1022 (9th Cir.2003) (quoting Pence v. Andrus, 586 F.2d 733, 736-37 (9th Cir.1978)). The "injury must have actually occurred or must occur imminently; hypothetical speculative or other `possible future' injuries do not count in the standings calculus." Schmier v. U.S. Court of Appeals for Ninth Circuit, 279 F.3d 817, 820 (9th Cir.2002) (citing Whitmore v. Arkansas, 495 U.S. 149, 155 (1990)).

Defendant asserts that "Plaintiffs allege only a bare procedural violation of [Section 1747.08]" and that "the alleged statutory violation is not sufficient by itself to satisfy the injury in fact requirement" of Article III. (ECF No. 86 at 8.) Defendant argues that "Plaintiffs do not allege that they suffered a concrete injury . . . [and that] they seek only `civil penalties.'" (ECF No. 86 at 5.) Defendant concludes by stating that the application of Spokeo should lead the Court to find that Plaintiffs' allegations do not survive under Article III standing requirements. (ECF No. 86 at 8.)

Plaintiffs argue that "[t]he allegations in this case are simply not of a technical nature where no harm is imaginable." (ECF No. 88 at 6.) Plaintiffs explain that the information collected by Defendant "exposes Plaintiffs to hackers as well as Defendant's own improper usage." (ECF No. 88 at 6.) Therefore, Plaintiff argues, Defendant's actions constitute a legal violation, significant risk to Plaintiffs, and, thus, a concrete violation of Section 1747.08.

In Spokeo the plaintiff alleged that Spokeo, an online background check company, reported inaccurate information about him to its customers. Spokeo, 136 S. Ct. at 1543. The plaintiff then sued Spokeo, alleging that the defendant operated its website in violation of the Fair Credit Reporting Act ("FCRA"). Id. The Ninth Circuit held that the plaintiff had adequately alleged an injury in fact because he sufficiently alleged that "Spokeo violated his statutory rights" and that his "personal interests in the handling of his credit information [were] individualized rather than collective." Robins v. Spokeo, Inc., 742 F.3d 409, 413 (2014). The Supreme Court reversed finding that the Ninth Circuit erred in its standing analysis by focusing solely on whether the plaintiff's purported injury was "particularized" without also assessing whether it was sufficiently "concrete." The Court stated that "[t]he Ninth Circuit's injury-in-fact analysis elided the independent `concreteness' requirement. Both observations it made concerned only `particularization,' i.e., the requirement that an injury `affect the plaintiff in a personal and individual way.'" Spokeo, 136 S. Ct. at 1543 (quoting Lujan, 504 U.S. at 560).

The Supreme Court further stated that a "`concrete' injury must be `de facto'; that is, it must actually exist." Id. at 1548; See Black's Law Dictionary 479 (9th ed. 2009). The Court clarified that, though tangible injuries are easier to recognize as "concrete," many of the Court's previous cases have shown that intangible injuries can also qualify as concrete. Id. at 1549; See, e.g., Pleasant Grove City v. Summum, 555 U.S. 460 (2009) (free speech); Church of Lukumi Babalu Aye, Inc. v. Hialeah, 508 U.S. 520 (1993) (free exercise). "In determining whether an intangible harm constitutes injury in fact, both history and the judgment of Congress play important roles." Spokeo, 136 S. Ct. at 1549. "Congress may `elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.'" Id. (quoting Lujan, 504 U.S. at 578).

However, the Supreme Court stated that "Congress' role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right." Spokeo, 136 S. Ct. at 1549. "Article III standing requires a concrete injury even in the context of a statutory violation." Id. Therefore, the Court reasoned, a plaintiff cannot allege a bare procedural violation absent a concrete injury and still be able to satisfy the Article III injury-in-fact requirement. Id.; See Summers v. Earth Island Institute, 555 U.S. 488, 496 (2009) ("[D]eprivation of a procedural right without some concrete interest that is affected by the deprivation . . . is insufficient to create Article III standing").

"This does not mean, however, that the risk of real harm cannot satisfy the requirement of concreteness." Spokeo, 136 S. Ct. at 1549. The Supreme Court explained that "the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact . . . [and] a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified." Id. at 1549-50, See Federal Election Comm'n v. Akins, 524 U.S. 11, 20-25 (1998) (confirming that a group of voters' "inability to obtain information" that Congress had decided to make public is a sufficient injury in fact to satisfy Article III); Public Citizen v. Department of Justice, 491 U.S. 440, 449 (1989) (holding that two advocacy organizations' failure to obtain information subject to disclosure under the Federal Advisory Committee Act "constitutes a sufficiently distinct injury to provide standing to sue"). The Court in Spokeo recognized that the law has permitted recovery by victims even if their harms are difficult to prove or measure. Spokeo, 136 S. Ct. at 1549. Additionally, in regards to Section 1747.08, "the legislative history of . . . [S]ection 1747.08 in particular, demonstrates the Legislature intended to provide robust consumer protections." Pineda v. Williams-Sonoma Stores, Inc., 51 Cal.4th 524, 535-36 (2011).

The Song-Beverly Credit Card Act states that a retailer may not request "personal identification information" when a consumer makes a credit card purchase. Cal. Civ. Code § 1747.08(a)(2). The California Supreme Court held that "personal identification information" includes a person's ZIP code because it is part of an individual's address, is similar in character to an address or telephone number which are also considered personal identification information, and can be used with a credit card holder's name to locate his or her home address. Pineda, 51 Cal. 4th at 531-32. Therefore, the court in Pineda held that requesting and recording a cardholder's ZIP code violates the Song-Beverly Credit Card Act. Id. at 527. This Court agrees with the California Supreme Court and finds that the Song-Beverly Credit Card Act confers standing on plaintiffs who sufficiently allege violations of Section 1747.08. This Court reasons that properly alleging a violation of Section 1747.08 confers standing on a plaintiff due to the fact that the statute was designed to protect consumers from harms such as abuse by retailers of private consumer information. Id. at 534.

In the instant case, Plaintiffs allege that Defendant violated Section 1747.08 by requesting and recording the ZIP codes from its customers. (ECF No. 15-1 at 9.) Plaintiffs argue that Section 1747.08 "was passed to combat retailers' improper collection of personal identification information that leads to undesired marketing contact, credit card fraud, identity theft and even stalking." (ECF No. 88 at 6.) Accordingly, Plaintiffs assert that Section 1747.08 "provides for mandatory civil penalties to be assessed against those who violate the law because of the imminent danger such a violation presents to the consumer." (ECF No. 88 at 6.) Defendant argues that, besides seeking "only civil penalties," Plaintiffs do not allege that they suffered a concrete injury. (ECF No. 86 at 5.) This Court disagrees.

The holding in Spokeo does not have as broad an application as Defendant argues. Defendant asserts that Spokeo applies in the instant case because the issue here is similar to that discussed in Spokeo. (ECF No. 86 at 4-5.) Thus, Defendant argues, Plaintiffs must allege more than a "bare procedural violation" in order to constitute a concrete injury that satisfies Article III standing requirements. (ECF No. 88 at 8.)

In their reply to Plaintiffs' opposition, Defendant points to various cases that have issued rulings based on the holding in Spokeo in order to argue that the Court should rule in a similar manner to those cases. (ECF No. 89 at 4-7.) One such case is Hancock v. Urban Outfitters, Inc., No. 14-7047, 2016 WL 3996710 (D.C. Cir. July 26, 2016), where the plaintiffs alleged that the defendants unlawfully collected their zip codes in violation of the District of Columbia's consumer protection statutes. (ECF No. 89 at 4.) However, while the facts in Hancock are similar to the instant case, the plaintiffs in Hancock do not allege "any invasion of privacy, increased risk of fraud or identity theft, or pecuniary or emotional injury." Hancock, 2016 WL 3996710, at *3. Therefore, the court in Hancock ruled that "without any plausible allegation of Article III injury, the complaint fails to state a basis for federal court jurisdiction." Id. However, in this case Plaintiffs have alleged that Defendant's actions exposed them to "undesired marketing contact, credit card fraud, identity theft, and even stalking." (ECF No. 88 at 6.) Therefore, this Court finds that the two cases are dissimilar and that the court's ruling in Hancock has no effect on this case.

Defendant also directs the Court to consider Medellin v. IKEA U.S.A. W., Inc., No. 11CV921 WQH (BGS), 2011 WL 5104362 (S.D. Cal. Oct. 27, 2011). (ECF No. 89 at 5.) In Medellin, the plaintiff brought a class action against defendant alleging that defendant had unlawfully collected and recorded ZIP codes in violation of Section 1747.08. Medellin, 2011 WL 5104362, at *1. Defendant points out that the district court found for the plaintiff individually even though the defendant argued that the plaintiff lacked standing. (ECF No. 89 at 5.) Defendant also states that the court decertified the class and that the plaintiff appealed the decertification to the Ninth Circuit. (ECF No. 89 at 5.) Defendant argues to the Court that the plaintiff filed a motion to dismiss her appeal based on the holding in Spokeo. (ECF No. 89 at 5.) The Court interprets Defendant's case illustration to be Defendant's argument that the Court should hold that the class in the instant case should be decertified in light of the fact that other plaintiffs fail to show standing in similar cases. However, the Ninth Circuit has not issued a ruling in the Medellin case and this Court refuses to base its ruling on the perceived reasoning of another plaintiff's actions. Therefore, this Court again finds that Defendant has not provided this Court with a sufficient reason to find that Plaintiffs lack standing.

The Court in Spokeo stated that "the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact." Spokeo, 136 S. Ct. at 1549. Additionally, the risk of real harm can satisfy the requirement of concreteness. Id. (emphasis added). Accordingly, this Court finds that Plaintiffs adequately allege a procedural violation of Section 1747.08 sufficient to satisfy Article III standing requirements. Additionally, even if this Court were to consider Defendant's request to follow the holding of Spokeo, the Court finds that Plaintiffs sufficiently allege concrete harm because they assert that Defendant's collection of their ZIP codes exposed them to undesired marketing contact, credit card fraud, identity theft, stalking, and hackers. (ECF No. 88 at 6.)

At this point, the Court is left to consider Defendant's Motion to Decertify the Class in order to determine if Plaintiffs can still bring their claims. Plaintiffs brought their cause of action in state court and Defendant properly removed it to federal court under the Class Action Fairness Act of 2005 ("CAFA"). (Def.'s Not. of Rem., ECF No. 1) This Court then granted Plaintiffs' Motion for Class Certification and the Ninth Circuit denied Defendant's petition to appeal the certification. (ECF No. 22 & 46-1 at 2.) Defendant now asks this Court to consider whether Plaintiffs still satisfy the requirements of Rule 23. (ECF No. 51-2.) As long as the Court continues to find that Plaintiffs adequately meet the Rule 23 standards to maintain a class action, then Plaintiffs will have standing to bring their claims in this Court. However, this issue will be addressed in a subsequent order. In regards to Defendant's motion to determine whether subject matter exists, the Court finds that the holding in Spokeo does not apply and this Court continues to have subject matter jurisdiction in this case.

V. CONCLUSION

For the reasons set forth above, the Court DENIES Defendant's Motion to Determine Whether Subject Matter Jurisdiction Exists (ECF No. 86).

IT IS SO ORDERED.