Summary
holding that merely alleging an increased risk of identity theft due to the printing of ten digits of credit card account number on receipt was insufficient to establish injury in fact where plaintiff was in possession of the receipt and no one else had seen it
Summary of this case from Tarr v. Burger King Corp.Opinion
CIVIL ACTION NO. 16–4069
04-18-2017
Joel HENDRICK, individually and as a representative of all other persons similarly situated, Plaintiff v. ARAMARK CORPORATION, et al., Defendants
Archie I. Grubb, II, Rebecca D. Gilliland, W. Daniel Miles, III, Beasley Allen Crow Methvin Portis & Miles PC, Montgomery, AL, Kenneth J. Grunfeld, Golomb & Honik P.C., Philadelphia, PA, for Plaintiff. Gregory T. Parks, Andrew W. Katz, Ezra Dodd Church, Kristin M. Hadgis, Morgan Lewis & Bockius LLP, Philadelphia, PA, for Defendants.
Archie I. Grubb, II, Rebecca D. Gilliland, W. Daniel Miles, III, Beasley Allen Crow Methvin Portis & Miles PC, Montgomery, AL, Kenneth J. Grunfeld, Golomb & Honik P.C., Philadelphia, PA, for Plaintiff.
Gregory T. Parks, Andrew W. Katz, Ezra Dodd Church, Kristin M. Hadgis, Morgan Lewis & Bockius LLP, Philadelphia, PA, for Defendants.
MEMORANDUM OPINION
NITZA I. QUIÑONES ALEJANDRO, U.S.D.C. J.
INTRODUCTION
Presently before this Court is a motion to dismiss filed by Defendants pursuant to Federal Rule of Civil Procedure 12(b)(1) and 12(b)(6), in which they seek dismissal of the single claim asserted against them by Plaintiff Joel Hendrick ("Plaintiff"), under the Fair and Accurate Credit Transactions Act. [ECF 15]. Plaintiff has opposed the motion. [ECF 17]. The issues raised in the motion to dismiss have been fully briefed by the parties and are now ripe for disposition. For the reasons stated herein, Defendants' motion is granted.
Originally named as party Defendants are Aramark Corporation, Aramark Campus, LLC, Aramark Educational Services, LLC, Aramark FHC, LLC, Aramark Food and Support Services Group, Inc., Aramark Refreshment Services, LLC, Aramark Sports and Entertainment Services, LLC, Aramark American Food Services, Inc., Aramark FHC Campus Services, LLC, Aramark FHC Refreshment Services, LLC, and Aramark Food Service, LLC (collectively, "Defendants" or "Aramark"). By stipulation, the parties have agreed that only Aramark Corporation, Aramark Educational Services, LLC, and Aramark Campus, LLC, are proper Defendants; and have agreed to the dismissal of the other named Defendants. (See Plaintiff's Memorandum of Law, at n.1).
In adjudicating the underlying motion to dismiss, this Court has also considered Defendants' reply, [ECF 18], and the parties' respective supplemental filings. [ECF 19, 20, 21].
BACKGROUND
On July 28, 2016, Plaintiff filed a complaint against Defendants in which he asserts a single claim for violation of the Fair and Accurate Credit Transactions Act ("FACTA"), 15 U.S.C. 1681c(g)(1). [ECF 1]. Specifically, Plaintiff alleges that Defendants violated FACTA when a store they operated gave him a receipt, following a purchase of a soft drink, which displayed ten digits of his credit card number. Plaintiff also purports to assert this claim on behalf of a class of similarly situated individuals.
On September 23, 2016, Defendants filed the underlying motion to dismiss in which they argue that Plaintiff has failed to allege facts sufficient to establish Article III standing because he has not alleged facts sufficient to show an actual injury-in-fact. [ECF 15]. When ruling on Defendants' motion to dismiss, this Court must accept, as true, all relevant and pertinent factual allegations in the amended complaint and construe these facts in the light most favorable to Plaintiff. Fowler v. UPMC Shadyside , 578 F.3d 203, 210–11 (3d Cir. 2009). Succinctly, the allegations are that:
On April 1, 2016, Plaintiff Joel Hendrick purchased a drink refill using his credit card at the Stewart's Corner, located on the University of Alabama campus in Tuscaloosa, Alabama. (Comp. ¶¶ 24, 40). The store was operated by Defendants. (Id. at ¶ 23). At the point of sale, Plaintiff was given a paper receipt for the transaction that contained ten digits of his credit card number, which Plaintiff alleges violated the FACTA. (Id. at ¶¶ 23, 40). A copy of the paper receipt was attached to the complaint as Exhibit A. (Id. ). Plaintiff alleges that this FACTA violation "exposed [him] to at least an increased risk of identity theft...." (Id. at ¶ 44).
LEGAL STANDARD
As stated, Defendants move to dismiss Plaintiff's complaint pursuant to Federal Rule of Civil Procedure ("Rule") 12(b)(1) on the basis that Plaintiff has failed to allege facts sufficient to establish Article III standing, and under Rule 12(b)(6) for failing to state a claim upon which relief can be granted. "A motion to dismiss for want of standing is ... properly brought pursuant to Rule 12(b)(1), because standing is a jurisdictional matter." Constitution Party of Pa. v. Aichele , 757 F.3d 347, 357 (3d Cir. 2014). Rule 12(b)(1) challenges may be either facial or factual challenges. Id. A facial challenge asserts that the complaint does not allege sufficient grounds to establish subject matter jurisdiction. Id. Where a Rule 12(b)(1) motion is filed prior to an answer, as is the case here, it will be considered a facial challenge to jurisdiction. Id. at 358. When considering such a facial challenge, a court must apply the same standard of review that would apply on a motion to dismiss under Rule 12(b)(6). Id. As such, well-pleaded factual allegations are taken as true, and reasonable inferences are drawn in the plaintiff's favor. Id. The complaint will be dismissed for lack of standing only if it appears that the plaintiff will not be able to assert a colorable claim of subject matter jurisdiction. Cardio–Med. Assocs., Ltd. v. Crozer–Chester Med. Ctr. , 721 F.2d 68, 75 (3d Cir. 1983).
A court may grant a motion to dismiss an action under Rule 12(b)(6) if the complaint "fail[s] to state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b)(6). When considering a Rule 12(b)(6) motion to dismiss, a court must "accept all of the complaint's well-pleaded facts as true, but may disregard any legal conclusions." Fowler , 578 F.3d at 210–11. The court must determine "whether the facts alleged in the complaint are sufficient to show that the plaintiff has a ‘plausible claim for relief.’ " Id. at 211 (quoting Ashcroft v. Iqbal , 556 U.S. 662, 679, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) ). The complaint must do more than merely allege the plaintiff's entitlement to relief: it must "show such an entitlement with its facts." Id. (citations omitted).
To determine the sufficiency of a complaint, "a court ... must take three steps." Connelly v. Lane Constr. Corp. , 809 F.3d 780, 787 (3d Cir. 2016) ; to wit : a court must (1) "tak[e] note of the elements a plaintiff must plead to state a claim;" (2) identify allegations that are merely legal conclusions "because they ... are not entitled to the assumption of truth;" and (3) assume the veracity of all well-pleaded factual allegations and "then determine whether they plausibly give rise to an entitlement to relief." Id. (quoting Iqbal , 556 U.S. at 675, 679, 129 S.Ct. 1937 ). While a complaint need not assert detailed factual allegations, "[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice." Iqbal , 556 U.S. at 678, 129 S.Ct. 1937. A court may determine that a complaint's factual allegations are plausible if the court is able "to draw the reasonable inference that the defendant is liable for the misconduct alleged." Iqbal , 556 U.S. at 678, 129 S.Ct. 1937 (citing Bell Atlantic Corp. v. Twombly , 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). "But where the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged—but it has not ‘show[n]’—‘that the pleader is entitled to relief.’ " Id. at 679, 129 S.Ct. 1937 (quoting Fed. R. Civ. P. 8(a) ) (alterations in original). In other words, "[f]actual allegations must be enough to raise a right to relief above the speculative level." Twombly , 550 U.S. at 555, 127 S.Ct. 1955. Thus, to survive a motion to dismiss under Rule 12(b)(6), "a plaintiff must allege facts sufficient to ‘nudge [his] claims across the line from conceivable to plausible.’ " Phillips v. Cnty. of Allegheny , 515 F.3d 224, 234 (3d Cir. 2008) (quoting Twombly , 550 U.S. at 570, 127 S.Ct. 1955 ). "Although the plausibility standard ‘does not impose a probability requirement,’ it does require a pleading to show ‘more than a sheer possibility that a defendant has acted unlawfully.’ " Connelly , 809 F.3d at 786 (citations omitted). Reviewing the plausibility of the complaint is a "context-specific" inquiry and requires a court to "draw on its experience and common sense." Iqbal , 556 U.S. at 663–64, 129 S.Ct. 1937.
DISCUSSION
Plaintiff's complaint purports to assert a violation of FACTA which allegedly occurred when Defendants gave him an electronically printed receipt that showed ten digits of his credit card number. Though Defendants do not dispute these facts (nor could they at this motion to dismiss stage), they argue that Plaintiff has not alleged facts sufficient to establish that he has Article III standing to maintain his claim. This Court agrees.
FACTA was enacted in 2003 as an amendment to the Fair Credit Reporting Act (the "FCRA"), 15 U.S.C. §§ 1681 et seq. FACTA prohibits retailers who accept credit or debit cards from "print[ing] more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." Id. at § 1681c(g)(1). In enacting FACTA, Congress was attempting to combat identity theft by reducing the personal data printed on credit and debit card receipts. Fair and Accurate Credit Transactions Act of 2003, Pub. L. No. 108–159, 117 Stat. 1952 (2003); S. Rep. No. 108–166, at 13 (2003). Those violating FACTA may be liable under the two-tiered system of liability set forth in the FCRA. See 15 U.S.C. § 1681n. A plaintiff may recover actual damages resulting from a negligent violation, see id. at § 1681o(a), or actual, statutory, and/or punitive damages for a willful violation. See id. at § 1681n(a).
A plaintiff invoking federal jurisdiction bears the burden of establishing the "irreducible constitutional minimum" of standing by demonstrating (1) an injury-in-fact, (2) fairly traceable to the challenged conduct of the defendant, and (3) likely to be redressed by a favorable judicial decision. Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016) (citing Lujan v. Defenders of Wildlife , 504 U.S. 555, 560–61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). Plaintiff, as the party invoking federal jurisdiction, has the burden of demonstrating each element. FW/PBS, Inc. v. Dallas , 493 U.S. 215, 231, 110 S.Ct. 596, 107 L.Ed.2d 603 (1990). "Where, as here, a case is at the pleading stage, the plaintiff must ‘clearly ... allege facts demonstrating’ each element." Spokeo , 136 S.Ct. at 1547 (quoting Warth v. Seldin , 422 U.S. 490, 518, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975) ). The existence of Article III standing often turns on the injury-in-fact element. Spokeo , 136 S.Ct. at 1547. To establish injury-in-fact, "a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’ " Id. at 1548 (quoting Lujan , 504 U.S. at 560, 112 S.Ct. 2130 ). "For an injury to be particularized, it must affect the plaintiff in a personal and individual way." Id. (internal citations omitted). To be "concrete," an injury must be "real" as opposed to "abstract," but it need not be "tangible." Id. at 1548–49.
In Spokeo , the Supreme Court recently addressed whether Congress may confer Article III standing upon a plaintiff who suffers no concrete harm and who, therefore, could not otherwise invoke the jurisdiction of a federal court by authorizing a private right of action based on a bare violation of a federal statute. 136 S.Ct. 1540. The Spokeo Court held that "Article III standing requires a concrete injury even in the context of a statutory violation." Id. at 1549. As the Supreme Court explained, "Congress' role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right." Id. In other words, Congress' decision that there should be a legal remedy for the violation of a particular statute does not mean that each such statutory violation creates an Article III injury. To the contrary, an injury "must be ‘de facto ’; that is, it must actually exist." Id. at 1548 (citing Black's Law Dictionary 479 (9th ed. 2009)).
Defendants argue that consistent with Spokeo , Plaintiff has failed to allege facts sufficient to demonstrate Article III standing. That is, Defendants argue that Plaintiff's mere allegation of an increased risk of identity theft is legally insufficient to show the requisite "concrete," "particularized," and "actual or imminent" injury-in-fact for Article III standing. In response, Plaintiff contends that he has adequately stated a FACTA claim by alleging facts to establish a violation of the statute and an increased risk of identity theft.
Though neither the Third Circuit Court of Appeals nor any court in this District has addressed the precise Article III standing issue involved here since the Supreme Court's decision in Spokeo , several courts in other jurisdictions have. For example, the Seventh Circuit Court of Appeals in Meyers v. Nicolet Restaurant of De Pere, LLC , 843 F.3d 724, 728–29 (7th Cir. 2016) concluded that under the reasoning of Spokeo , a similar allegation of increased risk of identity theft was insufficient to meet the standing requirements of Article III for a FACTA claim. See also Cruper–Weinmann v. Paris Baguette America, Inc. , 235 F.Supp.3d 570, 575–77 (S.D.N.Y. 2017) (holding that plaintiff failed to assert facts sufficient to establish Article III standing for FACTA claim where plaintiff alleged only increased risk of identity theft); Stelmachers v. Verifone Sys. , 2016 WL 6835084, at *4 (N.D. Cal. Nov. 21, 2016) (holding that plaintiff who received receipt displaying more than the last five digits of his card number had no standing because, given that only he had seen the receipt, the risk of identity theft was too speculative to constitute impending harm); Kamal v. J. Crew Group, Inc. , 2016 WL 6133827, at *3 (D.N.J. Oct. 20, 2016) (same).
In Kamal , the district court rejected the same arguments with respect to a plaintiff's standing to assert a FACTA claim as those made by Plaintiff here. In particular, the plaintiff there alleged that he was exposed to an "increased risk of identity theft" on account of the defendant's violation of FACTA. Id. at *3. Relying on Spokeo , the district court described what is required to sufficiently allege an "injury-in-fact," when the injury alleged is an "increased risk" of future harm:
An "injury in fact" may be "intangible" or difficult to monetize, but it must be "actual or imminent, not conjectural or hypothetical." Spokeo , 136 S.Ct. at 1548. Where the alleged injury is heightened risk of future harm, the allegations must "entail a degree of risk sufficient to meet the concreteness requirement." Id. at 1550 ; Clapper v. Amnesty Int'l USA , 568 U.S. 398, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013) ; Bock v. Pressler & Pressler, LLP , 658 Fed.Appx. 63, 65 (3d Cir. 2016) ("the question framed by [ Spokeo ] [is] whether the particular procedural violations alleged in [a] case entail a degree of risk sufficient to meet the concreteness requirement.") (citations omitted).
Kamal , 2016 WL 6133827, at *2. The court concluded that the plaintiff's allegation of an "increased risk of identity theft" did not "entail a degree of risk sufficient to meet the concreteness requirement" because the complaint lacked "any facts demonstrating a risk sufficiently ‘actual or imminent’ to constitute a concrete injury." Id. at *3. (citations omitted). In reaching this conclusion, the court reasoned as follows:
There is no evidence that anyone has accessed or attempted to access or will access Plaintiff's credit card information. See Thompson , 15–00886, at * 9 [ (W.D.Mo. Oct. 6, 2016) ] ("There is no real risk of harm as the improper receipt has only been in Plaintiff's possession since receiving it from Defendants."); Khan v. Children's Nat'l Health System , 188 F.Supp.3d 524, 532–33 (D. Md. 2016) (risk of future harm did not amount to "injury in fact" where it was unclear whether hackers "actually viewed, accessed, or copied" personal medical data). Nothing has been disclosed to third parties. See Reilly , 664 F.3d at 43–44 ; Braitberg v. Charter Commc'ns, Inc. , 836 F.3d 925, 930–31 (8th Cir. 2016) (procedural violation of data retention statute was not sufficiently "concrete" to confer standing). Nor does the record indicate that anyone will actually obtain one of Plaintiff's discarded J. Crew receipts, and—through means left entirely to the Court's imagination—identify the remaining six digits of the card number and then proceed undetected to ransack Plaintiff's Discover account.
Kamal , 2016 WL 6133827, at *2. Recognizing that "[n]ot all violations of FACTA cause harm or present any material risk of harm," the court dismissed the complaint because "[w]ithout an injury in fact," the plaintiff "lacked standing to sue under Article III." Id. at 6.
This Court finds the reasonings of these courts' post- Spokeo decisions persuasive and incorporates and adopts them. As stated, Plaintiff alleges only that he is subject to an increased risk of harm, not that he has suffered an actual injury. He has not alleged any facts to substantiate such a risk. For example, he does not allege that anyone other than himself saw or possessed the receipt. In fact, he alleges that the receipt is still in his possession. He does not allege that anyone has, or somehow could obtain the remaining digits or the expiration date of his credit card that were not printed on the receipt. Nor does he allege that anyone has attempted to use or access his credit card information. As such, this Court finds that Plaintiff's allegations do not "entail a degree of risk sufficient to meet the concreteness requirement." Spokeo , 136 S.Ct. at 1550. Under the Spokeo analysis, Plaintiff's bald allegation of increased risk of identity theft is insufficient to satisfy the injury in fact requirement for Article III standing. Without an injury in fact, Plaintiff lacks standing to sue under Article III. Therefore, Plaintiff's complaint is dismissed.
Though the Third Circuit has not addressed standing in a FACTA case postSpokeo, the Third Circuit has held preSpokeo, that an allegation of an increased risk of identity theft was insufficient to establish ‘the injury in fact’ necessary for Article III standing. See Reilly v. Ceridian Corp., 664 F.3d 38, 42 (3d Cir. 2011).
CONCLUSION
For the reasons stated herein, Defendants' motion to dismiss is granted. An Order consistent with this Memorandum Opinion follows.