Brady O'Leary v. TrustedID, Inc.

60 F.4th 240

• Court: Court of Appeals for the Fourth Circuit
• Decided: February 21, 2023
• Docket: 21-2144
• Status: Published

Opinion

USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 1 of 12

PUBLISHED

UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT

No. 21-2144

BRADY O’LEARY, on behalf of himself and all others similarly situated,

Plaintiff − Appellant,

v.

TRUSTEDID, INC.,

Defendant – Appellee.

Appeal from the United States District Court for the District of South Carolina, at Columbia. Sherri A. Lydon, District Judge. (3:20−cv−02702−SAL)

Argued: December 7, 2022 Decided: February 21, 2023

Before AGEE, DIAZ, and QUATTLEBAUM, Circuit Judges.

Vacated and remanded with instructions by published opinion. Judge Diaz wrote the opinion, in which Judge Agee and Judge Quattlebaum joined.

ARGUED: David Andrew Maxfield, DAVE MAXFIELD, ATTORNEY, LLC, Columbia, South Carolina, for Appellant. Ashley Charles Parrish, KING & SPALDING LLP, Washington, D.C., for Appellee. ON BRIEF: Justin T. Holcombe, SKAAR & FEAGLE, LLP, Woodstock, Georgia, for Appellant. Gabriel Krimm, Washington, D.C., Zachary A. McEntyre, Robert D. Griest, KING & SPALDING LLP, Atlanta, Georgia, for Appellee. USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 2 of 12

DIAZ, Circuit Judge:

Brady O’Leary appeals the dismissal of his claim against TrustedID, Inc. under

South Carolina’s Financial Identity Fraud and Identity Theft Protection Act (the “Act”),

S.C. Code Ann. § 37-20-180. The district court held that O’Leary alleged an Article III

injury in fact but failed to state a claim under the Act. O’Leary agrees with the district

court’s decision on standing but appeals its Rule 12(b)(6) dismissal. But we hold that

O’Leary hasn’t alleged an Article III injury, so we vacate and remand with instructions.

I.

A.

O’Leary’s First Amended Class Action Complaint alleges the following.

Nonparty Equifax was subject to a data breach. Equifax then engaged its subsidiary,

TrustedID, to use TrustedID’s website to inform customers whether they were impacted

by the data breach.

O’Leary had no other way to learn whether his data had been compromised, so he

went to TrustedID’s website. The website prompted O’Leary to enter six digits of his

social security number (“SSN”). In exchange for this information, the website informed

O’Leary that he was “not impacted” by Equifax’s data breach. J.A. 28 ¶ 11. TrustedID

didn’t use any other security precautions, such as a password, unique personal

identification number, or another authentication device. O’Leary alleges that TrustedID

shared the six digits of his SSN with Equifax.

2 USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 3 of 12

B.

O’Leary sued TrustedID in state court, alleging that TrustedID’s practice of

requiring six digits of consumers’ SSNs violated the Act and South Carolina’s common-

law right to privacy.

The Act prohibits “requir[ing] a consumer to use his social security number or a

portion of it containing six digits or more to access an Internet web site, unless a password

or unique personal identification number or other authentication device is also required to

access the Internet web site.” S.C. Code Ann. § 37-20-180(A)(4). O’Leary alleges that

TrustedID “could have avoided violating the statute simply by requesting five or fewer

digits” of consumers’ SSNs. J.A. 29 ¶ 20.

TrustedID removed the case to federal court under the Class Action Fairness Act

(“CAFA”). O’Leary then filed an Amended Complaint in the federal district court, re-

asserting the same claims and adding one for negligence. TrustedID moved to dismiss

under Federal Rule of Civil Procedure 12(b)(6).

While TrustedID’s motion was pending, O’Leary filed a Motion to Determine

Subject Matter Jurisdiction Or, in the Alternative, to Remand. O’Leary agreed that the

case satisfied CAFA. But he asked the district court to “inquire before reaching the merits

into whether it has subject matter jurisdiction” under Article III given TransUnion LLC v.

Ramirez, 141 S. Ct. 2190 (2021), which had been recently decided. D. Ct. ECF No. 44 at

2. O’Leary took “no position” on whether he’d suffered an Article III injury. Id.

TrustedID opposed O’Leary’s “puzzling” motion and argued that he had sufficiently

alleged standing. D. Ct. ECF No. 46 at 1. The district court held a hearing.

3 USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 4 of 12

The district court denied O’Leary’s motion, holding that he had alleged Article III

standing. The court noted the unique posture of a plaintiff questioning his own standing,

rather than a defendant raising the issue under Rule 12(b)(1). But the court decided that

O’Leary’s “harm allegations, while perhaps scarce, certainly suggest that Plaintiff is

claiming to have suffered some damage as a result of Defendant’s actions.” J.A. 43.

In its decision, the court recounted both parties’ articulation of O’Leary’s alleged

injury: At the hearing, O’Leary said he was injured when TrustedID “intentionally [took]

personal identifying information and monetiz[ed] it in some way.” Id. And TrustedID

called the alleged injury “an invasion of privacy or ‘intrusion upon seclusion,’ as used in

Ramirez.” J.A. 44. The district court held that O’Leary had alleged “an intangible concrete

harm in the manner of an invasion of privacy,” which the court said was “enough to give

[it] subject-matter jurisdiction at this early stage of the case.” Id.

Nonetheless, the district court granted TrustedID’s motion to dismiss on the merits,

holding that O’Leary had not plausibly stated a claim under the Act or under common-law

principles of privacy or negligence.

On appeal, O’Leary again notes his “concerns as to whether the [statutory] violation

in this case constitutes a concrete injury in fact for Article III standing,” Appellant’s Br. at

2, but he asks us to affirm the district court’s holding on standing anyway. He challenges

only the district court’s dismissal of his claim under the Act, not the dismissal of his

common-law privacy and negligence claims.

4 USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 5 of 12

II.

We hold that O’Leary has alleged only a bare statutory violation and no Article III

injury. So we do not—and cannot—reach the question whether he’s pleaded facts that

state a claim under the Act, though he may presumably pursue that claim in state court.

We begin with some key principles of federal jurisdiction. Article III constrains

federal courts to hear only cases or controversies in which (1) a plaintiff “suffered an injury

in fact that is concrete, particularized, and actual or imminent,” (2) “the injury was likely

caused by the defendant,” and (3) “the injury would likely be redressed by judicial relief.”

TransUnion, 141 S. Ct. at 2203.

This case implicates the first requirement: whether O’Leary suffered a concrete

injury in fact. Without one, he can’t pursue his claim in federal court. Id. at 2200 (“No

concrete harm, no standing.”).

The most obvious concrete injuries are “tangible harms, such as physical harms and

monetary harms.” Id. at 2204. Intangible harms are trickier, but they too can be concrete.

Id. “Chief among them are injuries with a close relationship to harms traditionally

recognized as providing a basis for lawsuits in American courts,” such as “reputational

harms, disclosure of private information, and intrusion upon seclusion.” Id.

The intangible harm of enduring a statutory violation, standing alone, typically

won’t suffice under Article III—unless there’s separate harm (or a materially increased risk

of another harm) associated with the violation. See Spokeo, Inc. v. Robins, 578 U.S. 330,

342 (2016) (no standing based on “bare procedural violation” of the Fair Credit Reporting

Act); see also Baehr v. Creig Northrop Team, PC, 953 F.3d 244, 254 (4th Cir. 2020) (being

5 USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 6 of 12

“deprived of impartial and fair competition between settlement services providers,” in

violation of the Real Estate Settlement Procedures Act, isn’t a concrete injury when it

didn’t increase plaintiffs’ costs); Dreher v. Experian Info. Sols., Inc., 856 F.3d 337, 347

(4th Cir. 2017) (alleged informational injury from the violation of a Fair Credit Reporting

Act provision wasn’t a concrete injury when the plaintiff didn’t allege how the violation

adversely affected him). In other words, “under Article III, an injury in law is not an injury

in fact.” TransUnion, 141 S. Ct. at 2205. 1

There don’t appear to be cases interpreting the South Carolina Act under an Article

III framework. But several analogous contexts provide guidance, and we discuss them

below.

Cases involving the Fair and Accurate Credit Transactions Act (“FACTA”), 15

U.S.C. § 1681 et seq., show that a FACTA digit-truncation violation isn’t a concrete injury

unless it creates a nonspeculative risk of identity theft.

“FACTA forbids merchants from printing more than the last five digits of the

[credit] card number (or the card’s expiration date) on receipts offered to customers.”

Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917, 921 (11th Cir. 2020) (en banc). In

1 TransUnion, Spokeo, and the other key standing cases dealt with federal statutes, so their separation-of-powers concerns aren’t implicated in this case. But the district court assumed that the same principles (i.e., that a mere statutory violation typically won’t suffice as an Article III injury) apply whether the alleged statutory violation is under federal or state law. J.A. 42 n.6. We think the district court must be right. It would be an anomaly if a state legislature could grant plaintiff the keys to federal court based on a mere statutory violation when Congress can’t.

6 USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 7 of 12

Muransky, the plaintiff received “a receipt containing the first six and last four digits of his

sixteen-digit credit card number—too many digits under FACTA.” Id. at 922. The en banc

Eleventh Circuit held that receiving the receipt wasn’t itself a concrete injury under Article

III, and the plaintiff didn’t “plausibly allege a material risk . . . or anything approaching a

realistic danger” of identity theft. Id. at 933. Even though Congress drew the line at five

unredacted digits, the court reasoned, federal courts must still independently determine

whether the plaintiff alleging a FACTA violation suffered a concrete injury. Id. at 933–

34.

The D.C. Circuit appears to be the only Court of Appeals to find Article III standing

based on a FACTA violation, in a case in which the plaintiff received a receipt that exposed

the entire credit-card number and expiration date—that is, “sufficient information for a

criminal to defraud her.” Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1066 (D.C.

Cir. 2019). Given this “egregious” FACTA violation, the plaintiff’s increased risk of

identity theft wasn’t speculative or conjectural, the court reasoned. Id. So her injury

sufficed under Article III.

Also illustrative are our data-breach precedents. As in the FACTA cases, we’ve

held that being subjected to a data breach isn’t in and of itself sufficient to establish Article

III standing without a nonspeculative, increased risk of identity theft.

In Beck v. McDonald, we held that plaintiffs whose personal information was

compromised in a data breach hadn’t shown an Article III injury based on an alleged

“increased risk of future identity theft and the cost of measures to protect against it.” 848

7 USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 8 of 12

F.3d 262, 267 (4th Cir. 2017). The plaintiffs’ alleged increased risk was only speculative,

and even though a laptop and reports with their personal information had been stolen, “the

mere theft of these items, without more, cannot confer Article III standing.” Id. at 275.

In contrast, the plaintiffs in Hutton v. National Board of Examiners in Optometry,

Inc., were, in fact, victims of identity theft traceable to the defendant’s data breach. 892

F.3d 613, 621–22 (4th Cir. 2018). Unlike the Beck plaintiffs, who relied on “a mere

compromise of personal information,” the Hutton plaintiffs suffered identity theft and

credit-card fraud such that there was “no need to speculate on whether substantial harm

will befall” them—it already had. Id. at 621–22. So those plaintiffs had standing.

C.

The parties also point us to one more relevant authority: Ruiz v. Gap, Inc., 380 F.

App’x 689 (9th Cir. 2010). Ruiz involved a California statute that prohibited requiring “an

individual to use his or her social security number to access an Internet Web site, unless a

password or unique personal identification number or other authentication device is also

required to access the Internet Web site.” Id. at 693 (quoting Cal. Civ. Code

§ 1798.85(a)(4) (2006)).

The plaintiff there alleged that he had to use his (full) SSN to fill out a job

application for the defendants, in violation of the statute. Id. He also submitted an expert

affidavit explaining how the disclosure of his SSN increased his risk of identity theft. Id.

at 691. On that record, the district court found that the plaintiff’s increased risk of identity

theft was “real, and not merely speculative,” constituting an Article III injury. Id. at 691.

The Ninth Circuit affirmed in an unpublished opinion.

8 USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 9 of 12

III.

Applying the principles just discussed, we hold that O’Leary hasn’t alleged an

Article III injury in fact. It’s true that “general factual allegations of injury resulting from

the defendant’s conduct” can suffice at the pleading stage. Beck, 848 F.3d at 270 (quoting

Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992)). But even given that low bar and

taking all plausible factual inferences in O’Leary’s favor, his complaint doesn’t allege an

injury that suffices under Article III.

As the cases above show, Article III excludes plaintiffs who rely on an abstract

statutory privacy injury unless it came with a nonspeculative increased risk of identity theft.

And unlike in Ruiz, Beck, and the FACTA cases, O’Leary hasn’t alleged—even in a

speculative or conclusory fashion—that entering six digits of his SSN on TrustedID’s

website has somehow raised his risk of identity theft.

Simply put, O’Leary can’t connect the alleged statutory violation to an increased

risk of identity theft without a Rube Goldberg-type chain reaction. For example, crediting

his allegation “on information and belief” that TrustedID shared his six SSN digits with

Equifax, J.A. 29 ¶ 17, there would have to be another Equifax data breach, that breach

would have to compromise O’Leary’s partial SSN, and an identity thief would then have

to misappropriate that information to harm O’Leary (presumably by first figuring out the

rest of his SSN). That’s the kind of daisy chain of speculation that can’t pass muster under

Article III. See Clapper v. Amnesty Int’l USA, 568 U.S. 398, 410–11 (2018); Beck, 848

F.3d at 274–75.

9 USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 10 of 12

O’Leary’s position that it would’ve been fine for TrustedID to require five digits of

his SSN—but not six—is telling. He’s failed to explain how entering six digits increased

his risk of identity theft (or otherwise concretely injured him) in a way that five digits

wouldn’t. This omission betrays the fact that O’Leary relies entirely on a mere procedural

violation of a statute, which Article III rejects. See Spokeo, 578 U.S. at 342.

Nor has O’Leary alleged an injury with a “close relationship” to a traditional or

common-law analog. TransUnion, 141 S. Ct. at 2204. The parties point generally to

O’Leary’s “privacy interest in his Social Security number.” Appellee’s Br. at 8. But the

cases they cite suggest that SSN privacy is important to stave off identity theft—of which

O’Leary doesn’t allege an increased risk. See, e.g., Ostergren v. Cuccinelli, 615 F.3d 263,

279–80 (4th Cir. 2010) (suggesting, in First Amendment challenge to statute, that states

likely have a compelling interest in prohibiting disclosure of SSNs because of the risk of

identity theft); Sherman v. U.S. Dept. of Army, 244 F.3d 357, 365–66 (5th Cir. 2001)

(noting that disclosure of SSNs can be appropriate, especially to avoid fraud, but

individuals also have an interest in keeping them private to avoid identity theft).

Since O’Leary hasn’t pleaded a nonspeculative connection between the alleged

statutory violation and identity theft, he appears to rely on some abstract privacy interest

in his SSN itself. But such an injury bears no close relationship to a traditional or common-

law analog.

10 USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 11 of 12

First, O’Leary hasn’t alleged an injury with a close relationship to “intrusion upon

seclusion,” 2 as TrustedID suggested in the district court. True, TransUnion mentions

intrusion upon seclusion as a traditionally recognized harm that provides a basis for

lawsuits in federal court. 141 S. Ct. at 2204. The case TransUnion cites as an example

was then-Judge Barrett’s holding in Gadelhak that receiving unwanted text messages

(which violated the Telephone Consumer Protection Act of 1991) could be a concrete

injury in fact, as it closely relates to intrusion upon seclusion. 950 F.3d at 462.

We too have recognized that violations involving unwanted calls under the

Telephone Consumer Protection Act are concrete injuries in fact, based on federal courts’

traditional protection of “privacy interests in the home.” Krakauer v. Dish Network, L.L.C.,

925 F.3d 643, 653 (4th Cir. 2019). But the injury O’Leary alleges doesn’t bear a close

relationship to this traditional harm.

O’Leary pleaded that he chose to hand over his partial SSN “[i]n exchange for”

finding out whether he was impacted by Equifax’s data breach. J.A. 28 ¶ 11. It’s the

unwanted intrusion into the home that marks intrusion upon seclusion, and O’Leary hasn’t

pleaded anything that closely relates to that.

Second, TransUnion recognizes that the “disclosure of private information” can be

another traditional analog for intangible harms that confer standing. 141 S. Ct. at 2204

(citing Davis v. FEC, 554 U.S. 724, 733 (2008)). Neither party has argued that this applies

2 Intrusion upon seclusion is a common-law cause of action “against defendants who invade[] the private solitude of another.” Gadelhak v. AT&T Servs., Inc., 950 F.3d 458, 462 (7th Cir. 2020) (quoting Restatement (Second) of Torts § 652B (Am. Law Ins. 1977)).

11 USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 12 of 12

to O’Leary, though. And “[t]he party invoking federal jurisdiction bears the burden of

establishing” standing. Lujan, 504 U.S. at 561.

The parties’ silence on this theory is likely for good reason. Davis held that a self-

financed political candidate had standing to challenge a statute that would require him to

disclose to the government when he spent more than $350,000 in personal funds on his

campaign, which implicated the candidate’s privacy of association guaranteed by the First

Amendment. 554 U.S. at 733, 744. Here, nothing implicates O’Leary’s associational

rights. And he (voluntarily) disclosed his partial SSN to TrustedID, not to the government.

At bottom, O’Leary hasn’t adequately pled that he was injured by the alleged

statutory violation at all—much less in a way that closely relates to a traditional analog for

a federal lawsuit.

IV.

It’s certainly odd that TrustedID failed to comply with the five-digit SSN cutoff,

which doesn’t appear to be unique to South Carolina’s Act. But federal courts can’t

entertain a case without a concrete injury in fact. We therefore vacate the district court’s

judgment and remand with instructions to remand this case to state court, where it

originated. See Dixon v. Coburg Dairy, Inc., 369 F.3d 811, 815–16 (4th Cir. 2004) (en

banc). We offer no opinion about whether the alleged facts state a claim under the Act.

Absent Article III jurisdiction, that’s a question for O’Leary to take up in state court.

VACATED AND REMANDED WITH INSTRUCTIONS