Recently, a federal court in New Jersey dismissed a putative class action against J. Crew for claims that the fashion retailer violated the Fair and Accurate Credit Transactions Act (“FACTA”) amendment to the Fair Credit Reporting Act, 15 U.S.C. §1681, by printing too many digits on its customers’ receipts. See Ahmed Kamal v. J. Crew Group, Inc., et al., No. 2:15-0190 (WJM) (D.N.J June 6 2017). U.S. District Judge William J. Martini held that the Plaintiffs had not sufficiently alleged a concrete injury as required by the U.S. Supreme Court’s decision in Spokeo Inc. v. Robins, 136 S. Ct. 1540 (2016).
The FACTA requires that “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number…upon any receipt provided to the cardholder at the point of the sale of transaction.” See id. at 1 (quoting 15 U.S.C.A. §1681(c)). The statute creates a private right of action for “any actual damages…or damages of not less than $100 and not more than $1,000” for each violation. Id. (quoting 15 U.S.C.A. §1681n(a)).
Plaintiff, Ahmed Kamal, alleged that on three occasions, J. Crew printed the first six and last four digits of his credit card number on transaction receipts. See id. Plaintiff claimed that this conduct constituted a violation of FACTA and brought the action “on behalf of all persons or entities to whom [J. Crew] provided an electronically printed receipt at the point of sale or transaction…which receipts displayed more than the last five digits of the customer’s credit card number”, seeking statutory damages of $100 – $1,000 per violation. See id.
Initially, on August 6, 2015, the Court denied J. Crew’s motion to dismiss under Federal Rules of Civil Procedure Rule 12(b)(6), finding that Plaintiff had adequately stated a claim for willful violation of FACTA’s provisions. Id. at 2. Subsequently though, in December 2015, the Court granted J. Crew’s motion to stay the case, pending the Supreme Court’s decision regarding constitutional standing in Spokeo Inc. v. Robins (“Spokeo”). See id.
On May 16, 2016, the Supreme Court issued a ruling in Spokeo, holding that a plaintiff does not automatically “satisfy[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Id. (citing Spokeo, 136 S. Ct. at 1549). The Supreme Court set forth two factors that determine whether an intangible harm is sufficiently concrete: (1)“[W]hether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.”; and (2) “[W]hether Congress has expressed an intent to make an injury redressable.” Id. (quoting Spokeo, 136 S. Ct. at 1549).
Accordingly, the district court in Kamal v. J. Crew, applying Spokeo, “determined that it lacked subject matter jurisdiction and dismissed Kamal’s [Complaint] without prejudice.” Id. Plaintiff subsequently filed an Amended Complaint on November 17, 2016 and J. Crew filed a motion to dismiss for lack of standing, which gave rise to the recent decision. Id.
In deciding this motion to dismiss, the district court pointed to the Supreme Court’s decision in Spokeo, which clarified that an injury in fact must be “concrete,” meaning that “it must actually exist.” Id. (citing Spokeo, 136 S. Ct. at 1548). The district court also relied upon the Third Circuit’s recent decision in In re Horizon Healthcare Services In. Data Breach Violation, 846 F. 3d 625 (3d Cir. 2017) (“Horizon”), which had been issued while the motion was pending. There, the plaintiff alleged that unencrypted personal information of over 800,000 health insurance customers was stolen from Horizon’s headquarters, leading to a fraudulent tax return filed in plaintiff’s name and to an attempted credit card fraud. In Horizon, the Third Circuit held that the alleged injuries were sufficiently “concrete” to confer constitutional standing “because it sufficiently resembled a common law injury (invasion of privacy), such that Congress could ‘elevat[e] [it] to the status of legally cognizable injur[y].’” Id. at 4 (citing Horizon, 846 F. 3d. at 638-640).
Here, Plaintiff identified two “concrete” injuries: “(1) disclosure of information considered by law to be intrinsically private, and (2) the increased risk of identity theft or credit-card fraud in the future.” Id. The Court, however, found that neither theory adequately set forth a “concrete” harm; and therefore held that the Plaintiff had failed to satisfy the injury-in-fact element of constitutional standing. Id.
As to the first Spokeo factor (whether an alleged intangible harm is closely related to a harm that has traditionally been regarded as providing a basis for a lawsuit), the Court explained that there was no meaningful relationship with the allegedly unlawful conduct and “any privacy interest historically recognized at common law.” Id. at 5 (citing Horizon, 846 F. 3d at 637). The Court distinguished this case from Horizon based on the fact that here, “Plaintiff’s personal information was not disclosed to third parties or used to perpetrate credit-card or tax fraud.” Id. With respect to the second Spokeo factor (“the judgment of Congress”), the Court found that the legislative intent underlying FACTA’s private cause of action suggests that “[w]hile Congress undoubtedly hoped that FACTA would reduce identify theft, it does not follow that Congress contemplated private actions by individuals who have not sustained any actual harm.” Id.
Similarly, the Court rejected the argument that Plaintiff’s increased risk of future identity theft provided a basis for standing. Id. at 6. The Court concluded that “[e]ven drawing all reasonable inferences in Plaintiff’s favor,…the risk-of-harm argument fails to establish constitutional standing.” Id. Specifically, because the first six digits of a credit card number relate to the bank or card-issuer and the last 10 digits refer to the card-holder’s specific account, the Court could not “reasonably infer that printing the first six and last four digits of Plaintiff’s credit card materially increased the risk of future harm, because doing so ‘gives an identity thief no more personal information about a person’s account than Congress has permitted to be printed on receipts.’” Id. (quoting Noble v. Nevada Checker CAB Corp., No. 2:15-cv-02322-RCJ-VCF, 2016 WL 4432685, at *3 (D. Nev. Aug. 19, 2016)).
Accordingly, the Court granted J. Crew’s motion to dismiss under Federal Rules of Civil Procedure Rule 12(b)(1). As we have previously reported, the Spokeo decision highlighted the importance of the injury-in-fact requirement, making clear that consumers cannot rely solely on a mere statutory violation to establish standing. This opinion provides an insightful illustration of the injury-in-fact requirement set forth in Spokeo and later applied by the Third Circuit in Horizon. As always, we will continue to monitor for post-Spokeo decisions and developments.