McCloud v. Save-a-lot Knoxville, LLC et al, No. 3:2018cv00486 - Document 37 (E.D. Tenn. 2019)
Court Description: MEMORANDUM AND OPINION. Having addressed both of Plaintiffs alleged injuries, and having found that Plaintiff does not allege an injury in fact, the Court will GRANT Defendants motion to dismiss (Doc. 20) and will DISMISS this action WITHOUT PREJUDICE for lack of jurisdiction. Signed by District Judge Curtis L Collier on 5/24/2019. (BDG)
Download PDF
<![CDATA[
McCloud v. Save-a-lot Knoxville, LLC et al Doc. 37 UNITED STATES DISTRICT COURT EASTERN DISTRICT OF TENNESSEE AT KNOXVILLE LARRY McCLOUD, Plaintiff, v. SAVE-A-LOT KNOXVILLE, LLC, et al., Defendants. ) ) ) ) ) ) ) ) ) Case No. 3:18-cv-486 Judge Curtis L. Collier Magistrate Judge Debra C. Poplin MEMORANDUM Before the Court is a motion to dismiss by Defendants Moran Foods, LLC and Save-a-lot, LTD. (Doc. 20.) On March 26, 2019, the Court granted a motion by Defendants Newcorp, LLC, and Save-a-lot Knoxville, LLC to join in the motion to dismiss. (Doc. 27.) Plaintiff Larry McCloud has responded in opposition to the motion to dismiss (Doc. 30), and Defendants Moran Foods, LLC, Save-a-lot, LTD., Newcorp, LLC, and Save-a-lot, Knoxville, LLC (“Defendants”1) have replied (Doc. 33). Also before the Court is a motion by Plaintiff for oral argument on the motion to dismiss, as well as an amended motion for oral argument on the motion to dismiss. (Docs. 34, 35.) Defendants have responded in opposition to Plaintiff’s motions for oral argument. (Doc. 36.) Upon review of the submissions of the parties, the docketed record, and applicable law, the Court finds that a hearing is not necessary to resolve the issues before it. The Court will DENY Plaintiff’s motion for oral argument (Docs. 34, 35). For the following reasons, the Court will 1 Plaintiff has also named as Defendants to this action Does 1 through 10, inclusive. The Doe Defendants have not been served with process and are not included in the Court’s reference to Defendants in this memorandum. Dockets.Justia.com GRANT Defendants’ motion to dismiss (Doc. 20) and will DISMISS this action WITHOUT PREJUDICE for lack of jurisdiction. I. BACKGROUND On November 15, 2018, Plaintiff filed this case as a putative class action, alleging in a one- count complaint that Defendants violated the Fair and Accurate Credit Transactions Act (“FACTA”), 15 U.S.C. § 1681, et seq. (Doc. 1.) Plaintiff states that Defendants transgressed a portion of FACTA which prohibits printing more than the last five digits of a consumer’s credit or debit card number on any transactional receipt. Plaintiff alleges that Defendants printed at least the first six and the last four digits of the credit or debit card number on receipts given to Plaintiff and putative class members. Plaintiff has attached a redacted receipt to his response brief showing that he made a purchase at a Save-A-Lot store in Knoxville, Tennessee for a total of $23.53 in goods on April 6, 2018. (Doc. 30-2.) Plaintiff seeks statutory damages, punitive damages, costs, and attorney’s fees, all of which are made available by FACTA. See 15 U.S.C. § 1681n. On March 12, 2019, Defendants moved to dismiss Plaintiff’s complaint under Federal Rule of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction, or alternatively, under Rule 12(b)(6) for failure to state a claim. (Doc. 20.) II. STANDARD OF REVIEW When a defendant moves to dismiss for a lack of subject-matter jurisdiction under Rule 12(b)(1), the plaintiff has the burden of proving jurisdiction. Davis v. United States, 499 F.3d 590, 593-94 (6th Cir. 2007). A Rule 12(b)(1) motion may present either a facial attack, which questions the sufficiency of the pleadings, or a factual attack, which challenges the factual existence of subject-matter jurisdiction. United States v. Ritchie, 15 F.3d 592, 598 (6th Cir. 1994). 2 Defendants do not specify here, but appear to generally make a facial attack on the sufficiency of Plaintiff’s pleadings. While Defendants make some factual arguments,2 they do not attach any extrinsic evidence to their motion to dismiss in support of those points. In addition, Plaintiff characterizes Defendants’ motion as presenting a facial attack in his response brief (Doc. 30 at 5)—a claim which Defendants do not address or dispute in their reply brief. The Court will thus review the motion as presenting a facial attack. “When reviewing a facial attack, a district court takes the allegations in the complaint as true,” though conclusory allegations and legal conclusions will not prevent dismissal. Gentek Bldg. Prods. v. Sherwin-Williams Claims, 491 F.3d 320, 330 (6th Cir. 2007); O’Bryan v. Holy See, 556 F.3d 361, 376 (6th Cir. 2009).3 III. ANALYSIS In support of their motion to dismiss, Defendants argue that Plaintiff has not suffered an injury in fact, that Plaintiff does not fall within the zone of interests of FACTA,4 and that Plaintiff has not alleged a willful violation of FACTA. (Doc. 20-1.) Defendants also argue that Plaintiff should be ordered to provide a more definite statement under Rule 12(e), should the Court not dismiss Plaintiff’s case on jurisdictional grounds or for failure to state a claim. (Id.) The Court, 2 For instance, Defendants argue that evidence suggests that any disclosure of the first six digits of a consumer’s credit or debit card merely identifies the consumer’s card issuer and does not give any more personal information than Congress has otherwise permitted to be printed on receipts. (Doc. 20-1 at 7-8.) 3 The Court does not provide the standard of review under Rule 12(b)(6) because it concludes it does not have jurisdiction to hear this action under Rule 12(b)(1). 4 Though Defendants make arguments regarding FACTA’s zone of interests in the context of Rule 12(b)(6), the Supreme Court has suggested that the zone of interests test is a component of standing. See, e.g., Bank of Am. Corp. v. City of Miami, Fla., 137 S. Ct. 1296, 1302-03 (2017). Because of this, the Court notes that Defendants’ zone of interests argument would better align with their jurisdictional arguments under Rule 12(b)(1). 3 however, agrees with Defendants that it does not have jurisdiction: Plaintiff has not suffered an injury in fact. The Court first provides some background information regarding FACTA before turning to a discussion of the legal standard for alleging an injury in fact in the context of consumer protection statutes like FACTA, as well as an analysis of Plaintiff’s alleged injuries as compared to that legal standard. 1. FACTA Title Fifteen, United States Code Section 1681c(g) is entitled “Truncation of credit card and debit card numbers,” and states, (1) In general Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction. (2) Limitation This subsection shall apply only to receipts that are electronically printed, and shall not apply to transactions in which the sole means of recording a credit card or debit card account number is by handwriting or by an imprint or copy of the card. (3) Effective date This subsection shall become effective— (A) 3 years after December 4, 2003, with respect to any cash register or other machine or device that electronically prints receipts for credit card or debit card transactions that is in use before January 1, 2005; and (B) 1 year after December 4, 2003, with respect to any cash register or other machine or device that electronically prints receipts for credit card or debit card transactions that is first put into use on or after January 1, 2005. 15 U.S.C. § 1681c(g). Congress enacted this provision of FACTA as an amendment to the Fair Credit Reporting Act (the “FCRA”) in a 2003 effort to prevent identity theft. Kamal, 918 F.3d at 106. The provision was “included . . . to limit the number of opportunities for identity thieves to ‘pick off’ key card account information.” Id. (quoting S. Rep. No. 108-166, at 13 (2003)). 4 In May of 2007, the Federal Trade Commission (“FTC”) issued a notice reminding businesses that the law had gone into effect, and that under it, businesses “may include no more than the last five digits of the card number, and [that they] must delete the card’s expiration date.” Slip Showing? Federal Law Requires All Businesses to Truncate Credit Card Information on Receipts, Federal Trade Commission (May 2007), https://www.ftc.gov/tips-advice/businesscenter/guidance/slip-showing-federal-law-requires-all-businesses-truncate. The FTC stated, “[f]or example, a receipt that truncates the credit card number and deletes the expiration date could look like this: ACCT: ***********12345 EXP: ****[.]” Id. The FTC stated it was important for businesses to comply with the law in order to prevent “fraudsters and identity thieves,” but also because “[n]oncompliance could open a company up to an FTC law enforcement action, including civil penalties and injunctive relief.” Id. The FTC also noted that, “the law allows consumers to sue businesses that don’t comply and to collect damages and attorney’s fees.” Id. The parties dispute the significance of a development regarding FACTA which took place around that same time. By 2007, FACTA was resulting in a consequence Congress had not anticipated—“hundreds of lawsuits were filed” which Congress saw as “abusive” and which did “not protect consumers but only result in increased cost to business and potentially increased prices to consumers.” Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241, 122 Stat. 1565 (June 3, 2008). In particular, Congress was concerned with lawsuits which alleged that businesses had failed to remove the expiration date of a consumer’s card on their receipt, “even where the account number was properly truncated.” Id. § (a)(4). Congress found that “none 5 of [those] lawsuits contained an allegation of harm to any consumer’s identity,” id. § (a)(5), and that “the continued appealing and filing of [those] lawsuits represent[ed] a significant burden on the hundreds of companies that ha[d] been sued and could well raise prices to consumers without corresponding consumer protection benefit[,]” id. § (a)(7). Accordingly, Congress amended the enforcement provision of the FCRA in the Credit and Debit Card Receipt Clarification Act of 2007 (the “Clarification Act”), Pub. L. No. 110-241, 122 Stat. 1565 (June 3, 2008). Under the Clarification Act, any person who printed an expiration date on a receipt between December 4, 2004 and the date of the enactment of the clarification, but otherwise complied with Section 605(g), would not be in “willful noncompliance” with the Section, and could not be found in violation of the FCRA. See 15 U.S.C. § 1681n(d). The amendment, in effect, provided a safe harbor for businesses which had improperly printed receipts with consumers’ card expiration dates, but which did properly truncate consumers’ card digits. See id. 2. Injury in Fact in the Context of Consumer Protection Statutes As the number and breath of federal laws like FACTA have grown, federal courts have had occasion to consider whether a defendant’s alleged violation of those statutes can confer an injury in fact onto a plaintiff, and by consequence, have the potential to confer adequate standing. See Macy v. GC Services Ltd. P’ship, 897 F.3d 747, 753-56 (6th Cir. 2018). At their core, arguments about the doctrine of standing concern the power a federal court has under the United States Constitution. Under the Constitution, federal courts are endowed with “[t]he judicial Power of the United States.” U.S. Const. Art. III, § 1. The judicial power of the United States extends only to “Cases” and “Controversies.” Id. § 2. Standing is rooted in the interpretation of what constitutes a “case” or “controversy,” and which serves to properly limit the category of litigants empowered to maintain a lawsuit in federal court. Spokeo, Inc. v. Robins, 136 6 S. Ct. 1540, 1547 (2016). A litigant must have “‘such a personal stake in the outcome of the controversy’ as to warrant his invocation of federal-court jurisdiction and to justify exercise of the court’s remedial powers on his behalf.” Warth v. Seldin, 422 U.S. 490, 498-99 (1975) (quoting Baker v. Carr, 369 U.S. 186, 204 (1962)). The “irreducible constitutional minimum of standing contains three elements”: (1) injury in fact, (2) causation, and (3) redressability. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992). The injury in fact requirement mandates that a plaintiff must have suffered an invasion of a legally protected interest which is (a) concrete and particularized and (b) actual or imminent and not conjectural or hypothetical. Id. First, a plaintiff must show that he suffered a concrete injury— a de facto injury which “actually” exists. Soehnlen v. Fleet Owners Ins. Fund, 844 F.3d 576, 58182 (6th Cir. 2016) (quoting Spokeo, 136 S. Ct. at 1548). Second, “[f]or an injury to be particularized, ‘it must affect the plaintiff in a personal and individual way.’” Id.; see also Valley Forge Christian Coll. v. Am. United for Separation of Church & State, Inc., 454 U.S. 464, 472 (1982) (observing plaintiff must have personally suffered some actual or threatened injury). When a case is at the pleading phase, a plaintiff must clearly allege facts which demonstrate an injury in fact. Spokeo, 136 S. Ct. at 1547. In the foremost recent Supreme Court case on the issue of standing in the context of a statutory violation, Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), the Court considered whether a consumer had standing by alleging that a website operator had published inaccurate information about him in violation of the Fair Credit Reporting Act (“FCRA”). Macy, 897 F.3d at 753-56. Because the Supreme Court remanded Spokeo without deciding whether the consumer had adequately alleged an injury in fact on the facts of the case, interpretations of the decision have diverged. Id. at 754. 7 On the one hand, the Court made it clear that “a plaintiff must allege that the procedural statutory violation caused the plaintiff to suffer some harm that ‘actually exist[s]’; there must be an injury that is ‘real’ and not ‘abstract’ or merely ‘procedural.’” Id. at 753 (quoting Spokeo, 136 S. Ct. at 1548-49) (alteration in original). For example, the Supreme Court stated that even if a website operator violated the FCRA by reporting someone’s zip code incorrectly, it would be “difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.” Spokeo, 136 S. Ct. at 1550. Through this observation, the Court recognized that the injury in fact requirement is a constitutional doctrine, and that “Congress cannot erase Article III’s standing requirements by statutorily granting the right to sue a plaintiff who would not otherwise have standing.” Id. (quoting Raines v. Byrd, 521 U.S. 811, 820 n.3 (1997)). “[T]here is no such thing as an ‘anything-hurts-so-long-as-Congress-says-it-hurts theory of Article III injury.’” Huff v. TeleCheck Servs., Inc., — F.3d —, No. 18-5438, 2019 WL 1967707, at *3 (6th Cir. May 3, 2019) (quoting Hagy v. Demers & Adams, 882 F.3d 616, 622 (6th Cir. 2018)). On the other hand, however, the Court also recognized that the “violation of a procedural right granted by a statute can be sufficient in some circumstances to constitute injury in fact.” Spokeo, 136 S. Ct. at 1549. Those harms, at times, can constitute an injury in fact because “Congress is well positioned to identify intangible harms that meet minimum Article III requirements,” and because Congressional “judgment is instructive and important.” Id. Indeed, the Court observed that, in a limited respect, “Congress may ‘elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.’” Id. (quoting Lujan, 504 U.S. at 578). The Court has also instructed that it is important to consider “whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts,” because the doctrine 8 of standing is “grounded in historical practice.” Id. Because of all of these observations, it is not accurate to state that a plaintiff has suffered an injury in fact only where he or she alleges an injury beyond the violation of a statute passed by Congress. Macy, 897 F.3d at 754. In Macy v. GC Services Limited Partnership, the United States Court of Appeals for the Sixth Circuit recently explained those “circumstances” where the violation of a right granted by a statute can itself confer an injury in fact. 897 F.3d 747, 754 (6th Cir. 2018). Those instances occur when (1) the statutory provision at issue was established to protect a concrete interest (as opposed to a purely procedural right); and (2) where the specific procedural violations alleged have presented a “material” risk of harm to such interests. Id. at 755. In summarizing, the appeals court stated, Spokeo categorized statutory violations as falling into two broad categories: (1) where the violation of a procedural right granted by statute is sufficient in and of itself to constitute concrete injury in fact because Congress conferred the procedural right to protect a plaintiff’s concrete interests and the procedural violation presents a material risk of real harm to that concrete interest; and (2) where there is a “bare” procedural violation that does not meet this standard, in which case a plaintiff must allege “additional harm beyond the one Congress has identified.” Id. at 756 (quoting Spokeo, 136 S. Ct. at 1549). In line with this observation, when a plaintiff alleges that a statute has been broken, but makes no legitimate allegation concerning further harm he or she has suffered, the district court must ask two questions, all while focusing on the statutory provision at issue: first, did Congress confer this procedural right (which has since been allegedly violated) to protect the plaintiff’s concrete interests? And, second, did the procedural violation itself present a material risk of real harm to that interest? If the answer to both questions is yes, then the plaintiff has alleged an injury in fact. If the answer to either question is no, then the plaintiff must allege some additional harm beyond the procedural violation to show he or she has suffered an injury in fact. 9 In regard to the second question, there must at least be a “material” risk of real harm when a statutory violation is at issue. Macy, 897 F.3d at 756. While Congress has “power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before,” Spokeo, 136 S. Ct. at 1549 (quoting Lujan, 504 U.S. at 580 (Kennedy, J., concurring) (internal quotation mark omitted)), the Supreme Court has also observed that, absent a statutory right of action, a threatened harm must be “certainly impending,” or based on a “substantial risk” of harm to amount to an injury in fact, Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013). See Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 113 n.4 (3d Cir. 2019). The material risk of harm standard strikes a balance between these two observations when an alleged statutory violation is at issue. See id. 3. Plaintiff’s Alleged Injuries The parties dispute whether Plaintiff has alleged an injury in fact. Plaintiff’s complaint and responsive brief state that Defendants injured Plaintiff, as well as those similarly situated, in two primary ways. (See Docs. 1, 30.) First, Defendants allegedly violated FACTA by printing at least the first six digits and the last four digits of the card number on receipts given to Plaintiff, as well as to purported class members. (Id. ¶ 4.) Plaintiff’s complaint argues that this is not a “trifling matter” because the violation exposed Plaintiff and class members to “at least an increased and material risk of identity theft and credit card and or debit card fraud.” (Id. ¶¶ 5, 9.) Plaintiff supports this argument by referencing Congress’s reasons for protecting credit card numbers, as well as through information from computer scientists about hacking. (Id. ¶¶ 11-12.) Second, Plaintiff alleges that purported class members and himself were burdened with an “additional inconvenience” of taking “steps to ensure the safety of his or her identity” because “he or she may 10 not simply crumple the receipt and throw it into a nearby trash can, but must review it to assess what was printed, hold on to it, and perhaps shred it or cut it up later.” (Id. ¶ 16.) Notably, the majority of Plaintiff’s complaint does not focus on Plaintiff at all. (See Doc. 1.) Rather, Plaintiff’s allegations focus on the intent of Congress in passing FACTA, the ability of hackers to use credit card information to engage in cyberattacks, and the complex problem of identity theft. (Id.) Plaintiff does not allege, however, that his own receipt was lost or stolen, or that he has been a victim of identity theft or credit card fraud. (Id.) Indeed, Plaintiff does not even allege that someone else has viewed the partially redacted card digits on his receipt. (Id.) It is also notable that Plaintiff brings no claims sounding in state law, but only alleges one count of the violation of FACTA. Because Plaintiff has not alleged he suffered any actual injury “in the fleshand-blood or dollars-and-cents sense of the term,” nor has he alleged that it was “certainly impending” that his identity would be stolen, the Court begins by assessing whether Plaintiff’s allegation of a FACTA violation created a “procedural or intangible injury.” See Huff, 2019 WL 1967707, at *3. a. FACTA Violation Presented with allegations regarding a statutory violation of FACTA, the Court must assess whether “the violation of a procedural right granted by [FACTA] is sufficient in and of itself to constitute concrete injury in fact because Congress conferred the procedural right to protect a plaintiff’s concrete interests and the procedural violation presents a material risk of real harm to that concrete interest.” Macy, 897 F.3d at 756 (quoting Spokeo, 136 S. Ct. at 1549). The Court finds, first, that Congress conferred the rights contained in FACTA to protect Plaintiff’s concrete interests in being free from identity theft, but, second, that Plaintiff has not sufficiently alleged a material risk of real harm to his concrete interests in his complaint. 11 1. Plaintiff’s Concrete Interests It is relatively undisputed that the FACTA provision requiring the truncation of a consumer’s credit card number “was part of Congress’s effort to prevent the concrete harm of identity theft.” Kamal, 918 F.3d at 115 (citing Bassett v. ABM Parking Servs., 883 F.3d 776, 78283 (9th Cir. 2018) (FACTA’s truncation provision seeks to reduce the risk of identity theft)); see also Katz v. Donna Karan Co., 872 F.3d 114, 116 (2d Cir. 2017) (same); Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 725 (7th Cir. 2016), cert. denied, 137 S. Ct. 2267 (2017) (same)); Muransky v. Godiva Chocolatier, Inc., 922 F.3d 1175, 1188 (11th Cir. 2019) (“We think it beyond debate that a consumer has a concrete interest in preventing his identity from actually being stolen”). When plaintiffs allege that “their data has already been stolen and is now in the hands of ill-intentioned criminals,” the Sixth Circuit has recognized that their allegations “are sufficient to establish a cognizable Article III injury at the pleading stage of the litigation.” Galaria v. Nationwide Mut. Ins. Co., 663 F. App’x 384, 388 (6th Cir. 2016). Thus, the Court agrees with those courts which have observed that prevention of identity theft is a “concrete” interest, and that the FACTA provision requiring card number truncation is aimed at protecting it. The Court notes that the parties dispute the import of the Clarification Act in revealing Congress’s aims. The Court finds, however, that the Clarification Act only illuminated that the inclusion of an expiration date on a receipt was a mere procedural violation of FACTA, while the truncation of card numbers could potentially play a larger role in protecting a consumer’s concrete interests. In the Clarification Act, Congress observed that, “[e]xperts in the field agree that proper truncation of the card number, by itself as required by the amendment made by the [FACTA], regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating 12 identity theft or credit card fraud.” Pub. L. No. 110-241, 112 Stat. 1565. Accordingly, Congress found lawsuits which targeted businesses for an expiration date violation to be “abusive” because the consumer’s credit or debit card number was still protected. Id. After the Clarification Act was passed, lawsuits which only alleged that a receipt included a consumer’s card expiration date were found certainly deficient for lack of a concrete injury. See Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 79-82 (2d Cir. 2017) (inclusion of expiration date alleged insufficient injury in fact); Meyers, 843 F.3d at 727-28 (same). Congress appeared to still indicate, however, that the truncation provision is an important part of FACTA for purposes of protecting a consumer’s identity. On the other hand, Defendants argue that the Clarification Act revealed a broader Congressional aim to limit FACTA lawsuits to those which contain “an allegation of harm to any consumer’s identity.” Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110241, 122 Stat 1565 (June 3, 2008). Congress stated that the purpose of the Clarification Act was “to ensure that consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits that do not protect consumers.” Id. (emphasis added). While Defendants’ point is valid, Plaintiff still argues that he suffered from actual harm, and that his lawsuit does protect consumers because it is based on the more important part of FACTA—the portion which requires credit or debit card number truncation. While this is a far more nuanced argument than one based, for instance, on an allegation that Plaintiff’s identity was stolen, it is still an alleged injury which Spokeo could potentially recognize as constituting an injury in fact. 136 S. Ct. at 1549 (“the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact”). 13 2. Material Risk of Harm However, Plaintiff must also show that the “procedural violation presents a material risk of real harm to [his] concrete interest.” Macy, 897 F.3d at 756. The Court finds that Plaintiff has not alleged any material risk of real harm to his concrete interest in being free from identity theft. Plaintiff’s complaint first generally claims that “by printing the first 6 and last 4 digits of the card number on the receipts provided to Plaintiff and other credit card and/or debit card cardholders transacting business with Defendants, Defendants have harmed Plaintiff and the Class by exposing them to at least an increased and material risk of identity theft and credit and or debit card fraud.” (Doc. 1 ¶ 9.) This sort of conclusory allegation does not suffice to prevent a motion to dismiss for lack of jurisdiction. O’Bryan, 556 F.3d at 376. Plaintiff also alleges that the first six and last four digits of a card number, either alone or in conjunction with other information, can be used to bolster the credibility of a criminal who is making pretext phone calls or engaging in email phishing scams. This allegation is based on the idea that a criminal may “pick off” different bits of information from different sources. Defendant also discusses a study by computer scientists showing that “even starting with no details at all other than the first six digits [of a card number] a hacker can obtain the three essential pieces of information to make an online purchase in as little as six seconds.” (Doc. 1 ¶ 12.) While Defendants contest these claims by arguing that the first six digits of a credit or debit card only identify the card issuer and give an identity thief no more information than Congress already permitted to be printed on receipts, the Court is mindful that it must take all well-pleaded allegations in Plaintiff’s complaint as true. Gentek Bldg. Prods., 491 F.3d at 330. Even taking these allegations as true, however, Plaintiff does not allege how common this exact criminal strategy may be. For instance, the fact that some computer scientists have found 14 that hackers have the capability to use the first six digits of a card number to quickly make an online purchase does not entail that this practice is currently being engaged in by hackers in any sort of threatening mass. Nor does the study mention that these hackers tend to be dumpster-divers or trash-pickers, thereafter using information that they have gathered from discarded transactional receipts. The allegation only notes that the six-digit method of hacking was “likely to have been used” in a recent cyberattack. In addition, an article which Plaintiff attaches regarding the hacking technique itself notes that the team of scientists only found the VISA network to be particularly vulnerable, but not the Mastercard network. (Doc. 1-6 at 4.) Plaintiff does not allege whether his card was issued by the VISA network, or not. Plaintiff additionally makes no allegation about how common it is for hackers to pick off pieces of information—in specific, using the partially disclosed digits of a consumer’s credit card from a discarded printed receipt—in order to engage in making pretext phone calls or e-mail phishing scams. Again, just because a criminal is capable of engaging in criminal behavior in a certain specific method does not entail that the same method is common enough such that Plaintiff was exposed to a “material” risk of a crime being committed against him by Defendants’ alleged violation of FACTA. In no way is the Court suggesting that identity theft is uncommon, nor does the Court wish to understate the havoc it can wreak in a consumer’s life. The Court merely observes that Plaintiff has not alleged that he was exposed to a material risk of harm of identity theft through his receipt from Save-A-Lot, LLC in his complaint.5 Yet, Plaintiff has the burden of clearly alleging facts which demonstrate each element of the standing doctrine. See Spokeo, 136 S. Ct. at 1547. 5 The Court also notes more generally that there is a long tradition in the law which tends to presume that criminal acts are unforeseeable and uncommon. See, e.g., Restatement (Second) of Torts § 448 (1965) (stating general rule that act of third person in committing an intentional tort 15 A contrast to this scenario is the case of Macy v. GC Services Limited Partnership, where the Sixth Circuit recently analyzed a procedural violation of a provision of the Fair Debt Collection Practices Act (the “FDCPA”). The portion of the FDCPA at issue required debt collectors to provide consumers with a notice stating that if the consumer opted to contest the debt in writing, additional debtor protections would be triggered. The Sixth Circuit reasoned that Congress conferred those procedural rights in order to protect the plaintiffs’ concrete interests in being free from abusive debt-collection practices. Macy, 897 F.3d at 756. In evaluating whether the plaintiff faced a material risk of harm by the defendant’s violation of the statute, the Sixth Circuit noted that courts use the standard of the “least sophisticated consumer” when evaluating the impact of an FDCPA violation. Id.; see also Barany-Snyder v. Weiner, 539 F.3d 327, 333 (6th Cir. 2008). Because the defendant violated the FDCPA by failing to let plaintiffs know about the additional protections they could receive by contesting their debt in writing, every single plaintiff (presumed to be the “least sophisticated consumer”) who was sent a deficient notice undoubtedly experienced a material risk that they, themselves, would unintentionally waive their FDCPA debt validation rights. The Sixth Circuit concluded that, “Plaintiffs were placed at a materially greater risk of falling victim to ‘abusive debt collection practices.’” Id. at 758 (quoting15 U.S.C. § 1692(e)). Thus, the plaintiffs in Macy alleged a sufficient injury in fact. Unlike here, the plaintiffs in Macy did not refer to a speculative string of causation about what a third party might or might not do to harm them. Accord Huff, 2019 WL 1967707, at *7 (“The Macy statute made a risk of harm far more likely than this law does.”). Instead, there was a material risk that each plaintiff would harm him or herself by waiving their FDCPA debt-collection or crime is a superseding cause which can cut off liability of original actor due to lack of foreseeability). 16 rights because each plaintiff was presumed to be the least sophisticated consumer. Here, Plaintiff instead relies on a theory resting on conjecture about the decisions of independent, criminal actors. See Clapper, 568 U.S. at 414 (“We decline to abandon our usual reluctance to endorse standing theories that rest on speculation about the decisions of independent actors.”). More recently, the Sixth Circuit also compared the FDCPA violation in Macy to an FCRA violation more similar to the case here. See Huff v. TeleCheck Servs., Inc., — F.3d —, 2019 WL 1967707 (6th Cir. May 3, 2019). There, the plaintiff alleged that he was provided a copy of his file from a check verification company which omitted information about some of the plaintiff’s linked bank accounts. Id. at *2. As to that alleged statutory harm, the Sixth Circuit observed, The [FCRA] does not contain such interlocking statutory protections [as the FDCPA]. While it allows consumers to look into and correct information in their files, it does not provide a shield from imminent economic harm in the way the [FDCPA] does. The [FCRA’s] main target is the dissemination of inaccurate and harmful information, just as in Spokeo. See 136 S. Ct. at 1550. Because TeleCheck’s nondisclosure never harmed Huff, and because it did not create a material risk that Huff would suffer a check decline, Huff has not suffered an injury in fact. The difference between Macy and this case comes down to a difference in how Congress exercised its power. In Macy, Congress did not trespass on Article III because the statutory violation was closely connected to real economic harm and thus amounted to an injury in fact. In this instance, Congress crossed the line. It has not shown how a deprivation of information that neither holds consequences for the consumer nor imposes a real risk of harm creates an injury. In the absence of that showing, we have only Congress’s say-so, and that does not suffice—at least so long as the federal courts preserve the Constitution’s structural boundaries. Id. at *8. The Sixth Circuit found that the plaintiff had not suffered an injury in fact. Id. Because FACTA amended the FCRA in numerous respects, the Court finds this reasoning highly relevant to the case, here. While the Sixth Circuit has not considered whether the FACTA violation Plaintiff raises constitutes an injury in fact, the Court’s observation that there is no material risk of real harm is in 17 line with decisions of the majority of United States Courts of Appeals which have considered the issue.6 See Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 116 (3d Cir. 2019) (“we agree with the District Court that this speculative chain of events does not constitute a material risk of harm”); Noble v. Nevada Checker Cab Corp., 726 F. App’x 582, 584 (9th Cir. 2018) (no material risk of harm where first and last five digits were printed on receipt); Katz v. Donna Karan Co., L.L.C., 872 F.3d 114, 120 (2d Cir. 2017) (finding district court did not err in making factual finding that no injury exists because printing first six digits of credit or debit card “does not increase the risk of real harm”).7 The Court also aligns itself with the two courts within the Sixth Circuit which have reached the same conclusion in regard to defendants who printed the first six and last five digits of consumers’ card numbers on their receipts. See Hullinger v. Park Grove Inn, Inc., No. 3:17-cv-4, 2018 WL 3040571, at *3 (E.D. Tenn, June 19, 2018) (“This case presents a perfect example of a procedural violation which may result in no harm”); Everett v. Memphis Light Gas & Water Div., No. 16-cv-2810, 2017 WL 1830165, at *3 (W.D. Tenn, Apr. 18, 2017) (“Plaintiff has failed to plead facts that establish a causal chain between the FACTA violation alleged here and an increased risk of identity theft”). Plaintiff presents three primary counter-arguments to the Court’s conclusion regarding risk of harm. First, Plaintiff makes several references to Congress’s observations about the dramatic 6 Reaching the opposite conclusion is a case decided by the United States Court of Appeals for the Eleventh Circuit, Muranksy v. Godiva Chocolatier, Inc., 922 F.3d 1175 (11th Cir. 2019), which the Court discusses further, below. 7 While Plaintiff argues it is improper for the Court to rely on Katz because it presented a factual challenge to jurisdiction and not a facial challenge, the Court merely notes the case as persuasive authority for finding that there is no material risk of real harm. As stated above, the Court has taken all the well-pleaded allegations in Plaintiff’s complaint as true. Accord Kamal, 918 F.3d at 118 (“In this context, we agree with the Eleventh Circuit that we cannot “rely on facts established in . . . older cases.”). 18 increase in instances of identity theft which were taking place at the time of the adoption of FACTA. For instance, Plaintiff’s reply brief references a 2003 report from the United States House of Representatives Committee on Financial Services which cited the need to “provide consumers with the tools they need to fight identity theft[,]” and found that identity theft had “‘reached almost epidemic proportions’ with the FTC fielding over 160,000 calls about identity theft in 2002 alone.” (Doc. 30 at 2-3 (quoting H.R. Rep. No. 108-263, at 1 (Sept. 4, 2003)).) It logically follows that Congress would not have required credit or debit card number truncation on receipts unless that information was materially contributing to identity theft. On this point, however, the Court agrees with the Third Circuit, which observed, the congressional “[f]act-[f]inding” Kamal relies on is not particularized to his alleged injury. Kamal does not point us to any part of the congressional record that considers the risk of identity theft when only the first six and last four digits of a consumer’s credit card are printed on a receipt. Instead, he notes that “[e]xperts . . . recommended [to Congress] that card numbers not be printed in full on receipts, because card numbers are particularly dangerous in the hands of sophisticated criminals.” Because Kamal has not alleged that J. Crew printed his card number “in full,” these congressional findings of risk are not tailored to the FACTA violation he has pleaded. Kamal, 918 F.3d at 116 n.5 (internal citations omitted). In general, statistics cited by Congress before the adoption of FACTA addressed the harm of printing a credit or debit card number on a receipt in full. Congress did not have occasion to consider whether a consumer would face a material risk of real harm when the first six and last four digits of a credit or debit card number appear on a receipt. Second, Plaintiff argues that there is no “chain of causation” which the Court should concern itself with because Plaintiff’s harm occurred “at the point of the transaction”—that is, immediately when Plaintiff was provided his receipt. Plaintiff states, “[b]y requesting the Court to focus only on events after Plaintiff took possession of the unlawful receipt, Defendants urge the 19 Court to ignore or disregard Congress’ [sic] judgment that merchants must protect their customers by truncating card numbers on receipts given at the point of sale.” (Doc. 30 at 14.) At the point of sale, Plaintiff was given a receipt with some of his own credit card digits reflected on it. Plaintiff surely already knew the full number on his card, or could easily reference the number on the card itself. The Court does not see how Plaintiff suffered any type of arguable harm at that point in time without there being some sort of material risk that something would happen with the card information later on. Plaintiff may fear further exposure of his information due to the receipt, but the Court discusses why this fear is also insufficient below. Because Plaintiff does not successfully allege that he was exposed to a material risk of real harm of his identity being stolen later on, Plaintiff cannot have alleged any injury in fact at the time of the transaction. While the Court acknowledges “Congress’s judgment” in requiring card number truncation at the point of sale, the Court remains mindful that “Congress cannot erase Article III’s standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.” Spokeo, 136 S. Ct. at 1550 (quoting Raines, 521 U.S. at 820 n.3); see also Huff, 2019 WL 1967707, at *5 (“Although Congress wields broad authority to define injuries, it does not have a blank check.”). Third, Plaintiff stresses that the Eleventh Circuit has reached the opposite conclusion on this issue in Muransky v. Godiva Chocolatier, Inc., 922 F.3d 1175 (11th Cir. 2019). An Eleventh Circuit panel issued an initial opinion on October 3, 2018, 905 F.3d 1200, but the same panel later sua sponte vacated the previous opinion and published one in its place, 922 F.3d 1175. Overall, the Eleventh Circuit sided with the plaintiff, stating, “Dr. Muransky suffered the heightened risk of identity theft the moment Godiva printed too many digits of his credit card number.” 922 F.3d at 1185. 20 The Court first notes that, in part of its reasoning, the Eleventh Circuit panel observed, “where Congress elevates the risk of harm to a concrete interest to the status of a concrete injury, the risk need be no more than an ‘identifiable trifle’ to be concrete.” Id. at 1185-86. The panel then cited a 2009 case decided by its own court which observed that “a small injury, ‘an identifiable trifle[,]’” can be sufficient to confer standing—such as being required to present a photo identification when voting in person. Id. (citing Common Cause/Georgia v. Billups, 554 F.3d 1340, 1351 (11th Cir. 2009)). Billups, however, said nothing about how large the risk of harm to a plaintiff’s concrete interest needs to be. See Billups, 554 F.3d at 1351. Going further, the Muransky court stated, “[i]n our view, if Congress adopts procedures designed to minimize the risk of harm to a concrete interest, then a violation of that procedure that causes even a marginal increase in the risk of harm to the interest is sufficient to constitute a concrete injury.” Muransky, 922 F.3d at 1188 (emphasis added). This Court finds that following those observations would only alter the rule established by the Sixth Circuit that a plaintiff must show a “material risk of real harm” to his or her concrete interest, not a “marginal increase” in the risk of harm to his or her concrete interest. See Macy, 897 F.3d at 756. The Eleventh Circuit also observed that the plaintiff had standing based “on the similarity between the harm he allege[d] and the common law tort of breach of confidence.” Muransky, 922 F.3d at 1190. This was significant to the panel because Spokeo described it as “instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” 136 S. Ct. at 1549. The panel observed that a “common law breach of confidence lies where a person offers private information to a third party in confidence and the third party reveals that information[,]” and found that the defendant had engaged in a similar practice by printing more credit card digits 21 than FACTA allows. Muransky, 922 F.3d at 1190. Even then, the panel recognized that “the match” between the two types of actions is “not exact[,]” and recognized that “unlike a common law breach of confidence, a merchant need not disclose a credit card number to anyone in order to violate FACTA.” Id. at 1192. The Eleventh Circuit still found “sufficient similarity” between a FACTA violation and a breach of confidence such that the court found that the plaintiff had alleged an injury in fact. Here, Plaintiff makes similar arguments, proposing that FACTA’s truncation requirement bears a close relationship to analogous common law torts such as invasion of privacy, breach of confidence, and breach of an implied bailment agreement. The Court, however, is convinced by the Third Circuit’s observation that a plaintiff’s alleged injury does not have a close relationship with traditional privacy tort actions when the plaintiff does not allege any disclosure of his information to a third party. Kamal, 918 F.3d at 114. In all of the traditional privacy torts, the Third Circuit observed, harm transpires when a third party gains unauthorized access to a plaintiff’s personal information. Id. Absent disclosure to a third party, as is the case with Plaintiff’s allegations here, Plaintiff’s injury is unlike those harms recognized by traditional causes of action. Because of this, the Court rejects Plaintiff’s arguments that the harm he suffered has a close relationship to a harm traditionally regarded as providing a basis for a lawsuit in English or American courts, and disagrees with the Eleventh Circuit’s reasoning on those grounds. Taken together, the Court sees no reason to follow the reasoning of the Eleventh Circuit and depart from the majority of courts finding that a plaintiff does not allege a sufficient injury by pleading that a defendant violated FACTA by printing the first six and last four digits of his or her credit or debit card number on a receipt. 22 b. Burden of Destroying or Retaining Receipt Plaintiff also alleges that he was burdened by having to either safeguard his receipt through retaining it or through “disposing of it in a manner that does not display his card number”— presumably, through tearing it up or shredding it. (Doc. 30 at 16.) Either way, Plaintiff argues, he “is not able to simply crumple the receipt and throw it away.” 8 (Id.) The Court finds that this argument still hinges on whether Plaintiff faced any material risk of his identity being stolen. Because the Court has observed that Plaintiff did not allege a material risk of his identity being stolen, the Court is not convinced that Plaintiff had any real burden to protect or destroy his receipt. While Plaintiff may be a very cautious person who chooses to take the extra step of retaining or destroying his receipt regardless of his true exposure to risk, he cannot manufacture his own injury based on speculation about a threat which does not present any material risk of real harm. In Clapper v. Amnesty International, USA, the Supreme Court observed, respondents cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending. . . . If the law were otherwise, an enterprising plaintiff would be able to secure a lower standard for Article III standing simply by making an expenditure based on a nonparanoid fear. 568 U.S. 398, 416 (2013). As such, this secondary argument is simply a “repackaged version” of Plaintiff’s first, failed, theory of standing. See id. The Court similarly rejects it. 8 The Court notes that the Eleventh Circuit initially found that this could constitute an injury in fact in its first version of Muransky, 905 F.3d at 1211 (“Dr. Muransky must use their time (and wallet space) to safely dispose of or keep the untruncated receipt so as to avoid someone finding their credit card number on their receipt”). The opinion which vacated and superseded the first, however, does not contain this same observation. 922 F.3d at 1191-92. 23 III. CONCLUSION Having addressed both of Plaintiff’s alleged injuries, and having found that Plaintiff does not allege an injury in fact, the Court will GRANT Defendants’ motion to dismiss (Doc. 20) and will DISMISS this action WITHOUT PREJUDICE for lack of jurisdiction. An Order Will Enter. ENTER: /s/____________________________ CURTIS L. COLLIER UNITED STATES DISTRICT JUDGE 24
]]>
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You
should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.
