Summary
holding that printing of the first six digits of a credit card number does not violatie any recognized privacy interest nor does it increase the risk of future harm since the first six digits relate to the bank or card issuer
Summary of this case from Hullinger v. Park Grove Inn, Inc.Opinion
Civ. No. 2:15-0190 (WJM)
06-13-2017
AHMED KAMAL, Plaintiff, v. J. CREW GROUP, INC., et al., Defendants.
OPINION
WILLIAM J. MARTINI , U.S.D.J. :
Plaintiff Ahmed Kamal brings this putative class action suit for alleged violations of the Fair and Accurate Credit Transactions Act amendment to the Fair Credit Reporting Act, 15 U.S.C. § 1681, et seq. This matter comes before the Court on Defendants' motion to dismiss Plaintiff's Second Amended Complaint for lack of subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1). There was no oral argument. See Fed. R. Civ. P. 78(b). For the reasons set forth below, the motion to dismiss is GRANTED. Plaintiff's Second Amended Complaint is DISMISSED with prejudice.
I. BACKGROUND
The Fair and Accurate Credit Transactions Act ("FACTA") states that "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number . . . upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C.A. § 1681c. The statute creates a private cause of action for "any actual damages . . . or damages of not less than $100 and not more than $1,000" for each violation. 15 U.S.C. § 1681n(a).
Plaintiff Ahmed Kamal alleges that on three occasions Defendants, a conglomerate of clothing stores and manufacturers comprising J. Crew ("J. Crew" or "Defendants"), printed the first six and last four digits of Plaintiff's credit card number on transaction receipts. Second Amended Complaint ("SAC") ¶ 2. Plaintiff purports to bring this action "on behalf of all persons or entities to whom Defendants provided an electronically printed receipt at the point of sale or transaction . . . which receipt displayed more than the last five digits of the customer's credit card number." SAC ¶ 20.
Procedural History before this Court
Plaintiff filed his single-count FACTA Complaint on January 10, 2015, and his First Amended Complaint ("FAC") on March 25, 2015. He seeks statutory damages of $100 to $1000 per violation along with attorneys' fees and punitive damages. On August 6, 2015, the Court denied Defendants' motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), finding that Plaintiff adequately stated a claim for willful violation of FACTA's credit-card number truncation provision. ECF No. 33. See 15 U.S.C. § 1681, et seq. The Court granted J. Crew's motion to stay the case in December 2015 pending the Supreme Court's decision regarding constitutional standing in Spokeo Inc. v. Robins, 136 S. Ct. 1540 (2016). On May 16, 2016, the Supreme Court held that a plaintiff does not automatically "satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right." Spokeo, 136 S. Ct. at 1549. Applying Spokeo, this Court determined that it lacked subject matter jurisdiction and dismissed Kamal's FAC without prejudice. Most federal courts faced with similar FACTA complaints have agreed that a violation of the credit-card truncation provision does not automatically confer Article III standing under Spokeo.
See Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 724, 727-28 (7th Cir. 2016); Katz v. Donna Karan Int'l, Inc., 2017 WL 2191605 (S.D.N.Y. May 17, 2017); Llewellyn v. AZ Compassionate Care Inc., No. 16-cv-04181, 2017 WL 1437632, at *6 (D. Ariz. Apr. 24, 2017); Hendrick v. Aramark Corp., 2017 WL 1397241, at *4-5 (E.D. Penn. Apr. 18, 2017). See also Cruper-Weinmann v. Paris Baguette Am., Inc., 13-cv-7013, 2017 WL 398657, at *3 (S.D.N.Y. Jan. 30, 2017); Stelmachers v. Verifone Systems, Inc., 14-04912, 2016 WL 6835084, at *4 (N. D. Cal. Nov. 21, 2016); Thompson v. Rally House of Kansas City et al., 15-cv-00886, at *9 (W.D. Mo. Oct. 6, 2016); Noble v. Nevada Checker CAB Corp., No. 2:15-cv-02322, 2016 WL 4432685, at *3 (D. Nev. Aug. 19, 2016).
Plaintiff filed the SAC on November 17, 2016. ECF No. 65. Defendants again moved to dismiss for lack of standing. On January 20, 2017, as this motion was pending, the Third Circuit decided In re Horizon Healthcare Servs. Data Breach Litig., 846 F.3d 625 (3d Cir. 2017) (hereinafter "Horizon"), which applied Spokeo in the context of an alleged data breach that led to the disclosure of the plaintiff's personal information. At the parties' request, this Court allowed for a short supplementary briefing schedule. Meanwhile, J. Crew moved without opposition to consolidate this case with Parker v. J. Crew Group, Inc., et al., ("Parker"), a case originally filed in Illinois state court and then removed to the Northern District of Illinois. On February 21, 2017, the Northern District of Illinois transferred the case to the District of New Jersey pursuant to 28 U.S.C. § 1404(a) (providing transfer "for the convenience of the parties and witnesses, in the interests of justice . . .."); Order of Judge Samuel Der-Yeghiayan, ECF No. 75, Ex. B. This case and Parker involve virtually identical facts. Magistrate Judge Mark Falk granted the unopposed motion to consolidate on May 1, 2017. On May 5, 2017, after a telephone conference with the parties, Judge Falk temporarily stayed Parker pending this Court's decision on J. Crew's motion to dismiss Kamal's SAC, which the Court now decides.
Judge Falk also administratively denied Kamal's motion for appointment of interim lead counsel. ECF No. 83.
II. LEGAL STANDARD
Federal Rule of Civil Procedure 12(b)(1) is the proper vehicle for challenging a plaintiff's Article III standing. Fed. R. Civ. P. 12(b)(1). See Society Hill Towers Owners' Ass'n v. Rendell, 210 F.3d 168, 175 (3d Cir. 2000); Reilly v. Ceridian Corp., 664 F.3d 38, 41 (3d Cir. 2011) (citations omitted). Challenges to standing are either "facial" or "factual." Davis v. Wells Fargo, 824 F.3d 333, 346 (3d Cir. 2016). J. Crew's challenge is facial, in that it does not dispute what facts are, but rather whether the facts as plead create standing. In such cases, a "presumptive truthfulness attaches to the plaintiff's allegations," as would be the case in a 12(b)(6) setting. Horizon, 846 F.3d at 633, (citing Davis v. Wells Fargo, 824 F.3d 333, 346 (3d Cir. 2016)). Nonetheless, plaintiffs always bear the burden of establishing subject matter jurisdiction. Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016). Animal Sci. Prod., Inc. v. China Minmetals Corp., 654 F.3d 462, 470 (3d Cir. 2011). "Although 'general factual allegations of injury resulting from the defendant's conduct may suffice,' the complaint must still 'clearly and specifically set forth facts sufficient to satisfy' Article III." Reilly v. Ceridian Corp., 664 F.3d 38, 41 (3d Cir. 2011)(citations omitted).
III. DISCUSSION
The Constitution limits the subject matter jurisdiction of federal courts to "cases" and "controversies." See U.S. Art. III § 2. To establish constitutional standing, plaintiffs must, inter alia, "clearly . . . allege facts demonstrating" an "injury in fact." Lujan v. Defs. Of Wildlife, 504 U.S. 555, 561 (1992). An "injury in fact" is "an invasion of a legally protected interest which is concrete and particularized." Id. at 560 (citations omitted). The issue in this case is whether Kamal alleges a sufficiently "concrete" harm to confer standing. The Court will briefly summarize two recent, governing cases on the issue of concreteness, Spokeo and Horizon. Applying this case law, the Court finds that Kamal fails to clearly allege facts demonstrating that he has sustained a concrete injury in fact.
A. Spokeo , Inc. v. Robins , 136 S. Ct. 1540 (2016)
The Supreme Court in Spokeo v. Robbins clarified that an "injury in fact" must be "concrete," which means "it must actually exist." Spokeo Inc. v. Robins, 136 S. Ct. 1540, 1548 (2016) ((citing Black's Law Dictionary 479 (9th ed. 2009)). "Concrete" injuries may be "intangible" or non-economic, but, like other cognizable injuries, they must be "actual or imminent, not conjectural or hypothetical." Spokeo, 136 S. Ct. at 1548. Spokeo provided two factors that determine whether an intangible harm is sufficiently concrete. Id. at 1549. The first is "whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Id. If so, "it is likely to be sufficient to satisfy the injury-in-fact element of standing." Horizon, 846 F.3d at 637 (3d Cir. 2017). The second consideration is "whether Congress has expressed an intent to make an injury redressable;" for, "even if an injury was previously inadequate in law, Congress may elevate it to the status of [a] legally cognizable injur[y]." Id. (quoting Spokeo, 846 F.3d at 637) (internal citations omitted). Still, a plaintiff does not "automatically satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right. Article III standing requires a concrete injury even in the context of a statutory violation." Spokeo, 136 S. Ct. at 1549.
B. In re Horizon Healthcare Serv. Data Breach Litig., 846 F.3d 625 (3d Cir. 2017)
The Third Circuit recently applied Spokeo in In re Horizon Healthcare Services Inc. Data Breach Violation, 846 F.3d 625 (3d Cir. 2017). The plaintiff in Horizon alleged that two laptop computers containing unencrypted personal information of over 800,000 health insurance customers were stolen from Horizon's headquarters. Id. at 630. Among the stolen data were names, addresses, member identification numbers, dates of birth, "and in some instances, a Social Security Number and/or limited clinical information." Id. The breach led to a fraudulent tax return filed in plaintiff's name and to an attempted credit card fraud. Plaintiff was also "denied retail credit because his social security number has been associated with identity theft." Id. The complaint alleged multiple violations of the FCRA, including the unauthorized "furnishing" of certain personal information and failure to "adopt reasonable procedures to keep sensitive information confidential," along with several common law privacy torts. Id. at n. 5, 631 (citing 15 U.S.C. § 1681(b); 1681a(d)(3)).
Applying Spokeo, the Third Circuit denied Horizon's facial challenge, holding that the alleged injuries were sufficiently "concrete" to confer constitutional standing. First, under Anglo-American law, "unauthorized disclosures of information have long been seen as injurious." Id at 638. Indeed, "[t]he common law alone will sometimes protect a person's right to prevent the dissemination of private information . . . [and] improper dissemination of information can itself constitute a cognizable injury." Id. at 638-39. Second, by passing the FCRA, Congress clearly intended to establish "that the unauthorized dissemination of personal information by a credit reporting agency causes an injury in and of itself—whether or not the disclosure of that information increased the risk of identity theft or some other future harm." Id. at 639. In sum, the alleged injury was "concrete" because it sufficiently resembled a common law injury (invasion of privacy), such that Congress could "elevat[e] [it] to the status of legally cognizable injur[y]." Id at 640. The Horizon majority declined to consider "the full reach of congressional power to elevate a procedural violation to an injury in fact," because the case before it "[did] not strain that reach." Horizon, 846 F.3d at 638.
C. Plaintiff's Article III Standing
Plaintiff identifies two distinct "concrete" injuries: (1) disclosure of information considered by law to be intrinsically private, and (2) the increased risk of identity theft or credit-card fraud in the future. SAC ¶ 36. Neither theory adequately alleges a "concrete" harm, so Plaintiff fails to satisfy the injury-in-fact element of constitutional standing.
The SAC differs from the FAC mainly in that it adds more legislative history in support of its contention that Congress intended to create a de facto injury for each violation of FACTA's credit-card truncation provision. The FAC and SAC are otherwise virtually identical.
1. No de facto Injury to Plaintiff's Privacy Rights
There is no meaningful relationship between J. Crew's conduct and any privacy interest historically recognized at common law. See Horizon, 846 F.3d at 637 ("The first test, the one of history, asks whether 'an alleged intangible harm' is closely related 'to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American Courts.') (citing Spokeo, 136 S. Ct. at 1545). Unlike in Horizon, Plaintiff's personal information was not disclosed to third parties or used to perpetrate credit-card or tax fraud. See Horizon, 846 F.3d at 637 (noting that in Spokeo, where the Supreme Court found no de facto standing, "[t]he complaint did not include any allegation that the false information was actually used to the plaintiff's detriment."). See id. at 641.
In contrast, Kamal alleges "a bare procedural violation, divorced from any concrete harm," under circumstances that do not implicate traditional common law privacy interests. For one, J. Crew did not "disclose" Kamal's personal information. Rather, Kamal gave his credit-card number to J. Crew, which then printed a receipt containing part of that number and handed it back to Kamal. See Stelmachers v. Verifone Systems, Inc., 2016 WL 6835084, at *4 (Nov. 21, 2016). Regardless, printing a card's first six and last four digits—rather than only the last five digits—does not implicate the historic "right to be let alone," particularly when the first six digits do not pertain to the customer's individual bank account. See infra p. 6. See also The Right to Privacy, Warren & Brandeis, 4 Harv. L. Rev. at 193. This case is unlike In re Nickelodeon Consumer Privacy Litigation, in which the complaint alleged "disclosure of information relating to [each plaintiff's] online behavior." 827 F.3d 262, 273 (3d Cir. 2016) (finding standing where defendant violated federal statute by surreptitious, unauthorized tracking of plaintiffs' internet activities). Nor does the SAC allege unauthorized access to personal information. See In re Google Inc. Cookie Placement Consumer Privacy Litig., 806 F.3d 125 (3d Cir. 2015) (defendants surreptitiously "implanted tracking cookies on [plaintiffs'] personal computers] in order to track behavior ).
As an aside, the Court notes that Kamal continued to purchase from J. Crew even after sustaining his first alleged "injury." Despite receiving an insufficiently truncated receipt on December 18, 2014, Kamal made purchases on December 22, 2014, and January 4, 2015, albeit at different J. Crew retailers.
As for the second Spokeo factor, "the judgment of Congress," the Court finds that the legislative intent underlying FACTA's private cause of action is more ambiguous than Plaintiff suggests. Congress sought to "ensure that consumers suffering from any actual harm to their credit or identity are protected." Pub. L. No. 110-241 (emphasis in original). While Congress undoubtedly hoped that FACTA would reduce identify theft, it does not follow that Congress contemplated private actions by individuals who have not sustained any actual harm. See id.; Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 724, 727-28 (7th Cir. 2016). In fact, the Clarification Act warned that "the continued appealing and filing of these lawsuits represents a significant burden on the hundreds of companies that have been sued and could well raise prices to consumers without corresponding consumer protection benefit." Id. at 728 (citing Pub. L. 110-241, § 2(a)(7)).
2. Material Risk of Future Harm
The second alleged basis for standing is that Plaintiff sustained an increased risk of identity theft at some time in the future. Spokeo itself asked "whether the particular procedural violations alleged in [a] case entail a degree of risk sufficient to meet the concreteness requirement." Bock v. Pressler & Pressler, LLP, 658 F. App'x 63, 65 (3d Cir. 2016) (quoting Spokeo, 136 S.Ct. at 1550). If Kamal adequately alleges that J. Crew's statutory violation creates a material risk of future harm, then Kamal likely has constitutional standing. See Reilly v. Ceridian Corp., 664 F.3d 38 (3d. Cir. 2011). Even drawing all reasonable inferences in Plaintiff's favor, however, the risk-of-harm argument fails to establish constitutional standing.
As the Third Circuit explained, it is not required that a plaintiff allege a "material risk of harm" in order to establish standing where a statutory violation is related to an intangible right historically recognized at common law. Horizon, 846 F3d. at 637. It does not follow, however, that a "material risk of harm" may not be sufficient to create standing "where the mere technical violation of a procedural requirement of a statute cannot, in and of itself, constitute an injury in fact." See, e.g., Horizon, 846 F.3d at 641-42 (Shwartz, J., concurring). As such, the Court must examine Plaintiff's alternate position that printing the first six and last four digits of a credit card number on a customer receipt "created a real risk of identity theft." SAC ¶ 107.
While it emphasized the importance of congressional intent, the Horizon majority also stated that "an increased risk of future injury . . . at least weighs in favor of standing." Id. at n. 19, 639. The plaintiffs made a "legitimate argument that they face increased risk of future injury," as "the information that was stolen was highly personal and could be used to steal one's identity . . . The theft appears to have been direct toward the acquisition of such personal information . . . [and] [t]he stolen laptops were unencrypted, meaning that the personal information was easily accessible." Id. (citations omitted). See Horizon, 846 F.3d at 641 (Shwartz, J., concurring).
The Court takes notice that credit and debit card numbers are 16 digits long. The first six relate to the bank or card-issuer and the last 10 refer to the card-holder's specific account. See Toys "R" Us - Delaware, Inc. FACTA Lit., MDL No. 08-01980, 2010 WL 5071073, at *11 (C.D. Cal. Aug. 17, 2010). Given these facts, the Court cannot reasonably infer that printing the first six and last four digits of Plaintiff's credit card materially increased the risk of future harm, because doing so "gives an identity thief no more personal information about a person's account than Congress has permitted to be printed on receipts." See, e.g., Noble v. Nevada Checker CAB Corp., No. 2:15-cv-02322-RCJ-VCF, 2016 WL 4432685, at *3 (D. Nev. Aug. 19, 2016).
Since only the last 10 digits contain information personal to the Plaintiff's account, printing the first six and last four digits would seem to offer more protection than the statute's prohibition of printing more than the last five digits. The Court refers to the statute's text only to the extent it illuminates congressional intent. Whether Plaintiff states a cause of action under § 1681c is not at issue. --------
Like the FAC, the SAC alternates its focus between "dumpster divers," who gather lost or discard receipts, and more "sophisticated criminals," who use electronic means to perpetrate fraud. SAC ¶¶ 28, 37. The threat posed by dumpster divers consists of a highly "speculative chain of future events," Reilly 664 F.3d at 42: Kamal loses or throws away one of his J. Crew receipts, which is then discovered by a hypothetical third party, who then obtains the six remaining truncated digits along with any additional information required to use the card, such as the expiration date, security code or zip code, and proceeds to make online purchases. Unsurprisingly, Plaintiff cites no specific examples of this actually occurring. As the Court explained in its previous opinion, "there is no evidence that anyone has accessed or attempted to access or will access Plaintiff's credit card information." See Opinion Granting Motion to Dismiss FAC, at p. 5; ECF No. 63.
Alternatively, Plaintiff vaguely alleges that "sophisticated criminals" may deduce the remaining truncated numbers electronically. See SAC ¶ 37. Plaintiff provides two articles in support of this allegation, yet neither concerns credit-card truncation. The first article, in Exhibit A of the SAC, analyzes the incremental risk of identity theft under conditions in which the entire credit card number has already been obtained by prospective identity thieves. Muhammed Aamir Ali, et al., Does Online Card Payment Landscape Unwittingly Facilitate Fraud?, ECF No. 69-2. Plaintiff's Exhibit B contains an article by the same author that merely recapitulates the findings discussed in the first article.
The Court does not dispute that Congress "must have leeway to calibrate the burden of consumer protection as it best sees fit." Letter from Marvin L. Frank, at 3, ECF No. 70. But Congress cannot empower individuals to manufacture a "case" or "controversy" where none exists. As Spokeo explained and Horizon acknowledged, the "congressional power to elevate intangible harms into concrete injuries is not without limits." Horizon, 846 F.3d at 638 (citing Spokeo, 136 S. Ct. at 1549). Those limits are established by Article III of the Constitution, as interpreted by the Supreme Court. This Court finds that J. Crew's technical violation of FACTA lies beyond these limits. The Court lacks subject matter jurisdiction and the case must be dismissed.
IV. CONCLUSION
For the forgoing reasons, Defendants' motion to dismiss Plaintiff's Second Amended Complaint pursuant to Rule 12(b)(1) is GRANTED. Plaintiff's Second Amended Complaint is DISMISSED with prejudice.
/s/ William J. Martini
WILLIAM J. MARTINI, U.S.D.J. June 13, 2017