WILLIAM J. MARTINI, U.S.D.J.

OPINION

WILLIAM J. MARTINI , U.S.D.J. :

Plaintiff Ahmed Kamal brings this putative class action suit for alleged violations of the Fair and Accurate Credit Transactions Act ("FACTA") amendment to the Fair Credit Reporting Act, 15 U.S.C. § 1681, et seq. This matter comes before the Court on Defendants' motion to dismiss for lack of subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1). For the reasons set forth below, the motion to dismiss is GRANTED. Plaintiff's Amended Complaint is DISMISSED without prejudice.

I. BACKGROUND

In 2003, Congress passed the Fair and Accurate Credit Transaction Act ("FACTA") in part to curb credit card fraud and identity theft. 15 U.S.C. § 1681c. It prohibits, among other things, printing more than the last five digits of a credit card number on a sales receipt, a policy known as "truncation." In theory, at least, truncation reduces the risk that third parties use financial information on lost or stolen receipts to perpetrate fraud or identity theft. FACTA creates a private cause of action for "any actual damages . . . or damages of not less than $100 and not more than $1,000." 15 U.S.C. § 1681n(a).

Defendants are a conglomerate of several hundred clothing stores and manufacturers known as J. Crew, along with parent company Chino's Holdings, Inc. Plaintiff Ahmed Kamal brings this action "on behalf of all persons or entities to whom Defendants provided an electronically printed receipt at the point of sale or transaction . . . which receipt displayed more than the last five digits of the customer's credit card number." Pl. Am. Compl., ¶ 13.

Plaintiff alleges that on December 18, 2014, he visited one of Defendants' retail locations in Ocean City, Maryland. Upon making a purchase with his Discover credit card, Plaintiff was given a receipt featuring the last four digits and the first six digits of his credit card number, whereas the statute would permit printing no more than the final five digits. Pl. Am. Compl., ¶ 69. Plaintiff reports that similar violations occurred when he made purchases at Defendants' Rehoboth Beach, Delaware location on December 22, 2014, and at Defendants' Wayne, New Jersey location on January 4, 2015.

Procedural History before this Court

The Amended Complaint of March 25, 2015 states a single count action for violating FACTA. Plaintiff seeks the statutory damages of $100 to $1000 per violation along with attorneys' fees and punitive damages. On August 6, 2015, the Court denied Defendants' motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), finding that Plaintiff adequately stated a claim for willful violation of FACTA's credit card number truncation provision. See 15 U.S.C. § 1681, et seq.

The Court stayed the case in December of 2015 pending the Supreme Court's decision in Spokeo Inc. v. Robins, which asked the following: "Whether Congress may confer Article III standing upon a plaintiff who suffers no concrete harm, and who therefore could not otherwise invoke jurisdiction of a federal court, by authorizing a private right of action based on a bare violation of a federal statute." Defs. Mot. Dismiss, at 1. That case was decided on May 16, 2016. Spokeo Inc. v. Robins, 136 S. Ct. 1540 (2016).

On June 15, 2016, following supplemental briefing, Defendants moved to dismiss under 12(b)(1), arguing that Plaintiff lacked standing under Article III of the Constitution, and that the Court thus lacks subject matter jurisdiction over the action. Defs. Mot. Dismiss, at 2.

II. LEGAL STANDARD

Federal Rule of Civil Procedure 12(b)(1) is the proper vehicle for challenging a plaintiff's Article III standing. Fed. R. Civ. P. 12(b)(1); see Society Hill Towers Owners' Ass'n v. Rendell, 210 F.3d 168, 175 (3d Cir. 2000). The burden of establishing subject matter jurisdiction rests with the plaintiff. Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016). Animal Sci. Prod., Inc. v. China Minmetals Corp., 654 F.3d 462, 470 (3d Cir. 2011). "Although 'general factual allegations of injury resulting from the defendant's conduct may suffice,' the complaint must still 'clearly and specifically set forth facts sufficient to satisfy' Article III." Reilly v. Ceridian Corp., 664 F.3d 38, 41 (3d Cir. 2011) (citations omitted).

III. DISCUSSION

Article III of the Constitution limits the jurisdiction of federal courts to "Cases" and "Controversies." U.S. Art. III § 2. Plaintiffs must "clearly . . . allege facts demonstrating" all three elements of constitutional standing: (1) an "injury in fact," (2) that is "fairly traceable" to a defendant's conduct, and that (3) is likely to be redressed by favorable judicial intervention. Lujan v. Defs. Of Wildlife, 504 U.S. 555, 561 (1992). To establish an "injury in fact," Plaintiff must show "an invasion of a legally protected interest which is (a) concrete and particularized . . . and (b) actual or imminent, not conjectural or hypothetical." Id. at 560 (citations omitted). Defendants correctly argue that Plaintiff lacks standing because his injury is not sufficiently "concrete."

A. Governing Case Law

This action was stayed in December of 2015 pending the Supreme Court's decision in Spokeo v. Robbins. That decision confirmed that an "injury-in-fact" must be "concrete" even where Congress has authorized a private cause of action. Spokeo, 136 S. Ct., at 1548 (citations omitted). Spokeo did not disturb this circuit's standing jurisprudence. See In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262, 273 (3d Cir. 2016). An "injury in fact" may be "intangible" or difficult to monetize, but it must be "actual or imminent, not conjectural or hypothetical." Spokeo, 136 S. Ct., at 1548. Where the alleged injury is heightened risk of future harm, the allegations must "entail a degree of risk sufficient to meet the concreteness requirement." Id. at 1550; Clapper v. Amnesty Int'l USA, 133 S. Ct. 1138 (2013); Bock v. Pressler & Pressler, LLP, 2016 WL 4011150, at *1 (3d Cir. July 27, 2016) ("the question framed by [Spokeo] [is] whether the particular procedural violations alleged in [a] case entail a degree of risk sufficient to meet the concreteness requirement.") (citation omitted).

As the Defendants argue, the alleged injury here entails an increased risk of suffering fraud or identity theft sometime in the future, not a manifest violation of a traditional privacy interest. Compare Reilly, 664 F.3d, at 41 (finding no standing for allegations of an increased risk of identity theft resulting from the defendant's security breach) with Nickelodeon II, 827 F.3d, at 295 (finding plaintiff had standing where defendant engaged in coordinated surveillance of web browsing and disclosed private data to third parties). The purpose of credit card truncation is to limit incremental risk of fraud or identity theft, not safeguard one's freedom from "injurious disclosure[] as to private matters" or "intrusion upon the domestic circle" or some other traditional privacy interest. See Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 Harv. L. Rev. 193 (1890); Nickelodeon II, 827 F.3d, at 295 (finding standing where plaintiffs adequately stated claim for invasion of privacy). The essential question is whether, in light of Congress' decision to authorize private suits under FACTA, printing ten rather than five credit card digits on a sales receipt elevates the risk of fraud enough to work a "concrete" injury for the purpose of Article III standing. If the harm is not "concrete," the Court lacks subject matter jurisdiction and must dismiss the case.

B. Plaintiff's Article III Standing

On its face, the Amended Complaint alleges that Plaintiff became more susceptible to fraud because J. Crew prints the first six and last four digits of credit card numbers on customer receipts, instead of just the last four digits. See Am. Compl., ¶ 42 ("By failing to comply Defendants have deprived their customers of the protections that the statute was designed to confer, and exposes cardholders to increased risk of identity theft."). Several district courts have examined whether an individual in Plaintiff's position has Article III standing in light of Spokeo's discussion of the "concreteness" requirement. They have reached inconsistent outcomes. See Thompson v. Rally House of Kansas City et al., 15-cv-00886-GAF, at *9 (W.D. Mo. Oct. 6, 2016) (printing first six and last four digits amounts to "purely procedural violation" of FACTA and does not constitute an injury-in-fact); Wood v. J Choo USA, 2016 WL 4249953, at *4 (S.D. Fla. Aug. 11, 2016) (denying motion to dismiss claim for lack of standing where defendant violated FACTA by including expiration date on receipt); Guarisma v. Microsoft, 2016 WL 4017196 (S.D. Fla. July 26, 2016); Altman v. White House Black Mkt., Inc., 2016 WL 3946780 (N.D. Ga. July 13, 2016).

The Court finds that Plaintiff's allegations do not "entail a degree of risk sufficient to meet the concreteness requirement." Spokeo, 664 F.3d, at 1550. The Amended Complaint does not provide any facts demonstrating a risk sufficiently "actual or imminent" to constitute a concrete injury. Thompson, 15-cv-00886-GAF, at *9 (W.D. Mo. Oct. 6, 2016). See also Reilly v. Ceridian Corp, 664 F.3d 38, 46 (3d Cir. 2011); Crisafulli v. Ameritas Life Ins. Co., 2015 WL 1969176 (D.N.J. Apr. 30, 2015), at *3 (plaintiff failed to demonstrate "plausible, increased risk of future harm" and thus lacked standing); Noble v. Nevada Checker CAB Corp., 2016 WL 4432685, at *3 (D. Nev. Aug. 19, 2016) (finding no standing for FACTA plaintiffs where alleged injury was printing extra digit on customer receipts).

There is no evidence that anyone has accessed or attempted to access or will access Plaintiff's credit card information. See Thompson, 15-00886, at * 9 ("There is no real risk of harm as the improper receipt has only been in Plaintiff's possession since receiving it from Defendants."); Khan v. Children's Nat'l Health System, 2016 WL 2946165, at *5 (D. Maryland May 19, 2016) (risk of future harm did not amount to "injury in fact" where it was unclear whether hackers "actually viewed, accessed, or copied" personal medical data). Nothing has been disclosed to third parties. See Reilly, 664 F.3d, at 43-44; Braitberg v. Charter Commc'ns, Inc., No. 14-1737, ___F.3d___, 2016 WL 4698283, at *4 (8th Cir. Sept. 8, 2016) (procedural violation of data retention statute was not sufficiently "concrete" to confer standing). Nor does the record indicate that anyone will actually obtain one of Plaintiff's discarded J. Crew receipts, and—through means left entirely to the Court's imagination—identify the remaining six digits of the card number and then proceed undetected to ransack Plaintiff's Discover account.

Plaintiff vaguely refers to less sophisticated identity thieves called "carders" or "dumpster divers," who supposedly coble together credit card numbers from lost or discarded receipts. Am. Compl., ¶ 20. Even considered in a most favorable light, whatever causal chain Plaintiff alludes to is even more attenuated than the allegations in Reilly and other risk-of-harm cases in which courts have found no standing. See, e.g., In re Horizon Healthcare Services, Inc. Data Breach Litigation, 2015 WL 1472483, at *6 (March 31, 2015); In re Toys "R" Us - Delaware, Inc. - FACTA Litigation, 2010 WL 5071073, at *11 (C.D. Cal. Aug. 17, 2010) (risk of printing the first six and final four digits of credit card were statistically negligible). In Reilly, for instance, the court found no standing where hackers "potentially gained access to personal and financial information" after a security breach, because there was no evidence that "the hacker read, copied, or understood" the data. Reilly, 664 F.3d, at 42; Khan, 2016 WL 2946165, at *5. By analogy, Plaintiff's injury would be further removed still: akin to an increased risk of a data breach sometime in the future. That possibility is not sufficiently "concrete" to qualify as an "injury in fact." See Clapper, 133 S. Ct. 1138, 1147 (2013) ("Allegations of future harm can establish Article III standing if that harm is "certainly impending," but "allegations of possible future injury are not sufficient.").

The Court recognizes that Congress may "define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before." 136 S. Ct., at 1549. But "Congress' role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right . . ." Id. (internal quotations omitted). Not all violations of FACTA "cause harm or present any material risk of harm." See id. at 1550; Smith v. Ohio State University, 2016 WL 3182675, at *4 (S.D. Ohio June 8, 2016) (no standing under Spokeo for "bare procedural violation" of FCRA). No facts in the Senate Report cited by Plaintiff validate the alleged injury. See Senate Report No. 108-166 (Oct. 17, 2003). In fact, as Defendants note, the Credit and Debit Card Receipt Clarification Act of 2007 instructs that "[t]he purpose of [FACTA] is to ensure that consumers suffering from any actual harm to their credit or identity are protected." Pub. L. No. 110-241 (June 3, 2008) (emphasis added). See Harris v. Wal-Mart Stores Inc., No. 07 C 02561, 2008 WL 5085132, at *2 (N.D. Ill. Nov. 25, 2008) ("Congress made clear that its purpose in enacting the Clarification Act and amending § 1681n was to allow claims as a result of actual harm to one's credit or identity and to dispense with claims where no actual harm is sustained.").

While FACTA as a whole may implicate traditional privacy interests, Plaintiff's alleged injury does not. See Braitberg, 2016 WL 4698283, at *4 (no standing for violation of data retention, because "[a]lthough there is a common law traditional of lawsuits for invasion of privacy, the retention of information lawfully obtained, without further disclosure, traditionally has not provided the basis for a lawsuit in American courts."). Without an "injury in fact," Plaintiff lacks standing to sue under Article III. Plaintiff is free to refile an amended complaint within 30 days of this decision.

IV. CONCLUSION

For the forgoing reasons, the Defendants' motion to dismiss the Complaint is GRANTED without prejudice to Plaintiff's right to file an amended complaint within thirty days of this decision.

/s/ William J. Martini

WILLIAM J. MARTINI, U.S.D.J. October 20, 2016