The U.S. Court of Appeals for the Third Circuit added its voice to the chorus of circuit courts of appeal that have held that alleged procedural violations of the Fair and Accurate Credit Transactions Act (FACTA), such as the inclusion of a credit card’s full expiration date or a few additional digits from the card on a receipt, were, on their own, insufficient to satisfy the concrete injury requirement necessary for Article III standing. Other than the Eleventh Circuit, every circuit court to have confronted similar factual allegations in FACTA cases has found that they fail to establish standing.
The FACTA was a 2003 amendment to the Fair Credit Reporting Act (FCRA) and provides that “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last five digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.” Willful noncompliance with FACTA entitles consumers to “any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000.”
Following the enactment of FACTA, Congress passed the Credit and Debit Card Receipt Clarification Act in 2008 because many merchants erroneously believed that FACTA only required credit card truncation, resulting in “hundreds of lawsuits” alleging willful failure to remove the expiration date but no actual harm. The clarification act provided a safe harbor for merchants who printed expiration dates on receipts between 2004 and 2008 but otherwise complied with FACTA during that period.
In 2014, Ahmed Kamal visited three J. Crew retail stores and made purchases with his credit card at each of the stores. After each purchase, Kamal received a receipt which displayed the first six digits of his credit card number as well as the last four digits. Other than the cashier, no one saw his receipts. Kamal filed a putative class action, alleging that J. Crew had willfully violated FACTA by including the first six digits of his credit card number on his receipts.
In his complaint, Kamal alleged that he had suffered two harms from the FACTA violation: the printing of the prohibited information itself and the increased risk of identity theft caused by such printing. The district court dismissed the complaint with prejudice, finding that the printing of the information on the receipt was not itself a concrete injury. In addition, the district court stated that it could not “reasonably infer that printing the first six and last four digits of [Kamal’s] credit card materially increased the risk of future harm.” In doing so, it examined the intervening events that would have had to occur for Kamal’s identity to be stolen and found this chain of future events too speculative to constitute a concrete injury.
The Third Circuit affirmed the district court’s dismissal (but without prejudice), finding that Kamal had failed to allege facts demonstrating a concrete injury in Kamal v. J. Crew Group (March 8, 2019).
Citing Spokeo v. Robins (2016), the Third Circuit explained that “Article III standing requires a concrete injury even in the context of a statutory violation” and to determine whether an intangible injury constituted an injury in fact, courts needed to look at the “judgment of Congress” and at history. Because Congress was “well positioned to identify intangible harms that meet minimum Article III requirements,” its judgment was “instructive and important.” The historical inquiry examined “whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” However, “Congress cannot statutorily manufacture Article III standing in the case of a ‘bare procedural violation, divorced from any concrete harm.’”
The Third Circuit examined its prior standing decisions in other statutory violation cases and noted that in each case, it found standing because the alleged violation represented the “very harm that Congress sought to prevent.” In In re Horizon Healthcare Services Inc. Data Breach Litigation, the alleged unauthorized dissemination of personal information was the “very injury the FRCA was intended to prevent.” InSusinno v. Work Out World the nuisance and invasion of privacy from a prerecorded commercial call in violation of the Telephone Consumer Protection Act was just harm that Congress had elevated to a “legally cognizable injury.” While, in St. Pierre v. Retrieval-Masters Creditors Bureau, the unauthorized disclosure of a debtor account number and the invasion of privacy was a “core concern [of Congress in] animating the [Fair Debt Collection Practices Act].” Finally, in Long v. Southeastern Pennsylvania Transportation Authority, the taking of an adverse employment action without providing the required consumer report to the plaintiff in violation of FRCA was “the very harm that Congress sought to prevent.”
Turning to Kamal’s allegations of harm, the Third Circuit held that neither Congressional intent nor history supported the conclusion that a FACTA violation by itself met Article III’s standing requirements. The court found that, in enacting the clarification act, “Congress’s action to limiting FACTA liability to those claims implicating actual harm accords with [its] understanding of Article III.” In addition, the Third Circuit found that “Kamal’s injury does not have the requisite ‘close relationship’ with [privacy and breach of confidence] actions because he does not allege disclosure of his information to a third party.”
The Third Circuit noted that its decision was consistent with decisions from the Second, Seventh and Ninth Circuits. In Katz v. The Donna Karan, the Second Circuit held plaintiffs who alleged that they received receipts with the first six digits of their credit card number along with the final four digits in violation of FACTA did not have standing because they had not alleged a concrete injury. Similarly, in Meyers v. Nicolet Restaurant of De Pere and Bassett v. ABM Parking Services, the Seventh and Ninth Circuits held that plaintiffs who alleged that they received receipts with their credit card expiration dates in violation of FACTA had no standing because they had failed to establish an injury in fact.
The Third Circuit acknowledged Muransky v. Godiva Chocolatier, the only decision where a circuit court has found standing based solely on a FACTA violation, but distinguished Muransky from the present case. In Muransky, the Eleventh Circuit held that printing the first six digits of a credit card number on a receipt “create[d] a concrete injury” because the alleged FACTA violation was similar to a common law breach of confidence action. The Third Circuit declined to adopt the reasoning of the Eleventh Circuit, concluding that an improperly truncated credit card on a receipt was not analogous to a common law breach of confidence absent a third-party disclosure.
Kamal further reinforces the limitations on Article III standing imposed by Spokeo in statutory violation cases and gives defendants in FACTA cases additional ammunition to challenge complaints that are premised solely on a procedural violation of the statute without allegations of actual injury. Joining with the Second, Seventh and Ninth Circuits, Kamal narrows standing to bring cases based solely upon technical violations of FACTA. The Eleventh Circuit is the only outlier to the general trend that a FACTA violation without any actual harm is insufficient to establish standing. Therefore, unless they can allege “potential real-world harm” caused by a procedural FACTA violation, plaintiffs in the Second, Third, Seventh and Ninth Circuits will find it much more difficult to survive a motion to dismiss based on lack of standing.