Opinion
No. 1-18-0164
12-26-2018
EMIGUELA PACI, Plaintiff-Appellant, v. COSTCO WHOLESALE CORPORATION, Defendant-Appellee.
NOTICE: This order was filed under Supreme Court Rule 23 and may not be cited as precedent by any party except in the limited circumstances allowed under Rule 23(e)(1).
Appeal from the Circuit Court of Cook County.
No. 17 CH 6413
Honorable Anna Helen Demacopoulos, Judge Presiding.
JUSTICE HOWSE delivered the judgment of the court.
Presiding Justice Fitzgerald Smith and Justice Ellis concurred in the judgment.
ORDER
¶ 1. Held: The judgment of the circuit court of Cook County dismissing plaintiff's complaint is affirmed; plaintiff lacked standing to bring her complaint because plaintiff did not suffer an injury-in-fact; plaintiff did not suffer a distinct and palpable injury because she only alleged a technical statutory violation.
¶ 2. After bringing a claim seeking recovery under the federal Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681n, in federal court in the northern district of Illinois and having her
claim dismissed for lack of standing, plaintiff, Emiguela Paci, filed a complaint in the circuit court of Cook County alleging defendant, Costco Wholesale Corporation, violated the Fair and Accurate Credit Transactions Act (FACTA), 15 U.S.C. § 1681c(g)(1), by printing more than the last five digits of her credit card number on a receipt. Plaintiff sought statutory damages for willful violations of FACTA and did not claim actual damages. Defendant filed a motion to dismiss the complaint for failure to state a claim for which plaintiff could receive relief and raising the affirmative matter that plaintiff lacked standing to bring the complaint. The trial court found plaintiff needed to allege an injury-in-fact, and that plaintiff's claimed injury is not distinct and palpable. The court therefore granted defendant's motion to dismiss under section 2-619 grounds for plaintiff's lack of standing. 735 ILCS 5/2-619(a)(9) (West 2016). Plaintiff appealed, claiming she had standing because the statute provided that it is a violation to print on a receipt more than the last five digits of a consumer's credit card number and the statute also provided that the offending retailer is liable directly to the consumer either for actual damages or minimum statutory damages. Plaintiff claims defendant violated a duty owed to her under the statute and that she does not need to allege actual damages because she can seek statutory damages. Defendant argues that while plaintiff does not need to allege actual damages, she is still not excused from the requirement for standing that she have some injury in fact to a legally cognizable interest, and that plaintiff has not alleged an injury in fact to a legally cognizable interest. For the reasons that follow we conclude plaintiff must allege a distinct and palpable injury to have standing to sue for the minimum statutory damages provided in the statute, and therefore we affirm the judgment of the trial court.
¶ 3. BACKGROUND
¶ 4. On January 3, 2016, plaintiff shopped at the Costco in Niles, Illinois and made two
purchases. When she reached the store exit, plaintiff was asked for her receipt for proof she purchased the items which was required to exit and plaintiff discovered she had lost the receipt. Plaintiff requested a replacement receipt from the store supervisor, who printed her a "summary journal" report of the transaction. Plaintiff showed the journal report to the clerk at the exit and then left Costco. Plaintiff noticed that this new receipt had printed the first six digits of her credit card number. This receipt did not print plaintiff's name, but did print her member ID number. The receipt listed plaintiff's transactions for both of her purchases under the header "Cash Receipt," and an additional column listing "Summary Journal." Instead of throwing the receipt out as she normally does with receipts from grocery shopping, plaintiff stored it separate from other receipts in a filing cabinet in her home.
¶ 5. The FACTA is an amendment to the FCRA providing that "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. § 1681c(g)(1). The FCRA provides for damages payable to the consumer whose credit card number was printed:
"(a) In general Any person who willfully fails to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer in an amount equal to the sum of—
(1) (A) any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000; or
(B) in the case of liability of a natural person for obtaining a consumer report under false pretenses or knowingly without a permissible purpose, actual damages sustained by the consumer as a result of the failure or $1,000, whichever is
greater;
(2) such amount of punitive damages as the court may allow; and
(3) in the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney's fees as determined by the court." 15 U.S.C. § 1681n.
¶ 6. Plaintiff first filed her complaint in federal court in the Northern District of Illinois claiming defendant willfully printed more than the last five digits of her credit card number on a receipt. Plaintiff alleged defendant violated FACTA and sought statutory damages under the FCRA. Defendant filed a motion to dismiss plaintiff's complaint on the pleadings for failure to state a claim for which plaintiff could receive relief. Defendant argued it did not violate FACTA because it did not print the journal report at the point of sale, but instead at a different terminal that was not a cash register. The district court held a hearing on the motion to dismiss on April 6, 2016, and after hearing arguments on the motion, denied the motion to dismiss at the pleading stage, finding:
"these allegations at least plausibly suggest the defendant provided plaintiff with a receipt at the point of sale or transaction that displayed too many credit card digits. The fact that the receipt was printed from a different terminal 10 minutes after the actual purchase is not enough to set aside the claim within the scope of the statute, at least at this stage in the proceedings."
The district court therefore denied the motion to dismiss and the parties proceeded to discovery.
¶ 7. Plaintiff's claim proceeded to discovery and the parties conducted depositions. A Costco employee, an information systems director, with knowledge of Costco's policies and procedures for truncation of credit card numbers on receipts was deposed by plaintiff. The employee was
shown plaintiff's receipt and he identified it as a journal report printed from a controller and was not a register receipt. Typically, only managers and supervisors have access to the machines that print journal reports. Journal reports cannot be printed from the membership desk. The journal reports are generated when data is transmitted from the register where the goods are rung and then go to the point of sale system, and then can be printed at the controller using the default settings from the point of sale software. The employee testified that defendant used to print full credit card numbers and expiration dates, and that they now only print the last four digits of the credit card number. The default setting for the point of sale software for register receipts is to print only the last four digits of the credit card number.
¶ 8. Plaintiff and defendant both filed motions for summary judgment. In an order dated March 30, 2017, the district court dismissed plaintiff's complaint because she lacked Article III standing and the court therefore lacked jurisdiction. The district court did not reach the parties' summary judgment arguments. Instead, the district court found plaintiff did not articulate any actual harm or increased risk of injury, and therefore could not satisfy the injury in fact requirement for standing. Paci v. Costco Wholesale Corp., 16-CV-0094, 2017 WL 1196918, at *3 (N.D. Ill. Mar. 30, 2017). The district court accordingly dismissed the case for lack of jurisdiction. Id.
¶ 9. On May 4, 2017, plaintiff filed the present complaint in the circuit court of Cook County. Defendant filed a combined motion to dismiss, claiming plaintiff failed to state a claim for relief and raising the affirmative defense that plaintiff lacked standing to bring her claim. Plaintiff argued she had standing in Illinois state courts to sue for statutory damages only and was not required to prove actual injury to her from a statutory violation. She further argues federal courts are bound by Article III of the Constitution, which requires a distinct and palpable injury to
confer standing, but Illinois courts are not similarly constrained. The trial court was not persuaded. On December 19, 2017, the trial court entered an order granting defendant's motion for summary judgment. The court only ruled on the issue of plaintiff's standing to bring her complaint and not any other issues. The court found plaintiff lacked standing because plaintiff did not suffer any actual harm. The court found persuasive Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 724 (7th Cir. 2016), a Seventh Circuit case involving a plaintiff who sued over a restaurant's failure to truncate his credit card's expiration date on his receipt. The trial court concluded that a violation of the FACTA was not sufficient to provide plaintiff with a distinct and palpable injury sufficient to confer standing to maintain a lawsuit, and granted defendant's motion to dismiss for plaintiff's lack of standing. This appeal followed.
¶ 10. ANALYSIS
¶ 11. Plaintiff appeals from the trial court's order granting defendant's motion to dismiss for plaintiff's lack of standing. The trial court found plaintiff failed to allege she suffered a distinct and palpable injury and therefore did not suffer, or was not in danger of suffering, an injury-in-fact. Plaintiff argues she was not required to prove injury-in-fact to have standing because Congress provided for statutory damages as an alternative to actual damages for a violation of the Act. Plaintiff claims she has standing because defendant owed her a duty to not print more than the last five digits of her credit card number, that this duty was violated, and that under the statute she has standing to sue for statutory damages provided:
"(a) In general Any person who willfully fails to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer in an amount equal to the sum of—
(1) (A) any actual damages sustained by the consumer as a result of the failure or
damages of not less than $100 and not more than $1,000." 15 U.S.C. § 1681n.
¶ 12. Defendant argues plaintiff lacks standing because the statute did not absolve plaintiff from the standing requirement of pleading an injury-in-fact. Defendant argues FACTA provides for statutory damages because there will be times when a party was distinctly and palpably injured, but the actual damages are difficult to prove or ascertain. Defendant maintains that an alleged violation of the statute alone is not an injury-in-fact, and that plaintiff failed to show any harm, whether tangible or intangible, from defendant's conduct.
¶ 13. Defendant filed a motion to dismiss under section 2-619.1, raising arguments for dismissal under both sections 2-615 and 2-619. 735 ILCS 5/2-619.1 (West 2016). A 2-615 motion to dismiss attacks the legal sufficiency of the complaint while a 2-619 motion admits the sufficiency of the complaint but raises an affirmative matter that avoids or defeats the claim. In re Scarlett Z.-D., 2015 IL 117904, ¶20. "In ruling on a section 2-619 motion, a court must accept as true all well-pleaded facts in plaintiff's complaint and all inferences that can reasonably be drawn in plaintiff's favor. [Citation.] The court should grant the motion only if the plaintiff can prove no set of facts that would support a cause of action." Chicago Teachers Union, Local 1 v. Board of Education of City of Chicago, 189 Ill. 2d. 200, 206 (2000). The trial court here only ruled on defendant's argument under section 2-619 that plaintiff lacked standing to bring the complaint because plaintiff did not suffer an injury that was distinct and palpable. A plaintiff's lack of standing may be raised by a defendant as an affirmative matter that negates the plaintiff's cause of action. In re Scarlett Z.-D., 2015 IL 117904, ¶20. Plaintiffs do not need to allege facts in the complaint to establish standing. Chicago Teachers Union, Local 1, 189 Ill. 2d. at 206. Lack of standing is an affirmative defense that must be pleaded and proven by defendant. Id. "While a lack of subject matter jurisdiction cannot be forfeited [citation], a lack of standing
will be forfeited if not raised in a timely manner in the trial court." Lebron v. Gottlieb Memorial Hospital, 237 Ill. 2d 217, 252-53 (2010). We review de novo orders granting motions to dismiss under section 2-619. Chicago Teachers Union, Local 1, 189 Ill. 2d. at 206.
¶ 14. Standing to bring a claim for relief "in Illinois requires only some injury in fact to a legally cognizable interest." Greer v. Illinois Housing Development Authority, 122 Ill. 2d 462, 492 (1988). The claimed injury may be actual or threatened, and must be: "distinct and palpable," "fairly traceable" to the defendant's actions, and "substantially likely to be prevented or redressed by the grant of the requested relief." Id. at 492-93. A threatened injury, though lacking immediate and ascertainable damages, may still be a distinct and palpable injury granting standing. Id. at 494. The trial court here found plaintiff did not allege she faced or suffered a distinct and palpable injury, and did not rule on the remaining elements of standing. This appeal concerns only whether plaintiff faced or suffered a "distinct and palpable" injury when defendant printed the first six digits of her credit card number in violation of FACTA.
¶ 15. Distinct and Palpable Injury
¶ 16. Plaintiff maintains the trial court erred granting defendant's motion to dismiss because plaintiff has standing to pursue her claim and the trial court relied on inapplicable federal law, as well as inapposite Illinois case law. Plaintiff argues the trial court's reliance on Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 624 (7th Cir. 2016) is misplaced because Illinois courts are not required to follow federal law on issues of justiciability and standing, relying on Greer, 122 Ill. 2d. at 491. Although Illinois courts are indeed not bound to follow federal law on standing doctrine, our supreme court in Greer did not depart from federal law on the distinct and palpable requirement for injury-in-fact. Greer, 122 Ill. 2d. at 489-91.
¶ 17. While it is the case that we are not required to follow federal law on issues of standing,
the Greer court still maintained that a plaintiff will only have standing if they have a distinct and palpable injury, and that "there must be an actual controversy between adverse parties." Id. at 493. The Greer court provided citation specifically to United States Supreme Court cases for the "distinct and palpable," "fairly traceable to the defendant's actions," and "substantially likely to be redressed by the grant of the requested relief" standards for standing in Illinois. Id. (citing Warth v. Seldin, 422 U.S. 490, 500 (1975), Havens Realty Corp. v. Coleman, 455 U.S. 363, 375 (1982), Village of Arlington Heights v. Metropolitan Housing Development Corp., 429 U.S. 252, 261 (1977), Immigration and Naturalization Service v. Chadha, 462 U.S. 919, 936 (1983)). Although federal law is not determinative of Illinois standing doctrine, our supreme court has utilized federal standards for an injury-in-fact being actual or threatened.
¶ 18. The issue of plaintiff standing for FCRA claims seeking only statutory damages was before the Supreme Court of the United States in 2016. Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016). In Spokeo, the plaintiff brought a complaint in federal district court alleging the defendant posted on its website inaccurate information about the plaintiff, in violation of the FCRA. Id. at 1546. The plaintiff argued his personal rights were violated by violation of the statute and the statute provides that the defendant is liable to him for either actual damages or statutory damages of $100 to $1000. The district court dismissed the plaintiff's action for lack of standing and the Ninth Circuit reversed, finding the plaintiff alleged an injury in fact because the statutory violation was particular to the plaintiff. The Supreme Court vacated the Ninth Circuit's ruling and remanded the matter. Id. at 1550. The Court found the Ninth Circuit only considered whether the plaintiff's injury was "particular," but did not determine whether the plaintiff's injury was "concrete." Id. For a plaintiff to have an injury-in-fact, the injury (or threat of injury) must be particular and concrete. Id. at 1548. "For an injury to be 'particularized,' it must affect
the plaintiff in a personal and individual way." Id. An injury in fact must not only be particular, it must also be "concrete." Id.
"A 'concrete' injury must be 'de facto'; that is, it must actually exist. [Citation.] When we have used the adjective 'concrete,' we have meant to convey the usual meaning of the term—'real,' and not 'abstract.' [Citations.] Concreteness, therefore, is quite different from particularization. 'Concrete' is not, however, necessarily synonymous with 'tangible.' Although tangible injuries are perhaps easier to recognize, we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete." Id. at 1548-49.
The plaintiff pleaded intangible injuries of potential harms that could result from inaccurate information being displayed by a credit reporting agency, even if that information portrays the plaintiff in a good light. The Court provided a two part examination to determine whether an intangible injury constitutes an injury in fact.
"In determining whether an intangible harm constitutes injury in fact, both history and the judgment of Congress play important roles. Because the doctrine of standing derives from the case-or-controversy requirement, and because that requirement in turn is grounded in historical practice, it is instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts. [Citation.] In addition, because Congress is well positioned to identify intangible harms that meet minimum Article III requirements, its judgment is also instructive and important. Thus, we said in Lujan that Congress may 'elevat[e] to the status of legally cognizable injuries concrete, de facto
injuries that were previously inadequate in law.' [Citation.] Similarly, Justice Kennedy's concurrence in that case explained that 'Congress has the power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before.' " Id. at 1549.
However, even when an injury is elevated by Congress, bare procedural violations of a statute do not automatically provide plaintiffs with standing to sue to vindicate that right.
"Congress' role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right. For that reason, Robins could not, for example, allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III. [Citation.] This does not mean, however, that the risk of real harm cannot satisfy the requirement of concreteness. [Citation.] For example, the law has long permitted recovery by certain tort victims even if their harms may be difficult to prove or measure. [Citation.] Just as the common law permitted suit in such instances, the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. In other words, a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified." Id.
¶ 19. Statutory Violation Constituting Distinct and Palpable Injury
¶ 20. Since the Supreme Court's ruling in Spokeo, different Circuits of the United States Court of Appeals have adopted seemingly opposing stances when presented with cases brought by plaintiffs claiming a statutory violation and seeking to recover statutory damages. The Seventh
Circuit found in Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 724 (7th Cir. 2016) that a plaintiff seeking to recover under the FCRA for a business printing the expiration date of the plaintiff's credit card number did not have standing to only bring a claim for a bare procedural violation. Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 724 (7th Cir. 2016). The Third Circuit, however, in In re Horizon Healthcare Services, Inc. Data Breach Litigation, 846 F.3d 625 (3d Cir. 2017), found that plaintiffs had standing to seek recovery under the FCRA claiming the defendant exposed the plaintiffs' private medical information and subjected the plaintiffs to increased risk of identity theft due to computers containing unencrypted patient medical history being stolen. In re Horizon Healthcare Services, Inc. Data Breach Litigation, 846 F.3d 625 (3d Cir. 2017). The Third Circuit, in a subsequent case, reaffirmed its ruling in Horizon in Susinno v. Work Out World Inc., 862 F.3d 346 (3d Cir. 2017), a case where the plaintiffs brought suit against Kirkland for failing to truncate all but the last five digits of their credit card numbers. The Third Circuit found that the plaintiffs in Horizon and Kirkland did not allege mere technical statutory violations, and therefore had standing to bring their claims.
¶ 21. In Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 724 (7th Cir. 2016), the Seventh Circuit ruled on whether a plaintiff had standing to bring a claim seeking recovery under the FCRA. Meyers, 843 F.3d at 725. The plaintiff in Meyers was given a receipt by the defendant that failed to truncate the expiration date of the plaintiff's credit card number. Id. As noted above, the FACTA provides that in order to "reduce the amount of potentially misappropriateable information produced in credit and debit card receipts," "[n]o person that accepts credit cards or debit cards for transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. § 1681c(g)(1). The plaintiff filed a putative class
action seeking only statutory damages. Meyers, 843 F.3d at 725. The district court dismissed the plaintiff's case and the Seventh Circuit affirmed, finding the plaintiff lacked standing to bring the claim because the plaintiff did not allege a concrete injury that resulted from the statutory violation.
"That Congress has passed a statute coupled with a private right of action is a good indicator that whatever harm might flow from a violation of that statute would be particular to the plaintiff. Yet the plaintiff still must allege a concrete injury that resulted from the violation in his case. As Spokeo explained, 'Congress' role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.' [Citation.] In other words, Congress' judgment that there should be a legal remedy for the violation of a statute does not mean each statutory violation creates an Article III injury." Id. at 737.
The Seventh Circuit found the plaintiff did not suffer any harm due to the defendant printing the expiration date of the plaintiff's credit card number on his receipt. The Meyers court found that Congress made a finding of fact that failure to truncate a credit card's expiration date on a receipt is not alone sufficient for an injury-in-fact.
"That brings us to the present case. Spokeo compels the conclusion that Meyers' allegations are insufficient to satisfy the injury-in-fact requirement for Article III standing. The allegations demonstrate that Meyers did not suffer any harm because of Nicolet's printing of the expiration date on his receipt. Nor has the violation created any appreciable risk of harm. After all, Meyers discovered the
violation immediately and nobody else ever saw the non-compliant receipt. In these circumstances, it is hard to imagine how the expiration date's presence could have increased the risk that Meyers' identity would be compromised. [Citation.]
Moreover, Congress has specifically declared that failure to truncate a card's expiration date, without more, does not heighten the risk of identity theft. In the Credit and Debit Card Receipt Clarification Act of 2007, Congress made a finding of fact that '[e]xperts in the field agree that proper truncation of the card number, by itself as required by the [FACTA], regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud.' [Citation.] Congress was instead quite concerned with the abuse of FACTA lawsuits, finding that 'the continued appealing and filing of these lawsuits represents a significant burden on the hundreds of companies that have been sued and could well raise prices to consumers without corresponding consumer protection benefit.' [Citation.]" Id. at 727-28.
Because Congress made clear that a bare procedural violation of failing to truncate a credit card's expiration date is not sufficient for a concrete injury, the Meyers court concluded that the plaintiff did not have standing without alleging some harm resulting from the defendant's conduct. The Third Circuit, on the other hand, examined the issue of plaintiff standing under the FCRA where Congress created an express remedy to consumers for procedural violations.
¶ 22. The Third Circuit, in In re Horizon Healthcare Services, Inc. Data Breach Litigation, 846 F.3d 625 (3d Cir. 2017), found that the violation of statutory rights under the FCRA gave rise to a concrete injury. In re Horizon Healthcare Services, Inc. Data Breach Litigation, 846 F.3d 625
(3d Cir. 2017). The plaintiffs in Horizon brought a claim against the defendant after two laptops containing unencrypted information about the plaintiffs were stolen from the defendant. Id. at 630.
"The Complaint does not include any allegation that their identities were stolen as a result of the data breach. Plaintiff Rindner is a citizen and resident of New York. He was a Horizon member but was not initially notified of the data breach. After Rindner contacted Horizon in February 2014, the company confirmed that his personal information was on the stolen computers. The Plaintiffs allege that, '[a]s a result of the Data Breach, a thief or thieves submitted to the [IRS] a fraudulent Income Tax Return for 2013 in Rindner's and his wife's names and stole their 2013 income tax refund.' Rindner eventually did receive the refund, but 'spent time working with the IRS and law enforcement ... to remedy the effects' of the fraud, 'incurred other out-of-pocket expenses to remedy the identity theft[,]' and was 'damaged financially by the related delay in receiving his tax refund.' After that fraudulent tax return, someone also fraudulently attempted to use Rindner's credit card number in an online transaction. Rindner was also 'recently denied retail credit because his social security number has been associated with identity theft.' " Id.
The Third Circuit determined that Congress elevated the unauthorized disclosure of information to an injury a plaintiff could sue to enforce without suffering some other harm. "The Supreme Court has repeatedly affirmed the ability of Congress to 'cast the standing net broadly' and to grant individuals the ability to sue to enforce their statutory rights." Id. at 635.
¶ 23. Congress created a statutory right in the FCRA that granted the plaintiffs standing.
"so long as an injury 'affect[s] the plaintiff in a personal and individual way,' the plaintiff need not 'suffer any particular type of harm to have standing.' [Citation.] Instead, 'the actual or threatened injury required by Art[icle] III may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing,' even absent evidence of actual monetary loss." Id. at 636.
Using the two part analysis the Supreme Court outlined in Spokeo, the Third Circuit found that Congress created an injury in fact by statute and that the injury of invasion of privacy has historically provided individuals with a basis for suit in American courts.
" '[W]hen it comes to laws that protect privacy, a focus on economic loss is misplaced.' [Citation.] Instead, 'the unlawful disclosure of legally protected information' constituted 'a clear de facto injury.' [Citation.] We noted that 'Congress has long provided plaintiffs with the right to seek redress for unauthorized disclosures of information that, in Congress's judgment, ought to remain private.' " Id. at 636.
The Horizon court found that the Supreme Court's ruling in Spokeo made clear that Congress has the power to define injuries and that all but a mere technical violation of a statute will be sufficient to confer standing. "Although it is possible to read the Supreme Court's decision in Spokeo as creating a requirement that a plaintiff show a statutory violation has caused a 'material risk of harm' before he can bring suit, we do not believe that the Court so intended to change the traditional standard for the establishment of standing." Id. at 637. The Third Circuit noted:
"We reaffirm that conclusion today. Spokeo itself does not state that it is redefining the injury-in-fact requirement. Instead, it reemphasizes that Congress 'has the power to define injuries,' [citation,] 'that were previously inadequate in
law.' [Citation.] In the absence of any indication to the contrary, we understand that the Spokeo Court meant to reiterate traditional notions of standing, rather than erect any new barriers that might prevent Congress from identifying new causes of action though they may be based on intangible harms." Id.
Although the Horizon court recognized that Spokeo reaffirmed Congress' power to define injuries, the court also indicated that mere technical violations of a statute may nevertheless not constitute an injury in fact.
"It is nevertheless clear from Spokeo that there are some circumstances where the mere technical violation of a procedural requirement of a statute cannot, in and of itself, constitute an injury in fact. [Citation.] Those limiting circumstances are not defined in Spokeo and we have no occasion to consider them now. In some future case, we may be required to consider the full reach of congressional power to elevate a procedural violation into an injury in fact, but this case does not strain that reach." Id. at 638.
The Horizon plaintiffs did not allege a mere technical violation because they alleged they suffered the very injury the statute was designed to protect against. "Plaintiffs here do not allege a mere technical or procedural violation of FCRA. They allege instead the unauthorized dissemination of their own private information—the very injury that FCRA is intended to prevent." Id. at 640. The plaintiffs' injury was therefore "concrete." Id.
¶ 24. The Third Circuit reaffirmed its holding in Horizon in Susinno v. Work Out World, Inc., 862 F.3d 346 (3d Cir. 2017). The plaintiff in Susinno received an unsolicited call on her cell phone from the defendant and brought suit in the United States District Court for the District of New Jersey. Id. at 348. The Third Circuit found that Congress provided consumers with a
private right of action when they receive a call from an automatic telephone dialing system or an artificial or prerecorded voice. Id. at 349. The court found that the plaintiff suffered a concrete injury and alleged sufficient facts to have standing to bring her claim. Id. at 352.
"We summarize Horizon's rule as follows. When one sues under a statute alleging 'the very injury [the statute] is intended to prevent,' and the injury 'has a close relationship to a harm ... traditionally ... providing a basis for a lawsuit in English or American courts,' a concrete injury has been pleaded. [Citation.] We do not, and need not, conclude that intangible injuries falling short of this standard are never concrete. [Citation.] Rather, we simply observe that all intangible injuries that meet this standard are concrete." Id. at 351.
The Susinno court made clear that its ruling was consistent with Spokeo and that the plaintiff's intangible injury was elevated to an injury in fact by Congress.
"Our opinion today repeats our 'understand[ing] that the Spokeo Court meant to reiterate traditional notions of standing.' [Citation.] And the traditional notion of standing 'requir[es] only that claimant allege some specific, identifiable trifle of injury.' [Citation.] Where a plaintiff's intangible injury has been made legally cognizable through the democratic process, and the injury closely relates to a cause of action traditionally recognized in English and American courts, standing to sue exists. Consistent with this legal standard, we hold that the TCPA provides Susinno with a cause of action, and that her injury satisfies the concreteness requirement for constitutional standing. Accordingly, we will vacate the District Court's order dismissing her case and remand for further proceedings consistent with this opinion." Id. at 352.
¶ 25. The rulings in Meyers, Horizon, and Susinno all indicate that Congress may elevate an injury to be legally actionable and that mere technical violations of a statute may be insufficient to confer standing. The holdings are not at odds because the Meyers plaintiff only alleged a technical violation that Congress made clear was insufficient on its own to provide standing. See supra ¶ 21. However, the statutory violations in Horizon and Susinno were not similarly carved out by Congress, and those statutory violations alone were sufficient because they were the very harms Congress intended to prevent. See supra ¶¶ 22-24. Defendant here argues that plaintiff's claim is merely a technical violation of the FACTA and therefore similar to Meyers.
¶ 26. Mere Technical Statutory Violation and Statutory Damages
¶ 27. Defendant claims that plaintiff does not have standing to bring her claim because she alleged a mere technical violation of the FACTA. Horizon, 846 F.3d at 638. Plaintiff argues that she alleged more than a mere technical violation, claiming Gennock v. Kirkland's, Inc., CV 17-454, 2017 WL 6883933 (W.D. Pa. Nov. 29, 2017), was based on the same facts and the plaintiffs had standing there. Gennock v. Kirkland's, Inc., CV 17-454, 2017 WL 6883933 (W.D. Pa. Nov. 29, 2017). We disagree. The plaintiffs in Gennock made repeated purchases at Kirkland's, and each time the receipt printed at the cash register contained both the first six and last four digits of their credit card numbers. Id. at *1. The plaintiffs similarly brought suit claiming the defendant violated FACTA and that they were injured from increased risk of identity theft. Id. The District Court found that the plaintiffs had standing to bring their claim and that the plaintiffs did not raise a mere technical statutory violation, relying on Horizon and Susinno. Id. at *5.
"Congress explicitly prohibited merchants from printing 'no more than the last five digits of the card number.' The Supreme Court has consistently held that: 'In
statutory construction, we begin with the language of the statute. If the statutory language is unambiguous and the statutory scheme is coherent and consistent ... [t]he inquiry ceases.' [Citation.] The language of the statute is clear." Id. at *6.
The court concluded that "a plaintiff who can cite an explicit violation of FACTA's truncation provision does not need to prove that he suffered or was at an increased risk of suffering actual identity theft in order to demonstrate standing for purposes of bringing suit." Id. In contrast, plaintiff here has not alleged the receipts printed during her transactions printed any information in violation of the FACTA. Plaintiff's argument amounts to a claim that the FACTA was technically violated because the summary journal report was used as a receipt and it contained the first six digits of her credit card number. After the journal report was printed plaintiff put it in a secured place and, accordingly, plaintiff did not suffer an increased risk of identity theft.
¶ 28. In Tierney v. Advocate Health & Hospitals Corp., 13 CV 6237, 2014 WL 5783333 (N.D. Ill. Sept. 4, 2014), the plaintiffs whose possibility of injury was speculative did not have standing to bring a claim under the FCRA while plaintiffs who alleged tangible threats of identity theft were found to have standing. Tierney v. Advocate Health & Hospitals Corp., 13 CV 6237, 2014 WL 5783333, at *2 (N.D. Ill. Sept. 4, 2014), affirmed, 797 F.3d 449 (7th Cir. 2015). The plaintiffs in Tierney brought suit against Advocate Health for violations of the FCRA, alleging four computers containing patient information were stolen from the defendant and that this exposed the plaintiffs to increased risk of identity theft. Id. at *1. The district court found that the plaintiffs who only raised speculative fear of identity theft did not have standing to bring a claim.
"Here, Tierney, Strautins, Robles, and Robinson allege only a speculative fear of harm that someone could have bought and sold their personally identifiable
information and personal health information on the international cyber black market and thereby place them at risk of identity theft, identity fraud, and medical fraud. Without any allegations to support their mere conclusion of imminent harm, they fail to establish standing. [Citation.]" Id. at *2.
However, the court held that two of the plaintiffs had standing because those plaintiffs were not merely speculating that they were at risk of identity theft.
"In contrast, Benkler and Oliver allege that they were injured insofar as each was notified of fraudulent activity—namely, that one or more individuals had attempted to access personal bank accounts and had opened cell phone accounts, respectively. Moreover, Benkler alleges that he has never been a victim of a data breach aside from Defendant's data breach. Oliver also alleges that other than the notification from Defendant regarding its data breach he has not otherwise been informed that his personal information has been compromised. Both Benkler and Oliver allege a causal relationship between their injuries and Defendant's alleged wrongful actions. Finally, Benkler and Olvier 'narrate [ ] a claim that arises under federal law'—the FCRA. [Citation.] The relief that they seek from their alleged injuries is not too attenuated to warrant dismissal for lack of standing." Id.
The two plaintiffs in Tierney did not face a threat of injury that was too attenuated from the defendant's data breach. Rather, the attempts to steal their identities, although not amounting to any actual damages, still constituted an injury in fact. Id.
¶ 29. Gennock and Tierney are instructive for our decision here. In both cases, the plaintiffs faced palpably increased threats to their security. In Tierney, the plaintiffs provided a more tangible presentation of threat due to the attempts to access their bank accounts and steal their
identities, while the Gennock plaintiffs presented a more intangible threat. Nevertheless, the threat the Gennock plaintiffs encountered was real - the plaintiffs found that the receipts they received after their transactions routinely contained the first six digits and last four digits of their credit card numbers. Gennock, CV 17-454, 2017 WL 6883933, at *1. This was not a one off occurrence and the plaintiffs only kept some of the receipts that violated FACTA. This meant a number of receipts containing unauthorized disclosures of information had been printed by the defendant without regard to where those receipts wound up. Congress identified this conduct as harmful in itself.
"[T]he law as written specifically precludes merchants, including Kirkland's, from printing receipts in the manner that it did. It is not the business of this Court to determine whether Kirkland's actions, although indisputably in violation of FACTA's requirements, did not actually provide more personal information than Congress permitted." Id. at *6.
Plaintiff here has not alleged the kind of violation of FACTA that the Gennock plaintiffs alleged. Plaintiff here did not allege that the receipts she received after she made her purchases listed more than the last five digits of her credit card number. She received a summary journal report containing a receipt that was printed by a manager and viewed by a store employee at the exit. Plaintiff has stored the receipt and has not alleged any unauthorized access or attempt to access that information. She does not face the intangible harms that the Gennock plaintiffs faced. Instead, plaintiff has only alleged that defendant technically violated the FACTA by printing a summary journal report that failed to truncate the first six digits of plaintiff's credit card number.
"A violation of one of the FCRA's procedural requirements may result in no harm. For example, even if a consumer reporting agency fails to provide the
required notice to a user of the agency's consumer information, that information regardless may be entirely accurate. In addition, not all inaccuracies cause harm or present any material risk of harm. An example that comes readily to mind is an incorrect zip code. It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm." Spokeo, Inc., 136 S. Ct. at 1550.
Plaintiff has not given any indication defendant displays credit card information in violation of the FACTA on the receipts printed from cash registers.
¶ 30. Plaintiff claims that she does not need to prove actual harm to recover, relying on Kirkpatrick v. Strosberg, 385 Ill. App. 3d 119, 134 (2008). However, Kirkpatrick does not support her contention: "section 10a(a) requires only that a plaintiff prove that he suffered actual damages and does not expressly require the plaintiff to prove the amount of actual damages" Kirkpatrick v. Strosberg, 385 Ill. App. 3d 119, 134 (2008). The language plaintiff herself quoted indicates the plaintiff in Kirkpatrick had to show actual damages, but did not need to show the amount of actual damages. Plaintiff here was not absolved of showing she suffered actual harm to recover statutory damages, she simply did not need to quantify the actual damages to seek the statutory compensation.
¶ 31. Plaintiff claims "The trial court however seemingly equated 'distinct and palpable' to require an actual monetary harm." We disagree. Plaintiff is not required to plead monetary harm, but she is still required to plead that she suffered more than a mere technical violation of a statute. Plaintiff conflates actual damages with actual harm. An actual harm may not have any actual damage. For instance, one may face intangible injury that doesn't result in any economic harm. The FACTA creates a remedy for instances where a party is harmed but faced no damage.
As noted above, the Tierney court found that two plaintiffs had standing even though they did not suffer monetary harm because there was a palpable threat. The other four plaintiffs did not have standing because they could not point to any attempt to steal their identity or signs of fraudulent activity. Tierney, 13 CV 6237, 2014 WL 5783333, at *2. Therefore, one can have an actual injury without suffering any actual damages.
"While at the time the complaint was brought this injury was 'threatened' rather than actual, the lack of immediate, ascertainable damages is not itself a barrier to the grant of declaratory and injunctive relief. Because of the appellees' proximity to the development, there is no question that they allege an injury which is 'distinct and palpable,' rather than a generalized grievance common to all members of the public. Nor is there any question that they allege that the diminution in the value of their homes would be 'fairly traceable' to IHDA's approval of the development." Greer, 122 Ill. 2d at 493-94.
Actual damages may be difficult to prove or may be negligible, and so Congress provided for an award between $100-$1000 for individuals who are harmed by a retailer printing more than the last five digits of their credit card number. See, e.g., Rodmaker v. Johns Holding Co., Inc., 205 Ill. App. 3d 520, 528 (1990). Plaintiff has not alleged that she faces damages that may be difficult to ascertain or quantify, she argues that simply alleging de minimus damages is sufficient to confer standing. As noted above, plaintiff here only raised a mere technical violation of the FACTA without claiming she suffered any harm or increased risk of harm. Therefore, we find that plaintiff does not have standing because she raised only a technical violation of the FACTA and has not pleaded a distinct and palpable injury.
¶ 32. Plaintiff claims that she suffered a distinct and palpable injury, relying on Justice
Thomas' concurring opinion in Spokeo, because Congress created a duty owed to her individually for which she could individually vindicate the violation of that duty. "A plaintiff seeking to vindicate a statutorily created private right need not allege actual harm beyond the invasion of that private right." Spokeo, Inc., 136 S. Ct. at 1553. However, Justice Thomas' concurrence went on to note that the FCRA only creates regulatory duties owed to the public collectively. "The Fair Credit Reporting Act creates a series of regulatory duties. Robins has no standing to sue Spokeo, in his own name, for violations of the duties that Spokeo owes to the public collectively, absent some showing that he has suffered concrete and particular harm." Id. Therefore, Justice Thomas' concurring opinion does not support plaintiff's contention that she has standing here.
¶ 33. For a plaintiff to have standing to bring a claim in Illinois that plaintiff must face "some injury in fact to a legally cognizable interest." Greer, 122 Ill. 2d at 492. The trial court here found plaintiff did not allege that she faced some injury in fact because plaintiff's threatened injury is not distinct and palpable. We find the trial court did not err granting defendant's motion to dismiss for plaintiff's lack of standing. Plaintiff only alleged a mere technical violation of the FACTA, which is insufficient to constitute a distinct and palpable injury. Spokeo, Inc., 136 S. Ct. at 1550. Therefore, the trial court's order granting defendant's motion to dismiss plaintiff's complaint for lack of standing is affirmed.
¶ 34. CONCLUSION
¶ 35. For the foregoing reasons the judgment of the circuit court of Cook County is affirmed.
¶ 36. Affirmed.