After paying for groceries with a credit card or debit card, the clerk hands the receipt to the customer. In addition to the last four digits of the card number, it contains the first digit. Or perhaps it contains the first six digits. Or maybe the expiration date. Is this a concrete injury that provides the customer standing to sue the grocery store?
That is the question federal courts have grappled with since the Supreme Court decided Spokeo, Inc. v. Robins in May 2016. The Fair and Accurate Credit Transactions Act (“FACTA”) regulates retailers’ conduct in printing card number information on customers’ receipts and provides a private right of action for alleged violations. But, as discussed below, a customer may not have standing to sue in federal court or even in certain state courts just because a violation may have occurred.
FACTA—a 2003 amendment to the Fair Credit Reporting Act—requires the truncation of card numbers and expiration dates on printed cardholder receipts. Specifically, section 113 of FACTA provides that “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any [electronically-printed] receipt provided to the cardholder at the point of the sale or transaction.” Consumers may bring a civil claim for negligent or willful violation of the statute; a willful violation can give rise to statutory and punitive damages.
If consumers sue in federal court, they must establish standing, including an “injury in fact,” to maintain a claim. Although an intangible statutory injury may suffice under some circumstances, this “does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Thus, as the Supreme Court held in Spokeo, “a bare procedural violation, divorced from any concrete harm,” does not “satisfy the injury-in-fact requirement.” Courts have wrestled with how to apply this aspect of Spokeo to FACTA cases.
Despite Initial Decisions in Favor of Plaintiffs, the Majority View is Now to the Contrary
In mid-2016, district courts in the Eleventh Circuit issued a series of five decisions that applied Spokeo to FACTA claims and rejected challenges to the plaintiffs’ standing. The rulings reasoned that the alleged failure to truncate a card number, or the alleged printing of a card expiration date, was a “substantive” violation of a statutory right, rather than “a bare procedural violation.” According to these courts, the violation itself constituted a concrete injury, and thus the plaintiffs did not need to plead any further facts regarding harm suffered.
District courts outside of the Eleventh Circuit, however, began developing a contrary view of the application of Spokeo to FACTA claims. These courts concluded that certain alleged violations of the FACTA card number truncation requirement were “technical violation[s]” that “create no ‘concrete’ harm of the type sought to be prevented by Congress.” For instance, in Noble v. Nevada Checker CAB Corp., the District of Nevada reasoned that FACTA’s “more than the last 5 digits” language creates ambiguity when viewed in the context of the card industry standard that the first six digits of a card number identify the card issuer, not the cardholder. And because FACTA does not preclude the printing of the card issuer’s name on the receipt, the printing of the first digit and last four digits presents no greater risk of harm to the cardholder than what the statute permits. Thus, absent separate allegations of “actual harm,” such as resulting credit card fraud, the cardholder lacks an injury-in-fact and thus standing. Other district courts in the Ninth Circuit adopted similar reasoning, as did district courts in the Second, Third, Seventh, and Eighth Circuits.
In September 2017, the Second Circuit validated the reasoning of the district courts in the developing majority. In Katz v. Donna Karan Co., the court ruled that the alleged violation was a “bare procedural violation” and proceeded to consider how district courts should “determine whether a bare procedural violation presents a material risk of harm to a concrete interest.” The Second Circuit held that the district court had not clearly erred in finding that the printing of the card issuer identification number (the first six digits) failed to produce concrete harm. “While [plaintiff] may be correct that every additional digit increases the risk of a brute force cryptological attack, printing the first six digits … is the equivalent of printing the name of the issuing institution, information which need not be truncated under FACTA.”
Courts have also ruled that printing an expiration date on a receipt, without more, is a mere technical violation of FACTA that does not support standing. In Meyers v. Nicolet Restaurant of De Pere, LLC, for example, the Seventh Circuit reasoned that because the plaintiff “discovered the violation immediately and nobody else ever saw the non-compliant receipt,” “it is hard to imagine how the expiration date’s presence could have increased the risk that [the plaintiff’s] identity would be compromised.” Additionally, in passing the Credit and Debit Card Receipt Clarification Act of 2007 (the “Clarification Act”), Congress “specifically declared that failure to truncate a card’s expiration date, without more, does not heighten the risk of identity theft.” Thus, the court concluded that “without a showing of injury apart from the statutory violation, the failure to truncate a credit card’s expiration date is insufficient to confer Article III standing.”
Subsequently, district courts in the Second, Fifth, Ninth, and Tenth Circuits have followed Meyers. Several decisions acknowledge and rely on the congressional declaration, expressed through the Clarification Act, that the mere failure to truncate an expiration date does not increase the risk of identity theft. And in Crupar-Weinmann v. Paris Baguette America, Inc., the Second Circuit joined the Seventh Circuit, determining the impact of the Clarification Act was “dispositive.” The Second Circuit explained that “[w]hile we acknowledge that the Clarification Act maintained FACTA’s prohibition on this practice, we decline to draw plaintiff’s proposed inference” that the prohibition necessarily recognizes a “concrete harm.”
Even some district courts in the Eleventh Circuit have now adopted the majority approach. In Gesten v. Burger King Corp., the Southern District of Florida dismissed FACTA claims because the plaintiff had not alleged a concrete injury under Spokeo. The Gesten court recognized that “the Second Circuit and several district courts have held that the printing of the first six digits of a credit card account number on a receipt does not constitute an injury in fact because the first six digits merely identify the institution that issued the card, and are not part of the consumer’s unique account number.” The court also recognized that “the Seventh and Second Circuits, as well as multiple district courts, have held that under Spokeo, a plaintiff does not have standing to pursue a FACTA claim if the plaintiff has not suffered any actual harm or a material risk of harm.”
Remand and State Court Jurisprudence
Without standing to pursue a FACTA claim in federal court, a consumer might try to assert such a claim in state court. Yet, some states have standing jurisprudence that mirrors that of federal law. In those states, a successful challenge to the concreteness of the plaintiff’s alleged injury under Spokeo may serve as grounds to dismiss FACTA claims in state court (whether in the first instance or upon remand) or in a case removed to federal court, to oppose remand to state court under the “futility exception.”
A recent trial court decision out of North Carolina is illustrative. In Miles v. Company Store, Inc., the plaintiff alleged that the defendant violated FACTA by printing both the first six digits and last four digits of his credit card number on his customer copy receipt, thereby purportedly exposing him “to an increased risk of identity theft.” Recognizing that North Carolina’s standing doctrine incorporates an injury-in-fact requirement “imported from federal standing doctrine,” the North Carolina state court looked to recent federal court decisions for guidance. Without citing to Spokeo, the court identified and followed several post-Spokeo decisions where “federal courts have determined that the exact injury alleged here does not meet the concreteness requirement.” It remains to be seen if more state courts apply a Spokeo-type concreteness analysis to alleged FACTA claims and, if so, in which states Spokeo-type challenges result in dismissal.
Although a clear majority trend—that an alleged FACTA violation by itself does not establish a concrete injury under Spokeo—has developed, upcoming decisions from the courts of appeals could change the legal landscape. The Ninth Circuit will likely be the next federal appellate court to address the intersection of FACTA and Spokeo. On November 17, 2017, a Ninth Circuit panel heard oral argument in the Noble appeal, focusing largely on whether the printing of the card issuer identification portion of a card number can give rise to concrete injury when FACTA does not prohibit the printing of the issuer’s name on the same receipt. Depending on how the court rules, it could create a split with the Second Circuit’s decision in Katz. Appeals are also underway in the Third and Fifth Circuits.
Absent a circuit split, it does not appear that the Supreme Court will review the application of Spokeo to FACTA claims any time soon. In June 2017, for example, the Court denied certiorari in the Meyers case. And the parties did not seek certiorari in Crupar-Weinmann or Katz. It remains to be seen how other federal courts—including the courts of appeals before which appeals are pending—and other state courts view the issue, as well as whether it eventually makes its way to the Supreme Court. Businesses that generate printed cardholder receipts—like our hypothetical grocery store—should remain alert to developments in this area of the law.