Opinion
Civil Action No. 17-cv-0147 (TSC)
2022-08-01
Neil H. HEUER, Plaintiff, v. SMITHSONIAN INSTITUTION, et al., Defendants.
Glenn C. Etelson, Shulman, Rogers, Gandal, Pordy & Ecker. P.A., Potomac, MD, Cory L. Zajdel, Pro Hac Vice, Z Law, LLC, Timonium, MD, for Plaintiff. Jeremy S. Simon, DOJ-USAO, Washington, DC, for Defendants.
Glenn C. Etelson, Shulman, Rogers, Gandal, Pordy & Ecker. P.A., Potomac, MD, Cory L. Zajdel, Pro Hac Vice, Z Law, LLC, Timonium, MD, for Plaintiff. Jeremy S. Simon, DOJ-USAO, Washington, DC, for Defendants. MEMORANDUM OPINION TANYA S. CHUTKAN, United States District Judge
Plaintiff Neil H. Heuer has filed a class action lawsuit against Defendants—the Smithsonian Institution and the United States of America—alleging they violated the Fair Credit Reporting Act ("FCRA"). Defendants have moved to dismiss Plaintiff's lawsuit pursuant to Federal Rule of Civil Procedure 12(b)(1) and 12(b)(6). ECF No. 35. For reasons explained below, the court will GRANT Defendants' motion.
I. BACKGROUND
The facts in this case are straightforward and not in dispute. Plaintiff, a resident of Florida, alleges that on or about April 9, 2015, he visited the Smithsonian Institution's National Air and Space Museum in Washington, DC. ECF No. 34, Amended Complaint ("Am. Compl.") ¶¶ 8, 26, 55. While there, he used a credit card to purchase tickets to watch a movie in the museum's IMAX theater and to enter the museum's planetarium. Id. ¶ 55. A museum employee issued Plaintiff a printed receipt captioned "SALES RECEIPT," which also listed Plaintiff's first and last name, as well as the name of his card issuer ("AMEX"), and the first and last four digits of his credit card number. Id. ¶ 29. Plaintiff was required to hand this receipt to another museum employee to enter the IMAX theater, and the employee then handed the receipt back to Plaintiff. Id. ¶¶ 30-31. Plaintiff kept the receipt in his wallet until he returned home to Florida, whereupon he disposed of it using a paper shredder. Id. ¶¶ 33-34.
Plaintiff then filed suit on behalf of himself and persons he alleges to be similarly situated, claiming that Defendants violated the Fair and Accurate Credit Transactions Act of 2003 (FACTA)—an amendment to FCRA—which prohibits any "person" from printing "more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." Pub. L. No. 108-159, § 113, 117 Stat. 1952, 1959-60 (codified at 15 U.S.C. § 1681c(g)(1)). Plaintiff alleges that Defendants breached this provision by printing a receipt containing the first four and last four digits of his credit card number, and that this breach violated his "substantive right to privacy, entrustment and bailment of credit card information," his "right to receive an electronic receipt with truncated credit card information as established" by statute, and "caused [him] to safe keep and later destroy the electronically printed receipt." Am. Compl. ¶ 57. He seeks damages and a court order enjoining Defendants from printing receipts in violation of the "receipt provision." Id. at 18 (Prayer for Relief).
Defendants have moved to dismiss the Amended Complaint, arguing that the court lacks subject matter jurisdiction over Plaintiff's lawsuit because it is barred by the doctrine of sovereign immunity and, in the alternative, that Plaintiff lacks standing to sue, because any violation of the statute has not caused him to suffer a concrete injury in fact.
II. LEGAL STANDARD
Pursuant to Federal Rule of Civil Procedure 12(b)(1), a defendant may move to dismiss a complaint for lack of subject matter jurisdiction. The law presumes that "a cause lies outside [a federal court's] limited jurisdiction" unless the party asserting jurisdiction establishes otherwise. Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377, 114 S.Ct. 1673, 128 L.Ed.2d 391 (1994); see also Georgiades v. Martin-Trigona, 729 F.2d 831, 833, n.4 (D.C. Cir. 1984) ("It is the burden of the party claiming subject matter jurisdiction to demonstrate that it exists."). In evaluating a motion to dismiss under Rule 12(b)(1), a court must assume the truth of all factual allegations and must review " 'the complaint liberally, granting plaintiff the benefit of all inferences that can be derived from the facts alleged.' " Am. Nat'l Ins. Co. v. F.D.I.C., 642 F.3d 1137, 1139 (D.C. Cir. 2011) (quoting Thomas v. Principi, 394 F.3d 970, 972 (D.C. Cir. 2005)). Nevertheless, " 'the court need not accept factual inferences drawn by plaintiffs if those inferences are not supported by facts alleged in the complaint, nor must the [c]ourt accept plaintiff's legal conclusions.' " Disner v. United States, 888 F. Supp. 2d 83, 87 (D.D.C. 2012) (quoting Speelman v. United States, 461 F.Supp.2d 71, 73 (D.D.C. 2006)). Finally, a court "may consider materials outside the pleadings in deciding whether to grant a motion to dismiss for lack of jurisdiction." Jerome Stevens Pharm., Inc. v. Food and Drug Admin., 402 F.3d 1249, 1253 (D.C. Cir. 2005) (citation omitted).
Rule 12(b)(6) permits a party to move for dismissal on the grounds that the complaint has failed "to state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b)(6). A Rule 12(b)(6) motion "tests the legal sufficiency of a complaint." Browning v. Clinton, 292 F.3d 235, 242 (D.C. Cir. 2002). To withstand a motion to dismiss under Rule 12(b)(6), "a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face." Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (internal quotation marks and citation omitted). A claim is facially plausible "when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id.; see also Rollins v. Wackenhut Servs., Inc., 703 F.3d 122, 129-130 (D.C. Cir. 2012).
III. ANALYSIS
A. Sovereign Immunity
Defendants argue that the court lacks subject matter jurisdiction over Plaintiff's suit because Defendants are entitled to sovereign immunity from civil lawsuits, and Congress has not waived their immunity from damages claims under FCRA. The court disagrees.
A waiver of sovereign immunity "must be unequivocally expressed in statutory text." F.A.A. v. Cooper, 566 U.S. 284, 290, 132 S.Ct. 1441, 182 L.Ed.2d 497 (2012) (cleaned up). Any ambiguities must be "construed in favor of immunity," and ambiguity exists if there is a "plausible interpretation of the statute that would not authorize money damages against the Government." Id. at 290-91, 132 S.Ct. 1441. At the same time, waiving sovereign immunity does not require "magic words." Id. at 291, 132 S.Ct. 1441. The Supreme Court instead requires only that the waiver "be clearly discernable from the statutory text in light of traditional interpretive tools." Id.
The FCRA provides that "[a]ny person who willfully fails to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer" for either "actual damages" or statutory "damages" within specified dollar ranges. 15 U.S.C. § 1681n(a)(1)(A). Likewise, the FCRA provides that "[a]ny person who is negligent in failing to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer" for "actual damages." Id. § 1681o(a)(1). The FCRA also defines the term "person" as used in sections 1681n and 1681o: "for the purposes of this subchapter . . . [t]he term 'person' means any individual, partnership, corporation, trust, estate, cooperative, association, government or governmental subdivision or agency, or other entity." Id. § 1681a(a)-(b). For willful violations, the FCRA provides one cause of action against "[a]ny person," id. § 1681n(a)(1)(A), and an additional cause of action against any "natural person," id. § 1681n(a)(1)(B).
As the D.C. Circuit recently held in a FCRA case, "these provisions speak clearly enough to waive federal sovereign immunity." Mowrer v. U.S. Dep't of Transp., 14 F.4th 723, 729 (D.C. Cir. 2021). The Act's definition of "person," which includes "any . . . government," 15 U.S.C. § 1681a(a)-(b), "surely includes the federal government," Mowrer, 14 F.4th at 729. And by distinguishing between liability that runs against "any" person and liability that runs only against "natural" persons, the FCRA reflects "a calibrated approach to the question of which persons should bear which liabilities." Id. Consequently, the court finds that Congress has waived Defendants' federal sovereign immunity from FCRA damages claims.
The parties disagree on whether the Smithsonian Institution is entitled to assert sovereign immunity. See ECF No. 35, Defs. Mot. at 5-6; ECF No. 36, Pl. Opp'n at 11 n.2. Without deciding the issue, the D.C. Circuit has noted "[s]everal elements of the Smithsonian's congressional design" that suggest "it does have sovereign immunity." Forman v. Small, 271 F.3d 285, 295 (D.C. Cir. 2001). The court need not reach this question here because, regardless of whether the Smithsonian Institution is entitled to assert sovereign immunity, such immunity has been waived. Mowrer, 14 F.4th at 729.
B. Standing
Article III of the Constitution confines federal judicial power to the resolution of "Cases" and "Controversies." For there to be a case or controversy under Article III, the plaintiff must have a "personal stake" in the case—in other words, standing. Raines v. Byrd, 521 U.S. 811, 819, 117 S.Ct. 2312, 138 L.Ed.2d 849 (1997). Standing is a necessary predicate to any exercise of federal jurisdiction and, when it is lacking, the dispute fails to present a concrete case or controversy under Article III. Ariz. Christian Sch. Tuition Org. v. Winn, 563 U.S. 125, 131 S. Ct. 1436, 1442, 179 L.Ed.2d 523 (2011); Dominguez v. UAL Corp., 666 F.3d 1359, 1361 (D.C. Cir. 2012).
To have Article III standing to sue in federal court, a plaintiff must show (1) that they suffered an injury in fact that is concrete, particularized, and actual or imminent; (2) that the injury was likely caused by the defendant; and (3) that the injury would likely be redressed by the relief sought. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-561, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). As the party invoking federal jurisdiction, a plaintiff bears the burden of demonstrating that they have standing. See id. at 561, 112 S.Ct. 2130. At the pleading stage, "a plaintiff is required only to state plausibly that each standing element exists." Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1063 (D.C. Cir. 2019) (citing Attias v. Carefirst, Inc., 865 F.3d 620, 625 (D.C. Cir. 2017)).
Defendants argue that Plaintiff has not plausibly stated that he suffered a concrete, particularized, and actual or imminent injury. Plaintiff does not allege that Defendants' conduct caused him any physical or monetary harm. See generally Am. Compl. He instead contends that Defendants' conduct violated his statutory right and, as a result, exposed him to an increased risk of identity theft. Id. ¶¶ 23, 65. He also alleges that because of Defendants' conduct, he was forced to take steps to safeguard the non-compliant receipt. Id. ¶¶ 34, 57.
"[T]he violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact." Spokeo, Inc. v. Robins, 578 U.S. 330, 136 S. Ct. 1540, 1549, 194 L.Ed.2d 635 (2016). Indeed, "Congress may create a statutory right or entitlement the alleged deprivation of which can confer standing to sue even where the plaintiff would have suffered no judicially cognizable injury in the absence of statute." Warth v. Seldin, 422 U.S. 490, 514, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975). But for "a statutory violation to constitute an injury in fact, . . . the statute must protect the plaintiff's concrete interest—i.e., afford the putative plaintiff a right to be free of a harm capable of satisfying Article III." Jeffries, 928 F.3d at 1064.
The D.C. Circuit has held that FACTA "vests consumers with a concrete interest in using their credit and debit cards without incurring an increased risk of identity theft." Id. The Act's truncation requirement imposes on the merchant the duty not to print "more than the last 5 digits of the card number or the expiration date," 15 U.S.C. § 1681c(g)(1), a duty that applies at the "point of the sale or transaction" regardless of whether a plaintiff ever becomes the victim of identity theft or fraud, Jeffries, 928 F.3d at 1064. In other words, FACTA's "truncation requirement is a procedure designed to decrease the risk that a consumer would have his identity stolen." Id. (cleaned up). The Act "thus vests consumers with an interest in using their credit and debit cards without facing an increased risk of identity theft." Id. And that interest is concrete in that it is closely related to "a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts," specifically, a common law breach of confidence. Id. (citing Spokeo, 136 S. Ct. at 1549). "FACTA protects against the risk of the very harm the breach of confidence tort makes actionable—an unauthorized disclosure of privileged information to a third party." Id. at 1065. Accordingly, the interest protected by FACTA—avoiding an increased risk of identity theft—is concrete.
But the analysis does not end there. Having determined that FACTA protects a concrete interest, the court must determine whether Defendants' alleged violation of FACTA harmed or created a "risk of real harm" to Plaintiff's concrete interest. Id.
In Jeffries, the defendant printed a receipt containing all sixteen digits of the plaintiff's credit card and its expiration date, in violation of FACTA. Id. at 1062. This presented a "nightmare scenario" for the plaintiff, who was unable to use her credit card without incurring an increased risk of identity theft. Id. at 1066. As a result, the court concluded that the plaintiff suffered a concrete injury in fact. Id. The D.C. Circuit in Jeffries noted, however, that "not every violation of FACTA's truncation requirement creates a risk of identity theft." Id. at 1065. For example, "printing an expiration date on a receipt without more—although a technical violation of FACTA—does not create a risk of identity theft" and thus does not cause a concrete injury in fact. Id. at 1066; accord Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 783 (9th Cir. 2018) (no standing where plaintiff alleged FACTA violation when only expiration date was printed on receipt); Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 81 (2d Cir. 2017) (same); Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016) (same).
This case lies somewhere between the "nightmare scenario" in Jeffries and those cases involving the mere printing of an expiration date, in that Plaintiff's receipt contained the first and last four digits of his credit card number. The D.C. Circuit has not considered whether such a disclosure increases the risk of identity theft sufficient to constitute concrete injury. Other Circuits, however, have.
In Kamal v. J. Crew Grp., Inc., the defendant printed a receipt containing the first six and last four digits of the plaintiff's credit card, as well as the name of his card issuer (Discover). 918 F.3d 102, 107 (3d Cir. 2019). The plaintiff broadly alleged that the defendant's conduct "created a real risk of identity theft" and that "identity thieves . . . obtain Card receipts that are lost or discarded, or through theft, and use the information on them to commit fraud and theft." Id. at 116. Based on these allegations, the Third Circuit affirmed the district court's dismissal for lack of standing because the plaintiff failed to allege that "the receipt included enough information to likely enable identity theft." Id. The court noted, however, that its "analysis would be different if the plaintiff had alleged that the receipt included all sixteen digits of his credit card number, making the potential for fraud significantly less conjectural," as was the case in Jeffries. Id.
Other Circuits have reached the same conclusion in similar circumstances. See Thomas v. TOMS King (Ohio), LLC, 997 F.3d 629, 636 (6th Cir. 2021) (no concrete injury where defendant printed receipt containing first six and last four digits of plaintiff's credit card); Noble v. Nev. Checker Cab Corp., 726 F. App'x 582 (9th Cir. 2018) (same regarding first digit and last four digits); Katz v. Donna Karan Co., 872 F.3d 114 (2d Cir. 2017) (same regarding first six and last four digits). In each of these cases, the courts found it important that (1) the first digits of a card number reveal nothing more than the card issuer, and (2) FACTA does not prohibit printing the identity of the card issuer on a receipt. "In other words, 'printing the first six digits—the [issuer identification number]—is the equivalent of printing the name of the issuing institution, information which need not be truncated under FACTA.' " Thomas, 997 F.3d at 636 (quoting Katz, 872 F.3d at 120); see also Noble, 726 F. App'x at 584 ("[T]he first digit of a credit card number merely identifies the brand of the card, and Congress has not prohibited printing the identity of the credit card issuer along with the last five digits of the credit card number."); Kamal, 918 F.3d at 107 (noting that "the first six digits identify the issuing bank and card type").
Defendants attach to their motion a declaration from John Duven, the Payment Card Industry Accessor in the Smithsonian Institution's Office of Chief Information Officer. See Defs. Mot., Duven Decl. ¶ 2. Duven attests that the first four digits of an American Express credit card—such as the one used by Plaintiff—do not provide any sensitive information specific to a cardholder. Id. ¶ 3. Specifically, the first two digits identify the issuing financial institution (in this case, American Express), and the next two digits identify the type and currency of the card. Id. In his opposition to Defendants' motion, Plaintiff did not respond to this assertion, and the court therefore treats it as conceded. See Wannall v. Honeywell, Inc., 775 F.3d 425, 428 (D.C. Cir. 2014) (explaining that if a party files an opposition addressing only some of the movant's arguments, the court may treat the unaddressed arguments as conceded).
Because the first four digits of Plaintiff's credit card do not reflect any sensitive information specific to him, but rather information that merchants are otherwise permitted to print on receipts, that disclosure alone appears less likely to have increased the risk of any "real harm" to Plaintiff. See, e.g., Thomas, 997 F.3d at 636; Katz, 872 F.3d at 120; Noble, 726 F. Appx. at 584. This finding is consistent with the D.C. Circuit's reasoning in Jeffries.
In Jeffries, the D.C. Circuit emphasized the deference courts must afford to Congress's judgment about what credit card information—when presented on a receipt—presents a tolerable versus intolerable risk of identity theft. 928 F.3d at 1065 ("Congress's judgment about when increased risk becomes intolerable is entitled to respect.") (citing Spokeo, 136 S. Ct. at 1549). In determining whether printing an expiration date on a receipt presents an intolerable risk of identity theft, the D.C. Circuit looked to Congress's actions, specifically, to the Credit and Debit Card Receipt Clarification Act of 2007. There, Congress observed that the inclusion of expiration dates did not raise a material risk of identity theft and thus suspended the damages provisions of FACTA as they relate to printing expiration dates. Id. (citing Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(4)-(5) 122 Stat. 1565, 1565). Bearing this in mind, the D.C. Circuit reasoned that printing a receipt with an expiration date—though still a violation of FACTA—does not increase the risk of identity theft to an "intolerable" level, and thus does not constitute a concrete injury in fact. Id.
The same reasoning applies to receipts showing the first four digits of a credit card number. Those numbers reveal nothing more than the credit card issuer, type of currency, and type of card, information that Congress did not prohibit from printing on a receipt presumably because it has judged that the disclosure of this information does not present an intolerable risk of identity theft. See Thomas, 997 F.3d at 636; Katz, 872 F.3d at 120; Noble, 726 F. Appx. at 584; cf. Jeffries, 928 F.3d at 1066. Accordingly, the court concludes that printing a receipt with the first four digits of a credit card—though a violation of FACTA—does not increase the risk of identity theft to the level where it constitutes a concrete injury in fact.
Plaintiff also alleges that Defendant violated FACTA by including his name on the printed receipt. Am. Compl. ¶¶ 4, 36. Plaintiff is incorrect: FACTA does not prohibit printing a consumer's name on a receipt, see generally Pub. L. No. 108-159, § 113, 117 Stat. 1952, and Defendant's doing so is therefore not material to the concrete interest FACTA seeks to protect or the concrete harm it seeks to prevent. See Jeffries, 928 F.3d at 1065 (considering whether statutory violation constitutes injury in fact) (emphasis added); see generally id. (giving no weight to district court's finding—319 F. Supp. 3d 525, 531 (D.D.C. 2018)—that credit card did not contain plaintiff's name). Plaintiff does not show that printing his name on his receipt invaded any legally protected interest, Spokeo, 136 S. Ct. at 1549 ("Congress is well positioned to identify intangible harms that meet minimum Article III requirements."), or that such a disclosure "has a close relationship to a harm that has traditionally been regarded as providing the basis for a lawsuit in English or American courts," id. For instance, as previously explained, a FACTA violation bears a "close relationship" to the common law breach of confidence because FACTA creates a "relationship of trust between the consumer and merchant, requiring the merchant to safeguard the consumer's credit or debit card information." Jeffries, 928 F.3d at 1064-65. Plaintiff does not point to any law or tradition that establishes the same relationship of trust for a person's name.
Mindful of the D.C. Circuit's finding that "not every violation of FACTA's truncation requirement creates a risk of identity theft," Id. at 1065, the court concludes that this is one such case in which the plaintiff has not plausibly stated that the alleged violation of FACTA has created a risk of identity theft that amounts to a concrete injury in fact.
Plaintiff has also failed to plausibly state that the time he spent safeguarding the receipt and disposing of it amounts to a concrete injury in fact. Where a "hypothetical future harm" is not "certainly impending," plaintiffs "cannot manufacture standing merely by inflicting harm on themselves." Clapper v. Amnesty Int'l USA, 568 U.S. 398, 416, 422, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013). Plaintiff's management-of-risk claim is intertwined with his arguments about actual risk. If the receipt he received on April 9, 2015, offered no advantage to identity thieves, Plaintiff can "hardly say that he was injured because of the efforts he took to keep it out of their hands." Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917, 931 (11th Cir. 2020) (noting that "any assertion of wasted time and effort necessarily rises or falls along with [a court's] determination of whether the risk posed by [the defendant's] FACTA violation, as pleaded by [the plaintiff], is itself a concrete harm"). Plaintiff also does not allege that he treated the Smithsonian receipt any differently than any other receipt, or that he spent any additional time safeguarding it. Without more, Plaintiff has not adequately pled that he suffered a concrete injury in fact.
IV. CONCLUSION
For reasons explained above, the court will GRANT Defendants' motion to dismiss Plaintiff's Amended Complaint.