Summary
noting that "there is no doubt that defendants violated the statute" by printing the first six and last four digits of the credit card number
Summary of this case from Delamarter v. Supercuts, Inc.Opinion
Case No. 1:17-CV-119-SNLJ
04-13-2018
MICHAEL COLEMAN, on behalf of himself and others similarly situated, Plaintiff, v. EXXON MOBIL CORPORATION, REEVES BOOMLAND, INC., and BI-STATE SOUTHERN OIL COMPANY Defendants.
MEMORANDUM AND ORDER
"Is receiving an overly revealing credit card receipt—unseen by others and unused by identity thieves—a sufficient injury to confer Article III standing?" Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 777 (9th Cir. 2018). Under the facts of this case, it is not.
Plaintiff alleges defendants violated the Fair and Accurate Credit Transactions Act ("the Act") by printing the first six digits of his credit card on the receipts they provided after he purchased gas. Defendants claim plaintiff does not have standing and have moved to dismiss (#16). Because plaintiff failed to allege a concrete injury, the motion will be granted.
I. Factual Background
Plaintiff alleges he got gas at one of the defendants' locations several times during the summer of 2017. Each time, after processing plaintiff's credit card, defendants provided a printed receipt that listed the first six and last four digits of plaintiff's sixteen-digit credit card number. Plaintiff alleges defendants "willfully" violated the Act, which prohibits defendants from printing more than the last five digits of plaintiff's credit card number on any receipt provided at the point of sale.
"On occasion, . . . [p]laintiff believes he has forgotten to pull his receipt out of the machine, leaving it hanging in public view." (#1 at 8, ¶ 58.) "At other times, . . . [p]laintiff believes he has thrown his receipt in the trash next to the pump." (#1 at 8, ¶ 59.) He does not allege anyone tried stealing his identity by using the information on his receipts. In fact, he does not allege anyone even saw the receipts, let alone the ten digits of his credit card number. Instead, plaintiff alleges the defendants caused him to "suffer a heightened risk of identity theft, and potentially exposed [his] private information to third parties who may have come into contact with those receipts." (#1 at 11-12, ¶ 84) (emphases added). As such, he seeks statutory and punitive damages.
II. Legal Standard
Under Rule 12(b)(1) of the Federal Rules of Civil Procedure, a court must dismiss a complaint if it lacks subject-matter jurisdiction. Arbaugh v. Y&H Corp., 546 U.S. 500, 514 (2006). At the motion-to-dismiss stage, the Court must "accept the allegations contained in the complaint as true and draw all reasonable inferences in favor of the nonmoving party." Cole v. Homier Dist. Co., 599 F.3d 856, 861 (8th Cir. 2010) (quoting Coons v. Mineta, 410 F.3d 1036, 1039 (8th Cir. 2005)).
III. Discussion
The Act. Congress passed the Act, an amendment to the Fair Credit Reporting Act, to curb identity theft by reducing the personal information printed on credit and debit card receipts. Fair & Accurate Credit Transactions Act of 2003, Pub. L. No. 108-159, 117 Stat. 1952 (Dec. 4, 2003) (codified at 15 U.S.C. §§ 1681-1681x). The Act provides "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. § 1681c(g)(1). A plaintiff may recover actual damages resulting from a negligent violation, id. § 1681o(a), or actual, statutory, and punitive damages for a willful violation, id. § 1681n(a).
After the Act's compliance deadline, consumers filed "hundreds of lawsuits" alleging merchants that failed to remove the expiration date (a requirement not at issue in this case) willfully violated the Act. Credit & Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(4), 122 Stat. 1565 (June 3, 2008) (codified at 15 U.S.C. § 1681n(d)). Yet none of these consumers alleged their identity had been harmed. Id. § 2(a)(5). Congress responded by amending the Act so that persons who only violated the Act by printing expiration dates could not be sued for a willful violation for roughly four years. See id. § 3. In doing so, Congress stated the purpose of the amendment "is to ensure that consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits that do not protect consumers but only result in increased cost to business and potentially increased prices to consumers." Id. § 2(b) (emphasis added).
Accepting plaintiff's allegations as true, there is no doubt that defendants violated the statute. But that does not mean plaintiff automatically has standing to bring this claim. "Indeed, Congress does not have the final word on whether a plaintiff has alleged a sufficient injury for the purposes of standing[.]" Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016), cert. denied, 137 S. Ct. 2267 (2017).
Article III Standing. Article III of the Constitution gives federal courts the power to decide actual cases and controversies only. U.S. Const. art. III, § 2. In fact, "[n]o principle is more fundamental to the judiciary's proper role in our system of government than the constitutional limitation of federal-court jurisdiction to actual cases or controversies." Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016), as revised (May 24, 2016) (alteration in original) (quoting Raines v. Byrd, 521 U.S. 811, 818 (1997)). Ruling without a case or controversy "create[s] the potential for abuse of the judicial process, distort[s] the role of the Judiciary in its relationship to the Executive and the Legislature[,] and open[s] the Judiciary to an arguable charge of providing government by injunction." Schlesinger v. Reservists Comm. to Stop the War, 418 U.S. 208, 222 (1974) (internal quotations omitted).
"Standing to sue is a doctrine rooted in the traditional understanding of a case or controversy." Spokeo, 136 S. Ct. at 1547. To satisfy the standing requirements, "plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Id. "The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements." Id.
This case deals with the injury-in-fact element. "To establish injury in fact, [the] plaintiff must show that he . . . suffered 'an invasion of a legally protected interest' that is [a] 'concrete and particularized' and [b] 'actual or imminent, not conjectural or hypothetical.'" Id. at 1548 (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). Narrowing further, this case deals with the concrete component of the injury-in-fact element. A "concrete" injury "must actually exist" and be real, not abstract. Id.
Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), is the Supreme Court's last word on the concrete component. In Spokeo, the Supreme Court analyzed when a statutory violation amounts to a concrete injury that satisfies Article III's injury-in-fact requirement. Id. at 1549. It explained a plaintiff does not automatically satisfy the injury-in-fact requirement just by alleging the violation of a statutory right. Id. For example, "a bare procedural violation, divorced from any concrete harm, [does not] satisfy the injury-in-fact requirement of Article III. Id.
Finally, the Supreme Court explained that while "tangible injuries are perhaps easier to recognize, we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete." Id. When analyzing an intangible injury, like the "heightened risk of identity theft" (#1 at 11, ¶ 84) alleged in this case, "both history and the judgment of Congress play important roles." Id. As for history, "it is instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Id. As for Congress, it "may 'elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.'" Id. (alteration in original) (quoting Lujan, 504 U.S. at 578). While not always the case, "the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. In other words, a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified." Id.
When a plaintiff alleges the violation of a procedural right granted by statute, the standing question boils down to this: "'whether the particular procedural violations alleged in this case entail a degree of risk sufficient to meet the concreteness requirement,' which in turn depends on 'whether the particular bare procedural violation may present a material risk of harm to the underlying concrete interest Congress sought to protect' in enacting the statutory requirement." Katz v. Donna Karan Co., L.L.C., 872 F.3d 114, 118 (2d Cir. 2017) (internal citations omitted) (quoting Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 80-81 (2d Cir. 2017)). Of course, the Court also is guided by history and the judgment of Congress.
As best this Court can tell, the Eighth Circuit has not yet framed the question so directly, but it has implicitly endorsed this framing. See Braitberg v. Charter Commc'ns, Inc., 836 F.3d 925, 930 (8th Cir. 2016) (noting the plaintiff failed to identify any "material risk of harm" from the procedural violation). Other courts of appeals interpreting Spokeo have framed the issue this way, see Katz v. Donna Karan Co., L.L.C., 872 F.3d 114, 118 (2d Cir. 2017); Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017), cert. denied, 138 S. Ct. 931 (2018); Dreher v. Experian Info. Sols., Inc., 856 F.3d 337, 346 (4th Cir. 2017), and the parties seem to agree this question controls (#17 at 6; #21 at 3). The Third Circuit, however, rejected this framing and found that a plaintiff alleging a statutory violation need not always show the violation caused a material risk of harm. In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 637 (3d Cir. 2017) (explaining the Eighth Circuit requires a material-risk-of-harm showing and rejecting Eighth Circuit's reading of Spokeo).
No Material Risk of Identify Theft. Both parties agree Congress passed the Act to protect consumers from identity theft by limiting the personal data printed on credit and debit card receipts. The question now is whether plaintiff has alleged a material risk of identity theft. The Court finds that he has not for at least two reasons.
First, plaintiff's identity can be stolen only if another person actually steals it. So naturally, many courts answering this question analyze whether any third party actually saw or possessed the overly revealing receipt. See, e.g., Katz v. Donna Karan Int'l, Inc., No. 14 CIV. 740 (PAC), 2017 WL 2191605, at *5 (S.D.N.Y. May 17, 2017), aff'd and remanded sub nom. Katz v. Donna Karan Co., L.L.C., 872 F.3d 114 (2d Cir. 2017); Thompson v. Rally House of Kan. City, Inc., No. 15-00886-CV-W-GAF, 2016 WL 8136658, at *5 (W.D. Mo. Oct. 6, 2016). Plaintiff does not allege that any third party (1) possessed his receipts, (2) read his receipts, (3) tried to figure out his entire credit card number, (4) successfully figured out his credit card number, or (5) fraudulently used his credit card number.
At best, plaintiff has shown only that he left receipts in the printing machine and that he threw other receipts away. Yet plaintiff does not allege any material risk that machine watchers or dumpster divers will snatch his left-behind receipts. Nor does he give the Court any reason to believe there is a material risk these machine watchers or dumpster divers or would try to steal his identity. Or that they would be successful if they tried. In fact, if plaintiff actually thought this bizarre hypothetical presented a material risk of identity theft, he probably would not have tossed his receipts or left them in the machines. In that respect, the Eighth Circuit has found that plaintiffs—whose credit card information was stolen when hackers infiltrated a business's computer network—failed to allege a "substantial risk" of identity theft and thus did not allege an imminent injury. In re SuperValu, Inc., 870 F.3d 763, 771 (8th Cir. 2017). Although the Eighth Circuit was not using the material-risk standard, its holding supports this Court's conclusion. After all, hackers—criminals—actually stole the plaintiffs' information in SuperValu. Here, plaintiff has alleged only that his receipts are there for the taking (and not that anyone wants to take them or has even tried doing so), which undermines his allegation that there is a material risk his identity will be stolen. See, e.g., Katz, 2017 WL 2191605, at *5; Kamal v. J. Crew Grp., Inc., No. 2:15-0190 (WJM), 2016 WL 6133827, at *3 (D.N.J. Oct. 20, 2016); Thompson, 2016 WL 8136658, at *5; Taylor v. Fred's, Inc., 285 F. Supp. 3d 1247, 1264 (N.D. Ala. 2018); Gesten v. Burger King Corp., No. 17-22541-CIV, 2017 WL 4326101, at *3 (S.D. Fla. Sept. 27, 2017); Hendrick v. Aramark Corp., 263 F. Supp. 3d 514, 520-21 (E.D. Pa. 2017), appeal dismissed, No. 17-2120, 2017 WL 5664867 (3d Cir. Oct. 31, 2017).
Second, the first six digits of plaintiff's sixteen-digit credit card number do not convey any personal information about him. Instead, as plaintiff concedes, the first six digits identify only the bank that issued the card, and Congress does not prohibit printing the card issuer in word form on the receipt. In fact, each issuer's six-digit code is publicly available on the internet. "[B]ecause Congress did not prohibit the printing of issuer information on the credit card receipt, there is no possibility that the printing of the first six digits could have resulted in a risk of harm greater than that prohibited by Congress." In re Toys "R" Us - Del., Inc. - Fair & Accurate Credit Transactions Act (FACTA) Litig., No. CV 06-08163 MMM FMOX, 2010 WL 5071073, at *12 (C.D. Cal. Aug. 17, 2010); see also Katz, 872 F.3d at 120; Noble v. Nev. Checker CAB Corp., No. 215CV02322RCJVCF, 2016 WL 4432685, at *2 (D. Nev. Aug. 19, 2016), aff'd, No. 16-16573, 2018 WL 1223484 (9th Cir. Mar. 9, 2018).
Plaintiff argues disclosing the first six digits "allow[s] an identity thief to learn the card issuer, issuing country, brand of card, and card category, all potentially valuable information to an identity thief that would not be available had Defendants complied with the [Act]." (#21 at 8.) This is not necessarily true, even assuming defendants printed receipts that included (in word form) the issuer of plaintiff's credit card, and also assuming one of plaintiff's receipts fell into the hands of a fraudster. After briefly searching the internet, the fraudster would know the six-digit code associated with the issuer of plaintiff's credit card. That is, the fraudster would have the information that plaintiff claims should be unavailable, but actually is available, and defendants would not have violated the Act.
Plaintiff goes on to argue "[d]isclosing this information contravenes the purpose behind the [Act]'s restriction on printing more than the last five digits of a card number, which is specifically intended 'to limit the number of opportunities for identity thieves to "pick off" key card account information.'" (#21 at 8) (quoting S. Rep. No. 108-166, at 13 (2003)). Printing the first six digits violates only the statutory ban on printing more than the last five digits. But whether the statute was violated is not at issue. Printing the first six digits does not make it easier to "pick off key card account information" for the reasons explained above. That is, the risk of identity theft "has not been made materially more likely to occur, because printing the first [six] number[s] plus the last four numbers gives an identity thief no more personal information about a person's account than Congress has permitted to be printed on receipts." Noble, 2016 WL 4432685, at *3; see also Katz, 872 F.3d at 120; Taylor, 285 F. Supp. 3d at 1261; Gesten, 2017 WL 4326101, at *3; Tarr v. Burger King Corp., No. 17-23776-CIV, 2018 WL 318477, at *3 (S.D. Fla. Jan. 5, 2018); Kamal, 2016 WL 6133827, at *3; Kamal, 2017 WL 2587617, at *4-5.
Plaintiff has not alleged a material risk of identity theft.
History. Historical practice also supports the conclusion that plaintiff has not alleged a concrete injury. Although plaintiff acknowledges history plays an important role when deciding whether an intangible injury in concrete, he failed to brief the issue. But under Spokeo, this Court must still consider whether the alleged intangible harm—here, the heightened risk of identity theft—"has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Spokeo, 136 S. Ct. at 1549.
Plaintiff's alleged harm probably has the closest relationship to "privacy-based torts centered on wrongful disclosures of information." Bassett, 883 F.3d at 780. But not close enough. "Without disclosure of private information to a third party, it hardly matters that '[a]ctions to remedy . . . invasions of privacy, intrusion upon seclusion, and nuisance have long been heard by American courts, and the right of privacy is recognized by most states." Id. (quoting Van Patten v. Vertical Fitness Grp., LLC, 847 F.3d 1037, 1043 (9th Cir. 2017)); see also Taylor, 285 F. Supp. 3d at 1261 (listing cases); Gesten, 2017 WL 4326101, at *3; Kamal v. J. Crew Grp., Inc., No. CV 2:15-0190 (WJM), 2017 WL 2587617, at *3 (D.N.J. June 14, 2017); Braitberg v. Charter Commc'ns, Inc., 836 F.3d 925, 930-31 (8th Cir. 2016). Again, plaintiff has not alleged anyone else ever saw the first six digits of his credit card number.
Judgment of Congress. The judgment of Congress also supports the conclusion that plaintiff has not alleged a concrete injury. Again, printing the first six digits "is the equivalent of printing the name of the issuing institution," Katz, 872 F.3d at 120, which the Act allows, at least in word form. Moreover, the six-digit code for each issuer is publicly available online. This strongly suggests Congress did not think disclosing the first six digits exposed consumers to a risk of identity theft. Also, when amending the Act in 2007, Congress reaffirmed that "[t]he purpose of this [amendment] is to ensure that consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits that do not protect consumers but only result in increased cost to business and potentially increased prices to consumers." Pub. L. No. 110-241, § 2(b) (emphasis added).
If the Court were simply interpreting the statutory language, it would not rely on legislative history like this. Indeed, the statute is clear, and the problems with relying on legislative history are well documented, Digital Realty Tr., Inc. v. Somers, 138 S. Ct. 767, 783-84 (2018) (Thomas, J., concurring in part and concurring in the judgment). But when deciding whether an intangible injury is concrete, Spokeo makes clear that courts must consider the judgment of Congress. --------
All in all, plaintiff claims Congress's ban on printing more than the last five digits shows "its judgment was that any more digits unnecessarily exposes consumers to an increased risk of identity theft." (#21 at 8 n.7.) If this were true, Congress also would have banned printing in word form the name of the issuer. Thus, this argument fails.
IV. Conclusion
Plaintiff has not alleged a concrete injury because he has not shown that there is a material risk he will have his identity stolen. History and the judgment of Congress support this conclusion. As such, defendants' motion to dismiss will be granted, and the Court need not address defendants' arguments that plaintiff failed to plead facts showing willfulness and that plaintiff failed to allege the Act applies to Exxon Mobil.
Accordingly,
IT IS HEREBY ORDERED that defendants' motion to dismiss (#16) is GRANTED.
So ordered this 13th day of April 2018.
/s/_________
STEPHEN N. LIMBAUGH, JR.
UNITED STATES DISTRICT JUDGE