Opinion
No. CV-16-04181-PHX-DGC
04-24-2017
Jason Llewellyn, Plaintiff, v. AZ Compassionate Care Incorporated, et al., Defendants.
ORDER
Plaintiff Jason Llewellyn, on behalf of himself and all others similarly situated, filed a complaint against Defendant AZ Compassionate Care, Inc. Doc. 1, ¶ 1. Defendant has filed a motion to dismiss under Rule 12(b)(1) of the Federal Rules of Civil Procedure. Doc. 10. The motion is fully briefed (Docs. 10, 14, 17), and the Court concludes that oral argument is not necessary. For the reasons set forth below, the Court will grant Defendant's motion.
I. Background.
According to Plaintiff's complaint, Defendant and others "own, manage, maintain and or operate one or more physical retail stores within this district which sell goods and/or services to the public, including, but not limited to, various types of cannabis (medical marijuana)." Doc. 1, ¶ 13. Plaintiff alleges that, at some point after December 3, 2006, and within two years from the date of filing this action, Defendants provided him with "one or more electronically printed receipts on each of which Defendants printed the expiration date of his debit card and the last four digits of his card number." Id., ¶ 34.
While failing to provide the Court with the precise date of the alleged violation(s), this description appears to be intended to inform the Court that they occurred after the effective date of the relevant statutory provisions and within the statute of limitations for bringing this action. See 15 U.S.C. §§ 1681c(g)(3)(A), 1681p(1).
Plaintiff contends that this constitutes a violation of the Fair and Accurate Credit Transactions Act ("FACTA"), 15 U.S.C. §§ 1681 et seq. In relevant part, FACTA provides that "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. § 1681c.
Defendant moves to dismiss the claim for lack of subject-matter jurisdiction. Specifically, Defendant contends that Plaintiff has not suffered an injury in fact and therefore lacks standing to bring suit.
II. Legal Standard.
Lack of subject-matter jurisdiction may be raised at any time by the parties or the Court. Henderson ex rel. Henderson v. Shinseki, 562 U.S. 428, 434 (2011). "A Rule 12(b)(1) jurisdictional attack may be facial or factual. In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction." Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). When considering a facial attack, the Court takes the allegations in the plaintiff's complaint as true. Wolfe v. Strankman, 392 F.3d 358, 362 (9th Cir. 2004). The party invoking the Court's jurisdiction has the burden of establishing it. Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016).
The Constitution limits the jurisdiction of the federal courts to "Cases" and "Controversies." U.S. Const. art. III, § 2. "No principle is more fundamental to the judiciary's proper role in our system of government." Raines v. Byrd, 521 U.S. 811, 818 (1997) (citation omitted). In order to show that a case or controversy exists, a plaintiff must establish that he has standing to bring suit. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992). A plaintiff has standing if he (1) "has suffered an 'injury in fact' that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision." Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180-81 (2000). "If a plaintiff lacks Article III standing to bring a suit, the federal court lacks subject matter jurisdiction and the suit must be dismissed under Rule 12(b)(1)." Dunn v. Haag, No. 16-CV-00792-JST, 2017 WL 818863, at *2 (N.D. Cal. Mar. 2, 2017).
III. Analysis
A. Statutory Scheme.
FACTA, which amended the Fair Credit Reporting Act ("FCRA"), was enacted in 2003 "[i]n an effort to combat identity theft." Bateman v. Am. Multi-Cinema, Inc., 623 F.3d 708, 717 (9th Cir. 2010) (citing FACTA, Pub. L. 108-159, 117 Stat. 1952 (2003)). FACTA provides that "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. § 1681c(g)(1). A person who is willfully noncompliant will be liable for "any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000." 15 U.S.C. § 1681n(a)(1)(A).
In the years following enactment of FACTA, Congress found that many merchants erroneously understood § 1681c(g)(1) to be satisfied by simply truncating the account number down to the last 5 digits, without removing the expiration date. Credit and Debit Card Receipt Clarification Act of 2007, Pub. L 110-241 § (a)2(3), 122 Stat. 1565. "Almost immediately after the deadline for compliance passed, hundreds of lawsuits were filed alleging that the failure to remove the expiration date was a willful violation of the Fair Credit Reporting Act even where the account number was properly truncated," and "[n]one of these lawsuits contained an allegation of harm to any consumer's identity." Id. § (a)2(4), (5). These lawsuits represented "a significant burden on the hundreds of companies that have been sued and could well raise prices to consumers without corresponding consumer protection benefit." Id. § (a)2(7). Congress responded to this development by amending FACTA with the Credit and Debit Card Receipt Clarification Act of 2007 ("CDCRCA"). Id. The purpose of the amendment was "to ensure that consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits that do not protect consumers but only result in increased cost to business and potentially increased prices to consumers." Id. § (b)
Congress additionally found that "that proper truncation of the card number, by itself as required by the amendment made by the Fair and Accurate Credit Transactions Act, regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud." Id. § (a)2(6). Notably, however, the CDCRCA did not eliminate FACTA's requirement that persons remove expiration dates from receipts; it simply "insulate[d] from liability any person who printed an expiration date on a receipt between December 4, 2004, and June 3, 2008, so long as they otherwise complied with FACTA's requirements." Bateman, 623 F.3d at 717.
B. Standing.
The Supreme Court recently addressed standing under FCRA. Spokeo, 136 S. Ct. 1540. The parties disagree on whether Spokeo requires a finding in this case that Plaintiff lacks standing to bring this FACTA claim. Lower courts have disagreed on the proper application of Spokeo to the concrete and particularized injury analysis for FACTA claims. Compare, e.g., Wood v. J Choo USA, Inc., 201 F. Supp. 3d 1332 (S.D. Fla. 2016), with Kamal v. J. Crew Grp., Inc., No. 2:15-0190 (WJM), 2016 WL 6133827 (D.N.J. Oct. 20, 2016).
In Spokeo, the Supreme Court vacated and remanded a Ninth Circuit opinion finding that a plaintiff had standing to bring a claim under FCRA. 136 S. Ct. at 1544-45. The plaintiff alleged that his statutory rights were violated when Spokeo - a website that allows individuals to search for information about others - gathered and disseminated incorrect information about him. Id. The Supreme Court did not decide whether the plaintiff had alleged an injury in fact, but found that the Ninth Circuit had erred by conflating the "concrete" and "particularized" characteristics of the injury in fact requirement. Id. at 1550. The Court explained that to be "particularized," an injury "must affect the plaintiff in a personal and individual way." Id. at 1548. To be "concrete," an injury "must be 'de facto'; that is, it must actually exist." Id.
The Supreme Court was careful to emphasize that an injury may actually exist even if it is intangible. Id. at 1549 ("Although tangible injuries are perhaps easier to recognize, we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete."). To determine whether an intangible injury is concrete, courts should consider "both history and the judgment of Congress." Id. The Court noted that "Congress is well positioned to identify intangible harms that meet minimum Article III requirements," but made clear that Congress's judgment is "instructive" rather than "definitive." Id. As a result, while "Congress has the power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before," its "role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right." Id. (citation and quotation marks omitted). Stated differently, "Article III standing requires a concrete injury even in the context of a statutory violation." Id.
The Supreme Court noted that a "risk of real harm" can satisfy the requirement of concreteness in certain circumstances, but emphasized that "a bare procedural violation, divorced from any concrete harm," would not suffice. Id. It did not otherwise provide a clear test for when an intangible harm will constitute a concrete injury.
Lower courts have reached inconsistent results when applying Spokeo to FACTA claims similar to this case. On what appears to be the minority side of this split, three district courts in the Eleventh Circuit have held that a plaintiff who claims to have received a receipt that includes his credit card expiration date, without alleging additional harm, has sufficiently pleaded a concrete injury. See Wood, 201 F. Supp. 3d 1332; Guarisma v. Microsoft Corp., 209 F. Supp. 3d 1261 (S.D. Fla. 2016); Altman v. White House Black Mkt., Inc., No. 1:15-CV-2451-SCJ, 2016 WL 3946780, at *1 (N.D. Ga. July 13, 2016). These cases found that "[t]hrough FACTA, Congress created a substantive legal right [for individuals] to receive receipts truncating their personal credit card numbers and expiration dates and, thus, protecting their personal financial information." Wood, 201 F. Supp. 3d at 1340; see also Guarisma, 209 F. Supp. 3d at 1261; Altman, 2016 WL 3946780, at *5. But as a district court in the Southern District of New York pointed out:
there is reason to question those cases' basis for concluding that FACTA confers such a substantive right. Altman and Guarisma each rely in part on Hammer v. Sam's E., Inc., 754 F.3d 492 (8th Cir. 2014), a pre-Spokeo decision holding that FACTA violations in themselves give rise to standing; but the Eighth Circuit subsequently recognized that Hammer was abrogated by Spokeo. See Braitberg v. Charter Communications, Inc., 836 F.3d 925, 930 (8th Cir. 2016). Altman and Guarisma also rely on an unpublished decision by the Eleventh Circuit, Church v. Accretive Health, Inc., 654 Fed. Appx. 990 (11th Cir. 2016) (per curiam), which held that the FDCPA conferred a substantive right to receive certain disclosures, yet neither case explains why FDCPA and FACTA violations should be treated the same for standing purposes. Wood provides no additional support, as it relies entirely on the reasoning of Guarisma and Altman.Cruper-Weinmann v. Paris Baguette Am., Inc., No. 13 CIV. 7013 (JSR), 2017 WL 398657, at *4 n.3 (S.D.N.Y. Jan. 30, 2017).
Moreover, these cases infer from Spokeo a distinction between the treatment of procedural and substantive rights that this Court finds unconvincing. Plaintiff similarly emphasizes this alleged distinction, arguing that Spokeo is not controlling because it addressed only procedural rights. Doc. 14 at 12-16. Plaintiff contends that he is asserting a violation of his substantive rights, and need not, therefore, allege any harm beyond the one Congress identified. Id. Assuming without deciding that Plaintiff is correct that FACTA provides him a substantive right to receive a truncated receipt, his argument remains without merit. Spokeo made clear that "Congress cannot erase Article III's standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing." 136 S. Ct. at 1547-48 (quoting Raines, 521 U.S. at 820 n.3). The Supreme Court did not make any distinction between the showing of harm necessary to maintain an action for a substantive right and a procedural right. In fact, the majority did not mention substantive rights at all, but concluded generally that "Article III standing requires a concrete injury even in the context of a statutory violation." Id. at 1549. Thus, as the Seventh Circuit has found, "whether [a] right is characterized as 'substantive' or 'procedural,' its violation must be accompanied by an injury-in-fact." Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 n.2 (7th Cir. 2016); see also Cruper-Weinmann, 2017 WL 398657, at *5; Thompson v. Rally House of Kansas City, Inc., No. 15-00886-CV-W-GAF, 2016 WL 8136658, at *5 (W.D. Mo. Oct. 6, 2016).
Plaintiff cites several pre-Spokeo cases to support his claim that an allegation of a violation of a substantive right is alone sufficient to establish an injury in fact. Doc. 14 at 12-16. But none of the cited cases stands for this proposition. Plaintiff additionally cites an unpublished post-Spokeo case from the Eleventh Circuit. See Church v. Accretive Health, Inc., 654 F. App'x 990 (11th Cir. 2016). Church states that "[i]n Spokeo, the Court stated that a Plaintiff 'cannot satisfy the demands of Article III by alleging a bare procedural violation.' This statement is inapplicable to the allegations at hand, because Church has not alleged a procedural violation. Rather, Congress provided Church with a substantive right to receive certain disclosures and Church has alleged that Accretive Health violated that substantive right." Id. at 995 (citation omitted). Not only is this case unpublished, but its logic is called into question by a subsequent published case from the same circuit, Nicklaw v. Citimortgage, Inc., 839 F.3d 998 (11th Cir. 2016). Nicklaw addressed standing to assert an alleged substantive right created by a New York statute. Id. at 1003. The Eleventh Circuit determined that "the relevant question is whether Nicklaw was harmed when this statutory right was violated. Article III standing requires a concrete injury even in the context of a statutory violation." Id. at 1002 (citation and quotation marks omitted). This case additionally calls into question the continuing validity of Wood, Altman, and Guarisma, which relied on Church.
Meyers is the only circuit court decision after Spokeo to address standing to maintain an action for violation of FACTA's requirement to omit expiration dates from receipts. The Seventh Circuit noted that "Congress' judgment that there should be a legal remedy for the violation of a statute does not mean each statutory violation creates an Article III injury." Meyers, 843 F.3d at 727. "[O]ne of the lessons of Spokeo" is that a "violation of a statute that causes no harm does not trigger a federal case." Id. at 727 n.2. Applying these principles to the allegations before it, the Seventh Circuit found:
Meyers did not suffer any harm because of Nicolet's printing of the expiration date on his receipt. Nor has the violation created any appreciable risk of harm. After all, Meyers discovered the violation immediately and nobody else ever saw the non-compliant receipt. In these circumstances, it is hard to imagine how the expiration date's presence could have increased the risk that Meyers' identity would be compromised.Id. at 727. As a result, "without a showing of injury apart from the statutory violation, the failure to truncate a credit card's expiration date is insufficient to confer Article III standing." Id. at 728-79.
Several district courts have reached similar conclusions in FACTA cases. See, e.g., Cruper-Weinmann, 2017 WL 398657, at *4 (holding that a plaintiff had not sufficiently alleged a concrete harm where she claimed to have received a receipt containing her card expiration date in violation of FACTA, but gave no indication that any third party ever saw or accessed the receipt); Stelmachers v. Verifone Sys., Inc., No. 5:14-CV-04912-EJD, 2016 WL 6835084, at *4 (N.D. Cal. Nov. 21, 2016) (holding that a plaintiff had alleged "only a bare procedural violation of FACTA" and had not established Article III standing where he claimed to have received a receipt with more than the last five digits of his credit card number, but did not allege that any third party had accessed his receipt); Kamal, 2016 WL 6133827, at *3 (finding an insufficient degree of risk to establish a concrete injury where a plaintiff alleged to have received a receipt with the first six digits of his credit card number in violation of FACTA, but provided no evidence that anyone had accessed or attempted to access the plaintiff's credit card information); Thompson, 2016 WL 8136658, at *5 (holding that a plaintiff alleged a violation of FACTA without any concrete, actual harm where he claimed to have received a receipt with more than the last five digits of his credit card number, but did not allege that any third party had access to the receipt, that he had suffered any stress or psychological harm, or that he had undertaken any costly and burdensome measures to protect himself); Noble v. Nevada Checker CAB Corp., No. 215CV02322RCJVCF, 2016 WL 4432685, at *4 (D. Nev. Aug. 19, 2016) (holding that a plaintiff alleged a technical violation of FACTA but did not establish Article III standing where he claimed to have received a receipt with more than the last five digits of his credit card number, but did not separately allege any actual harm, such as resulting credit card fraud).
Three additional district courts adopted the Meyers position after the parties submitted their briefs. See Hendrick v. Aramark Corp., No. CV 16-4069, 2017 WL 1397241 (E.D. Pa. Apr. 18, 2017); Weinstein v. Intermountain Healthcare, Inc., No. 2:16-CV-00280-DN, 2017 WL 1233829 (D. Utah Apr. 3, 2017); Paci v. Costco Wholesale Corp., No. 16-CV-0094, 2017 WL 1196918 (N.D. Ill. Mar. 30, 2017).
In this case, Plaintiff claims to have received at least one receipt from Defendant that displayed his credit card expiration date in violation of FACTA. He provides no additional factual allegations of harm. He does not assert when he learned of the violation, what he did with the receipt, that any third party ever had access to the receipt, or what, if any, extra steps he took to secure his credit card information as a result of the receipt. Plaintiff alleges a bare technical violation of FACTA, without satisfying his burden of alleging concrete harm.
In another case brought by Plaintiff's counsel with almost identical facts, a respected judge in this District found that the plaintiff had sufficiently asserted a concrete harm and thus established Article III standing. See Deschaaf v. Am. Valet & Limousine Inc., No. CV-16-03464-PHX-GMS, 2017 WL 610522 (D. Ariz. Feb. 15, 2017). The judge in that case concluded:
A person or entity who prints an expiration date on a receipt, therefore, does not simply violate a procedural provision of FACTA but creates a real
risk of identity theft - the very harm that FACTA was enacted to combat. There is a real risk that the customer's right to the privacy of their credit or debit card information is violated. Nor is this harm made harmless when, as here, the risk fails to materialize because no potential identity thief actually sees the receipt. Even in this situation, the consumer must take additional steps to ensure the safety of her identity; she may not simply crumple the receipt and throw it into a nearby trash can, but must review it to assess what was printed, hold on to it, and perhaps shred it or cut it up later. The inconvenience may be minor; but the additional inconvenience that a consumer must undertake in order to secure their own rights, when a statute places that burden on others, is surely a concrete harm.Id., at *4.
Respectfully, the Court disagrees. Congress itself found that mere printing of the expiration date does not create a risk of identity theft: "proper truncation of the card number, by itself . . . , regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud." CDCRCA, Pub. L 110-241 § 2(6), 122 Stat. 1565 (2008). As a result, even if Plaintiff had alleged that a third party had viewed a receipt with his expiration date - which he does not - he would not without more have alleged an actual risk of fraud or identity theft.
Deschaaf relies on a Seventh Circuit case discussing how truncation of the expiration date combats identity theft. 2017 WL 610522, at *3 (discussing Redman v. RadioShack Corp., 768 F.3d 622, 626-27 (7th Cir. 2014)). Redman notes that the expiration date is an additional security feature that protects the cardholder's account information from fraud and identity theft. It emphasizes that expiration dates are used by criminals in pretext calls and phishing scams, in order to obtain additional information from the cardholder. 768 F.3d at 626-27. But "unless a litany of speculative events come about, the risk that Plaintiff will be subjected to . . . identity theft . . . is too attenuated to constitute a qualifying injury in fact for standing[.]" Stelmachers, 2016 WL 6835084, at *4 (N.D. Cal. Nov. 21, 2016).
Deschaaf notes that an individual who receives a receipt with his card's expiration date may have to "take additional steps to ensure the safety of her identity," such as assessing, shredding, or cutting the violating receipt. Deschaaf, 2017 WL 610522, at *4. But whether or not such an admittedly "minor" inconvenience is sufficient to establish a concrete harm and Article III standing - a question the Court need not decide - Plaintiff does not allege that he suffered such inconvenience.
Deschaaf relies on a post-Spokeo case from the Ninth Circuit which found that "violations of FCRA's requirements of disclosure and authorization deprived a plaintiff of, respectively, his rights to information and privacy, thus giving the plaintiff standing to bring suit." Id., at *3 (citing Syed v. M-I, LLC, No. 14-17186, 2017 WL 242559, at *4 (9th Cir. Jan. 20, 2017)). But Syed is not controlling here. First, Syed addressed violations of FCRA, not FACTA. What is more, the plaintiff in Syed alleged that he discovered his rights were violated when he obtained and reviewed a copy of his personnel file, which showed that the defendant procured a consumer report regarding him based on a disclosure and authorization form that were illegal under FCRA. Syed, 2017 WL 1050586, at *5. The Ninth Circuit found that:
Syed has been subsequently amended and superseded. Syed v. M-I, LLC, No. 14-17186, 2017 WL 1050586 (9th Cir. Mar. 20, 2017). The Court will discuss the opinion as amended.
[The plaintiff] alleges more than a "bare procedural violation." The disclosure requirement at issue, 15 U.S.C. § 1681b(b)(2)(A)(i), creates a right to information by requiring prospective employers to inform job applicants that they intend to procure their consumer reports as part of the employment application process. The authorization requirement, § 1681b(b)(2)(A)(ii), creates a right to privacy by enabling applicants to withhold permission to obtain the report from the prospective employer, and a concrete injury when applicants are deprived of their ability to meaningfully authorize the credit check. By providing a private cause of action for violations of Section 1681b(b)(2)(A), Congress has recognized the harm such violations cause, thereby articulating a "chain of causation that will give rise to a case or controversy."Id., at *4 (citation omitted and alteration incorporated).
The Ninth Circuit found that the plaintiff's allegation was sufficient "to infer that [the plaintiff] was deprived of the right to information and the right to privacy guaranteed by Section 1681b(b)(2)(A)(I)-(ii) because it indicates that [the plaintiff] was not aware that he was signing a waiver authorizing the credit check when he signed it." Id., at *5. As a result, the plaintiff's personal information was actually obtained by a third party, his employer, without the notice and permission required by federal law. The Ninth Circuit noted that it was able to "fairly infer" that the plaintiff was confused by the document he was asked to sign and would not have signed it had a sufficiently clear disclosure been made, as required in the statute. Id. The plaintiff therefore did allege a concrete injury and had Article III standing to bring his lawsuit. Id.
Here, Plaintiff also alleges that Defendant's printing of his card's expiration date on a receipt interfered with his privacy rights. Doc. 14 at 22. But Plaintiff has not explained how such a receipt invaded his privacy rights. He alone received the receipt. Unlike the plaintiff in Syed, Plaintiff does not allege that anyone but himself saw the receipt or accessed his personal information. Moreover, district courts have repeatedly held that an allegation that a receipt contained credit card information in violation of FACTA, without more, does not implicate traditional privacy interests. See, e.g., Kamal, 2016 WL 6133827, at *4 ("While FACTA as a whole may implicate traditional privacy interests, Plaintiff's alleged injury does not."); Cruper-Weinmann, 2017 WL 398657, at *5; Stelmachers, 2016 WL 6835084, at *3.
Because the Court finds that Plaintiff has not alleged a concrete injury, it need not address the other standing arguments made by the parties. The Court will dismiss for lack of subject matter jurisdiction.
Plaintiff requests that the Court take judicial notice of an exhibit attached to his response, a brief from the United States in support of 15 U.S.C. § 1681c(g) filed in another case. Doc. 14-2. The brief does not address the issue of standing to bring a FACTA claim; it instead addresses the constitutionality of § 1681c(g) in the face of vagueness and First Amendment challenges. Id. The brief notes that the "expiration date of a customer's credit/debit card . . . is one of several pieces of information that can make it easier for criminals to rack up fraudulent charges. These dates are worth protecting even when not accompanied by other important financial information." Id. at 19. That this information is worth protecting and that it may be used in combination with other information to commit fraud or identity theft does not establish that printing an individual's credit card expiration date on a receipt, without more, creates a sufficient risk of harm to establish a concrete injury for Article III standing purposes. --------
IT IS ORDERED that Defendant's motion to dismiss (Doc. 10) is granted. The Clerk of Court is directed to terminate this matter.
Dated this 24th day of April, 2017.
/s/_________
David G. Campbell
United States District Judge