On June 6, 2017, in Kamal v. J. Crew Grp, Inc., No. CV 2:15-0190, 2017 WL 2443062 (D.N.J. June 6, 2017), the United States District Court for the District of New Jersey dismissed a plaintiff's second attempt to assert a claim for violations of the Fair and Accurate Credit Transactions Act (FACTA) for lack of standing in a decision that highlights the evolving boundaries of injury-in-fact in the wake of Spokeo.
The plaintiff alleged that three different J. Crew stores provided him with purchase receipts that violated the FACTA amendment to the Fair Credit Reporting Act (FCRA). Specifically, he alleged that the receipts included the first six and last four digits of his credit card number—more than "the last five digits" of his card number authorized to be printed under FACTA. Plaintiff's first amended complaint (FAC) initially survived a Fed. R. Civ. P. 12(b)(6) challenge; however, the court subsequently stayed the case pending the outcome of Spokeo, Inc. v. Robins.
On May 16, 2016, the Supreme Court decided Spokeo, holding that, under Article III, an injury-in-fact must be "concrete and particularized" as well as "actual or imminent, not conjectural or hypothetical." Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016). The Court further observed that a "violation of a procedural right granted by statute can [alone] be sufficient in some circumstances to constitute injury in fact." Id. at 1549.
In light of the Spokeo holding, the plaintiff's FAC was dismissed for lack of standing under Fed. R. Civ. P. 12(b)(1). The court noted that "most federal courts faced with similar FACTA complaints have agreed that a violation of the credit-card truncation provision does not automatically confer Article III standing under Spokeo," but allowed the plaintiff to amend his complaint.
Shortly after the plaintiff brought his second amended complaint (SAC), the Third Circuit issued its opinion in In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625 (3d Cir. 2017), conferring standing in a data breach case where the plaintiffs alleged that two laptops containing unencrypted personal information of over 800,000 health insurance customers were stolen. In so holding, the Third Circuit found that the plaintiffs' allegations of FCRA violations constituted de facto injury sufficient to satisfy Article III's injury-in-fact requirements, reasoning that Congress had established that the unauthorized dissemination of personal information by a credit reporting agency caused an injury in and of itself—whether or not the disclosure of that information increased the risk of identity theft. Horizon, 846 F.3d at 640-41.
In an attempt to satisfy Spokeo and Horizon, the plaintiff alleged two "concrete" injuries: (1) disclosure of information considered by law to be intrinsically private, and (2) the increased risk of identity theft or credit card fraud in the future. The court found these allegations were insufficient to confer standing, reasoning that, with respect to disclosure, unlike Horizon, personal information was not disclosed to a third party or used to perpetuate fraud. Instead, the plaintiff "gave his credit-card number to J. Crew, which then printed a receipt containing part of that number and handed it back to [plaintiff]." These allegations were "a bare procedural violation, divorced from any concrete harm, under circumstances that d[id] not implicate traditional common law privacy interests."
The court also rejected the plaintiff's theory that printing a receipt identifying the first six digits (which "do not pertain to the customer's individual bank account") and the last four digits of the plaintiff's credit card number (less than the statutorily-allowed disclosure of the last five digits) and then returning that receipt to the plaintiff "implicat[ed] the historic 'right to be let alone.'" Further, the court found there was no congressional intent for a bare procedural violation of FACTA to constitute a de facto injury.
With respect to future harm, the court found the allegations did not give rise to an inference that the information on the receipt "materially increased the risk of future harm." The plaintiff offered only a "speculative chain of events" regarding the threat of future harm, which pertained to the gathering of discarded receipts by "dumpster divers" or "sophisticated criminals" deducing plaintiff's account number. The court also noted that the plaintiff cited no support for these concepts. Thus, plaintiff could not meet the requirements of Article III.
Courts have been wrestling with Spokeo's statements regarding injury-in-fact, especially in data privacy litigation. Specifically, whether an intangible harm must have a close relationship to harm traditionally recognized at common law or whether Congress, in enacting a law, contemplated private actions arising only from a procedural statutory violation. In its ruling, the J. Crew court noted that "[a]s Spokeo explained and Horizon acknowledged, the congressional power to elevate intangible harms into concrete injuries is not without [Article III] limits." Many will continue to watch as cases like J. Crew and Horizon continue to test and define these limits.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
