Emerging Trends in Post-Spokeo FACTA Litigation

A Refresher on Article III Standing and Subject Matter Jurisdiction

Subject matter jurisdiction can be challenged at any time by the parties or the court. The party invoking a federal court’s jurisdiction has the burden of establishing it. The United States’ Constitution expressly limits the jurisdiction of federal courts to actual “Cases” and “Controversies.” U.S. Const. art. III, § 2. The Supreme Court has recognized that “[n]o principle is more fundamental to the judiciary’s proper role in our system of government than the constitutional limit of federal-court jurisdiction to actual cases or controversies.” Rains v. Byrd, 521 U.S. 811, 818 (1997). The case-or-controversy requirement of Article III of the Constitution requires plaintiffs to establish standing to sue. There can be no case or controversy, and therefore no subject matter jurisdiction, until a plaintiff first demonstrates standing.

A plaintiff has standing only if he or she (1) has suffered an “injury in fact” that is (a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the defendant’s challenged conduct; and (3) it is likely (as opposed to speculative) that the injury will be redressed by a favorable judicial decision. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992). If a plaintiff lacks Article III standing, the suit must be dismissed under Federal Rule of Civil Procedure 12(b)(1).

The Spokeo Decision

In Spokeo, a plaintiff filed a class action for alleged violations of the Fair Credit Reporting Act (FCRA). The district court dismissed the complaint, holding that the plaintiff failed to properly allege an injury in fact as required by Article III. The Ninth Circuit reversed and held that the plaintiff had standing because he alleged his statutory rights were violated when the defendant allegedly collected and disseminated inaccurate information about the plaintiff. The Supreme Court vacated and remanded the decision because the Ninth Circuit improperly conflated two of the independent requirements of the injury-in-fact analysis: concreteness and particularity. Spokeo, 136 S. Ct. at 1546, 1548. The Supreme Court did not decide whether the plaintiff adequately alleged an injury in fact, but it did provide guidance to judges and practitioners when evaluating the injury-in-fact requirement of Article III standing.

One primary takeaway from Spokeo is that courts and practitioners must treat the injury-in-fact requirements separately: A plaintiff must have a concrete and particularized injury, and the injury must be actual or imminent. A particularized injury “must affect the plaintiff in a personal and individual way.” Id. at 1548. With regard to a concrete injury, the Supreme Court explained that an injury might exist even if the injury is intangible, but the Court clarified that “Congress’ role in identifying and elevating intangible harms does not mean a plaintiff automatically satisfies the injury in fact requirement whenever a statute grants a person a statutory right and purports to authorize that individual to sue to vindicate that right.” Instead, a “concrete” injury must “actually exist,” be “real,” and “not abstract.” While a “risk of real harm” may potentially satisfy the requirement of concreteness in certain circumstances, “a bare procedural violation, divorced from any concrete harm,” will not suffice. Article III standing requires a concrete injury even in the context of an alleged statutory violation. Id. at 1548–49.

The Supreme Court did not address the requirement that an injury be actual or imminent in its Spokeo opinion. The Court provided separate guidance on such requirements in Clapper v. Amnesty International USA, 133 S. Ct. 1138, 1147 (2013) (holding that the “threatened injury must be certainly impending to constitute an injury in fact and allegations of possible future injury are not sufficient”).

Spokeo’s Impact on FACTA Litigation Has Been Particularly Significant

Since the Supreme Court’s Spokeo decision, it has become common for defendants in privacy and consumer class actions to challenge Article III standing. The strategy has been successfully employed in a variety of class action matters, but it has been particularly effective in combating FACTA class actions.

As background, FACTA was a 2003 amendment to the FCRA. See 15 U.S.C. §§ 1681 et seq. Congress enacted FACTA in response to a perceived increased risk of identity theft. 149 Cong. Rec. 26,891 (2003). In relevant part, FACTA provides that “[n]o person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.” 15 U.S.C. § 1681c(g)(1). Each “willful” violation permits a consumer to recover either the actual damages sustained by the consumer as a result of the violation or potentially ruinous statutory damages of between $100 and $1,000 per transaction. 15 U.S.C. § 1681n(a)(1)(A).

After FACTA’s enactment, there was a tidal wave of class action litigation in which plaintiffs alleged merchants “willfully” violated the FCRA or FACTA. The problem was so pervasive that Congress subsequently enacted the Credit and Debit Card Receipt Clarification Act of 2007, which was designed to ensure that consumers suffering from actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits that do not protect consumers but only result in increased cost to business and potentially increased prices to consumers. Pub. L. No. 110-241, § 2(b) (emphasis supplied).

Notwithstanding Spokeo’s guidance, plaintiffs in FACTA litigation have largely attempted to establish Article III standing by arguing that any individual who receives a receipt that violates FACTA, without alleging any additional harm, has sufficiently pled concrete injury. More specifically, or perhaps alternatively, plaintiffs also frequently argue that Spokeo only addressed procedural rights and that Congress, through FACTA, created a substantive legal right to receive receipts truncating personal credit card numbers and expiration dates, thus protecting individuals’ personal financial information. In other words, so long as a plaintiff is pursuing vindication of his or her substantive legal rights, the plaintiff need not allege harm beyond the technical statutory violation defined by Congress.

A strong majority of courts have rejected such arguments and dismissed FACTA complaints for lack of subject matter jurisdiction. For example, in Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 724 (7th Cir. 2016), the plaintiff received a receipt after dining at the defendant’s restaurant and noticed that the receipt did not truncate the credit card’s expiration date as FACTA requires. Two months after visiting the restaurant, the plaintiff brought a class action seeking statutory damages for himself and everyone who received a noncompliant receipt. The plaintiff argued that Congress, through FACTA, granted him the right to receive a receipt that truncated the expiration date on his credit or debit card; the defendant argued that its alleged FACTA violation did not cause the plaintiff any harm.

The Seventh Circuit held that “Spokeo compels the conclusion that [the plaintiff’s] allegations are insufficient to satisfy the injury-in-fact requirement for Article III standing.” Meyers, 843 F.3d at 727. The court explained that the allegations of the complaint actually demonstrated that the plaintiff did not suffer any harm because of the defendant’s printing of the expiration date on his receipt. “Nor has the violation created any appreciable risk of harm.” Id. The court noted that “Congress has specifically declared that the failure to truncate a card’s expiration date, without more, does not heighten the risk of identity theft.” Id. at 727–28. Further, in the Credit and Debit Card Receipt Clarification Act of 2007, Congress made a finding of fact that “[e]xperts in the field agree that proper truncation of the card number, by itself required by [FACTA], regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud.” Id. (quoting Pub. L. 110-241, § 2(a)(6)). The Seventh Circuit concluded that a violation of FACTA, divorced from real-world harm, is insufficient to satisfy Article III’s injury in fact requirement. Id.

In Crupar-Weinmann v. Paris Baguette America, Inc., No. 14-3709 (2d Cir. June 26, 2017), the Second Circuit recently joined the Seventh Circuit and also held that in the context of FACTA litigation, the printing of an expiration date on a credit or debit card receipt by itself does not constitute an injury in fact sufficient to establish Article III standing. The Second Circuit noted that even where Congress has created statutory rights designed to protect a specific interest, a plaintiff may still fail to demonstrate a concrete injury where violation of the statute at issue presents no material risk of harm to the underlying interest. The Second Circuit found the Credit and Debit Card Receipt Clarification Act highly relevant to its decision—noting that “Congress did not think that the inclusion of a credit card expiration date on a receipt increases the risk of material harm of identity theft.”

Most district courts faced with similar FACTA complaints agree that a technical violation of the statute’s credit card truncation provisions does not automatically confer Article III standing under Spokeo. See Kamal v. J. Crew Grp., Inc., 2017 WL 2587617 (D.N.J. June 14, 2017); Katz v. Donna Karan Int’l, Inc., 2017 WL 2191605 (S.D.N.Y. May 17, 2017); Llewellyn v. AZ Compassionate Care Inc., No. 16-cv-04181, 2017 WL 1437632, at *6 (D. Ariz. Apr. 24, 2017); Hendrick v. Aramark Corp., 2017 WL 1397241, at *4–5 (E.D. Pa. Apr. 18, 2017); Stelmachers v. Verifone Sys., No. 14-04912, 2016 WL 6835084, at *4 (N.D. Cal. Nov. 21, 2016); Thompson v. Rally House of Kan. City, 2016 U.S. Dist. LEXIS 146146, at *9 (W.D. Mo. Oct. 6, 2016); Noble v. Nev. Checker CAB Corp., No. 2:15-cv-02322, 2016 WL 4432685, at *3 (D. Nev. Aug. 19, 2016).

Spokeo’s impact on non-FACTA privacy and consumer class action litigation has also been significant, but such cases are not as clearly defined and do not enjoy the same strong majority as outlined above. One clear takeaway from Spokeo is that purely technical violations of statutory rights will not likely result in Article III standing. Another takeaway is that defendants will continue to challenge standing’s injury-in-fact requirement—alleging that the plaintiff did not suffer a concrete and particularized and actual or imminent injury—and seek to have such matters dismissed for lack of subject matter jurisdiction. As a result, practitioners must carefully analyze the statutory rights in question and the particular risk of harm Congress sought to prevent, and evaluate whether the technical violation in question entails the degree of risk necessary to establish injury in fact and, ultimately, standing.

_{Copyright © 2017, American Bar Association. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. The views expressed in this article are those of the author(s) and do not necessarily reflect the positions or policies of the American Bar Association, the Section of Litigation, this committee, or the employer(s) of the author(s).}