RECOMMENDED FOR PUBLICATION Pursuant to Sixth Circuit I.O.P. 32.1(b) File Name: 21a0102p.06
UNITED STATES COURT OF APPEALS FOR THE SIXTH CIRCUIT
┐ DENECE THOMAS, on behalf of herself and all others │ similarly situated, │ Plaintiff-Appellant, > No. 20-3977 │ │ v. │ │ TOMS KING (OHIO), LLC; TOMS KING (OHIO II), │ LLC; TOMS KING SERVICES, LLC; DOES, 1–10, │ inclusive, │ Defendants-Appellees. │ ┘
Appeal from the United States District Court for the Northern District of Ohio at Cleveland. No. 1:19-cv-01419—Christopher A. Boyko, District Judge.
Argued: April 27, 2021
Decided and Filed: May 11, 2021
Before: SUHRHEINRICH, GRIFFIN, and DONALD, Circuit Judges.
_________________
COUNSEL
ARGUED: Chant Yedalian, CHANT & COMPANY, Glendale, California, for Appellant. Gregory W. Guevara, BOSE MCKINNEY & EVANS LLP, Indianapolis, Indiana, for Appellees. ON BRIEF: Chant Yedalian, CHANT & COMPANY, Glendale, California, Brian K. Herrington, CHHABRA GIBBS & HERRINGTON PLLC, Jackson, Mississipp, for Appellant. Gregory W. Guevara, Elizabeth A. Roberge, Philip R. Zimmerly, BOSE MCKINNEY & EVANS LLP, Indianapolis, Indiana, for Appellees. No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 2
OPINION _________________
SUHRHEINRICH, Circuit Judge.
I. INTRODUCTION
After receiving a credit card receipt printed with the first six and last four digits of her credit card, Plaintiff Denece Thomas (Plaintiff) sued Defendants TOMS King (Defendants)1 for violating the “truncation requirement” of the Fair and Accurate Credit Transactions Act of 2003 (FACTA).2 That provision prohibits anyone who accepts credit or debit cards for payment from printing more than the last five digits of a customer’s card number on the receipt, and offers actual and statutory damages. The question before us is whether Defendants’ alleged violation of that statute resulted in harm sufficiently concrete for Article III standing purposes. The district court concluded that it did not and dismissed the case without prejudice for lack of subject matter jurisdiction. Plaintiff appeals that decision.
FACTA reflects Congress’s concern with preventing identity theft, and its belief that truncating card numbers is the most effective means of doing so. But a violation of the truncation requirement does not automatically cause an injury in fact. And the complaint in this case fails to establish that Defendants’ technical violation of the statute caused harm or presented any material risk of harm. We therefore affirm the lower court’s ruling.
1Thomas named TOMS King (Ohio) LLC, TOMS King (Ohio II) LLC, TOMS King Services LLC (collectively, TOMS King), and “Does 1–10.” The TOMS King Defendant filed a Rule 12(b)(1) motion to dismiss for lack of subject matter jurisdiction. For ease of reference, we refer to the TOMS King Defendants simply as Defendants. 2Pub. L. No. 108–159, 117 Stat. 1952 (codified as amended at 15 U.S.C. § 1681c(g)). No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 3
II. BACKGROUND
A. FACTA
First, a bit about the statute at issue. Congress enacted FACTA in 2003 as an amendment to the Fair Credit Reporting Act (FCRA). Pub. L. No. 108–159, 117 Stat. 1952 (2003). One aim of the legislation is “to prevent identity theft.” Id. To this end, § 1681 instructs that “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of sale or transaction.” 15 U.S.C. § 1681c(g)(1). Any person who willfully violates this provision is liable for actual damages or statutory damages ranging from $100 to $1,000. 15 U.S.C. § 1681n(a)(1)(A). Punitive damages as well as attorneys’ fees are also available. Id. § 1681n(a)(2)–(3).
The legislation launched “hundreds of lawsuits” based on receipts printed with expiration dates “even where the account number was properly truncated,” which prompted Congress to amend FACTA in 2008. Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110–241 § 2(a)(4)–(5), 122 Stat. 1565, 1565 (2008) (Clarification Act). Congressional findings also noted that “[n]one of these lawsuits contained an allegation of harm to any consumer’s identity.” Id. After finding that “[e]xperts in the field agree that proper truncation of the card number . . . regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud,” id. § 2(a)(6), Congress eliminated liability for merchants who had mistakenly printed receipts between 2004 and 2008 with expiration dates but otherwise complied with FACTA. Id. sec. 3, § 616(d), 122 Stat. at 1566 (codified at 15 U.S.C. § 1681n(d)). The stated purpose of the amendment is “to ensure that consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits that do not protect consumers but only result in increased cost to business and potentially increased prices to consumers.” Id. § 2(b). No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 4
B. The Complaint
Plaintiff alleges that on June 26, 2017, at an undisclosed TOMS King location, for an undisclosed purchase,3 she received an electronically printed receipt containing the first six and last four digits of her card number. She asserts that all Class Members received noncompliant receipts from Defendants within two years of the suit’s filing date. She therefore claims injury because (1) her situation “is exactly the scenario Congress sought to avoid by passing FACTA,” and (2) Defendants exposed her and the entire Class “to at least an increased and material risk of identity theft and credit and/or debit card fraud.” In other words, according to the complaint, Defendants’ “violation of FACTA’s prohibition against printing excess digits of a card number presents a significant risk of the exact harm that Congress intended to prevent—the display of card information that could be exploited by an identity thief.” And this harm is not made harmless simply because the receipt was not seen by a potential identify thief: “Plaintiff and class members must take additional steps to ensure the safety of his or her identity” like saving the receipt. Furthermore, there is also a risk of harm because merchants often retain receipts, allowing others access to card information. Plaintiff seeks statutory damages, punitive damages, costs, and attorney fees.
C. The District Court’s Ruling
The district court held that Plaintiff lacked standing because she alleged merely a threat of future harm that was not certainly impending. The court reasoned that no injury had yet occurred because (1) both sides acknowledged that the first six digits identify the card issuer only, (2) Plaintiff did not allege that receipt was lost, stolen, or viewed by a third person, (3) Plaintiff merely speculated that Defendants had retained a copy of the receipt or its contents, and (4) Plaintiff had safeguarded her identity by retaining the receipt.
The district court also held that the complaint asserted a mere technical violation of FACTA unaccompanied by factual allegations of any actual material risk of identity theft. court
3TOMS King “owns and operates over 130 BURGER KING(®) restaurants across Illinois, Ohio, North Carolina, Pennsylvania and Virginia.” TOMS King, https://www.tomsking.com/about.html (last visited Apr. 30, 2021). No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 5
found the violation purely technical because FACTA does not prohibit the printing of the issuing institution on a credit card receipt. Thus, because “Defendants’ technical violation of FACTA demonstrates no harm to Plaintiff’s identity,” and her “allegations of hypothetical future injury are insufficiently concrete to confer Article III standing,” the court found that it lacked subject matter jurisdiction. It dismissed the matter without prejudice.
III. STANDARD OF REVIEW
Our review of the district court’s dismissal of Plaintiff’s complaint for lack of subject matter jurisdiction is de novo. Buchholz v. Meyer NJUS Tanick, 946 F.3d 855, 860 (6th Cir. 2020). Because Defendants are raising a facial (as opposed to factual) challenge, which focuses exclusively on the sufficiency of the pleadings, we must accept all allegations as true. Rote v. Zel Custom Mfg. LLC, 816 F.3d 383, 387 (6th Cir. 2016). And, at the pleadings stage, “general factual allegations of injury . . . may suffice.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992). However, that does not mean that we must accept conclusory legal allegations as true. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555–56 (2007). The burden of establishing standing belongs to Plaintiff. Lujan, 504 U.S. at 561.
IV. STANDING PRINCIPLES
We apply well-worn yet enduring standards. To satisfy Article III standing requirements, Plaintiff must show that (1) she suffered an injury in fact, (2) caused by Defendants, that (3) is redressable by a judicial decision. Spokeo v. Robins, 136 S. Ct. 1540, 1547 (2016). Only the first element is at issue in this case. An injury in fact is one that is “real, not abstract, actual, not theoretical, concrete, not amorphous.” Huff v. TeleCheck Servs., Inc., 923 F.3d 458, 462 (6th Cir. 2019) (citing Spokeo, 136 S. Ct. at 1548), cert. denied, 140 S. Ct. 1117 (2020). An injury in fact can be tangible or intangible. Spokeo, 136 S. Ct. at 1549.4
4Tangible injuries are easy to identify, like physical injury or economic loss. See Clinton v. New York, 524 U.S. 417, 432–33 (1998) (economic loss); Debernardis v. IQ Formulations, LLC., 942 F.3d 1076, 1085–86 (11th Cir. 2019) (economic loss). Intangible injuries, such as abridgement of free speech or free exercise, can also be concrete. See, e.g., Pleasant Grove City v. Summum, 555 U.S. 460 (2009) (free speech); Church of Lukumi Babalu Aye, Inc. v. City of Hialeah, 508 U.S. 520 (1993) (free exercise). “[S]ome concrete, intangible injuries may also flow from statutory violations.” Buchholz, 946 F.3d at 862 (citing Spokeo, 136 S. Ct. at 1549). Take for example, the inability to obtain information that Congress has made public. See, e.g., Fed. Election Comm’n v. Akins, No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 6
Congress can give de facto intangible harms statutory status, but that “does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Id. In other words, “Article III standing requires a concrete injury even in the context of a statutory violation.” Thole v. U.S. Bank N.A., 140 S. Ct. 1615, 1620–21 (2020) (quoting Spokeo, 136 S. Ct. at 1549); see also Hagy v. Demers & Adams, 882 F.3d 616, 623 (6th Cir. 2018) (“That’s just what we take Spokeo to mean when it said that ‘Congress cannot erase Article III’s standing requirement.’” (quoting Spokeo, 136 S. Ct. at 1547–48)). The Supreme Court has instructed that the lower courts look to congressional judgment and historical practice for guidance in making that assessment. Spokeo, 136 S. Ct. at 1549.
V. ANALYSIS
Plaintiff claims that she has standing because Congress vested her with the right to have merchants print no more than the last five digits of her credit card printed on a receipt; (2) Defendants’ violation exposed her to an increased risk of identity theft; and (3) the violation also placed a burden on her to safeguard her receipt.
A. Congressional Judgment
We can quickly dispense with Plaintiff’s claim that she has a concrete injury based on a congressional grant of a statutory right and remedy. “After Spokeo, we know there is no such thing as an ‘anything-hurts-so-long-as-Congress-says-it-hurts theory of Article III injury.’” Huff, 923 F.3d at 463 (quoting Hagy, 882 F.3d at 622); see also Frank v. Gaos, 139 S. Ct. 1041, 1046 (2019) (per curiam) (same). In other words, this argument is without merit.
But “the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact . . . [and] a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified.” Spokeo, 136 S. Ct. at 1549; Huff,
524 U.S. 11, 20–25 (1998) (holding that inability to obtain information is an injury in fact); see also Perry v. Cable News Network, Inc., 854 F.3d 1336, 1340–41 (11th Cir. 2017) (holding that a violation of Video Privacy Protection Act, which prohibits wrongful disclosure by a video tape service provider of video tape rental or sale records, would be a concrete injury since it was analogous to the well-established torts of invasion of privacy and intrusion upon seclusion). No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 7
923 F.3d at 464 (“When Congress confers a procedural right to protect a plaintiff’s concrete interests, a violation of that right may establish the requisite injury in fact.”) Plaintiff argues that we should defer to Congress’s judgment that a bare violation of the statute is a concrete injury because it engaged in extensive fact-finding; found that identity theft is rampant; and determined that electronically printed receipts with excess digits provides identity thieves with “easy access” to consumers’ card information. Appellant’s Br. at 9–10 (quoting H. Rep. 108–263, at 25; S. Rep. No. 108–166, at 3). See Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1065 (D.C. Cir. 2019) (quoting S. Rep. No. 108–166, at 3). Further, in the truncation requirement, Congress identified a concrete interest, the risk of identity theft; created measures to combat that harm, requiring merchants to truncate card numbers on receipts; and gave consumers a right to sue for noncompliant receipts. Thus, she claims that she need not allege any harm beyond the violation of the statute.
Those circuits that have weighed in on this issue basically agree that “not every violation of FACTA’s truncation requirement creates a risk of identity theft.” Jeffries, 928 F.3d at 1065; Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917 (11th Cir. 2020) (en banc); Kamal v. J. Crew Grp., Inc., 918 F.3d 102 (3d Cir. 2019); Noble v. Nevada Checker Cab Corp., 726 F. App’x 582 (9th Cir. 2018); Katz v. Donna Karan Co., LLC, 872 F.3d 114 (2d Cir. 2017). The Second, Third, and Eleventh Circuits did so on identical facts to this case—the first six and last four digits of the consumer’s credit card. See Muransky, 979 F.3d at 922, 928–29; Kamal, 918 F.3d at 106; Katz, 872 F.3d at 116. Cf. Noble, 726 F. App’x at 583 (first and last four digits). Although reiterating “not every FACTA violation creates a concrete injury in fact,” the Jeffries court ultimately concluded that the plaintiff had stated a FACTA claim because of the “egregious” facts before it. See Jeffries, 928 F.3d at 1066.
Like the district court, several of these courts reasoned that because (1) the first six digits of a card number reveal nothing more than the card issuer, and (2) FACTA does not prohibit printing the identity of the card issuer on a receipt, there is no automatic concrete harm. In other words, “printing the first six digits—the [issuer identification number]—is the equivalent of printing the name of the issuing institution, information which need not be truncated under No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 8
FACTA.” Katz, 872 F.3d at 1205; Noble, 726 F. App’x at 584 (stating that “the first digit of a credit card number merely identifies the brand of the card, and Congress has not prohibited printing the identity of the credit card issuer along with the last five digits of the credit card number”). Or, as the Eleventh Circuit put it: “Nothing in FACTA suggests some kind of intrinsic worth in a compliant receipt, nor can we see any. So, it makes little sense to suggest that receipt of a noncompliant receipt itself is a concrete injury.” Muransky, 979 F.3d at 929.
Plaintiff contends that this view is flawed because an individual card issuer such as Bank of America or Chase may issue branded cards, such as Mastercard or Visa. Thus, printing the card issuer’s name or the type of card does not necessarily provide the identity thief with the first six digits of a card number.6 Even if she is right, Plaintiff has not advanced the ball because she does not explain how knowledge of the card issuer, the card type, and the first six digits creates or at least enables actual harm or a material risk of harm. In other words, printing the first six digits does not inevitably lead to identity theft or increase the risk of it. Congress has not offered any insight either. “In the absence of an explanation of how a . . . procedural violation constitutes a real injury; we are left with a . . . gap between Congress’s authority and the problem it seeks to resolve.” Huff, 923 F.3d at 466; see also Hagy, 882 F.3d at 622 (“Nowhere in the [Fair Debt Collection Practices] Act (or for that matter the legislative record) does Congress explain why the absence of such a warning always creates an Article III injury.”)
In fact, Congress itself recognized that not every violation of the statute establishes standing. The Third Circuit explained that although the statutory text manifests Congress’s intent to make printing all but the last five digits of a consumer’s card number a redressable injury, the later-in-time Clarification Act, which limited liability for printing the expiration date, “also expresses Congress’s judgment that not all procedural violations of FACTA will amount to
5The Katz court did so on a factual challenge to the complaint. In concluding that printing the first six and last four digits of a credit card number did not cause a cognizable injury, the district court relied on information in a website cited by the defendant explaining that the first six digits of a credit card number are known as the Issuer Identification Number (IIN). 872 F.3d at 118. The Second Circuit affirmed the district court’s finding. Id. at 120. 6Plaintiffalso claims that the first six digits are significant to anti-fraud measures because the credit card industry uses an algorithm to check the validity of a credit card number. Again, though, this fact does not establish that a harm occurred here. No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 9
concrete harm.” Kamal, 918 F.3d at 113. The Muransky majority likewise found the Clarification Act telling because it “offered a subsequent Congress’s view that some technical FACTA violations caused consumers no harm: the statute’s stated ‘purpose’ was to protect ‘consumers suffering from any actual harm’ while also ‘limiting abusive lawsuits’ that would drive up costs to consumers without offering them any actual protection.” Muransky, 979 F.3d at 921 (emphasis added) (citation omitted); see also Jeffries, 928 F.3d at 1065–66 (citing the Clarification Act in support of its assertion that “not every violation of FACTA’s truncation requirement creates a risk of identity theft”); Noble, 726 F. App’x at 584 (deferring to Congress’s expertise that not every violation of the truncation requirement concrete). 7 But see Muransky, 979 F.3d 941 (Wilson, J., dissenting) (noting that the Congress “left the truncation requirement and enforcement mechanism untouched” in the Clarification Act, which meant that it perceived the printing of extra digits caused real harm or the risk of harm (quoting Jeffries, 928 F.3d at 1068 (Rogers, J., concurring in part and in judgment))).
Plaintiff pivots to increased-risk-of-injury as real harm. See Spokeo, 136 S. Ct. at 1549 (“This does not mean, however, that the risk of real harm cannot satisfy the requirement of concreteness.”) Thomas claims that the Jeffries court supports her position, namely that FACTA creates a concrete interest “vest[ing] consumers with an interest in using their credit and debit cards without facing an increased risk of identity theft.” 928 F.3d at 1064. She is partially correct. In agreeing with the plaintiff’s position in that case, the D.C. Circuit reasoned that (1) the truncation requirement “imposes on the merchant the duty not to print ‘more than the last 5 digits of the card number or the expiration date.’” Id. (quoting § 1681c(g)(1)); and (2) “[t]he duty applies at the ‘point of the sale or transaction,’” so “a violation occurs regardless [of] whether a plaintiff ever becomes the victim of any crime,” id. (quoting § 1681c(g)(1)). Thus, “FACTA itself does not prohibit the crimes of identity theft or fraud; its truncation requirement is a procedure designed to decrease the risk that a consumer would have his identity stolen.” Id.
7Noble relied on a prior Ninth Circuit case, Bassett v. ABM Parking Servs., Inc., 883 F.3d 776 (9th Cir. 2018). Bassett relied on the Clarification Act to conclude that the plaintiff did not suffer actual harm because his receipt included the credit card expiration date. Id. at 782. Katz too relied on prior precedent, Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76 (2d Cir. 2017), which held that printing the expiration date did not create actual harm without more, because Congress itself had clarified the point in the Clarification Act. Id. at 81. No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 10
(cleaned up) (citing Muransky v. Godiva Chocolatier, Inc., 922 F.3d 1175, 1188 (11th Cir. 2019), vacated, 979 F.3d 917 (11th Cir. 2020) (en banc)).8
One of the dissenting views in Muransky takes this reasoning several steps further. Judge Wilson found that three aspects of the statute show that Congress intended that “consumers have an interest in avoiding the heightened risk of identity theft in addition to avoiding actual identity theft.” Muransky, 979 F.3d at 939 (Wilson, J., dissenting). First, is FACTA’s damages scheme, which “ha[s] no tie to actual identity theft; the consumer can recover them no matter if he ‘ever becomes the victim of any crime.’” Id. (quoting Jeffries, 928 F.3d at 1064). In other words, the statutory damages remedy addresses “a broader aim: to ‘decrease the risk that a consumer would have his identity stolen.’” Id. (quoting Jeffries, 928 F.3d at 1064). Second, is the “point-of-sale” feature. “The cause of action that Congress created” is complete when the receipt is printed, “well before” any identity theft occurs. Id. at 940. “The point-of-sale trigger thus reveals that Congress sought to protect an immediately harmed interest—the interest in avoiding the heightened risk of identity theft.” Id. (citing Jeffries, 928 F.3d at 1064, 1067 n.3). Third, is the statute of limitations, which “turns on the untruncated receipt alone.” Id. The FACTA limitations period is two years from discovery of the noncompliant receipt but not later than five years from its printing. Id. (citing 15 U.S.C. § 1681p). Thus, “[i]dentity theft plays no role in this sequence—the statute is indifferent to when or whether identity theft occurs.” Id. As Judge Wilson reasoned, “[i]f FACTA’s sole aim were to redress the harm of identity theft, that limitations scheme would make no sense—it operates without regard for when (or even if) identity theft occurs.” Id. That is why “Congress reasonably chose to start the clock the moment the consumer discovers this point-of-sale injury.” Id.
As the Jeffries majority and Judge Wilson point out, the statute’s design reflects Congress’s desire to reduce the risk of identity theft before, or regardless of whether, it ever occurs. But, as the Jeffries’ court itself acknowledged, this reasoning goes only so far: recognizing that “the [truncation] requirement . . . vests consumers with an interest in using their credit and debit cards without facing an increased risk of identity theft,” 928 F.3d at 1064, did
8The Jeffries court found persuasive the panel decision in Muransky. The Muransky panel’s view was vacated by the en banc court. No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 11
not resolve whether that interest “is concrete,” id. (“The question now becomes whether the interest protected by FACTA—avoiding an increased risk of identity theft—is concrete.”). The Jeffries court found that “[h]istory tilt[ed] toward concreteness,” because FACTA’s truncation requirement resembles the common law breach of confidence tort and “g[a]ve weight to Congress’s determination that printing too much credit card information on a receipt creates a ‘real’ or ‘de facto’ harm.” Id. at 1064–65.
But then the Jeffries asked another question: “whether the challenged violation of [the plaintiff’s] statutory right harmed or created a ‘risk of real harm’ to the concrete interests protected by FACTA.” Id. at 1065 (“Our analysis does not stop with the conclusion that FACTA protects a concrete interest.”). That is, the Jeffries court did exactly what Spokeo instructed it to do: perform its constitutional duty to verify that actual harm in the case sub judice occurred. Noting that “not every FACTA violation creates a concrete injury in fact,” the D.C. Circuit found that the alleged violation of the plaintiff’s right did so in that case because the defendant had printed “all of the information” FACTA prohibits at the point of sale—credit card digits and expiration date. Id. at 1066. Thus, the plaintiff’s receipt, which “contain[ed] all sixteen digits of her credit card number, her credit card expiration date[,] and her credit card provider,” id. at 1062, “bore sufficient information for a criminal to defraud her.” id. at 1066. Armed with these additional factual allegations—that the receipt contained all sixteen digits and the expiration date—the D.C. Circuit concluded that:
At the point of sale—the time at which FACTA measures liability—there was no way to know whether [the plaintiff] would recognize [the defendant’s] mistake and mitigate any harm or whether the receipt would end up in the trash for anyone to find or otherwise be accessed by a malevolent third party (e.g., an employee or fellow customer). Accordingly, [the plaintiff] was not able to use her credit card without incurring an increased risk of identity theft and, as a result, suffered a concrete injury in fact. She has pleaded enough facts to establish standing.
Id. The court reiterated that “[b]ecause the receipt contained enough information to defraud [the plaintiff], she suffered an injury in fact at the point of sale.” Id. at 1067. No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 12
The Jeffries court distinguished a case, Kamal, where, like here, the plaintiff alleged harm merely because the credit card printed the first six and last four digits. In Kamal, the Third Circuit found no injury because “the plaintiff failed to allege that ‘the receipt included enough information to likely enable identity theft.’” Id. (quoting Kamal, 918 F.3d at 116). As Jeffries pointed out, the Third Circuit “expressly stated its ‘analysis would be different if, for example, [the plaintiff] had alleged that the receipt included all sixteen digits of his credit card number, making the potential for fraud significantly less conjectural.’” Id. (quoting Kamal, 918 F.3d at 116).
The bottom line is that the Jeffries court did not find an automatic injury in fact based on a purely procedural violation of FACTA; it found standing because the complaint alleged sufficient facts to establish that a violation of the statute actually caused harm or risk of harm.
Plaintiff says that a concrete risk of avoiding identity theft is baked into the statute because “the first 6 and last 4 digits of the card number either alone and/or in conjunction with other information can be used to bolster the credibility of a criminal who is making pretext calls to a card holder or engaging in e-mail phishing scams” to obtain sensitive information. She explains in the complaint that:
[a]ccess to such information not only allows for the misuse of card information but also allows criminals to potentially obtain additional credit cards, obtain loans for vehicles, obtain home mortgages, obtain a passport in the consumer’s name, and other similarly serious fraudulent acts that can cause serious harm to the consumer’s financial and personal life.
But what the complaint does not aver is how the printing of the six first digits and last four digits lead to the aforementioned evils, leaving it up to the court to infer “a highly speculative change of future events.” Kamal, 918 F.3d at 116 (cleaned up). Such conclusory allegations are too speculative to support an actual injury, let alone one that was certainly impending. Cf. Buchholz, 946 F.3d at 865 (holding that the plaintiff’s allegation that he feared litigation and suffered anxiety as result after receiving a debt collector’s letter signed by an attorney was not a future harm that was “certainly impending” because the debt collector’s letter did not threaten to sue, and plaintiff did not allege that he would refuse to pay if sued). More No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 13
importantly, “[n]owhere in the Act . . . does Congress explain” why the printing of more than the last five digits “always creates an Article III injury.” Hagy, 882 F.3d at 622.
To recap: A violation of the statute does not automatically create a concrete injury of increased risk of real harm even if Congress designed it so. And the factual allegations in this complaint do not establish an increased risk of identity theft either because they do not show how, even if Plaintiff’s receipt fell into the wrong hands, criminals would have a gateway to consumers’ personal and financial data. Furthermore, as the district court noted, Plaintiff does not allege that the receipt was lost, stolen, or seen by a third set of eyes, inside or outside of Defendants’ employ.
Notwithstanding, Plaintiff does identify one potentially concrete harm: forcing her to safeguard her receipt, which can be a legitimate injury. See Huff, 923 F.3d at 463 (suggesting that wasted time is an actual injury); Jeffries, 928 F.3d at 1064 n.2. But a “‘hypothetical future harm’ [that] is not ‘certainly impending’” is not a concrete injury, and so Plaintiff’s efforts to protect her identity cannot be either. See Muransky, 979 F.3d at 931 (quoting Clapper v. Amnesty Int’l USA, 568 U.S. 398, 416, 422 (2013)); Buccholz, 946 F.3d at 865 (same). In other words, “[i]f [the] receipt would not offer any advantage to identity thieves, we could hardly say that [Plaintiff] was injured because of the efforts [he] took to keep it out of their hands.” Muransky, 979 F.3d at 931.
B. History
Thomas also invokes historical practice, asserting that a FACTA claim is analogous to two common law torts: breach of confidence and invasion of privacy. As noted, Spokeo said that “it is instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” 136 S. Ct. at 1549. No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 14
1. Breach of Confidence Tort
A common law claim for breach of confidence occurs when a person discloses private information to another person and the receiver of that information reveals it to a third party. Jeffries, 928 F.3d at 1064. “This tort ‘is rooted in the concept that the law should recognize some relationships as confidential to encourage uninhibited discussions between the parties involved.’” Id. (quoting Young v. U.S. Dep’t of Justice, 882 F.2d 633, 640 (2d Cir. 1989)).
Some courts perceive a kinship between FACTA and a breach of confidence tort. The D.C. Circuit in Jeffries concluded that a FACTA violation resembles a common law breach of confidence because the truncation requirement establishes a similar relationship of trust between consumer and merchant by requiring the merchant to safeguard a customer’s card information. Id. at 1064–65. Judge Wilson shares the D.C. Circuit’s view that “history also ‘tilts toward concreteness.’” Muransky, 979 F.3d at 942 (Wilson J. dissenting) (quoting Jeffries, 928 F.3d at 1064). He reasons that the “interest harmed in a breach-of-confidence case is the plaintiff’s ‘general interest in the security of the confidential relationship and his corresponding expectation of secrecy.’” Id. (quoting Alan B. Vickery, Note, Breach of Confidence: An Emerging Tort, 82 Colum. L. Rev. 1426, 1434 (1982)). In his opinion, the “interest harmed in a FACTA case is the same: the consumer expects the business to comply with FACTA and keep his card number confidential.” Id. at 943.
Other courts do not see a resemblance. The Third Circuit in Kamal court rejected the analogy on a claim similar to Thomas’s because there was no allegation of disclosure of the consumer’s information to a third party. 918 F.3d at 114. The Eleventh Circuit en banc majority questioned the breach of tort’s status in English or American courts, see Muransky, 979 F.3d at 931 (noting that the tort’s historical status is debated), but found any analogy lacking in any event for two reasons. First, like the Kamal court, the Muransky majority focused on the absence of disclosure to a third party. Second, a customer and a retail store do not share a confidential relationship, which traditionally arise in the context of close professional relationships, like those with doctors, therapists, and financial institutions. Id. at 932. “Handing a common form of payment to a cashier at a retail store is simply not equivalent to these kinds of vulnerable, confidential relationships.” Id. Thus, to the Eleventh Circuit’s mind, “[b]ecause no information No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 15
was disclosed, and no confidential relationship existed, the relationship between [the merchant’s] conduct and a breach of confidence [was] anything but ‘close.’” Id. We agree with the Third and Eleventh Circuit’s view and reject the analogy to a breach of confidence tort.
Even if we agreed that the truncation requirement shares common features of traditional harms, there is no injury here because the receipt was not disclosed to a third party. In any event, it did not disclose privileged information that increased the risk of harm.
2. Invasion of Privacy
Thomas also invokes the common law tort of invasion of privacy, which recognizes that “an individual has an interest in preventing disclosure of personal information.” Perry, 854 F.3d at 1340–41. Even if this tort has ancient origins, the analogy is flawed for the same reasons just stated above.
C. Comparisons to Other Cases
Other cases involving statutory violations of consumer protection statutes bolster our analysis. In Spokeo, the Supreme Court acknowledged that Congress enacted the FCRA to ensure accurate credit reporting and “curb the dissemination of false information,” and also found that a plaintiff “cannot satisfy the demands of Article III by alleging a bare procedural violation.” 136 S. Ct. at 1545, 1550. Use of an incorrect zip code, for example, would not constitute a concrete harm. Id. at 1550. Fast forward to the case on remand from the Supreme Court with instructions to address concreteness. See id. The Ninth Circuit held that the consumer’s alleged injuries were sufficiently concrete where he alleged that the defendant falsely reported his professional, economic, and personal information, which could cause actual harm to his employment prospects. Robins v. Spokeo, Inc., 867 F.3d 1108, 1117 (9th Cir. 2017).
In Buchholz, the plaintiff felt aggrieved after receiving two letters from a debt collector that gave him the false impression that an attorney had determined he owed the debts, so he sued under the Fair Debt Collection Practices Act (FDCPA). 946 F.3d at 859. Although we agreed “that Congress passed the FDCPA to prevent debt collectors from engaging in abusive debt- collection practices,” we held that the plaintiff had not established that he suffered a harm No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 16
Congress intended to prevent or that had a common law analog because he did not allege that he did not owe the debt. Id. at 870. In Huff, we found no standing because the defendant check verification company’s violation of the FCRA for inaccurately reporting his credit file had no consequence to the consumer, like having a check declined, and therefore did not create an imminent risk of injury. 923 F.3d at 461–65. In Hagy, a letter failing to disclose that it came from a debt collector, which violated the FDCPA, failed to create standing because the letter informed the plaintiff debtors that their debt had been extinguished. 882 F.3d at 618–22. In Lyshe v. Levy, the plaintiff debtor alleged that a debt collection agency violated the FDCPA by failing to provide electronic discovery and requiring that the plaintiff’s responses to requests for admission be sworn and notarized. 854 F.3d 855, 855–57 (6th Cir. 2017). We found no standing because (1) the FDCPA was not designed to prevent parties from having to visit a notary and contact the defendant to obtain electronic copies of discovery, (2) the plaintiff had not alleged that he suffered any harm, and (3) he conceded that he was at no risk to suffer of having to visit a notary and contact the defendants to obtain electronic copies of discovery. Id. at 859.
On the flip side, the plaintiffs in Macy v. GC Services Ltd. Partnership had standing because the debt-collection letter they received neglected to inform them that it was required to provide verification of their debt’s validity only if they contested it in writing, which could have caused them to contest it orally and waive some other FDCPA protections as a result. 897 F.3d 747, 761–68 (6th Cir. 2018). Because Congress sought to curb abusive debt collection practices and tied the writing requirement to protecting concrete economic interests, the defendant’s failure to include the words “in writing” created a material risk of harm. See Huff, 923 F.3d at 468 (discussing Macy).
The final example proves the point best. In Galaria v. Nationwide Mutual Insurance Co., the plaintiff sued under the FCRA after hackers stole their personal information, which included names, dates of birth, marital statuses, employment, Social Security numbers, and driver’s license numbers, from the defendants. 663 F. App’x 385, 386–87 (6th Cir. 2016). The plaintiffs alleged that because of the identity theft, they would have to expend “hundreds of hours” and “hundreds of dollars” to mitigate the increased risk of fraud by imposing credit freezes, modifying financial accounts, reviewing credit reports and bank statements, and purchasing No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 17
mitigation products. Id. at 386–87. We agreed that the alleged theft of the plaintiffs’ personal information constituted “a substantial risk of harm, coupled with reasonably incurred mitigation costs,” because the alleged violation of the statute created a concrete risk that their data would be used for fraudulent purposes. Id. at 388. The comparison highlights what’s missing in this case: an allegation that the information revealed in this case—the first six (and therefore the card issuer and type) and last four digits of Plaintiff’s credit card—created a substantial risk that criminals could parlay that information into actual identity theft.
The bottom line in these cases, as in the one before us now, is that statutory-injury-for- injury’s sake does not satisfy Article III’s injury in fact requirement. By exercising our constitutional duty to make sure a plaintiff has standing, we ensure that Congress does not abuse its constitutional power to define and create by “overrid[ing] [its] constitutional limits.” Hagy, 882 F.3d at 623; see also Huff, 923 F.3d at 462 (confining the judicial branch to resolving concrete disputes limits its power “and checks the power of the legislative branch by prohibiting it from using the Judiciary as an adjunct to its own powers.”).9
VI. CONCLUSION
AFFIRMED.
9There is a groundswell of support for Justice Thomas’s perspective that Article III standing distinguishes between private and public rights. See Spokeo, 136 S. Ct. at 1551–53 (Thomas, J., concurring); see also Frank, 139 S. Ct. at 1046–47 (Thomas, J., dissenting); Buchholz, 946 F.3d at 871–74 (Murphy, J., concurring in part and concurring in the judgment); Huff, 923 F.3d at 469; Muransky, 979 F.3d at 970–85 (Jordan, J., dissenting). With respect to statutes creating private rights—that create duties owed to the plaintiffs as individuals—a bare statutory violation may suffice to establish standing. But with respect to statutes creating public rights—that create duties owed to the community as a whole—a bare statutory violation may not suffice, and the plaintiff must show some individual harm beyond the violation. Huff, 923 F.3d at 469. As in Huff, that perspective was not raised in this case. Id. But “[t]he theory deserves further consideration at some point.” Id.