The Ninth Circuit follows the Second and Seventh Circuits in dismissing consumer class actions in which named plaintiff alleges no injury other than statutory damages.
• In Bassett v. ABM Parking Services, Inc., the Ninth Circuit applies Spokeo, Inc. v. Robins in holding that a named plaintiff must allege a sufficiently concrete injury.
• While Bassett addresses a claim brought under FACTA, the decision may have broader implications because plaintiffs claiming bare procedural violations of other consumer protection statutes, without more, will have similar difficulty establishing standing to sue.
• Companies should not view Bassett as amnesty for violating statutes that provide for statutory damages such as FACTA, and must remain vigilant in ensuring compliance with statutes.
• Bassett will likely present an obstacle to plaintiffs seeking class certification because whether or not a particular putative class member suffered a concrete Article III injury will result in highly individualized inquiries.
On February 21, 2018, the Ninth Circuit issued its decision in Bassett, addressing whether the disclosure of a customer’s credit card expiration date on a receipt constitutes a sufficiently concrete injury to confer standing to sue. 1 The Ninth Circuit, consistent with the Second and Seventh Circuits’ rulings, held that printing a customer’s credit card expiration date on a receipt, without any other allegation of injury, does not constitute an injury-in-fact for standing purposes.2 The Ninth Circuit relied on Spokeo, in which the US Supreme Court held that a plaintiff must establish that an injury-in-fact is concrete and particularized. However, the Ninth Circuit’s decision has limited reach, because it likely does not apply to circumstances in which a customer no longer possesses a receipt, which may create a material risk of harm. At this time, the Supreme Court is unlikely to review Bassett given that all three circuits to address this identical claim have applied Spokeo in the same manner, and have reached the same result.
The Bassett decision serves as a constitutional roadblock for plaintiffs’ counsel seeking to sue companies for technical violations of the Fair and Accurate Credit Transactions Act (FACTA). In a broader context, Bassett further solidifies that plaintiffs cannot recover based solely on statutory violations unless those violations are accompanied by actual harm or a material risk of harm sufficient to confer standing. Plaintiffs claiming bare procedural violations of other statutes, without more, will have difficulty establishing concrete injury requisite for standing if Bassett is applied more broadly.
In 2003, Congress passed FACTA, which amended the Fair Credit Reporting Act (FCRA). FACTA provided that “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.”3 The statute provides penalties for “willful noncompliance” and for “negligent noncompliance.” “Any person who willfully fails to comply with [the FACTA requirement] with respect to any consumer is liable to that consumer” for actual damages of between US$100 and US$1,000 per violation, costs, reasonable attorney’s fees, and, potentially, punitive damages.4 “Any person who is negligent in failing to comply with [the FACTA requirement] with respect to any consumer is liable to that consumer” for actual damages and attorney’s fees.5
Following the passage of FACTA, enterprising plaintiffs’ attorneys filed numerous lawsuits on behalf of consumers against merchants who printed receipts that included the expiration date of the credit or debit card. In 2008, Congress passed the Credit and Debit Card Receipt Clarification Act (the Clarification Act) in response to the onslaught of class action litigation and the business community’s concerns.6 The Clarification Act provided that “any person who printed an expiration date on any receipt provided to a consumer cardholder at a point of sale or transaction between December 4, 2004, and June 3, 2008, but otherwise” did not print more than the last five digits of the card number, “shall not be in willful noncompliance” with FACTA.7 While the Clarification Act thus retroactively shielded companies from liability for revealing customers’ credit card expiration dates on or before June 3, 2008, it did not grant any reprieve for companies’ “willful noncompliance” after June 3, 2008.
The Ninth Circuit’s Decision in Bassett
In Bassett, ABM Parking Services (ABM) committed a technical violation of FACTA by printing the expiration date of Bassett’s credit card on his parking garage receipt.8 Bassett responded by filing a putative class action lawsuit claiming violations of FACTA, alleging that he was injured because the disclosure exposed him to an imminent risk of identity theft.9 Notably, Bassett “did not allege that a second receipt existed, that his receipt was lost or stolen, ... that he was the victim of identity theft[,]” or that a third party viewed the receipt.10 The only “sufficiently concrete” injury Bassett could allege in order to establish Article III standing was the “risk of harm” that the printing of the expiration date created.11
The Ninth Circuit considered whether Bassett had alleged a sufficiently concrete injury to give him Article III standing, but agreed with the district court that Bassett’s allegation of “only a statutory violation and a potential for exposure to actual injury” does not constitute “a concrete injury sufficient to give Bassett standing.”12
In so holding, the Ninth Circuit relied upon the Supreme Court’s decision on standing in Spokeo, Inc. v. Robins.13 As an initial matter, in order to establish standing, a plaintiff “must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.”14 As stated earlier in this Client Alert, Spokeo indicated that a plaintiff must show that the injury-in-fact is concrete and particularized. 15 A concrete injury must be “de facto,” which means that it “must actually exist.”16 In examining a putative class action lawsuit alleging a different FCRA violation, the Supreme Court emphasized that the plaintiff “cannot satisfy the demands of Article III by alleging a bare procedural violation” since “[a] violation of one of the FCRA’s procedural requirements may result in no harm.”17 On remand, the Ninth Circuit clarified that some statutory violations alone do establish concrete harm, but only those statutory provisions established to protect “concrete interests” and that “actually harm, or present a material risk of harm to, such interests.” 18 In Bassett, the Ninth Circuit reasoned that it “is difficult to see how issuing a receipt to only the card owner and with only the expiration date” could constitute concrete harm.19
After examining historical practice and congressional judgment, the Ninth Circuit concluded that Bassett’s allegation of a bare procedural violation of FACTA, without more, does not constitute a concrete injury. Bassett also argued that his alleged injury had a historical relationship to privacy-based torts, but the Ninth Circuit rejected such a relationship because ABM did not disclose Bassett’s information to anyone other than Bassett.20 In examining congressional judgment, the Ninth Circuit reiterated that Spokeo “rejected [the] conclusion that a FCRA plaintiff need only invoke a FCRA violation and seek statutory damages to allege a concrete injury.”21 An examination of the Clarification Act suggested that expiration date violations were not concrete injuries because the Act found that “a disclosed expiration date by itself poses minimal risk” of identity theft and the Act created a “temporary safe-harbor period.”22 Like the Ninth Circuit, the Seventh and Second Circuits each followed Spokeo and dismissed identical class action suits for lack of standing because the plaintiffs did not suffer concrete and particularized harm.
Implications of the Ninth Circuit’s Decision and the Future of FACTA Lawsuits
While the Ninth Circuit’s decision in Bassett (and the decisions of the Second and Seventh Circuits) provide a procedural shield from liability against a plaintiff whose factual situation mirrors that in Bassett, the decision’s reach is likely limited to situations in which an otherwise-compliant company prints an expiration date on a customer’s receipt and no one other than the customer and his or her lawyers viewed the receipt. Indeed, the Ninth Circuit pointed out that “Bassett did not allege that another copy of the receipt existed, that his receipt was lost or stolen, that he was the victim of identity theft, or even that another person apart from his lawyers viewed the receipt. Nor did he allege that any risk of harm is real, “not conjectural or hypothetical,” given that he could shred the offending receipt along with any remaining risk of disclosure.”23 Under controlling law in the circuit, consumers who receive a receipt from a company containing the expiration date of their credit cards will not be able to sue under FACTA to establish standing. This will apply as long as the company does not print more than the last five digits of the card number, and the receipt was not issued or exposed to anyone other than the card owner since these consumers will not be able to establish a concrete injury-in-fact.
For companies to control what happens to a receipt once it has been issued to a customer is difficult, if not impossible, so companies must remain vigilant in conducting reviews of issued receipts to ensure that they comply with FACTA. What may end up being a significant individual inquiry is what happened to the receipt after it was given to the customer. Ironically, if the customer still has the receipt and provides a copy as evidence for the lawsuit, then the receipt has likely never been shown to anyone else, and he or she would not have standing. On the flip side, if the receipt is lost, then the individual may not have proof of a violation.
The decision will likely have a large impact on the legal landscape beyond FACTA and the FCRA, since plaintiffs will need to meet the same burden of establishing concrete injury-in-fact with respect to bare procedural violations of other consumer protection statutes in order to establish standing to sue. Bassett serves as additional authority supporting the proposition that plaintiffs cannot recover for injuries that are merely speculative and hypothetical in nature. Even if a company commits a statutory violation, a plaintiff will still need to establish actual harm or a material risk of harm in order to survive a motion to dismiss for lack of standing.
In addition, the Ninth Circuit’s decision will likely have an effect on class certification for procedural violations of statutes, since the decision will make it more difficult for plaintiffs to establish the commonality, typicality, and predominance required for certification, and to accurately identify an appropriately defined class.24 Individualized inquiries will likely predominate, since they are necessary to establish concrete injury by showing that either actual harm occurred or there was a material risk of harm.
For the FACTA violation at issue in Bassett, these individualized inquiries would focus on what sort of disclosure of nonconforming receipts occurred for customers, since disclosure of the nonconforming receipt to someone other than the customer is necessary to establish actual harm or a material risk of harm.