Opinion
CASE NO. 16–61198–CIV–ALTONAGA/O'Sullivan
08-29-2016
Shane FLAUM, Plaintiff, v. DOCTOR'S ASSOCIATES, INC., d/b/a Subway, Defendant.
Michael Hilicki, Keogh Law LTD, Chicago, IL, Bret Leon Lusskin, Jr., Bret Lusskin, P.A., Aventura, FL, Scott David Owens, Scott D. Owens, P.A., Hollywood, FL, for Plaintiff. Peter Breslauer, Montgomery McCrackern Walker & Rhoads, Philadelphia, PA, John R. Hargrove, Hargrove Law Group, Boca Raton, FL, for Defendant.
Michael Hilicki, Keogh Law LTD, Chicago, IL, Bret Leon Lusskin, Jr., Bret Lusskin, P.A., Aventura, FL, Scott David Owens, Scott D. Owens, P.A., Hollywood, FL, for Plaintiff.
Peter Breslauer, Montgomery McCrackern Walker & Rhoads, Philadelphia, PA, John R. Hargrove, Hargrove Law Group, Boca Raton, FL, for Defendant.
ORDER
CECILIA M. ALTONAGA, UNITED STATES DISTRICT JUDGE
THIS CAUSE came before the Court on Defendant, Doctor's Associates, Inc.'s ("Doctor's Associates[']," "Subway['s]" or "Defendant['s]") Motion and Memorandum ... to Dismiss Plaintiff's Class Action Complaint ("Motion") [ECF No. 15], filed July 12, 2016. The Court has carefully reviewed the Class Action Complaint for Violations of the Fair and Accurate Credit Transactions Act (FACTA) ("Complaint") [ECF No. 1]; the Motion; Plaintiff, Shane Flaum's ("Flaum['s]" or "Plaintiff['s] ) Response ... ("Response") [ECF No. 21]; Defendant's Reply ... ("Reply") [ECF No. 25]; and Notices of Supplemental Authority [ECF Nos. 24 and 26]. For the reasons that follow, the Motion is denied.
I. BACKGROUND
Plaintiff's Complaint states a single claim for relief against Subway for violation of the Fair and Accurate Credit Transactions Act ("FACTA"), 15 U.S.C. section 1681(c)(g). (See generally Compl.). Flaum was a customer at a Subway restaurant located in Pompano Beach. (See id. at ¶¶ 5, 36). Doctor's Associates operates under the brand name "Subway" and exercises control over its individually-owned franchise restaurants; Doctor's Associates' control over Subway includes dictating the point of sale ("POS") terminal used at its franchise locations. (See id. at ¶¶ 6, 10).
Congress enacted the FACTA in 2003 to minimize the likelihood of identity theft facilitated by credit card information being printed on receipts during a POS transaction. (See id. at ¶¶ 14–18, 23). The FACTA includes a provision stating no receipt from a credit or debit card transaction shall include the card's expiration date or more than the last five digits of the card number ("Receipt Provision"). (See id. at ¶ 19). Card–issuing organizations, including Visa, MasterCard, and American Express, contractually required compliance with the FACTA after its enactment. (See id. at ¶¶ 23–24). Subway stores currently accept cards from all major issuers, all of which require FACTA compliance. (See id. at ¶ 31).
The FACTA allowed a three-year period of compliance with its requirements, ending in December 4, 2006. (See id. at ¶ 22). In 2007, Congress passed The Credit and Debit Card Clarification Act ("Clarification Act") to make corrections to the previously stated definition of willful noncompliance; however, the Clarification Act did not amend the FACTA's Receipt Provision requiring omission of a credit card's expiration date. (See id. at ¶¶ 25–26). The Clarification Act was passed because several large retailers failed to comply with: (1) the terms agreed upon in their contracts with card-issuing organizations; and (2) FACTA regulations requiring the omission of card expiration dates on receipts. (See id. at ¶ 25). This failure to comply existed despite FACTA's publicity among retailers and the Federal Trade Commission, and despite card processing companies explicitly informing retailers of the FACTA's requirements. (See id. at ¶¶ 23, 27).
Subway has known of the illegality of printing card expiration dates on receipts through its agreements with American Express and MasterCard; and by the "Rules for Visa Merchants," a document setting forth binding rules all merchants accepting Visa cards must follow. (See id. at ¶¶ 24, 32–33). Defendant was on heightened notice of risks associated with identity theft following a 2008 scheme where payment card data was stolen from 150 Subway restaurants. (See id. at ¶ 47). Furthermore, Subway has been aware of the illegality of printing the full expiration dates of payment cards on receipts following lawsuits filed against it. (See id. at ¶ 34). On at least four occasions, Defendant has been sued for violating the FACTA by printing the full expiration dates of cards on its receipts. (See id. ).
Defendant provides a printed receipt upon completion of payment; if such payment is done by card, the card is run through a VeriFone VX820 POS terminal ("VeriFone system"). (See id. at ¶¶ 41–43). The VeriFone system manual explains the user can decide what information to print on its receipts. (See id. at ¶ 44). The manual informs the user it can truncate card numbers and mask expiration dates, and explicitly states legislation is in place that may require utilization of these options. (See id. at ¶¶ 44—45).
Plaintiff alleges before Subway changed to VeriFone, Subway properly truncated card account numbers because it had a written policy requiring retail locations to truncate card account numbers and expiration dates. (See id. at ¶ 43). But Defendant violated the FACTA on June 3, 2016, almost ten years after the December 4, 2006 deadline to comply. (See id. at ¶¶ 22, 36– 38). Flaum alleges a Subway location in Pompano Beach printed a receipt from his transaction containing the full expiration date of his Visa debit card on June 3, 2016. (See id. at ¶¶ 36–38).
According to Plaintiff, he and other consumers who conducted business with Doctor's Associates using credit or debit cards and were provided with defective receipts suffered violations of section 1681(c)(g). (See id. at ¶ 1). Flaum alleges he and other consumers have suffered harm as a result of Defendant's actions, and he and members of a putative class continue to be exposed to a heightened risk of identity theft. (See id. at ¶¶ 64, 74). Flaum seeks statutory damages of $100 to $1,000 per receipt under the FACTA, not actual damages. (See id. ¶¶ 2, 60, 75). Defendant now moves to dismiss the Complaint under Federal Rule of Civil Procedure 12(b)(1) for failure to allege injury in fact.
II. DISCUSSION
Defendant moves to dismiss under Rule 12(b)(1) with a facial attack to the Complaint, asserting it fails to sufficiently allege a basis of subject matter jurisdiction, even accepting the allegations as true. (See Mot. 3–4 (citing McElmurray v. Consol. Gov't of Augusta–Richmond Cnty. 501 F.3d 1244, 1251 (11th Cir. 2007) )). In response, Flaum argues Subway's failure to comply with the FACTA has subjected him to multiple concrete injuries. (See generally Resp.).
The Court recently addressed a similar issue in Guarisma v. Microsoft Corp. , No. 15–24326–Civ–Altonaga, 209 F.Supp.3d 1261, 2016 WL 4017196 (S.D. Fla. July 26, 2016), as acknowledged by the parties in their memoranda. (See Resp. 7; Reply 1). In Guarisma, the plaintiff claimed as a violation of the FACTA the defendant's inclusion, in a printed receipt, of the first six digits of his credit card account number as well as the last four digits. See 209 F.Supp.3d at 1262–63, 2016 WL 4017196, at *1. The Court's discussion there resolves the issue presented here. In Guarisma, the undersigned explained:
To establish subject matter jurisdiction, a plaintiff must allege he has standing, which consists of three elements: "The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016), as revised (May 24, 2016). "To establish injury in fact, a plaintiff must demonstrate he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’ " Id. at 1548 (quoting Lujan v. Defs. of Wildlife , 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). For an injury to be particularized, it "must affect the plaintiff in a personal and individual way." Lujan , 504 U.S. at 560 n.1, 112 S.Ct. 2130. For the injury to be "concrete," it must be "real," and not "abstract;" however it need not be "tangible." Spokeo, 136 S.Ct. at 1548–49 (explaining intangible violations such as restricting free speech can qualify as concrete harms).
Guarisma's injury is clearly particularized, as he received a receipt that included his own personal credit card information, as well as his name. (See Compl. ¶¶ 29–30). The issue at hand is whether Guarisma has also sufficiently established his alleged injury is concrete, specifically as he has not experienced any attempted identity theft or other obstacles as a result of the printed receipt. (See generally id. ). Guarisma primarily argues Microsoft's violation of the FACTA constitutes a concrete injury in and of itself because Congress created a substantive
right for individuals to receive printed receipts that truncate their personal credit card information, in order to decrease the ever-present threat of identity theft. (See Resp. 3–7). The Court agrees.
The Supreme Court recently analyzed a similar concrete-injury question in Spokeo v. Robins. See generally ––– U.S. ––––, 136 S.Ct. 1540, 194 L.Ed.2d 635. There, the defendant operated a website allowing users to search for information about other individuals by name, email address, or phone number. See id. at 1546. Robins, the plaintiff, noticed his profile on the defendant's website contained inaccurate information; thus, he brought a claim under the FCRA, which requires consumer reporting agencies to "follow reasonable procedures to assure maximum possible accuracy" of consumer reports. Id. at 1545–46 (citing 15 U.S.C. § 1681e(b) ). Remanding the case to the Ninth Circuit, the Supreme Court held Robins could not satisfy the injury-in-fact requirement "by alleging a bare procedural violation" of the FCRA, divorced from any concrete harm. Id. at 1549–50.
The Supreme Court provided two examples of such bare procedural violations. The first example is a situation where a consumer reporting agency fails to provide a required notice to a user of the agency's consumer information, but the information turns out to be entirely accurate regardless. See id. at 1550. The second example is a situation where a consumer agency reports some trivial inaccurate information, such as an incorrect zip code, which works no concrete harm upon the consumer. See id. The Supreme Court found both of these scenarios, without allegations of additional harm, would not suffice to satisfy the injury-in-fact requirement. See id.
In contrast, the Spokeo Court acknowledged "Congress may ‘elevate to the status of legally cognizable injuries, concrete, de facto injuries that were previously inadequate in law," id. at 1549 (quoting Lujan, 504 U.S. at 578, 112 S.Ct. 2130 (alteration omitted)); and in some cases, a plaintiff "need not allege any additional harm beyond the one Congress has identified," id. (emphasis omitted). In other words, the Supreme Court recognized where Congress has endowed plaintiffs with a substantive legal right, as opposed to creating a procedural requirement, the plaintiffs may sue to enforce such a right without establishing additional harm. See generally id.
The Eleventh Circuit has further explored the post–Spokeo landscape in an unpublished opinion: Church v. Accretive Health, Inc., No. 15–15708 , 2016 WL 3611543 (11th Cir. July 6, 2016). In Church, a hospital management company sent the plaintiff a letter advising her she owed a debt to a particular hospital. See id. [at ––––], at *1. The plaintiff brought suit against the hospital management company for failing to include certain disclosures in its letter required by the Fair Debt Collections Practices Act ("FDCPA"). See id. The plaintiff did not allege she suffered actual damages from the company's failure to disclose; nonetheless, the Eleventh Circuit held the plaintiff sufficiently alleged a concrete injury because: (1) in enacting the FDCPA, Congress created a substantive right to receive the required disclosures in relevant communications; and (2) the defendant violated this substantive right by failing to provide such disclosures. See id. [at ––––], at *3. In reaching its decision, the Eleventh Circuit relied on Spokeo , as well as Havens Realty Corp. v. Coleman , 455 U.S. 363, 102 S.Ct. 1114, 71 L.Ed.2d 214 (1982), in which the Supreme Court held an injury-in-fact "may exist solely by
virtue of statutes creating legal rights, the invasion of which creates standing." Id. at 373, 102 S.Ct. 1114 (internal quotation marks and citation omitted).
Using Spokeo and Church as guideposts, the question before the Court appears to be whether, in enacting the FACTA, Congress created a substantive right for consumers to have their personal credit card information truncated on printed receipts, or merely created a procedural requirement for credit card-using companies to follow. The Court is persuaded Congress intended to create a substantive right. Notably, other courts have found the FACTA endows consumers with a legal right to protect their credit identities, both pre– and post–Spokeo. See Hammer v. Sam's E., Inc., 754 F.3d 492, 498–99 (8th Cir. 2014) ("By enacting 15 U.S.C. § 1681c(g)(1), Congress gave consumers the legal right to obtain a receipt at the point of sale showing no more than the last five digits of the consumer's credit or debit card number. Appellants contend that Sam's Club invaded this right .... Thus, we conclude that appellants have alleged an injury-in-fact sufficient to confer Article III standing." (alteration and emphasis added)); see also Amason v. Kangaroo Exp., No. 7:09–CV–2117–RDP, 2013 WL 987935, at *4 (N.D. Ala. Mar. 11, 2013) ("[T]he statutory provisions invoked by Plaintiffs, 15 U.S.C. § 1681c(g) and § 1681n, create a substantive right to have one's financial information protected through truncation and also provide a procedural right to enforce that truncation." (alteration and emphasis added)); Altman v. White House Black Market, Inc., Case No. 1:15–cv–02451–SCJ [2016 WL 3946780 ] (N.D. Ga. Jul. 13, 2016) (finding Congress, in enacting the FACTA, created a substantive right to receive a truncated credit card receipt, the invasion of which constitutes a concrete injury).
Courts have also considered a FACTA violation to be concrete as soon as a company prints the offending receipt, as opposed to requiring a plaintiff actually suffer identity theft. See Amason , 2013 WL 987935, at *4 (stating:
Plaintiffs have alleged that their right to have their financial information protected was actually invaded when Defendants printed more than the last 5 digits of their credit and/or debit card numbers in violation of 15 U.S.C. § 1681c(g).... Because the Amended Complaint states that the invasion has already occurred and that it happened specifically to Plaintiffs as opposed to consumers who had never transacted business with Defendants, Plaintiffs have shown that the invasion is concrete and particularized as well as actual.
(alteration added; internal citation omitted)).
The FACTA's legislative history supports the Court's finding Congress desired to create a substantive legal right for consumers to utilize in protecting against identity theft.[ ] In particular, the "FACTA arose from a desire to prevent identity theft that can occur when card holders' private financial information, such as a card holder's complete credit card number, is exposed on electronically printed payment card receipts." Creative Hosp. Ventures, Inc. v. U.S. Liab. Ins. Co., 655 F.Supp.2d 1316, 1333 (S.D. Fla. 2009), rev'd in part, 444 Fed.Appx. 370 (11th Cir. 2011) ; see also
Congress's intent is particularly significant in this analysis as the Spokeo Court stated: "In determining whether an intangible harm constitutes injury in fact, both history and the judgment of Congress play important roles." 136 S.Ct. at 1549.
--------
149 Cong. Rec. H8122–02 (statement of Rep. Shadegg) ("[T]he bill requires that anytime a transaction is made and information is transmitted using a credit card number, that number has to be truncated so that someone who wants to steal your identity by grabbing ahold of your credit card number will not have the full number" (alteration added)); 149 Cong. Rec. H8122–02 (statement of Rep. Jackson–Lee) ("This bill ... will include comprehensive identity theft ... provisions." (alterations added)); H.R. Conf. Rep. No. 396, 108th Cong., 1st Sess. (2003) (statement of Rep. Oxley) ("One of the central elements of [the FACTA bill] was to make the new fraud prevention ... contained in the legislation the new uniform national standards on those subject matters. The bill was drafted in this way because identity theft is a national concern." (alterations added)).
Because: (1) the FACTA created a substantive legal right for Guarisma and other consumers to receive printed receipts truncating their personal credit card numbers, and thus protecting their financial information; and (2) Guarisma personally suffered a concrete harm in receiving a receipt that violated this statute, Guarisma has sufficiently alleged an injury-in-fact so as to confer standing. Therefore, the Court has subject-matter jurisdiction over this case, and Microsoft's Motion is denied with respect to its jurisdictional arguments.
Id. *2–4.
Here, because the FACTA created a substantive legal right for Flaum and other consumers to receive printed receipts that do not disclose "more than the last 5 digits of the card number," 15 U.S.C. § 1681c(g), and Flaum personally suffered a concrete harm in receiving a receipt that violated the statute, he has sufficiently alleged an injury-in-fact so as to satisfy subject matter jurisdiction. Accordingly, it is
ORDERED AND ADJUDGED that the Motion [ECF No. 15] is DENIED .
DONE AND ORDERED in Chambers at Miami, Florida this 29th day of August, 2016.