CURTIS L. COLLIER, UNITED STATES DISTRICT JUDGE.
Before the Court is a motion to dismiss by Defendants Moran Foods, LLC and Save-a-lot, LTD. (Doc. 20.) On March 26, 2019, the Court granted a motion by Defendants Newcorp, LLC, and Save-a-lot Knoxville, LLC to join in the motion to dismiss. (Doc. 27.) Plaintiff Larry McCloud has responded in opposition to the motion to dismiss (Doc. 30), and Defendants Moran Foods, LLC, Save-a-lot, LTD., Newcorp, LLC, and Save-a-lot, Knoxville, LLC ("Defendants"
Upon review of the submissions of the parties, the docketed record, and applicable law, the Court finds that a hearing is not necessary to resolve the issues before it. The Court will
On November 15, 2018, Plaintiff filed this case as a putative class action, alleging in a one-count complaint that Defendants violated the Fair and Accurate Credit Transactions Act ("FACTA"), 15 U.S.C. § 1681, et seq. (Doc. 1.) Plaintiff states that Defendants transgressed a portion of FACTA which prohibits printing more than the last five digits of a consumer's credit or debit card number on any transactional receipt. Plaintiff alleges that Defendants printed at least the first six and the last four digits of the credit or debit card number on receipts given to Plaintiff and putative class members. Plaintiff has
On March 12, 2019, Defendants moved to dismiss Plaintiff's complaint under Federal Rule of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction, or alternatively, under Rule 12(b)(6) for failure to state a claim. (Doc. 20.)
When a defendant moves to dismiss for a lack of subject-matter jurisdiction under Rule 12(b)(1), the plaintiff has the burden of proving jurisdiction. Davis v. United States, 499 F.3d 590, 593-94 (6th Cir. 2007). A Rule 12(b)(1) motion may present either a facial attack, which questions the sufficiency of the pleadings, or a factual attack, which challenges the factual existence of subject-matter jurisdiction. United States v. Ritchie, 15 F.3d 592, 598 (6th Cir. 1994).
Defendants do not specify here, but appear to generally make a facial attack on the sufficiency of Plaintiff's pleadings. While Defendants make some factual arguments,
"When reviewing a facial attack, a district court takes the allegations in the complaint as true," though conclusory allegations and legal conclusions will not prevent dismissal. Gentek Bldg. Prods. v. Sherwin-Williams Co., 491 F.3d 320, 330 (6th Cir. 2007); O'Bryan v. Holy See, 556 F.3d 361, 376 (6th Cir. 2009).
In support of their motion to dismiss, Defendants argue that Plaintiff has not suffered an injury in fact, that Plaintiff does not fall within the zone of interests of FACTA,
The Court first provides some background information regarding FACTA before turning to a discussion of the legal standard for alleging an injury in fact in
Title Fifteen, United States Code Section 1681c(g) is entitled "Truncation of credit card and debit card numbers," and states,
15 U.S.C. § 1681c(g). Congress enacted this provision of FACTA as an amendment to the Fair Credit Reporting Act (the "FCRA") in a 2003 effort to prevent identity theft. Kamal, 918 F.3d at 106. The provision was "included ... to limit the number of opportunities for identity thieves to `pick off' key card account information." Id. (quoting S. Rep. No. 108-166, at 13 (2003)).
In May of 2007, the Federal Trade Commission ("FTC") issued a notice reminding businesses that the law had gone into effect, and that under it, businesses "may include no more than the last five digits of the card number, and [that they] must delete the card's expiration date." Slip Showing? Federal Law Requires All Businesses to Truncate Credit Card Information on Receipts, Federal Trade Commission (May 2007), https://www.ftc.gov/tips-advice/business-center/guidance/slip-showing-federal-law-requires-all-businesses-truncate. The FTC stated, "[f]or example, a receipt that truncates the credit card number and deletes the expiration date could look like this:
Id. The FTC stated it was important for businesses to comply with the law in order to prevent "fraudsters and identity thieves," but also because "[n]oncompliance could open a company up to an FTC law enforcement action, including civil penalties and injunctive relief." Id. The FTC also noted that, "the law allows consumers to sue businesses that don't comply and to collect damages and attorney's fees." Id.
The parties dispute the significance of a development regarding FACTA which took place around that same time. By 2007, FACTA was resulting in a consequence Congress had not anticipated—"hundreds of lawsuits were filed" which Congress saw as "abusive" and which did "not protect consumers but only result in increased cost to business and potentially increased prices to consumers." Credit and Debit
As the number and breath of federal laws like FACTA have grown, federal courts have had occasion to consider whether a defendant's alleged violation of those statutes can confer an injury in fact onto a plaintiff, and by consequence, have the potential to confer adequate standing. See Macy v. GC Services Ltd. P'ship, 897 F.3d 747, 753-56 (6th Cir. 2018).
At their core, arguments about the doctrine of standing concern the power a federal court has under the United States Constitution. Under the Constitution, federal courts are endowed with "[t]he judicial Power of the United States." U.S. Const. Art. III, § 1. The judicial power of the United States extends only to "Cases" and "Controversies." Id. § 2. Standing is rooted in the interpretation of what constitutes a "case" or "controversy," and which serves to properly limit the category of litigants empowered to maintain a lawsuit in federal court. Spokeo, Inc. v. Robins, ___ U.S. ___, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016). A litigant must have "`such a personal stake in the outcome of the controversy' as to warrant his invocation of federal-court jurisdiction and to justify exercise of the court's remedial powers on his behalf." Warth v. Seldin, 422 U.S. 490, 498-99, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975) (quoting Baker v. Carr, 369 U.S. 186, 204, 82 S.Ct. 691, 7 L.Ed.2d 663 (1962)).
The "irreducible constitutional minimum of standing contains three elements": (1) injury in fact, (2) causation, and (3) redressability. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). The injury in fact requirement mandates that a plaintiff must have suffered an invasion of a legally protected interest which is (a) concrete and particularized and (b) actual or imminent and not conjectural or hypothetical. Id. First, a plaintiff must show that he suffered a concrete injury—a de facto injury which "actually" exists. Soehnlen v. Fleet Owners Ins. Fund, 844 F.3d 576, 581-82 (6th Cir. 2016) (quoting Spokeo, 136 S. Ct. at 1548). Second, "[f]or an injury to be particularized, `it must affect the plaintiff in a personal and individual way.'" Id.;
In the foremost recent Supreme Court case on the issue of standing in the context of a statutory violation, Spokeo, Inc. v. Robins, ___ U.S. ___, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016), the Court considered whether a consumer had standing by alleging that a website operator had published inaccurate information about him in violation of the Fair Credit Reporting Act ("FCRA"). Macy, 897 F.3d at 753-56. Because the Supreme Court remanded Spokeo without deciding whether the consumer had adequately alleged an injury in fact on the facts of the case, interpretations of the decision have diverged. Id. at 754.
On the one hand, the Court made it clear that "a plaintiff must allege that the procedural statutory violation caused the plaintiff to suffer some harm that `actually exist[s]'; there must be an injury that is `real' and not `abstract' or merely `procedural.'" Id. at 753 (quoting Spokeo, 136 S. Ct. at 1548-49) (alteration in original). For example, the Supreme Court stated that even if a website operator violated the FCRA by reporting someone's zip code incorrectly, it would be "difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm." Spokeo, 136 S. Ct. at 1550. Through this observation, the Court recognized that the injury in fact requirement is a constitutional doctrine, and that "Congress cannot erase Article III's standing requirements by statutorily granting the right to sue a plaintiff who would not otherwise have standing." Id. (quoting Raines v. Byrd, 521 U.S. 811, 820 n.3, 117 S.Ct. 2312, 138 L.Ed.2d 849 (1997)). "[T]here is no such thing as an `anything-hurts-so-long-as-Congress-says-it-hurts theory of Article III injury.'" Huff v. TeleCheck Servs., Inc., 923 F.3d 458, 463 (6th Cir. 2019) (quoting Hagy v. Demers & Adams, 882 F.3d 616, 622 (6th Cir. 2018)).
On the other hand, however, the Court also recognized that the "violation of a procedural right granted by a statute can be sufficient in some circumstances to constitute injury in fact." Spokeo, 136 S. Ct. at 1549. Those harms, at times, can constitute an injury in fact because "Congress is well positioned to identify intangible harms that meet minimum Article III requirements," and because Congressional "judgment is instructive and important." Id. Indeed, the Court observed that, in a limited respect, "Congress may `elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.'" Id. (quoting Lujan, 504 U.S. at 578, 112 S.Ct. 2130). The Court has also instructed that it is important to consider "whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts," because the doctrine of standing is "grounded in historical practice." Id. Because of all of these observations, it is not accurate to state that a plaintiff has suffered an injury in fact only where he or she alleges an injury beyond the violation of a statute passed by Congress. Macy, 897 F.3d at 754.
In Macy v. GC Services Limited Partnership, the United States Court of Appeals for the Sixth Circuit recently explained those "circumstances" where the violation of a right granted by a statute can itself confer an injury in fact. 897 F.3d 747, 754 (6th Cir. 2018). Those instances
Id. at 756 (quoting Spokeo, 136 S. Ct. at 1549).
In line with this observation, when a plaintiff alleges that a statute has been broken, but makes no legitimate allegation concerning further harm he or she has suffered, the district court must ask two questions, all while focusing on the statutory provision at issue: first, did Congress confer this procedural right (which has since been allegedly violated) to protect the plaintiff's concrete interests? And, second, did the procedural violation itself present a material risk of real harm to that interest? If the answer to both questions is yes, then the plaintiff has alleged an injury in fact. If the answer to either question is no, then the plaintiff must allege some additional harm beyond the procedural violation to show he or she has suffered an injury in fact.
In regard to the second question, there must at least be a "material" risk of real harm when a statutory violation is at issue. Macy, 897 F.3d at 756. While Congress has "power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before," Spokeo, 136 S. Ct. at 1549 (quoting Lujan, 504 U.S. at 580, 112 S.Ct. 2130 (Kennedy, J., concurring) (internal quotation mark omitted)), the Supreme Court has also observed that, absent a statutory right of action, a threatened harm must be "certainly impending," or based on a "substantial risk" of harm to amount to an injury in fact, Clapper v. Amnesty Int'l USA, 568 U.S. 398, 409, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013). See Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 113 n.4 (3d Cir. 2019). The material risk of harm standard strikes a balance between these two observations when an alleged statutory violation is at issue. See id.
The parties dispute whether Plaintiff has alleged an injury in fact. Plaintiff's complaint and responsive brief state that Defendants injured Plaintiff, as well as those similarly situated, in two primary ways. (See Docs. 1, 30.) First, Defendants allegedly violated FACTA by printing at least the first six digits and the last four digits of the card number on receipts given to Plaintiff, as well as to purported class members. (Id. ¶ 4.) Plaintiff's complaint argues that this is not a "trifling matter" because the violation exposed Plaintiff and class members to "at least an increased and material risk of identity theft and credit card and or debit card fraud." (Id. ¶¶ 5, 9.) Plaintiff supports this argument by referencing Congress's reasons for protecting credit card numbers, as well as through information from computer scientists about hacking. (Id. ¶¶ 11-12.) Second, Plaintiff alleges that purported class members and himself were burdened with an
Notably, the majority of Plaintiff's complaint does not focus on Plaintiff at all. (See Doc. 1.) Rather, Plaintiff's allegations focus on the intent of Congress in passing FACTA, the ability of hackers to use credit card information to engage in cyberattacks, and the complex problem of identity theft. (Id.) Plaintiff does not allege, however, that his own receipt was lost or stolen, or that he has been a victim of identity theft or credit card fraud. (Id.) Indeed, Plaintiff does not even allege that someone else has viewed the partially redacted card digits on his receipt. (Id.) It is also notable that Plaintiff brings no claims sounding in state law, but only alleges one count of the violation of FACTA. Because Plaintiff has not alleged he suffered any actual injury "in the flesh-and-blood or dollars-and-cents sense of the term," nor has he alleged that it was "certainly impending" that his identity would be stolen, the Court begins by assessing whether Plaintiff's allegation of a FACTA violation created a "procedural or intangible injury." See Huff, 923 F.3d at 464.
Presented with allegations regarding a statutory violation of FACTA, the Court must assess whether "the violation of a procedural right granted by [FACTA] is sufficient in and of itself to constitute concrete injury in fact because Congress conferred the procedural right to protect a plaintiff's concrete interests and the procedural violation presents a material risk of real harm to that concrete interest." Macy, 897 F.3d at 756 (quoting Spokeo, 136 S. Ct. at 1549). The Court finds, first, that Congress conferred the rights contained in FACTA to protect Plaintiff's concrete interests in being free from identity theft, but, second, that Plaintiff has not sufficiently alleged a material risk of real harm to his concrete interests in his complaint.
It is relatively undisputed that the FACTA provision requiring the truncation of a consumer's credit card number "was part of Congress's effort to prevent the concrete harm of identity theft." Kamal, 918 F.3d at 115 (citing Bassett v. ABM Parking Servs., 883 F.3d 776, 782-83 (9th Cir. 2018) (FACTA's truncation provision seeks to reduce the risk of identity theft)); see also Katz v. Donna Karan Co., 872 F.3d 114, 116 (2d Cir. 2017) (same); Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 725 (7th Cir. 2016), cert. denied, ___ U.S. ___, 137 S.Ct. 2267, 198 L.Ed.2d 699 (2017) (same); Muransky v. Godiva Chocolatier, Inc., 922 F.3d 1175, 1188 (11th Cir. 2019) ("We think it beyond debate that a consumer has a concrete interest in preventing his identity from actually being stolen"). When plaintiffs allege that "their data has already been stolen and is now in the hands of ill-intentioned criminals," the Sixth Circuit has recognized that their allegations "are sufficient to establish a cognizable Article III injury at the pleading stage of the litigation." Galaria v. Nationwide Mut. Ins. Co., 663 F. App'x 384, 388 (6th Cir. 2016). Thus, the Court agrees with those courts which have observed that prevention of identity theft is a "concrete" interest, and that the FACTA provision requiring card number truncation is aimed at protecting it.
The Court notes that the parties dispute the import of the Clarification Act in revealing Congress's aims. The Court finds, however, that the Clarification Act only illuminated that the inclusion of an expiration date on a receipt was a mere procedural
In the Clarification Act, Congress observed that, "[e]xperts in the field agree that proper truncation of the card number, by itself as required by the amendment made by the [FACTA], regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud." Pub. L. No. 110-241, 112 Stat. 1565. Accordingly, Congress found lawsuits which targeted businesses for an expiration date violation to be "abusive" because the consumer's credit or debit card number was still protected. Id. After the Clarification Act was passed, lawsuits which only alleged that a receipt included a consumer's card expiration date were found certainly deficient for lack of a concrete injury. See Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 79-82 (2d Cir. 2017) (inclusion of expiration date alleged insufficient injury in fact); Meyers, 843 F.3d at 727-28 (same). Congress appeared to still indicate, however, that the truncation provision is an important part of FACTA for purposes of protecting a consumer's identity.
On the other hand, Defendants argue that the Clarification Act revealed a broader Congressional aim to limit FACTA lawsuits to those which contain "an allegation of harm to any consumer's identity." Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241, 122 Stat 1565 (June 3, 2008). Congress stated that the purpose of the Clarification Act was "to ensure that consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits that do not protect consumers." Id. (emphasis added).
While Defendants' point is valid, Plaintiff still argues that he suffered from actual harm, and that his lawsuit does protect consumers because it is based on the more important part of FACTA—the portion which requires credit or debit card number truncation. While this is a far more nuanced argument than one based, for instance, on an allegation that Plaintiff's identity was stolen, it is still an alleged injury which Spokeo could potentially recognize as constituting an injury in fact. 136 S. Ct. at 1549 ("the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact").
However, Plaintiff must also show that the "procedural violation presents a material risk of real harm to [his] concrete interest." Macy, 897 F.3d at 756. The Court finds that Plaintiff has not alleged any material risk of real harm to his concrete interest in being free from identity theft.
Plaintiff's complaint first generally claims that "by printing the first 6 and last 4 digits of the card number on the receipts provided to Plaintiff and other credit card and/or debit card cardholders transacting business with Defendants, Defendants have harmed Plaintiff and the Class by exposing them to at least an increased and material risk of identity theft and credit and or debit card fraud." (Doc. 1 ¶ 9.) This sort of conclusory allegation does not suffice to prevent a motion to dismiss for lack of jurisdiction. O'Bryan, 556 F.3d at 376.
Plaintiff also alleges that the first six and last four digits of a card number, either alone or in conjunction with other information, can be used to bolster the credibility of a criminal who is making pretext phone calls or engaging in email phishing scams. This allegation is based on the idea that a criminal may "pick off" different bits of information from different
While Defendants contest these claims by arguing that the first six digits of a credit or debit card only identify the card issuer and give an identity thief no more information than Congress already permitted to be printed on receipts, the Court is mindful that it must take all well-pleaded allegations in Plaintiff's complaint as true. Gentek Bldg. Prods., 491 F.3d at 330.
Even taking these allegations as true, however, Plaintiff does not allege how common this exact criminal strategy may be. For instance, the fact that some computer scientists have found that hackers have the capability to use the first six digits of a card number to quickly make an online purchase does not entail that this practice is currently being engaged in by hackers in any sort of threatening mass. Nor does the study mention that these hackers tend to be dumpster-divers or trash-pickers, thereafter using information that they have gathered from discarded transactional receipts. The allegation only notes that the six-digit method of hacking was "likely to have been used" in a recent cyberattack. In addition, an article which Plaintiff attaches regarding the hacking technique itself notes that the team of scientists only found the VISA network to be particularly vulnerable, but not the Mastercard network. (Doc. 1-6 at 4.) Plaintiff does not allege whether his card was issued by the VISA network, or not.
Plaintiff additionally makes no allegation about how common it is for hackers to pick off pieces of information—in specific, using the partially disclosed digits of a consumer's credit card from a discarded printed receipt—in order to engage in making pretext phone calls or e-mail phishing scams. Again, just because a criminal is capable of engaging in criminal behavior in a certain specific method does not entail that the same method is common enough such that Plaintiff was exposed to a "material" risk of a crime being committed against him by Defendants' alleged violation of FACTA.
In no way is the Court suggesting that identity theft is uncommon, nor does the Court wish to understate the havoc it can wreak in a consumer's life. The Court merely observes that Plaintiff has not alleged that he was exposed to a material risk of harm of identity theft through his receipt from Save-A-Lot, LLC in his complaint.
A contrast to this scenario is the case of Macy v. GC Services Limited Partnership, where the Sixth Circuit recently analyzed a procedural violation of a provision of the Fair Debt Collection Practices Act (the "FDCPA"). The portion of the FDCPA at issue required debt collectors to provide consumers with a notice stating that if the consumer opted to contest the debt in writing, additional debtor protections would be triggered. The Sixth Circuit reasoned that Congress conferred those procedural rights in order to protect the plaintiffs'
Unlike here, the plaintiffs in Macy did not refer to a speculative string of causation about what a third party might or might not do to harm them. Accord Huff, 923 F.3d at 468 ("The Macy statute made a risk of harm far more likely than this law does."). Instead, there was a material risk that each plaintiff would harm him or herself by waiving their FDCPA debt-collection rights because each plaintiff was presumed to be the least sophisticated consumer. Here, Plaintiff instead relies on a theory resting on conjecture about the decisions of independent, criminal actors. See Clapper, 568 U.S. at 414, 133 S.Ct. 1138 ("We decline to abandon our usual reluctance to endorse standing theories that rest on speculation about the decisions of independent actors.").
More recently, the Sixth Circuit also compared the FDCPA violation in Macy to an FCRA violation more similar to the case here. See Huff v. TeleCheck Servs., Inc., 923 F.3d 458 (6th Cir. 2019). There, the plaintiff alleged that he was provided a copy of his file from a check verification company which omitted information about some of the plaintiff's linked bank accounts. Id. at 461-62. As to that alleged statutory harm, the Sixth Circuit observed,
Id. at 468. The Sixth Circuit found that the plaintiff had not suffered an injury in fact. Id. Because FACTA amended the FCRA
While the Sixth Circuit has not considered whether the FACTA violation Plaintiff raises constitutes an injury in fact, the Court's observation that there is no material risk of real harm is in line with decisions of the majority of United States Courts of Appeals which have considered the issue.
The Court also aligns itself with the two courts within the Sixth Circuit which have reached the same conclusion in regard to defendants who printed the first six and last five digits of consumers' card numbers on their receipts. See Hullinger v. Park Grove Inn, Inc., No. 3:17-cv-4, 2018 WL 3040571, at *3 (E.D. Tenn., June 19, 2018) ("This case presents a perfect example of a procedural violation which may result in no harm"); Everett v. Memphis Light Gas & Water Div., No. 16-cv-2810, 2017 WL 1830165, at *3 (W.D. Tenn., Apr. 18, 2017) ("Plaintiff has failed to plead facts that establish a causal chain between the FACTA violation alleged here and an increased risk of identity theft").
Plaintiff presents three primary counter-arguments to the Court's conclusion regarding risk of harm. First, Plaintiff makes several references to Congress's observations about the dramatic increase in instances of identity theft which were taking place at the time of the adoption of FACTA. For instance, Plaintiff's reply brief references a 2003 report from the United States House of Representatives Committee on Financial Services which cited the need to "provide consumers with the tools they need to fight identity theft[,]" and found that identity theft had "`reached almost epidemic proportions' with the FTC fielding over 160,000 calls about identity theft in 2002 alone." (Doc. 30 at 2-3 (quoting H.R. Rep. No. 108-263, at 1 (Sept. 4, 2003)).) It logically follows that Congress would not have required credit or debit card number truncation on receipts unless that information was materially contributing to identity theft.
On this point, however, the Court agrees with the Third Circuit, which observed,
Kamal, 918 F.3d at 116 n.5 (internal citations omitted). In general, statistics cited by Congress before the adoption of FACTA addressed the harm of printing a credit or debit card number on a receipt in full. Congress did not have occasion to consider whether a consumer would face a material risk of real harm when the first six and last four digits of a credit or debit card number appear on a receipt.
Second, Plaintiff argues that there is no "chain of causation" which the Court should concern itself with because Plaintiff's harm occurred "at the point of the transaction"—that is, immediately when Plaintiff was provided his receipt. Plaintiff states, "[b]y requesting the Court to focus only on events after Plaintiff took possession of the unlawful receipt, Defendants urge the Court to ignore or disregard Congress' [sic] judgment that merchants must protect their customers by truncating card numbers on receipts given at the point of sale." (Doc. 30 at 14.)
At the point of sale, Plaintiff was given a receipt with some of his own credit card digits reflected on it. Plaintiff surely already knew the full number on his card, or could easily reference the number on the card itself. The Court does not see how Plaintiff suffered any type of arguable harm at that point in time without there being some sort of material risk that something would happen with the card information later on. Plaintiff may fear further exposure of his information due to the receipt, but the Court discusses why this fear is also insufficient below. Because Plaintiff does not successfully allege that he was exposed to a material risk of real harm of his identity being stolen later on, Plaintiff cannot have alleged any injury in fact at the time of the transaction. While the Court acknowledges "Congress's judgment" in requiring card number truncation at the point of sale, the Court remains mindful that "Congress cannot erase Article III's standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing." Spokeo, 136 S. Ct. at 1550 (quoting Raines, 521 U.S. at 820 n.3, 117 S.Ct. 2312); see also Huff, 923 F.3d at 466 ("Although Congress wields broad authority to define injuries, it does not have a blank check.").
Third, Plaintiff stresses that the Eleventh Circuit has reached the opposite conclusion on this issue in Muransky v. Godiva Chocolatier, Inc., 922 F.3d 1175 (11th Cir. 2019). An Eleventh Circuit panel issued an initial opinion on October 3, 2018, 905 F.3d 1200, but the same panel later sua sponte vacated the previous opinion and published one in its place, 922 F.3d 1175. Overall, the Eleventh Circuit sided with the plaintiff, stating, "Dr. Muransky suffered the heightened risk of identity theft the moment Godiva printed too many digits of his credit card number." 922 F.3d at 1185.
The Court first notes that, in part of its reasoning, the Eleventh Circuit panel observed, "where Congress elevates the risk of harm to a concrete interest to the status of a concrete injury, the risk need be no more than an `identifiable trifle' to be concrete." Id. at 1185-86. The panel then cited a 2009 case decided by its own court which observed that "a small injury, `an identifiable trifle[,]'" can be sufficient to confer standing—such as being required to present a photo identification when voting in
The Eleventh Circuit also observed that the plaintiff had standing based "on the similarity between the harm he allege[d] and the common law tort of breach of confidence." Muransky, 922 F.3d at 1190. This was significant to the panel because Spokeo described it as "instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." 136 S. Ct. at 1549. The panel observed that a "common law breach of confidence lies where a person offers private information to a third party in confidence and the third party reveals that information[,]" and found that the defendant had engaged in a similar practice by printing more credit card digits than FACTA allows. Muransky, 922 F.3d at 1190. Even then, the panel recognized that "the match" between the two types of actions is "not exact[,]" and recognized that "unlike a common law breach of confidence, a merchant need not disclose a credit card number to anyone in order to violate FACTA." Id. at 1192. The Eleventh Circuit still found "sufficient similarity" between a FACTA violation and a breach of confidence such that the court found that the plaintiff had alleged an injury in fact.
Here, Plaintiff makes similar arguments, proposing that FACTA's truncation requirement bears a close relationship to analogous common law torts such as invasion of privacy, breach of confidence, and breach of an implied bailment agreement. The Court, however, is convinced by the Third Circuit's observation that a plaintiff's alleged injury does not have a close relationship with traditional privacy tort actions when the plaintiff does not allege any disclosure of his information to a third party. Kamal, 918 F.3d at 114. In all of the traditional privacy torts, the Third Circuit observed, harm transpires when a third party gains unauthorized access to a plaintiff's personal information. Id. Absent disclosure to a third party, as is the case with Plaintiff's allegations here, Plaintiff's injury is unlike those harms recognized by traditional causes of action. Because of this, the Court rejects Plaintiff's arguments that the harm he suffered has a close relationship to a harm traditionally regarded as providing a basis for a lawsuit in English or American courts, and disagrees with the Eleventh Circuit's reasoning on those grounds.
Taken together, the Court sees no reason to follow the reasoning of the Eleventh Circuit and depart from the majority of courts finding that a plaintiff does not allege a sufficient injury by pleading that a defendant violated FACTA by printing the first six and last four digits of his or her credit or debit card number on a receipt.
Plaintiff also alleges that he was burdened by having to either safeguard his
The Court finds that this argument still hinges on whether Plaintiff faced any material risk of his identity being stolen. Because the Court has observed that Plaintiff did not allege a material risk of his identity being stolen, the Court is not convinced that Plaintiff had any real burden to protect or destroy his receipt.
While Plaintiff may be a very cautious person who chooses to take the extra step of retaining or destroying his receipt regardless of his true exposure to risk, he cannot manufacture his own injury based on speculation about a threat which does not present any material risk of real harm. In Clapper v. Amnesty International, USA, the Supreme Court observed,
568 U.S. 398, 416, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013). As such, this secondary argument is simply a "repackaged version" of Plaintiff's first, failed, theory of standing. See id. The Court similarly rejects it.
Having addressed both of Plaintiff's alleged injuries, and having found that Plaintiff does not allege an injury in fact, the Court will
