Dr. David S. Muransky v. Godiva Chocolatier, Inc.

• Court: Court of Appeals for the Eleventh Circuit
• Decided: October 28, 2020
• Docket: 16-16486
• Status: Published

Opinion

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 1 of 148

[PUBLISH]

IN THE UNITED STATES COURT OF APPEALS

FOR THE ELEVENTH CIRCUIT ________________________

No. 16-16486 & 16-16783 ________________________

D.C. Docket No. 0:15-cv-60716-WPD

DR. DAVID S. MURANSKY, individually and on behalf of all others similarly situated,

Plaintiff - Appellee,

JAMES H. PRICE, ERIC ALAN ISAACSON, Interested Parties - Appellants

versus

GODIVA CHOCOLATIER, INC., a New Jersey corporation,

Defendant - Appellee. ________________________

Appeals from the United States District Court for the Southern District of Florida ________________________

(October 28, 2020) USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 2 of 148

Before WILLIAM PRYOR, Chief Judge, WILSON, MARTIN, JORDAN, NEWSOM, BRANCH, GRANT, LUCK, LAGOA, ED CARNES,* Circuit Judges.**

GRANT, Circuit Judge, delivered the opinion of the Court, in which WILLIAM PRYOR, Chief Judge, NEWSOM, BRANCH, LUCK, LAGOA, and ED CARNES, Circuit Judges, joined.

GRANT, Circuit Judge: In Spokeo, Inc. v. Robins, the Supreme Court took on a standing question

that had bedeviled litigants, scholars, and lower courts—whether pleading that a statutory requirement was violated is enough to establish standing, even if the plaintiff suffered no injury from the alleged violation. The answer was a resounding no: a party does not have standing to sue when it pleads only the bare violation of a statute. That holding left the class action litigants here in an awkward spot. Years

ago, the named plaintiff pleaded this case as a pure statutory violation. He alleged that Godiva chocolate stores had printed too many credit card digits on hundreds of thousands of receipts over the course of several years, and pointed out that those extra numbers were prohibited under a federal law aimed at preventing identity theft. His complaint disclaimed any recovery for actual damages, and why not— with per-violation statutory damages of up to $1,000, the potential class recovery

* We heard this case en banc while Judge Ed Carnes was an active judge, and he elected to continue to participate in the decision of this case after becoming a senior circuit judge. See Eleventh Circuit Rule 35-9 (“Senior circuit judges of the Eleventh Circuit . . . may continue to participate in the decision of a case that was heard or reheard by the court en banc at a time when such judge was in regular active service.”); see also Gogel v. Kia Motors Mfg. of Ga., Inc., 967 F.3d 1121, 1125 n.** (11th Cir. 2020) (en banc). ** Judge Rosenbaum and Judge Jill Pryor are recused. Judge Andrew Brasher joined the Court on June 30, 2020, and did not participate in this decision. 2 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 3 of 148

was staggering even if no one actually suffered any harm. Godiva, it seems, also found the potential damages staggering, and the parties agreed on a class

settlement not too long after the lawsuit was filed. So why are the litigants in an awkward spot? As they admitted in the district court, Spokeo was on the horizon during settlement talks, but had not yet been

decided; it formed an ominous backdrop for their negotiations. Both parties had an interest in settling before that case was decided, because the Supreme Court’s decision was likely to shift the bargaining calculus dramatically. So they settled. And having reached a deal in the shadow of Spokeo, neither side was ready to start all over after it was decided. Together, they pushed through the class fairness hearing, and landed here for a fairness review after a few class members objected

to the settlement. But even if the parties wish to bargain around Spokeo, we cannot indulge them. Federal courts retain our constitutional duty to evaluate whether a plaintiff has pleaded a concrete injury—even where Congress has said that a party may sue over a statutory violation. Having shut his eyes and closed his ears to the requirements of Spokeo while his claims were still at the district court, the named plaintiff now tries to say that those claims surely show concrete injury under Spokeo in any event. He has done his best to argue that the statutory violation he alleged carries with it both harm and risk of harm—and does so every time. But the emperor still has no clothes; the bare procedural violation the plaintiff alleges is just as bare as it ever was. Because the plaintiff alleged only a statutory violation, and not a concrete injury, he has no standing. That means we cannot evaluate the 3 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 4 of 148

fairness of the parties’ settlement, and we vacate the district court’s order approving it.

I. A. Before turning to why alleging the violation of a statute is not enough to

establish standing, we should say a few words about the statute at issue here. The Fair and Accurate Credit Transactions Act sets out a wide range of protections and procedures. Pub. L. No. 108-159, 117 Stat. 1952 (2003). One of the (many) stated goals of the legislation is “to prevent identity theft.” Id. In support of that goal, FACTA forbids merchants from printing more than the last five digits of the card number (or the card’s expiration date) on receipts offered to customers. Id. sec.

113, § 605(g), 117 Stat. at 1959 (codified at 15 U.S.C. § 1681c(g)(1)). A willful violation exposes a company to liability for actual damages—if any were sustained—or statutory damages ranging from $100 to $1,000 per violation. 15 U.S.C. § 1681n(a)(1)(A). Punitive damages and attorney’s fees are also available. Id. § 1681n(a)(2)–(3). Several years after the passage of FACTA, in response to “hundreds” of lawsuits seeking damages because credit card expiration dates had been printed on receipts—lawsuits that otherwise contained no “allegation of harm to any consumer’s identity”—Congress enacted what’s known as the Clarification Act. Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241 § 2(a)(4)–(5), 122 Stat. 1565, 1565 (2008). That law retroactively eliminated liability for merchants who had printed credit card expiration dates on receipts but 4 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 5 of 148

complied with the other receipt-printing limitations. Id. sec. 3, § 616(d), 122 Stat. at 1566 (codified at 15 U.S.C. § 1681n(d)). The Clarification Act offered a

subsequent Congress’s view that some technical FACTA violations caused consumers no harm: the statute’s stated “purpose” was to protect “consumers suffering from any actual harm” while also “limiting abusive lawsuits” that would

drive up costs to consumers without offering them any actual protection. Id. § 2(b), 122 Stat. at 1566. B. With that background, we return to the allegations in front of us. Dr. David Muransky used his credit card to spend $19.26 at a Godiva retail store in Florida. He was handed a receipt containing the first six and last four digits of his sixteen-

digit credit card number—too many digits under FACTA. Muransky got busy, filing a class action complaint against Godiva less than a week later. He alleged that Godiva had willfully printed more digits than the law allowed and that the excess digits were a national problem for the company. Muransky’s complaint made clear that the alleged FACTA violations were “statutory in nature” and that the suit was expressly “not intended to request any recovery for personal injury.” He alleged the class’s harm, and risk of harm, from those statutory violations in broad terms: “Plaintiff and the members of the class have all suffered irreparable harm as a result of the Defendant’s unlawful and wrongful conduct,” and “Plaintiff and members of the class continue to be exposed to an elevated risk of identity theft.” No additional details were offered.

5 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 6 of 148

The class of injured persons that Muransky proposed consisted of anyone in the United States who, in the two preceding years, received a point-of-sale receipt

from Godiva that displayed more than the last five digits of their credit or debit card number. He sought statutory damages, punitive damages, and costs—as well as attorney’s fees. Because of the size of the putative class, Godiva faced a

startling liability of more than $342 million. After a few motions to dismiss were rejected, Godiva’s answer to the complaint included a standing argument: “Neither Dr. Muransky nor any member of the proposed class has suffered any injury in fact. They therefore lack standing to prosecute their alleged claims.” Given the dramatic size of the potential damages, it is no surprise that the

parties soon began settlement negotiations. They tried to move quickly—both Muransky and Godiva admit that one of the driving forces in those negotiations was the Supreme Court’s impending decision in Spokeo, Inc. v. Robins, 136 S. Ct.

1540 (2016). As Muransky later told the trial court, “the class faced considerable uncertainty with regard to the Supreme Court’s anticipated decision in Spokeo, Inc. v. Robins which, depending on the outcome, could have resulted in the case’s

dismissal for failure to present an injury in fact.” Godiva’s briefing acknowledged the same—the potential outcome of Spokeo factored heavily into the settlement negotiations. The flush of negotiations led to an agreement in principle to settle the case: Godiva would pay $6.3 million instead of the $342 million initially sought. Almost a third of the pot, $2.1 million, would go to the class attorneys, with an 6 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 7 of 148

additional $10,000 going to Muransky “for his service as Class Representative.” The average class member, according to Muransky, would net about $60 when all

was said and done. With Spokeo still outstanding, the district court certified the class, granted preliminary approval of the settlement, and directed notice to the class members.

Four class members filed various objections after they heard about the suit— including Appellants James Price and Eric Isaacson—though none of the objectors initially argued that Muransky lacked standing. But by the time the district court held a fairness hearing on the proposed settlement, things had changed: the Supreme Court had issued its decision in Spokeo. Objector Isaacson took notice, and argued to the district court that it had

an obligation to examine whether Muransky’s claim satisfied the requirements of Article III standing as described in Spokeo. Muransky, he said, bore the burden of establishing the elements of standing as the party invoking federal jurisdiction— and in the absence of standing, the district court “would have no choice” but to dismiss the case. Neither Godiva nor Muransky offered anything in response. Roughly a week later, the district court—without addressing Spokeo or Article III standing—approved the class settlement. The court instead offered a general conclusion that it had “jurisdiction over the subject matter of this litigation,” before going on to approve the settlement. Isaacson and Price appealed. Objector Price raised the same issues he raised below—the contents of the class notice, the attorney’s fee award, and the incentive award to Muransky. 7 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 8 of 148

Objector Isaacson, in addition to several other objections, offered the one we face here today: that the court lacked Article III jurisdiction to approve the settlement

because Muransky had not suffered an injury in fact. A panel of our Court disagreed, affirming the settlement’s approval after concluding that Muransky had satisfied the requirements of Article III—even

considering Spokeo. A few months later, the panel vacated its first opinion and issued a new one in its place. Although the superseding opinion contained a revised standing analysis, it reached the same conclusions as the first: Muransky had Article III standing, the objections failed on the merits, and the class settlement was properly approved. The panel’s new standing analysis resulted in a categorical rule: “if Congress

adopts procedures designed to minimize the risk of harm to a concrete interest, then a violation of that procedure that causes even a marginal increase in the risk of harm to the interest is sufficient to constitute a concrete injury.” Muransky v. Godiva Chocolatier, Inc., 922 F.3d 1175, 1188 (11th Cir.), reh’g en banc granted, opinion vacated, 939 F.3d 1278 (11th Cir. 2019). The level of risk required was alternatively described as “no more than an identifiable trifle.” Id. at 1186 (quotation marks and citation omitted). So in the panel’s view, by setting out a statutory requirement for the number of digits on a receipt, Congress had judged that any violation of that requirement would increase the consumer’s risk of identity theft—and this Court was bound to accept that congressional assessment of injury. See id. at 1188.

8 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 9 of 148

In response, the full Court ordered rehearing en banc and vacated the panel opinion. In a testament to the complications of this case, the four parties offer

different perspectives on Muransky’s Article III standing. Objector Isaacson maintains that Muransky lacks standing because he was not injured and says this case should be dismissed. Muransky and Objector Price both argue that Muransky

has standing (though they disagree about the merits of the settlement approval). For its part, Godiva declines to offer the Court any perspective at all, claiming that it is “prevented from answering this question” by the settlement agreement. II. Whether the plaintiffs have standing to sue is a threshold jurisdictional question that we review de novo. Debernardis v. IQ Formulations, LLC, 942 F.3d

1076, 1083 (11th Cir. 2019). III. At the heart of this case is one question: whether the judiciary must assume that whenever Congress creates a legal entitlement, any violation of that entitlement causes a concrete injury. Although courts “sometimes make standing law more complicated than it needs to be,” a well-trod path leads us to the answer here. Thole v. U.S. Bank N.A., 140 S. Ct. 1615, 1622 (2020). The Supreme Court “has rejected the argument that ‘a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.’” Id. at 1620 (quoting Spokeo, 136 S. Ct. at 1549). And that rejection is derived from the now-familiar admonition that alleging a “bare procedural violation, divorced from any concrete 9 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 10 of 148

harm” is not enough to support standing. Spokeo, 136 S. Ct. at 1549. So, even considering the welter of standing doctrines that can clutter our analysis, we know

one thing to be true—alleging a statutory violation is not enough to show injury in fact. Why not? Article III of the Constitution limits federal courts to deciding

“Cases” or “Controversies.” U.S. Const. art. III, § 2. The existence of a case or controversy is a “bedrock requirement” of our jurisdiction; we cannot exercise judicial power without it. Raines v. Byrd, 521 U.S. 811, 818 (1997) (quoting Valley Forge Christian Coll. v. Ams. United for Separation of Church and State, Inc., 454 U.S. 464, 471 (1982)). So in order to find out if we can hear a party’s claim, we need to consider whether that party has a case or controversy rather than,

say, a strong and abiding interest in an issue, or a desire to obtain attorney’s fees. Standing, ripeness, and mootness are three traditional doctrines governing whether a case or controversy exists. Standing—“perhaps the most important of the jurisdictional doctrines”—is the only one at issue here. FW/PBS, Inc. v. City of Dallas, 493 U.S. 215, 231 (1990) (quoting Allen v. Wright, 468 U.S. 737, 750 (1984)) (alterations adopted). For a party to have standing to bring a lawsuit, it must have “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, 136 S. Ct. at 1547 (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992)). In plainer language, the plaintiff needs to show that the defendant harmed him, and that a court decision can either eliminate the harm or compensate for it. That standard applies equally in the class action 10 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 11 of 148

setting; a district court is “powerless to approve a proposed class settlement” if “no named plaintiff has standing.” Frank v. Gaos, 139 S. Ct. 1041, 1046 (2019).

Our inquiry becomes narrower as we move down the standing decision tree; injury is the only element we need to consider here. At the pleading stage of a case, “general factual allegations of injury” can suffice. Lujan, 504 U.S. at 561.

But that is not a free pass—these general factual allegations must “plausibly and clearly allege a concrete injury.” Thole, 140 S. Ct. at 1621; see also Ashcroft v. Iqbal, 556 U.S. 662, 678–79 (2009); Bell Atl. Corp. v. Twombly, 550 U.S. 544,

555–56 (2007); Salcedo v. Hanna, 936 F.3d 1162, 1168 (11th Cir. 2019). “[M]ere conclusory statements do not suffice.” Iqbal, 556 U.S. at 678 (punctuation omitted). Although Iqbal and Twombly have put a finer point on it, this standard is not new—it’s long been known that even at the pleading stage, the “litigant must clearly and specifically set forth facts” to satisfy the requirements of Article III. Whitmore v. Arkansas, 495 U.S. 149, 155 (1990). We will not “imagine or piece together an injury sufficient to give [a] plaintiff standing when it has demonstrated none,” and we are powerless to “create jurisdiction by embellishing a deficient allegation of injury.” Miccosukee Tribe of Indians of Fla. v. Fla. State Athletic

Comm’n, 226 F.3d 1226, 1229–30 (11th Cir. 2000) (citing Whitmore, 495 U.S. at 155). What is required, then? A plaintiff needs to plead (and later support) an

injury that is concrete, particularized, and actual or imminent, rather than

11 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 12 of 148

conjectural or hypothetical.1 See Spokeo, 136 S. Ct. at 1548 (quoting Lujan, 504 U.S. at 560). Our inquiry narrows again; we only consider concreteness here. A

lot of ink has been spilled to explain what concrete means, but the best word may also be the simplest—“real.” Id. And statutory violations do not—cannot—give us permission to offer plaintiffs a wink and a nod on concreteness. Plaintiffs must show, and the courts must ensure, that an alleged injury is concrete, or else we have no jurisdiction to consider it. Id. at 1548–49. As the parties recognized—or, less charitably, feared—during their

settlement negotiations, the Supreme Court’s Spokeo, Inc. v. Robins decision is central to our concreteness analysis. That’s because Spokeo was not only about concreteness; it was also about Congress. Spokeo cautioned that “Congress’ role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Id. at 1549. So although a congressional judgment may be “instructive and important” to this Court’s analysis, we need to come to our own conclusion that the alleged harm is concrete before we can find that a plaintiff has standing. Id.

1 We note that the burden of establishing these elements of standing continues—and, in fact, increases—all the way through the litigation. Lujan, 504 U.S. at 561. The elements need to be supported “with the manner and degree of evidence required at the successive stages of the litigation”—though what that means at the class settlement stage has been the subject of some debate. Id. Because Muransky has not offered any allegations beyond those in his complaint, and because we can resolve the case on the basis of his deficient pleadings, we do not need to wrestle with that question here. 12 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 13 of 148

Echoing Lujan v. Defenders of Wildlife, the Spokeo decision also acknowledged that Congress may “elevate to the status of legally cognizable

injuries concrete, de facto injuries that were previously inadequate in law” and that “Congress has the power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before.” Spokeo, 136 S.

Ct. at 1549 (citation omitted and alterations adopted). Congress can certainly create new legal entitlements, the denial of which will constitute a concrete injury. See, e.g., FEC v. Akins, 524 U.S. 11, 21–24 (1998) (inability to obtain information is an injury in fact); Pub. Citizen v. U.S. Dep’t of Justice, 491 U.S. 440, 449 (1989) (same). It can also recognize and provide legal remedies for concrete injuries that already exist, but for which there is no cause of action. But this is a limited

authority to provide legal process relating to actual harms, not a blanket power to authorize suit in the absence of harm: Congress “cannot erase Article III’s standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.” Spokeo, 136 S. Ct. at 1548 (quoting Raines, 521 U.S. at 820 n.3). 2 A. Now to the mechanics of pleading. Plaintiffs can show a concrete, or “real,” harm in two ways. The first is to show that the statutory violation itself caused a harm. It’s safe to say that pointing to a direct harm is the most straightforward way

2 Our dissenting colleague’s long discussion of the public-private rights theory is interesting to consider as a matter of first principles. See Jordan Dissent at 115–47. But it is also irrelevant to the work that we have to do as an inferior court in this appeal. That work is to apply the binding caselaw of the Supreme Court, which does not currently endorse the theory pressed by our colleague. 13 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 14 of 148

to show a concrete injury—in fact, it’s probably what most people think of naturally. Such harms can be tangible or intangible. Tangible harms are the most

obvious and easiest to understand; physical injury or financial loss come to mind as examples. Claims of intangible harm, on the other hand, can be tricky: some are

concrete, some are not. Violations of the rights to free speech or free exercise, for instance, are intangible harms that are also both direct and concrete. Spokeo, 136 S. Ct. at 1549 (collecting cases). “[C]onscientious objection” to a law or “fears of hypothetical future harm”? Not so much. See Diamond v. Charles, 476 U.S. 54, 67 (1986); Clapper v. Amnesty Int’l USA, 568 U.S. 398, 416 (2013). And questions of whether alleged intangible harms are concrete have an extra wrinkle

when the plaintiff’s claim stems from the violation of a statute. Shedding some light on how to draw that difficult line, Spokeo instructs that we may consider “both history and the judgment of Congress.” Spokeo, 136 S. Ct. at 1549. History first—by looking to history, we can discern a concrete injury where the “intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Id. The fit between a new statute and a pedigreed common-law cause of action need not be perfect, but we are called to consider at a minimum whether the harms match up between the two. Likewise, congressional judgment may illuminate a concrete injury because, as a body, Congress “is well positioned to identify intangible harms that meet minimum Article III requirements.” Id. But as we have already explained, congressional judgment only goes so far, and does not relieve 14 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 15 of 148

the judiciary of our constitutional duty to independently determine whether the plaintiff has suffered a concrete injury.

Our own post-Spokeo precedent illustrates how both history and congressional judgment can fit into the concreteness analysis. In several cases, we have concluded that a plaintiff had standing because the statutory violation at issue

led to a type of harm that has historically been recognized as actionable. For example, we held that CNN’s dissemination of a plaintiff’s news-viewing history to a third-party, in violation of the Video Privacy Protection Act, could constitute a concrete injury because it was analogous to torts that were well-established in American courts—namely, invasion of privacy and intrusion upon seclusion. Perry v. Cable News Network, Inc., 854 F.3d 1336, 1340–41 (11th Cir. 2017). We

reached a similar conclusion when we held that an agency’s violation of the Fair Credit Reporting Act—offering an allegedly inaccurate statement in a plaintiff’s credit report—was analogous to the longstanding tort for publication of defamatory material. Pedro v. Equifax, Inc., 868 F.3d 1275, 1279–80 (11th Cir. 2017). We have also relied on the judgment of Congress to discern concrete injuries. In Debernardis v. IQ Formulations, LLC, for instance, we considered the plaintiffs’ claim that they were sold an adulterated dietary supplement as defined by the Food, Drug, and Cosmetic Act because the manufacturer failed to provide notice to the Food and Drug Administration that a new dietary ingredient was safe. 942 F.3d at 1080–82. Although the plaintiffs suffered no physical harm from the supplement, we concluded that they were sold a worthless product “that Congress judged insufficiently safe for human ingestion.” Id. at 1085. That deprived the 15 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 16 of 148

plaintiffs of the benefit of their bargain and amounted to a direct economic loss that supported standing. Id. at 1085–86. In short, a variety of approaches can

demonstrate direct harm to a plaintiff. Even without any direct harm, a plaintiff can establish an injury in fact by showing that a statutory violation created a “risk of real harm.” Spokeo, 136 S. Ct.

at 1549 (citing Clapper, 568 U.S. 398). But while very nearly any level of direct injury is sufficient to show a concrete harm, the risk-of-harm analysis entails a more demanding standard—courts are charged with considering the magnitude of the risk. That means we evaluate whether the claimed “procedural violations . . . entail a degree of risk sufficient to meet the concreteness requirement.” Id. at 1550.

If some degrees of risk are called sufficient, that means others must be insufficient. Although Spokeo did not trace a numerical line between the two, it did explain that the risk must be “material.” Id. That’s a familiar word that, in this context, means “important; essential; relevant.” New Oxford American Dictionary (3d ed. 2010); see also The American Heritage Dictionary of the English Language (5th ed. 2018) (“Being both relevant and consequential; crucial.”). We recognize that “material risk of harm” is a somewhat indefinite term. Spokeo, 136 S. Ct. at 1550; Nicklaw v. CitiMortgage, Inc., 839 F.3d 998, 1002–03 (11th Cir. 2016). One thing is definite, however. Whatever “material” may mean, conceivable and

trifling are not on the list. And for all the things that Spokeo broke new ground on, the high standard for risk of harm was not one of them. The Supreme Court has long indicated that 16 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 17 of 148

standing predicated on a risk of harm must be based on something more than a minor or theoretical risk—“a ‘substantial risk’ that the harm will occur,” for

example. Clapper, 568 U.S. at 414 n.5 (citation omitted). Other cases use slightly different formulations to describe a significant or substantial risk, but they are consistent in recognizing a high standard for the risk-of-harm analysis, and a robust

judicial role in assessing that risk. See, e.g., Thole, 140 S. Ct. at 1622 (“substantially increased risk”); Dep’t of Commerce v. New York, 139 S. Ct. 2551, 2565 (2019) (“a substantial risk that the harm will occur” (quoting Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014))); Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139, 153, 155 (2010) (“substantial risk” or “significant risk”); Pennell v. City of San Jose, 485 U.S. 1, 8 (1988) (“realistic danger of

sustaining a direct injury” (citation omitted)); Blum v. Yaretsky, 457 U.S. 991, 1000 (1982) (a “sufficiently substantial” threat). We do not see, we should add, a “material” or “substantial” difference among these terms, and the Supreme Court has not suggested one. Our Court has already put this standard to work. In Nicklaw v. CitiMortgage, Inc., we concluded that a plaintiff had suffered neither direct harm

nor a “material risk of harm” when his mortgage company recorded the discharge of his debt later than it should have. 839 F.3d at 1000, 1003. The plaintiff, after all, had brought his lawsuit two years after the lender had finally (albeit tardily)

fulfilled its duty, and there was no allegation that the lender’s earlier failure had already injured him or would pose any risk in the future. Id. at 1003. With neither

17 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 18 of 148

a direct harm nor a material risk of harm, the plaintiff had suffered no concrete injury. See id.

We add that the lack of a numerical standard governing the quantum of risk that is sufficient to support standing does not mean that the standard is zero, that the standard is minimal, or that we simply defer to Congress. And the limits on

congressional authority do not disappear when the statutory right at issue protects against a risk of future harm; it would be backwards to say that Congress gets less than complete deference when it seeks to identify actual harm, but is due blind, unreviewable deference if it seeks to protect against a risk of actual harm. The same is true for pleading requirements. A conclusory statement that a statutory violation caused an injury is not enough, so neither is a conclusory statement that a

statutory violation caused a risk of injury. B. To boil down the lessons above, we consider two things when we evaluate whether concrete harm flows from an alleged statutory violation—and thus whether the plaintiff has standing. First, we ask if the violation itself caused harm, whether tangible or intangible, to the plaintiff. If so, that’s enough. If not, we ask whether the violation posed a material risk of harm to the plaintiff. If the answer to both questions is no, the plaintiff has failed to meet his burden of establishing standing.3

3 We will confess that we find ourselves somewhat perplexed by our dissenting colleague’s repeated assertions that we believe only identity theft can cause injury under FACTA. See Wilson Dissent at 36, 42–43, 47. Both identity theft and a material risk of identity theft plainly qualify as injuries under that statute and under this opinion. Nor do we see how interpreting the

18 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 19 of 148

The heart of Muransky’s claim is that “he was provided with an electronically printed receipt” that “displayed the last four digits of his credit card

as well as the first six digits of his account number” and that, because of this type of violation, he and other class members “have all suffered irreparable harm” and “continue to be exposed to an elevated risk of identity theft.” And, as we have

explained, the complaint emphasizes that the wrongs committed by Godiva are “statutory in nature” and expressly disclaims any recovery for “personal injury” arising from the violations. Relying on these allegations, all of which are grounded in the statute, Muransky now argues that the extra digits on his receipt can be counted as a concrete injury in four different ways. Three of his arguments suggest that the

statutory violation itself—his receipt of the receipt—caused him a direct harm. His alternative argument is that the violation exposed him to an increased risk of identity theft. But Muransky’s efforts to recharacterize the statutory violation he pleaded to fit within Spokeo’s limits demonstrate, if anything, a commitment to the idea that the violation alone must somehow be enough. 1. His first argument is that he had a “substantive right” to a properly truncated receipt, and that the violation of that right, “by itself, is a concrete injury.” This

interest protected by FACTA as avoidance of “risk of identity theft” moves the ball. To begin, this opinion makes clear that anyone who properly pleads a material risk of identity theft would have standing. Second, if the harm the statute protects against is “risk of identity theft” rather than “identity theft,” that would mean that we would need to consider whether a statutory violation led to a material risk of a risk of identity theft. We fail to see how that word-soup analysis would help plaintiffs in any event—either they suffer a material risk of harm or they do not. 19 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 20 of 148

argument gets at the core of his complaint’s allegations—statutory-violation-qua- injury was the predominant theory of harm throughout the litigation. Muransky

also presses a new argument that the (unpleaded) efforts he took to safeguard his receipt qualify as an injury in fact. Finally, he pivots to historical analogue, asserting that the mishandling of his account information is actionable because it

bears a close resemblance to a common-law breach of confidence. None of these direct-injury claims holds up. i. We have already explained the key holding from Spokeo: a “bare procedural violation, divorced from any concrete harm” is not enough to establish an Article III injury. Spokeo, 136 S. Ct. at 1549. But we restate the point here to explicitly

reject any argument that the complaint’s conclusory statement that “Plaintiff and the members of the class have all suffered irreparable harm as a result of the Defendant’s unlawful and wrongful conduct” is enough to show concrete injury; that claim would be so flimsy after Spokeo (not to mention Iqbal) that Muransky himself does not raise it. Nothing in FACTA suggests some kind of intrinsic worth in a compliant receipt, nor can we see any. So it makes little sense to suggest that receipt of a noncompliant receipt itself is a concrete injury. To resist the force of that intuition, Muransky attempts to reframe the nature of his injury by relying on a fuzzy distinction between “substantive” and “procedural” rights. He argues that Godiva’s statutory violation deprived him of a substantive right to receive “a properly truncated receipt,” and that the violation of a substantive right, unlike a procedural right, automatically inflicts an injury in 20 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 21 of 148

fact—even if it causes no harm. This, it turns out, is a dressed up version of the same argument that the Eighth Circuit accepted before Spokeo, but had to walk

back after it: “Our prior statement that ‘[i]njury in fact may thus be shown solely by the invasion of a legal right that Congress created,’ is no longer good law in light of the Supreme Court’s subsequent holding in Spokeo, Inc. v. Robins [that]

‘Article III standing requires a concrete injury even in the context of a statutory violation.’” Golan v. FreeEats.com, Inc., 930 F.3d 950, 957–58 (8th Cir. 2019) (quotation marks and citations omitted). In an attempt to resuscitate that argument, Muransky contends that the holding in Spokeo applies only to what he calls “procedural” statutory violations, and not to what he calls “substantive” ones. He argues that Spokeo confirms his

view when it says that even a procedural violation “can be sufficient in some circumstances to constitute injury in fact.” Spokeo, 136 S. Ct. at 1549. Muransky is absolutely right that Spokeo makes this point, but he’s absolutely wrong that it saves his claim. Spokeo’s statement stands for the unremarkable proposition that, in some cases, the violation of a procedural right set out in a statute will necessarily result in the harm that Congress was trying to prevent. A prime example is the illegal deprivation of information: “a plaintiff suffers an ‘injury in fact’ when the plaintiff fails to obtain information which must be publicly disclosed pursuant to a statute.” Akins, 524 U.S. at 21 (citation omitted); see also Havens Realty Corp. v. Coleman, 455 U.S. 363, 373 (1982) (denial of “legal right to truthful information about available housing” is an Article III injury). That, the Supreme Court has already 21 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 22 of 148

made clear, is not a “bare” procedural violation, or one that is “divorced from any concrete harm”; if a statute protects against a lack of information, the denial of

access to information is a concrete injury. For FACTA, on the other hand, a violation of the statute does not directly result in the harm Congress was trying to prevent. That is, no one’s identity is stolen at the moment a receipt is printed with

too many digits. See Pub. L. No. 108-159, 117 Stat. at 1952 (a goal of FACTA is “to prevent identity theft”). So while some statutory violations, by their very nature, will be coextensive with the harm that Congress was trying to prevent, labels do not control our analysis. We are not the first court to recognize that arguments grounded in a distinction between substantive and procedural rights miss the point and are

“unconvincing” because they depend “entirely on the framing of the right.” Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 782 (9th Cir. 2018); see also Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 n.2 (7th Cir. 2016). The question, always, is whether an injury in fact accompanies a statutory violation. Confronting this argument again also feels a little like Groundhog Day,

because we already rejected it in Nicklaw. There, the plaintiff claimed that, because “the New York legislature intended to create a substantive right to have the certificate of discharge timely recorded,” the plaintiff automatically suffered a

concrete injury when the discharge was untimely filed. 839 F.3d at 1002 (emphasis added). There too, we held that the “relevant question” was “whether Nicklaw was harmed when this statutory right was violated.” Id. The point is that 22 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 23 of 148

for standing purposes, no matter what label you hang on a statutory violation, it must be accompanied by a concrete injury.

We thus continue to adhere to our decision in Nicklaw. Muransky’s assertion that he does not need to show anything more than a noncompliant receipt because his statutory right was “substantive” cannot be squared with our

precedent—or with the central holding of Spokeo. To avoid “alleging a bare procedural violation,” the plaintiff must show either some harm caused by the violation or a material risk of harm. Spokeo, 136 S. Ct. at 1550. What Muransky has missed is that the word “bare” is just as important as the word “procedural.” ii. Perhaps suspecting that a statutory violation alone would no longer be

sufficient after we considered Spokeo, Muransky claims on appeal that the time he spent safeguarding his receipt also constitutes a direct injury in fact. Although we have held that “allegations of wasted time can state a concrete harm for standing purposes,” we have also declined to find standing when no such allegations were pleaded. Salcedo, 936 F.3d at 1173. In Salcedo, we rejected the plaintiff’s assertion at oral argument that receiving unwanted text messages caused him to waste time. Id. at 1168. We did so for a simple reason: his complaint lacked any “specific time allegation.” Id. So too here. Muransky never alleged that he treated his Godiva receipt differently than any other, or that he spent any additional time safeguarding it. But even if Muransky had alleged that he spent additional time destroying or safeguarding his receipt, he would not succeed on this theory. Where a 23 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 24 of 148

“hypothetical future harm” is not “certainly impending,” plaintiffs “cannot manufacture standing merely by inflicting harm on themselves.” Clapper, 568

U.S. at 416, 422. Muransky is no different than the Clapper plaintiffs in this respect—his management-of-risk claim is bound up with his arguments about actual risk. If his Godiva receipt would not offer any advantage to identity thieves,

we could hardly say that he was injured because of the efforts he took to keep it out of their hands. To be fair, we have not yet addressed Muransky’s risk-of-harm claims, but any assertion of wasted time and effort necessarily rises or falls along with this Court’s determination of whether the risk posed by Godiva’s FACTA violation, as pleaded by Muransky, is itself a concrete harm. iii.

In his final attempt to show a direct harm, Muransky argues—for the first time—that Godiva’s FACTA violation is analogous to a common-law breach of confidence tort. To succeed on this theory, he needs to show that the violation bears “a ‘close relationship’ to a traditionally redressable harm.” Salcedo, 936 F.3d at 1172 (quoting Spokeo, 136 S. Ct. at 1549). His argument proceeds along the following lines: FACTA requires merchants to keep credit card information secret. By handing him a receipt with too many digits of his credit card number exposed, Godiva “disclosed” information that he provided in confidence and gave criminals “easy access” to it. Because that disclosure (to him) bears a close relationship to the common-law breach of confidence tort, he says, it qualifies as a concrete harm.

24 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 25 of 148

Not so fast. As an initial matter, the parties dispute whether a breach of confidence tort can fairly be said to have “traditionally been regarded as providing

a basis for a lawsuit in English or American courts.” Spokeo, 136 S. Ct. at 1549. There is arguable support for both views in academic literature and caselaw. As a 1982 note cited by both Muransky and Isaacson explains, following its recognition

in 1849, “the breach of confidence tort has become the basis of an extensive body of law” in England. Alan B. Vickery, Note, Breach of Confidence: An Emerging Tort, 82 Colum. L. Rev. 1426, 1452–54 (1982). But that same source goes on to state that the “law of breach of confidence in the United States, at least with respect to personal information, has not enjoyed a similar development,” and that the tort was “emerging” in a “rudimentary” form after initially dying “out in its

infancy.” Id. at 1451–52, 1454. The observation that the tort was “emerging” in the 1980s is consistent with the Second Circuit’s 1989 description of a breach of confidence as “a relative newcomer to the tort family.” Young v. U.S. Dep’t of Justice, 882 F.2d 633, 640 (2d Cir. 1989). One of the unexpected consequences of the common-law-analogy approach to identifying harms is the growing insistence on hammering square causes of action into round torts. Litigants and courts alike can be drawn into overthinking what was really a simple instruction: see if a new harm is similar to an old harm. Another risk is that courts will be unnecessarily drawn into an arcane evaluation of a tort’s origins. Fortunately, we are not put to that test today. We need not resolve whether breach of confidence is sufficiently ancient, because even if we assume

25 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 26 of 148

that a breach of confidence was traditionally redressable in English and American common-law courts, we are unpersuaded by its analogy to the facts of this case.

A breach of confidence, at least as defined by the article cited by the parties, involves “the unconsented, unprivileged disclosure to a third party of nonpublic information that the defendant has learned within a confidential relationship.”

Vickery, supra, at 1455; see also Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 114 (3d Cir. 2019); Vassiliades v. Garfinckel’s, 492 A.2d 580, 591 (D.C. 1985). Godiva’s FACTA violation shares very little with this definition. Two key elements of a breach of confidence are completely absent from the violation he complains of. To begin, there was no “disclosure to a third party.” Muransky was handed a receipt that bore his own information, and he does not allege that anyone

else ever saw it. To describe this act as a “disclosure” would distort the meaning of the term. Nor can we see how Muransky could have had a confidential relationship with the Godiva retail store. A breach of confidence “is rooted in the concept that the law should recognize some relationships as confidential to encourage uninhibited discussions between the parties involved.” Young, 882 F.2d at 640; see also David A. Elder, Privacy Torts § 5:3 (2019). Given this understanding, it is unsurprising that breach of confidence claims traditionally arise in the context of close professional relationships—those involving physicians, therapists, financial institutions, and the like. See, e.g., Suburban Tr. Co. v. Waller, 408 A.2d 758, 764 (Md. Ct. Spec. App. 1979) (bank); Doe v. Roe, 400 N.Y.S.2d 668, 676 (N.Y. Sup. Ct. 1977) (psychiatrist); Horne v. Patton, 287 So. 2d 824, 829 (Ala. 1973) (medical 26 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 27 of 148

doctor). Handing a common form of payment to a cashier at a retail store is simply not equivalent to these kinds of vulnerable, confidential relationships.

Because no information was disclosed, and no confidential relationship existed, the relationship between Godiva’s conduct and a breach of confidence is anything but “close”: a Godiva clerk handed Muransky a receipt containing a portion of his own credit card information. The fit between a traditionally understood harm and a more recent statutory cause of action need not be perfect, but the association here is too strained. Accordingly, we cannot say—at least

based on a breach-of-confidence theory—that Muransky has pleaded the kind of injury that “has traditionally been regarded as providing a basis for a lawsuit.” Spokeo, 136 S. Ct. at 1549. 2. Because Muransky failed to allege that the FACTA violation caused him a direct harm, we move on to consider whether he pleaded that the extra digits caused him to suffer a material risk of harm. In arguing that he did, Muransky returns, really, to the same point we dismissed earlier: that the inquiry begins and ends with deference to congressional judgment. As he sees it, by requiring the

truncation of all but the last five digits of a credit card, Congress has decided that printing additional digits creates a real risk of identity theft. End of story; there is no role for the courts. What Muransky asks is for us to abandon our judicial role by merging the ordinary steps in the analysis—concluding that because the statute protects a concrete interest, any violation automatically threatens that interest and thus 27 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 28 of 148

supports standing. Although that approach would simplify our job, it is inconsistent with Spokeo and with what the Constitution demands of us. But first,

as a practical matter, there is good reason to doubt that Congress has deemed every violation of FACTA to pose a material risk of identity theft. FACTA did not specifically address the kind of partial truncation that occurred in this case—an

observation made by the Third Circuit when it noted (with respect to an identical FACTA violation) that the “congressional findings of risk are not tailored to the FACTA violation . . . pleaded.” Kamal, 918 F.3d at 115–16 n.5. Moreover, Congress expressly recognized in the Clarification Act that not all violations of the truncation requirement pose a serious threat to consumers. See Pub. L. No. 110- 241 § 2(b), 122 Stat. at 1566. So Congress itself has made clear that not every

FACTA violation carries with it a risk of harm. Still, even if Congress had explicitly stated in the text of the statute that every FACTA violation poses a material risk of harm, that alone would not carry the day. Although the judgment of Congress is an “instructive and important” tool to identify Article III injuries, we cannot accept Muransky’s argument that once Congress has spoken, the courts have no further role. Spokeo, 136 S. Ct. at 1549. “Congress cannot erase Article III’s standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.” Id. at 1547– 48 (citation omitted). And as Spokeo emphasized, deciding whether a given risk of harm meets the materiality threshold is an independent responsibility of federal courts. See Kamal, 918 F.3d at 115 (“But the lesson of Spokeo is that we must confirm a concrete injury or material risk exists even when Congress confers a 28 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 29 of 148

right of action.”). Indeed, the Spokeo majority’s ultimate instruction to the Ninth Circuit on remand was to determine “whether the particular procedural violations

alleged in this case entail a degree of risk sufficient to meet the concreteness requirement.” Spokeo, 136 S. Ct. at 1550. That instruction applies equally here. It thus falls to us to consider Muransky’s claim. The question is whether

Muransky has alleged a material risk of harm, one that is “sufficient to meet the concreteness requirement.” Id. Factual allegations that establish a risk that is substantial, significant, or poses a realistic danger will clear this bar—but Muransky gives us very little to go on. In his complaint, he offers the naked assertion that he “and members of the class continue to be exposed to an elevated risk of identity theft.” Nothing indicates how much risk this might be, however,

and no facts alleged in the complaint provide insight into what degree of “elevated risk” Muransky faced, or why. That kind of conclusory allegation is simply not enough. Muransky did not plead facts that, taken as true, plausibly allege a material risk, or significant risk, or substantial risk, or anything approaching a realistic danger. See Iqbal, 556 U.S. at 678–79. The thing is, contrary to our dissenting colleague’s assertion, Muransky did not offer “a general factual contention subject to proof or disproof with evidence at later stages of litigation.” Jordan Dissent at 101. In fact, he was not trying to do so, and his own brief headings tell us why. Muransky’s argument to this Court—still—is that Congress determined that he was put at risk and that Congress’s judgment of risk is sufficient. And he later adds that he is relieved of any duty to plead facts supporting a risk of harm because “Congress already found 29 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 30 of 148

the risk substantial.” So instead of actually pleading a material risk of harm, he has provided us with a threadbare allegation that he was exposed to an increased risk

of identity theft. But an allegation of risk is not excused from the ordinary bar on conclusory allegations—it would not be (indeed is not here) enough to plead that “the defendant broke the law and injured me in doing so.” That is, again, merely a

reiteration of the statutory violation. If this pleading is enough to show standing, then there is no violation of FACTA that would not be. Late-breaking allegations in unsworn briefs before this Court do not change that. According to Isaacson (and various amici), the extra numbers on Muransky’s receipt merely contain information that is already allowed to be printed on it elsewhere—the card issuer, for example. This observation was credited by the

Second Circuit, which has said that printing “the first six digits of a credit card . . . is the equivalent of printing the name of the issuing institution.” Katz v. Donna Karan Co., LLC, 872 F.3d 114, 120 (2d Cir. 2017). For his part, Muransky argues that the six digits do contain information that can be exploited by identity thieves, such as the card level or industry program, and that access to it enables identity thieves to conduct “phishing” inquiries.4 But all of that is really beside the point.

Maybe these facts are true; perhaps they are not. Neither scenario would change our ruling, which is based on Muransky’s pleading of a statutory violation. He pleaded nothing about any specific risks from the sequence of numbers included on

his receipt, and did not address the issue before the district court at any time. It

4 Muransky, we note, does not offer this factual assertion to show that he has or can plead an elevated risk of identity theft, but as support for his argument that we should defer to Congress’s judgment of risk. 30 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 31 of 148

was his burden to satisfy the court that standing exists, and thus to plead something more than a conclusory allegation of harm. If anything about Godiva’s violation

subjected him to an increased risk of identity theft, it was Muransky’s burden to tell the court about it. Perhaps before Spokeo there was an argument that Muransky’s claim could

have survived as pleaded, but now his allegation—consisting of nothing more than a “bare procedural violation, divorced from any concrete harm”—is too thin to survive. Spokeo, 136 S. Ct. at 1549. 3. The conclusion we reach here—that Muransky has alleged neither a harm nor a material risk of harm—is in accord with the majority of other circuits to

consider this same question. The Second, Third, and Ninth Circuits have each considered FACTA violations involving partially truncated credit-card numbers. All three concluded that the violation created neither a harm nor a material risk of harm. See Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 106, 119 (3d Cir. 2019); Noble v. Nevada Checker Cab Corp., 726 F. App’x 582, 583–84 (9th Cir. 2018) (unpublished); Katz v. Donna Karan Co., LLC, 872 F.3d 114, 117, 121 (2d Cir. 2017). Two out of the three, we should add, were dismissed on the pleadings without considering extrinsic evidence—just like this case will be. Similarly, after Spokeo, every circuit to have considered a FACTA violation involving an undeleted expiration date has held that, without more, it does not confer standing. See Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 783 (9th Cir. 2018);

31 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 32 of 148

Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 81–82 (2d Cir. 2017); Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016).5

The only circuit to conclude that a bare violation of FACTA’s receipt requirements could support standing reached that conclusion on significantly different facts. Last year, the D.C. Circuit considered a case where a merchant

printed the entire credit card number, as well as the expiration date, on a customer’s receipt. Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1066 (D.C. Cir. 2019). Because the merchant “printed all of the information in both categories” it created “the nightmare scenario FACTA was enacted to prevent” and provided “sufficient information for a criminal to defraud her.” Id. That factual scenario is different than the violation Muransky complains about, and we do not

consider it here. 4. Because Muransky has failed to allege either a harm or a material risk of harm stemming from the FACTA violation, he lacks standing to bring this lawsuit. And because federal courts are “powerless to approve a proposed class settlement” if “no named plaintiff has standing,” we necessarily conclude that the district court acted without jurisdiction. Frank, 139 S. Ct. at 1046. Accordingly, “we have jurisdiction on appeal, not of the merits but merely for the purpose of correcting the error of the lower court in entertaining the suit.” Steel Co. v. Citizens for a

5 Contrary to our dissenting colleague’s assertion, neither we nor our sister circuits have “misread[] FACTA” any more than the Supreme Court misread FCRA when it required the plaintiff in Spokeo to plead something beyond the violation of that statute. Wilson Dissent at 36. We seek only to ensure that the plaintiff has, as he must under the Constitution, an actual controversy rather than a theoretical one. 32 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 33 of 148

Better Env’t, 523 U.S. 83, 95 (1998) (citation omitted). The proper remedy is for us to remand to the district court for a dismissal without prejudice. Stalley ex rel.

United States v. Orlando Reg’l Healthcare Sys., Inc., 524 F.3d 1229, 1232, 1234– 35 (11th Cir. 2008). Muransky complains that at “no time in the district court proceedings was

standing challenged” and suggests that standing was only “mentioned . . . at the final approval hearing.” Those statements are not completely right. But even if they were, our decision would not change. As we have said before, it “is not unfair to require every plaintiff to file a complaint which contains sufficient allegations of standing.” Church v. City of Huntsville, 30 F.3d 1332, 1336 (11th Cir. 1994). That lack of unfairness is particularly acute here, where the plaintiff was

aware from the very beginning that his standing was in question and was critical to the success of his claim. In its answer to the complaint, one of Godiva’s defenses was that “[n]either Dr. Muransky nor any member of the proposed class has suffered any injury in fact” and that they “lack standing to prosecute their alleged claims.” With this defense in the backdrop, both Muransky and Godiva admitted that Spokeo was a driving force in their settlement negotiations. Muransky himself admitted that the impending decision in Spokeo, “depending on the outcome, could have resulted in the case’s dismissal for failure to present an injury in fact.” And of course, Isaacson raised the Spokeo decision at the fairness hearing and urged the district court to exercise its obligation to assure itself of standing. Indeed, though it is rare, from time to time plaintiffs have even filed affidavits in this Court to firm

33 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 34 of 148

up standing allegations. See Ouachita Watch League v. Jacobs, 463 F.3d 1163, 1170 (11th Cir. 2006). No such attempt was made here.

At any point in this series of events, Muransky could have confronted the standing issue head on, or requested leave to amend his complaint. We do not think it is too much to ask that litigants who are aware that their allegations may

not satisfy constitutional standing requirements take the time to firm up those allegations—if it is possible to do so—before an en banc circuit court confirms their suspicions of inadequacy. This is not a case where a surprise standing issue was thrust upon an unaware plaintiff. Because no court has had the opportunity to consider any facts supporting Muransky’s conclusory allegation of harm, we cannot say that no one could ever

show standing for a similar procedural violation. In fact, Muransky himself could try to do so, because we are dismissing his claim without prejudice. But for now, Muransky has not alleged any facts to support his claim beyond that of a bare procedural violation. That is not enough. We close with this. One of our dissenting colleagues suggests that Muransky and his counsel should have yet another opportunity on remand to plead or demonstrate harm—one last bite at the apple. See Jordan Dissent at 97, 100. The problem with that solution—even setting aside that the parties have been aware of the potential standing infirmities from the start—is that Muransky has never asked for it. Not before the panel, and not before our full Court. Instead, he and his counsel have pressed for their preferred theory of standing: “the violation of Dr. Muransky’s substantive FACTA rights, by itself, is a concrete injury.” 34 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 35 of 148

Muransky, for whatever reason, has never sought to replead or prove standing under a different theory. We defer to the parties on how to litigate their claims,

and decline to offer them a solution they have not sought. Because, under Spokeo, the bare statutory violation pleaded by Muransky on behalf of the class is not sufficient, we dismiss his claims.

* * * Muransky has alleged that a cashier handed him a receipt containing some of his own credit card information printed on it. Although the receipt violated the law because it contained too many digits, Muransky has alleged no concrete harm or material risk of harm stemming from the violation. Because this amounts to nothing more than a “bare procedural violation, divorced from any concrete harm,”

Muransky has failed to allege that he has standing to bring this lawsuit. Spokeo, 136 S. Ct. at 1549. And in the absence of a named plaintiff with standing, neither this Court nor the district court has jurisdiction over this case. We therefore VACATE the order of the district court and REMAND with instructions to dismiss without prejudice.

35 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 36 of 148

WILSON, Circuit Judge, dissenting:

The Fair and Accurate Credit Transactions Act is a bipartisan marvel. Built

in the shadow of the credit-card boom, the Act—known as FACTA—passed in

Congress with staggering support. Days later, President George W. Bush lauded

the bill in the Roosevelt Room for “protecting our citizens by taking the offensive

against identity theft.” Credit Transactions Act Signing, C-SPAN (Dec. 4, 2003),

https://www.c-span.org/video/?179442-1/credit-transactions-act-signing. The

bill’s “offensive” includes the truncation requirement, which made it the law that

no business may print more than the last five digits of their customers’ credit or

debit card number on store receipts. President Bush extolled that the truncation

requirement “will help prevent identity theft before it occurs.” Id. (emphasis

added). To enforce the new rule, FACTA imposed steep statutory penalties for

businesses that play fast and loose with this sensitive information.

Today this court misreads FACTA and dilutes core protections provided by

Congress. FACTA’s truncation requirement protects against both actual identity

theft and a consumer’s interest in using a credit or debit card without incurring any

heightened risk of identity theft. By assuming that the truncation requirement

redresses only actual identity theft and nothing more, the majority overlooks that

FACTA protects against a point-of-sale harm—the consumer suffers a heightened

risk of identity theft the moment the business prints an untruncated receipt. The

36 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 37 of 148

court’s mistake all but ensures that consumers in the Eleventh Circuit must now

allege, support, and prove that they suffered actual identity theft (or at least soon

will) because of a defendant’s FACTA violation in order to avail themselves of the

law’s protections. It is tough, though—and sometimes impossible—to trace an

identity thief. As a result, the majority’s decision essentially eviscerates this

statute in our circuit, stripping thousands of consumers who receive untruncated

receipts of a universally championed remedy.

Neither Article III nor Spokeo compel this result. Because Muransky

plausibly alleged that Godiva’s FACTA violation elevated his risk of identity theft

the moment the receipt was printed, he has shown that the violation harmed a

concrete interest that FACTA protects. That is enough to satisfy standing at this

phase of the case, so I dissent.

I.

Article III standing has three well-worn requirements: injury in fact,

causation, and redressability. See Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61

(1992). This case turns on injury in fact. To satisfy that prong, the plaintiff must

show, among other things, that he has suffered an injury that is “concrete.” Id. at

560. A concrete injury is a real one; it is not “hypothetical or speculative,” but in

fact exists. Salcedo v. Hanna, 936 F.3d 1162, 1167 (11th Cir. 2019). The standard

for establishing concrete injury climbs higher as the case inches forward. Lujan,

37 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 38 of 148

504 U.S. at 561. But when we analyze the plaintiff’s injury using only the

allegations in the plaintiff’s complaint, we take those allegations as true.

McElmurray v. Consol. Gov’t of Augusta-Richmond Cnty., 501 F.3d 1244, 1251

(11th Cir. 2007). The allegations need not be specific; when we rely on the

complaint, “general factual allegations . . . will suffice.” MSPA Claims 1, LLC v.

Tenet Fla., Inc., 918 F.3d 1312, 1318 (11th Cir. 2019). 1 The question is whether,

taking his allegations as true, the plaintiff has plausibly alleged a concrete injury.

Trichell v. Midland Credit Mgmt., Inc., 964 F.3d 990, 996 (11th Cir. 2020).

For a while, many debated whether the violation of a statute inherently

creates a concrete injury under Article III. Compare Edwards v. First Am. Corp.,

610 F.3d 514, 517 (9th Cir. 2010) (holding that a statutory violation alone is

enough), with David v. Alphin, 704 F.3d 327, 338–39 (4th Cir. 2013) (holding that

a statutory violation alone is not enough). Spokeo, Inc. v. Robins put that debate to

bed. 578 U.S. ___, 136 S. Ct. 1540 (2016). As the majority explains, Spokeo held

that the violation of a statute does not always cause a concrete injury; “bare

1 The majority says that Muransky must “clearly and specifically” allege facts to survive a standing analysis at the pleading stage. Majority Op. at 11. But that view neglects Lujan’s statement that, “[a]t the pleading stage, general factual allegations of injury” can suffice, “for on a motion to dismiss we presume that general allegations embrace those specific facts that are necessary to support the claim.” 504 U.S. at 561 (alteration accepted) (internal quotation mark omitted). True, Muransky must provide specific facts when pressed at summary judgment. Id. But when we scan his standing based on just his complaint, we presume that his general factual allegations contain the specific facts he needs. 38 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 39 of 148

procedural violation[s],” without more, are not enough. Id. at 1549. Rather, a

statutory violation must cause concrete harm. Id. at 1548–49.

When does that happen? At first blush, it seems simple: a statutory violation

causes a concrete harm when it causes a real harm or a material risk of real harm.

See id. at 1548–50. But that simple statement begs a trickier question: What is a

“real harm”?

Spokeo states that there are two types of real harm: tangible and intangible.

See id. at 1549. A tangible harm is a palpable one, something that most would

know hurts without much thought. It is a harm painfully obvious—often

physically obvious—to the common observer (like losing money, a benefit, or a

job). See, e.g., Young Apartments, Inc. v. Town of Jupiter, 529 F.3d 1027, 1038

(11th Cir. 2008) (holding that a lost rent payment was a concrete injury for

standing purposes). These harms are almost always concrete. See Spokeo, 136 S.

Ct. at 1548–49.

An intangible harm, in contrast, is harder to define yet still offensive; it is

one that infringes on a person’s interests or rights (like infringement of your

freedom of speech or exercise of religion). See id. at 1549. Due to their

conceptual nature, not all intangible harms are “real” enough to be concrete.

In the statutory context, Spokeo explains how we should decide whether an

alleged intangible harm is concrete. See id. at 1549–50. First, we ask whether the

39 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 40 of 148

statute protects “concrete interests (as opposed to purely procedural rights).” See,

e.g., Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017) (Spokeo II)

(applying Spokeo), cert. denied, 138 S. Ct. 931 (2018) (mem.); see also Kamal v. J.

Crew Grp., Inc., 918 F.3d 102, 112–13 (3d Cir. 2019) (same). Second, we ask if

the violation “actually harm[ed]” or “present[ed] a material risk of harm” to a

concrete interest that the statute protects. Spokeo II, 867 F.3d at 1113; see also

Kamal, 918 F.3d at 112. If the answer to both questions is yes, the statutory

violation causes a concrete injury. Spokeo II, 867 F.3d at 1113; Kamal, 918 F.3d

at 112. 2

Muransky has established concrete injury under this test. FACTA protects

his concrete interest in using his credit or debit card without incurring a heightened

risk of identity theft. And Muransky plausibly alleged that Godiva’s violation in

fact heightened his risk of identity theft, harming an interest that FACTA protects.

2 I agree with the majority that the distinction between “substantive” and “procedural” rights is semantical. The question is simply whether the violation harmed (or created a material risk of harm to) a concrete interest. See Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 n.2 (7th Cir. 2016) (“[W]hether the right is characterized as ‘substantive’ or ‘procedural,’ its violation must be accompanied by an injury-in-fact. . . . That is one of the lessons of Spokeo.”). Sometimes that happens innately—the violation always harms an underlying concrete interest. See Nayab v. Capital One Bank (USA), N.A., 942 F.3d 480, 490 (9th Cir. 2019) (holding that when “every” statutory violation “offends the interests that the statute protects,” plaintiffs need not allege more harm to establish standing); see also Havens Realty Corp. v. Coleman, 455 U.S. 363, 373–74 (1982) (holding that a violation of a statute establishing “an enforceable right to truthful information [about] the availability of housing” was such a statute, since the violation always harmed the concrete interest in truthful information). But that is not always the case, and thus we must decide for ourselves whether a violation harmed a concrete interest. 40 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 41 of 148

Because the violation actually harmed Muransky’s concrete interest, we need not

analyze whether the violation presented a material risk of harm.

II.

First up is the concrete interest. To decide whether a statute protects a

concrete interest, we look to “history and the judgment of Congress.” Spokeo, 136

S. Ct. at 1549. An interest is more likely to be concrete if it has a “close

relationship to a harm that has traditionally been regarded as providing a basis for a

lawsuit in English or American courts.” Id. So too is an interest that Congress has

identified and judged as important and worth protecting. See id. But the interest

need not pass both litmus tests: a substantial showing in either category can suffice

to establish a concrete interest. See Dreher v. Experian Info. Sols., Inc., 856 F.3d

337, 345–46 (4th Cir. 2017) (noting that the lack of a common-law analog is “not

fatal” to a plaintiff’s standing if Congress has judged the interest as concrete);

Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1068 (D.C. Cir. 2019) (Rogers,

J., concurring in part and concurring in judgment) (agreeing that the defendant’s

alleged FACTA violation harmed a concrete interest because Congress identified

the interest as concrete, no matter if a common-law analog exists).

But even if Muransky had to clear both hurdles, he does so with space to

spare. Both Congress and history have established that a consumer has a concrete

41 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 42 of 148

interest in using a credit or debit card without incurring a heightened risk of

identity theft. See Jeffries, 928 F.3d at 1064–65 (majority opinion).

A.

Let’s start in Congress. Statutory text, legislative history, and public policy

make clear that Congress, in passing FACTA, recognized that consumers have a

concrete interest in using their cards without fear that each swipe will raise their

risk of identity theft.

Statutory Text. The surest mark of what Congress meant is what Congress

wrote. Three aspects of FACTA make clear that Congress thought that consumers

have an interest in avoiding the heightened risk of identity theft in addition to

avoiding actual identity theft.

The first is FACTA’s damages structure. The statute allows a consumer to

recover statutory damages whenever a business willfully prints more than the last

five digits of the consumer’s card number. 15 U.S.C. § 1681n(a)(1)(A). These

damages have no tie to actual identity theft; the consumer can recover them no

matter if he “ever becomes the victim of any crime.” Jeffries, 928 F.3d at 1064.

That damages scheme clashes with the majority’s take on FACTA’s

purpose. The majority assumes that FACTA guards against only the harm of

identity theft. See Majority Op. at 22 (claiming that the “harm Congress was

trying to prevent” through FACTA was stolen identity). But why would the statute

42 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 43 of 148

allow damages divorced from identity theft if its sole purpose were to combat

identity theft? It wouldn’t; it would instead bind FACTA’s damages scheme to the

harm of identity theft. So there must be a more nuanced method to Congress’s

madness—we interpret statutes “to avoid constitutional difficulties,” not create

them. Off. of Senator Mark Dayton v. Hanson, 550 U.S. 511, 514 (2007). That

method becomes clear once we accept that Congress enacted the statutory-damages

remedy to address a broader aim: to “decrease the risk that a consumer would have

his identity stolen.” Jeffries, 928 F.3d at 1064 (alteration accepted) (emphasis

added). Its presence tells us that actual identity theft is not the only concern

driving FACTA. Rather, this statutory scheme also protects another interest, one

prone to harm even without identity theft: the consumer’s interest “in using [a]

credit [or] debit card[] without incurring an increased risk of identity theft.” Id.

(emphasis added).

The second statutory clue is FACTA’s point-of-sale trigger. The statute

“imposes a truncation duty at the point of sale when identity theft cannot yet have

occurred.” Id. at 1067 n.3. The cause of action that Congress created does not

become complete when the consumer suffers identity theft; it is complete well

before that, the moment the business prints out too many card digits. See 15

U.S.C. § 1681c(g)(1). If FACTA were concerned with just identity theft, though,

its penalty would not accrue at the point of sale (before identity theft can occur); it

43 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 44 of 148

would accrue at the point of identity harm (when one suffers harm from identity

theft). The point-of-sale trigger thus reveals that Congress sought to protect an

immediately harmed interest—the interest in avoiding the heightened risk of

identity theft. See Jeffries, 928 F.3d at 1064, 1067 n.3.

The last indication—perhaps the most telling—is FACTA’s statute of

limitations. The statute of limitations turns on the untruncated receipt alone. The

limitations period for a FACTA violation is two years from the discovery of the

untruncated receipt but not later than five years from the printing of the

untruncated receipt. 15 U.S.C. § 1681p. Identity theft plays no role in this

sequence—the statute is indifferent to when or whether identity theft occurs. We

must ask, then: If the statute aims to redress only the harm of identity theft, why is

its limitations period apathetic to the harm of identity theft? Wouldn’t the

limitations period run sometime after the theft occurs?

Indeed, an example reveals the catch-22 that awaits a FACTA claimant

under the majority’s one-track view of FACTA’s protected interest. Suppose you

purchase a box of chocolates from a Godiva Chocolatier. After paying for the box

with your credit card, you notice that the cashier handed you a receipt showing

more than the last five digits of your card number. Although this act violated the

statute, the majority says you cannot sue yet; FACTA protects against only the

harm of identity theft, and you have not yet felt the hurt. But assume that the

44 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 45 of 148

cashier remembers your number, jots it down, and lays in wait. Two years and a

day later, you learn that the cashier, using the information on your receipt, has

stolen your identity, racking up thousands in credit card debt. Now that you have

suffered actual identity theft, the majority would say that you still cannot sue. The

statute of limitations began when you discovered the printed receipt, and now it

has run.

If FACTA’s sole aim were to redress the harm of identity theft, that

limitations scheme would make no sense—it operates without regard for when (or

even if) identity theft occurs. But the limitations scheme makes perfect sense once

we accept that FACTA also seeks to protect a consumer’s interest in using a credit

or debit card without incurring the heightened risk of identity theft. See Jeffries,

928 F.3d at 1064–65. In Congress’s eyes, that harm can occur at the point of sale,

the moment Godiva prints an untruncated receipt. Accordingly, Congress

reasonably chose to start the clock the moment the consumer discovers this point-

of-sale injury.

Legislative History. The legislative history also confirms that FACTA

sought to do more than just redress actual identity theft. When Congress passed

FACTA, the crime of identity theft had “reached almost epidemic proportions.”

H.R. Rep. No. 108-263, 25 (2003). Consumers were “increasingly concerned

about the risk of their personal financial information falling into the wrong hands.”

45 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 46 of 148

Id. (emphasis added). In fact, a “hotline established by the Federal Trade

Commission to field consumer complaints and questions about identity theft

logged over 160,000 calls in 2002 alone.” Id.

To ease these concerns, Congress found it “vitally important to address

measures which will help prevent identity theft” before it occurs. S. Rep. No. 108-

166, 8 (2003). The result was FACTA: a law designed to lessen consumer worries

by “limit[ing] the number of opportunities for identity thieves to ‘pick off’ key

card account information.” Id. at 13; see also In re Zappos.com, Inc., 888 F.3d

1020, 1027 (9th Cir. 2018) (“Congress has treated credit card numbers as

sufficiently sensitive to warrant legislation prohibiting merchants from printing

such numbers on receipts—specifically to reduce the risk of identity theft.”).

President Bush confirmed this purpose at the bill’s signing, noting that FACTA

would “help prevent identity theft before it occurs.” Credit Transactions Act

Signing, C-SPAN (Dec. 4, 2003), https://www.c-span.org/video/?179442-1/credit-

transactions-act-signing.

Not a shred of legislative history suggests that Congress wrote FACTA to

remedy only actual or inevitably impending identity theft. The history says just the

opposite. Congress’s focus on preventing identity theft before it occurs shows that,

in passing FACTA, Congress was concerned with more than just the actual harm

of identity theft. It believed that consumers have an interest in participating in the

46 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 47 of 148

market without increasing their chances of suffering identity theft. See Jeffries,

928 F.3d at 1064–65 (respecting Congress’s judgment that consumers have “an

interest in using their credit and debit cards without facing an increased risk of

identity theft”). We must defer to this legislative prerogative. See Spokeo, 136 S.

Ct. at 1549.

The majority takes a different view. It says that a later Clarification Act

makes clear that Congress’s “‘purpose’ was to protect ‘consumers suffering from

any actual harm’” from identity theft. Majority Op. at 5. But all Congress

recognized in the Clarification Act is that the failure to truncate an expiration date

does not pose “actual harm” to any interest. See Credit and Debit Card Receipt

Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(4)–(6), (b) (2008). In

contrast, Congress reiterated that “proper truncation of the card number, by

itself . . . prevents a potential fraudster from perpetrating identity theft or credit

card fraud.” Id. § 2(a)(6) (emphasis added). As a result, Congress “left the

truncation requirement and enforcement mechanism untouched,” affirming that the

failure to hide customers’ credit or debit card numbers can still put them in harm’s

way: it can heighten their risk of identity theft, a harm FACTA sought to prevent.

See Jeffries, 928 F.3d at 1068 (Rogers, J., concurring in part and concurring in

judgment).

47 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 48 of 148

Public Policy. Good policy often flows from good sense, and it makes

sense why Congress identified the heightened risk of identity theft as a concrete

interest. For one, a higher risk of identity theft can lead to another concrete harm:

actual identity theft. See Redman v. RadioShack, Corp., 768 F.3d 622, 626 (7th

Cir. 2014) (“[T]he less information the receipt contains the less likely is an identity

thief who happens to come upon the receipt to be able to figure out the

cardholder’s full account information and thus be able to make purchases . . . .”).

For another, consumers are less likely to use credit cards if their transactions are

unprotected, hamstringing economic efficiency and consumer spending. And a

higher risk of identity theft can divert consumer resources toward theft-prevention

measures, rather than typical economic goods and services. So Congress had good

reason to recognize that freedom from the heightened risk of identity theft is itself

a concrete interest.

*

It is worth reporting the violence that the majority’s logic does to this

statute. The holding hiding behind its reasoning is that a plaintiff can enforce a

FACTA violation only if it causes (or will soon cause) harm from identity theft.

That view decimates the class that this statute sought to protect. FACTA of course

provides a remedy for those who suffer identity theft. But it also provides a

remedy for those who do not—it lets consumers recover damages at the point of

48 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 49 of 148

sale well before identity theft could occur. 15 U.S.C. §§ 1681c(g)(1),

1681n(a)(1)(A). We are supposed to construe FACTA so that this feature is not

“inoperative or superfluous, void or insignificant.” Corley v. United States, 556

U.S. 303, 314 (2009). But by shrinking FACTA to cover just those that suffer or

will soon suffer identity theft, the majority ignores this directive, rewrites the

statute, and blinks FACTA as Congress knew it out of existence.

I would take a different route. Congress passed FACTA to fight identity

theft, but it did not elevate this interest to the exclusion of all others. Another

interest—one just as important—was encouraging consumers to use their credit or

debit cards without fear that their usage would raise their risk of identity theft.

Because Congress identified this interest as important and worth protecting, we

should defer to its determination and dub the interest concrete. See Spokeo, 136 S.

B.

Congress’s thoughts on the matter are enough to cement Muransky’s interest

in avoiding the heightened risk of identity theft. See id. But if there were any

doubt, history also “tilts toward concreteness.” Jeffries, 928 F.3d at 1064 (majority

opinion). Again, an interest is more likely to be concrete if it has a “close

relationship to a harm that has traditionally been regarded as providing a basis for

a lawsuit.” Spokeo II, 867 F.3d at 1115. A consumer’s interest in engaging in

49 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 50 of 148

commerce without heightening his risk of identity theft fits that bill: it bears a close

relationship to an interest harmed in a common-law breach-of-confidence claim. 3

The tort of breach of confidence historically allowed a plaintiff to recover

against a party who failed to adequately protect a plaintiff’s confidential

information. See Alan B. Vickery, Breach of Confidence: An Emerging Tort, 82

Colum. L. Rev. 1426, 1427–28 (1982). It “is rooted in the concept that the law

should recognize some relationships as confidential to encourage uninhibited

discussions between the parties involved.” Young v. U.S. Dep’t of Just., 882 F.2d

633, 640 (2d Cir. 1989). The plaintiff in a breach-of-confidence claim relies on an

“assurance of secrecy . . . . in forming the relationship, and thereafter in revealing

what [he] would otherwise hold back.” Vickery, supra, at 1428. For that reason,

an interest harmed in a breach-of-confidence case is the plaintiff’s “general interest

in the security of the confidential relationship and his corresponding expectation of

secrecy.” Id. at 1434. An interest harmed in a FACTA case is the same: the

consumer expects the business to comply with FACTA and keep his card number

confidential. The failure to do so undermines the “security of the confidential

relationship” and the consumer’s “expectation” that his card number will stay

hidden. See Vickery, supra, at 1434; see also Jeffries, 928 F.3d at 1065. And

3 The majority assumes that the breach-of-confidence tort is old enough to serve as a historical analog. I do the same and note that there is good cause for that assumption. See Corliss v. E.W. Walker Co., 64 F. 280, 281–83 (C.C.D. Mass. 1894) (discussing the breach-of-confidence tort). 50 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 51 of 148

because of the breach, the consumer is more “likely to remain silent in

circumstances that would otherwise call for frankness,” see Vickery, supra, at

1434, precisely the type of economic inefficiency Congress sought to avoid

through FACTA. See, e.g., H.R. Rep. No. 108-263, 23 (noting that “[o]ne of the

hallmarks of the modern U.S. economy is quick and convenient access to

consumer credit”).

The majority fires two shots at this historical connection, but neither lands.

It first argues that a FACTA violation does not track the typical elements of a

breach-of-confidence claim, as a FACTA claim does not require disclosure to a

third party. See Majority Op. at 26. This argument fails on two levels.

To start, a statutory harm need not “exactly track[ a] common law” analog to

be concrete. See Spokeo II, 867 F.3d at 1115. Nor must the violation “give rise to

a cause of action under common law.” Susinno v. Work Out World Inc., 862 F.3d

346, 351 (3d Cir. 2017). Rather, the harm need only bear a “close relationship to a

harm that has traditionally been regarded as providing a basis for a lawsuit,” so that

it is similar “in kind and in degree.” Salcedo, 936 F.3d at 1171 (emphasis added).

If a plaintiff had “to satisfy every element of a common law cause of action before

qualifying for statutory relief, Congress’s power to ‘elevate intangible harms’ by

defining injuries and chains of causation” that create a “‘case or controversy where

none existed before’ would be illusory.” Trichell, 964 F.3d at 1010 (Martin, J.,

51 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 52 of 148

concurring in part and dissenting in part) (alteration accepted) (quoting Spokeo,

136 S. Ct. at 1549); see also Spokeo II, 867 F.3d at 1115; Steel Co. v. Citizens for a

Better Env’t, 523 U.S. 83, 102 (1998) (holding that judicial power extends to

“cases and controversies of the sort traditionally amenable to, and resolved by, the

judicial process” (emphasis added)). So even if “there are differences between

[FACTA’s] cause of action and those recognized at common law, the relevant

point is that Congress has chosen to protect against a harm that is at least closely

similar in kind to others that have traditionally served as the basis for lawsuit.” See

Spokeo II, 867 F.3d at 1115. Assurance that a plaintiff’s confidential disclosure

will remain hidden and will not spike his risk of injury lies at the heart of both a

FACTA claim and a breach-of-confidence claim. So FACTA’s underlying interest

has a historical partner. See id. (holding that the Fair Credit Reporting Act

protected against a harm bearing a close relationship to the harm suffered in a

defamation suit, even though the elements of the claims did not match).

Another reason: the element of third-party disclosure is not inextricably tied

to the harms underlying a breach-of-confidence claim. To the contrary, a

“seemingly innocuous or limited disclosure may nevertheless injure the wronged

party directly because of the special significance that the party attaches to the

information.” Vickery, supra, at 1434 n.29. And “even if the disclosure is

innocuous, the wronged party may well fear future disclosures of more damaging

52 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 53 of 148

information.” Id. In other words, the “harm in a breach-of-confidence case occurs

when the plaintiff’s trust in the breaching party is violated, whether or not the

breach has other consequences.” Jeffries, 928 F.3d at 1064 (internal quotation

mark omitted). In the FACTA context, the business breaches that trust when it

prints more than five card digits, harming the consumer’s expectation that his

disclosure will not increase his chances that a thief will uncover his card number.

That harm occurs at the point of sale, no matter if a third party ever sees the

receipt. See id. at 1064–65.

Next up, the majority says that the harms do not match because Muransky

does not have a confidential relationship with Godiva. Majority Op. at 27. In the

majority’s eyes, breach of confidence involves “close professional relationships,”

like that between a doctor and a patient. Id. The majority claims that a customer-

merchant relationship does not create similar secrecy duties. Id.

That oversimplifies the situation. The exchange of card information

between a customer and merchant no doubt triggers a confidential relationship.

The “essential ingredients of what can be termed a ‘confidential relationship’” are

“the assurance of secrecy and the reliance it evokes.” Vickery, supra, at 1428. A

consumer paying with a credit or debit card would naturally believe that the

merchant will keep his card number secret—a belief that FACTA codified. And

that belief spurs consumer spending, as it lets the consumer breathe easy knowing

53 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 54 of 148

that his card information will stay safe throughout the transaction. So a typical

card transaction has both assurance and reliance—the key triggers of

confidentiality.

Legal elements aside, that relationship stands on common sense. Few would

say that confidential financial information is less sensitive than confidential

medical or legal information. For this reason, scholars have noted that “given their

relationship to consumers, the holders of consumer data in commercial transactions

should be labeled with a distinct term: data confidants.” Alicia Solow-Niederman,

Beyond the Privacy Torts: Reinvigorating A Common Law Approach for Data

Breaches, 127 Yale L.J.F. 614, 625 (2018). So just as governing ethical standards

recognize a “relationship of trust” between a doctor and her patient or a lawyer and

her client, FACTA’s truncation requirement recognizes “a similar relationship of

trust between consumer and merchant, requiring the merchant to safeguard the

consumer’s credit or debit card information.” Jeffries, 928 F.3d at 1064–65.

Bottom line: customer and merchant do share a confidential relationship.

All things said, a FACTA violation and a breach-of-confidence tort each

concretely harm the plaintiff’s expectation that his confidential disclosure will be

protected. For FACTA specifically, the harmed interest is the consumer’s

expectation that his credit card purchase will not heighten his risk of identity theft.

See id. Because this interest is “similar in kind” and bears a “close relationship” to

54 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 55 of 148

the interest harmed in a breach-of-confidence case, see Spokeo II, 867 F.3d at

1115, history settles that this interest is concrete. See Jeffries, 928 F.3d at 1064–

65.

III.

Since FACTA protects Muransky’s concrete interest in using his credit or

debit card without incurring the heightened risk of identity theft, all that’s left is

whether Muransky plausibly alleged that Godiva’s FACTA violation “actually

harm[ed]” or “present[ed] a material risk of harm” to this interest. See Spokeo II,

867 F.3d at 1113; see also Kamal, 918 F.3d at 112. He did—he alleged that

Godiva’s violation in fact heightened his risk of identity theft. So he has pled

“actual[] harm” to an interest that FACTA protects. See Spokeo II, 867 F.3d at

1113.

Muransky alleged two core facts in his complaint: (1) Godiva violated

FACTA when it printed 10 digits of his card number, and (2) this violation

“elevated his risk of identity theft.” Both statements are facts, not legal

conclusions. So we must accept them as true when analyzing standing at this

stage, because “[w]ithout the benefit of discovery, we are not in a position to

55 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 56 of 148

second guess the harm [he] allege[s].” See Debernardis v. IQ Formulations, LLC,

942 F.3d 1076, 1090 (11th Cir. 2019) (Sutton, J., concurring). 4

Accepting these facts as true, Muransky has alleged that Godiva’s FACTA

violation harmed his interest in avoiding a heightened risk of identity theft the

moment the violation occurred. His harm is not one that might happen in the

future (so that we would need to analyze whether he alleged a material risk of real

harm); it is a real harm to a concrete interest, one that Muransky adequately alleges

happened the moment Godiva printed the untruncated receipt. See Spokeo II, 867

F.3d at 1118 (explaining that the material-risk-of-harm standard plays no role

when the complaint alleges that “the challenged conduct and the attendant injury

have already occurred”). Whether Muransky can prove down the road that

Godiva’s FACTA violation heightened his risk of identity theft is another matter.

See Lujan, 504 U.S. at 561 (noting that the plaintiff’s burden of proof increases as

the case advances). For now, it is enough that he alleged that the violation harmed

his interest in using his card without suffering a heightened risk of identity theft.

See McElmurray, 501 F.3d at 1251.5

4 The majority is thus wrong to say that Muransky alleged a “pure statutory violation.” Majority Op. at 2. If that were so, he would not have alleged another fact—that Godiva’s FACTA violation raised his risk of identity theft. He would have instead said that Godiva printed the receipt, violating FACTA—period. Because he alleged additional facts, we must take him at his word that he suffered additional harm. 5 Because Muransky alleges a direct harm, the majority’s focus on whether Muransky alleged a material risk of identity theft is irrelevant (and for the same reason, I diverge from my dissenting

56 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 57 of 148

To sidestep this conclusion, the majority calls Muransky’s complaint

conclusory. It says that it need not accept Muransky’s allegation that Godiva’s

violation increased his risk of identity theft because he has not given specific facts

to explain how the violation did so. But we have said time and again that a

plaintiff’s allegation of injury need not be specific at the pleading stage—“general

factual allegations . . . will suffice.” MSPA Claims, 918 F.3d at 1318. At this

stage, Lujan tells us to presume that Muransky’s “general allegations embrace

those specific facts that are necessary to support the claim.” 504 U.S. at 561; see

also Wilding v. DNC Servs. Corp., 941 F.3d 1116, 1124 (11th Cir. 2019) (applying

this rule), cert. denied, 590 U.S. ___, 140 S. Ct. 2828 (2020) (mem.).

Article III does not command Muransky to provide these facts at the

pleading phase; Lujan says that is what discovery is for. See 504 U.S. at 561; see

also Debernardis, 942 F.3d at 1090 (Sutton, J., concurring). Based on this

principle, we routinely accept general factual allegations on the promise that

specific support will come later. See, e.g., Debernardis, 942 F.3d at 1085

colleague’s discussion of materiality). See infra at 75–78. Our job when analyzing a direct- harm theory is not to decide whether the violation “materially” harmed the statutory interest; our job is to decide whether the violation “actually harm[ed]” the statutory interest. See Spokeo II, 867 F.3d at 1113, 1118. FACTA protects Muransky’s concrete interest in using his card “without incurring an increased risk of identity theft,” see Jeffries, 928 F.3d at 1066, and Muransky claimed that he suffered an increased risk at the point of sale. That is an alleged actual harm, not an alleged material risk of actual harm, so materiality plays no role. The only question is whether he has alleged enough facts to plausibly establish direct harm at the pleading stage. 57 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 58 of 148

(majority opinion) (accepting “at the motion to dismiss stage” the general

allegation that a “dietary supplement that is deemed adulterated and cannot

lawfully be sold has no value”). It is inconsistent that the majority demands those

specifics from Muransky right now.

IV.

To close, I note that the majority’s cases are not persuasive for a mix of

reasons. Some cases dealt with a different truncation failure: the failure to truncate

the expiration date—a violation that Congress judged as not creating concrete

harm. See, e.g., Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 777 (9th Cir.

2018); Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 78 (2d Cir.

2017); Meyers, 843 F.3d at 725. Another came with an evidentiary record (not on

an analysis of the complaint), in which the district court found that the violation

there did not harm or raise a material risk of harm to a concrete interest. Katz v.

Donna Karan Co., L.L.C., 872 F.3d 114, 119–120 (2d Cir. 2017). And both Kamal

and Noble v. Nevada Checker Cab. Co., 726 F. App’x 582, 583–84 (9th Cir. 2018)

incorrectly determined that FACTA redresses only actual identity theft; the Ninth

Circuit also chose not to publish Noble, so the opinion is not precedential. See

Kamal, 918 F.3d at 115; Noble, 726 F. App’x at 583–84; see also Jeffries, 928 F.3d

at 1067 n.3 (rejecting the Third Circuit’s position that “FACTA protects an interest

in avoiding actual identity theft, rather than increased risk of identity theft”).

58 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 59 of 148

Far more persuasive is the D.C. Circuit’s published opinion in Jeffries.

There, the D.C. Circuit considered most of the cases cited above and rejected their

reasoning. It held that FACTA protects a consumer’s interest in using a credit or

debit card without incurring an increased risk of identity theft. Jeffries, 928 F.3d at

1064–65. And then the court held that the FACTA violation alleged there harmed

that interest at the point of sale. Id. at 1066–67. To be sure, the FACTA violation

there was worse than the one levied here: the defendant printed all 16 digits of the

plaintiff’s card number. But Jeffries did not turn on that fact; its reasoning extends

to this case just the same. As in Jeffries, the interest at issue is the consumer’s

interest in avoiding the increased risk of identity theft. And as in Jeffries, the

plaintiff has alleged that the FACTA violation in fact increased his risk of identity

theft, harming an interest that the statute protects. Like the court in Jeffries, we

should take the plaintiff at his word for now and hold that he has established

standing at this phase of the case.

* * *

The majority claims that Muransky “shut his eyes and closed his ears to the

requirements of Spokeo.” Majority Op. at 3. Yet the majority shuts its eyes and

closes its ears to the interest that FACTA protects. The statute protects

Muransky’s concrete interest in avoiding a heightened risk of identity theft. And

Muransky plausibly alleged that the moment Godiva printed the untruncated

59 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 60 of 148

receipt, he sustained an injury sufficient to confer standing to maintain a claim

under FACTA. The mistake the majority makes is to require anything more.

60 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 61 of 148

MARTIN, Circuit Judge, dissenting:

Not all statutory violations result in a concrete injury. The Supreme Court

told us so in Spokeo, Inc. v. Robins, 578 U.S. ___, 136 S. Ct. 1540 (2016). Id. at

1547–48. Today, the majority extends this principle from Spokeo to conclude that

courts may ignore the judgment of Congress when assessing whether a party has

met the concreteness requirement of Article III. The majority opinion holds that a

receipt displaying ten digits of a customer’s credit card number does not pose a

material risk of identity theft, and therefore is not a concrete injury. The majority

says this means plaintiffs have no standing here, even though Congress established

the point of intolerable risk at more than the last five digits being displayed on a

receipt. Because Congress’s judgment is deserving of deference under these

circumstances, and because congressional judgment supports a finding of

concreteness, I respectfully dissent from the majority’s opinion.

Spokeo also tells us we may find concrete injury where a statutory violation

bears a close relationship to a type of harm that has traditionally been actionable at

common law. 136 S. Ct. at 1549. In contrast to the majority, I view Dr.

Muransky’s FACTA violation as bearing a close relationship to a common law

breach of confidence tort. I therefore respectfully dissent on this ground as well.

61 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 62 of 148

In April 2015, Dr. David Muransky filed a class action lawsuit against

Godiva Chocolatier (“Godiva”), alleging that Godiva violated the Fair and

Accurate Transactions Act (“FACTA” or the “Act”), 15 U.S.C. § 1681c(g), when it

issued him a receipt containing the first six and last four digits of his card number.

His central claim is that by issuing him this receipt, Godiva willfully violated

FACTA, which, among other things, prohibits merchants from printing “more than

the last 5 digits of the credit card number . . . upon any receipt provided to the

cardholder at the point of the sale or transaction.” Id. § 1681c(g). He alleged in

his complaint that Godiva’s violation of FACTA’s truncation requirement exposed

him and the class members “to an elevated risk of identity theft.”

The majority opinion recounts the dense and winding path this case has

taken since filed. Maj. Op. at 5–9. I will briefly review this history as well. After

Dr. Muransky filed his complaint, the parties engaged in mediation, and reached an

agreement to settle the case for $6.3 million. Notice of the settlement was sent to

class members, and James H. Price and Alan Isaacson filed objections. At the

District Court’s fairness hearing, Mr. Isaacson, but not Mr. Price, challenged Dr.

Muransky’s standing. The District Court approved the settlement reached by the

class members and Godiva. Then, both Mr. Price and Mr. Isaacson challenged that

approval on appeal. Throughout this appeal, Mr. Isaacson has maintained his

62 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 63 of 148

argument that Dr. Muransky lacks standing, while Mr. Price has joined Dr.

Muransky in arguing that Dr. Muransky has standing.

For all its procedural complexity, this appeal presents only a simple

question. Did Dr. Muransky establish Article III standing by alleging a violation

of FACTA’s truncation requirement, based on a receipt showing 10 of the 16 digits

of his credit card? I believe he did.

I begin, as I must, with the standard announced by the Supreme Court in

Spokeo. To satisfy the injury-in-fact requirement of Article III, a plaintiff must

allege an injury that is both “concrete and particularized,” as well as “actual and

imminent.” Spokeo, 136 S. Ct. at 1548. The discussion here is about the first of

these requirements: whether Dr. Muransky’s complaint alleges an injury that is

sufficiently concrete. The majority accurately recounts that an injury need not be

“tangible” to be concrete. Id. at 1549. And even intangible injuries, such as the

“risk of real harm,” can satisfy Article III’s concreteness requirement. Id. When

we are tasked with deciding whether an intangible injury is sufficiently concrete,

Spokeo tells us that “both history and the judgment of Congress” inform our

analysis. Id. On this much, the majority and I agree.

Absent from the majority opinion, however, is the mention of another

command from Spokeo. It tells us that when a statutory right itself protects a

63 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 64 of 148

concrete interest, a plaintiff need not allege “any additional harm beyond the one

Congress has identified.” Id. In practical terms, a complaint alleging a statutory

violation, and nothing more, can be sufficient to establish standing at the pleading

stage, so long as the statutory violation itself protects a concrete interest. Strubel v.

Comenity Bank, 842 F.3d 181, 190–91 (2d Cir. 2016). And in determining

whether a statutory provision protects a concrete interest, we are guided by

congressional judgment and common law principles. See Perry v. Cable News

Network, Inc., 854 F.3d 1336, 1340–41 (11th Cir. 2017) (holding that a plaintiff

alleging a violation of the Video Privacy Protection Act need not allege “any

additional harm beyond the statutory violation” because both congressional

judgment and common law support a finding of concreteness).

Focusing, for now, on Spokeo’s discussion of the role of Congress, the

Court recognized that congressional judgment is “instructive and important

because Congress is well positioned to identify intangible harms that meet

minimum Article III requirements.” Cordoba v. DIRECTV, LLC, 942 F.3d 1259,

1268 (11th Cir. 2019) (quotation marks omitted); see also Daniel Townsend, Who

Should Define Injuries for Article III Standing?, 68 Stan. L. Rev. Online 76, 81–83

(2015) (explaining that Congress is better positioned to gather facts and make

empirical judgments about whether a practice is injurious). And as the majority

recognizes, Congress may thus “elevat[e] intangible harms” by defining injuries

64 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 65 of 148

and chains of causation that will “give rise to a case or controversy where none

existed before.” Spokeo, 136 S. Ct. at 1549 (quotation marks omitted).

Where the intangible injury identified by Congress is a risk of harm, Spokeo

tells us that the risk must be “material.” Id. at 1550. The majority “recognize[s]

that ‘material risk of harm’ is a somewhat indefinite term,” and says that in this

context, “material” means “important; essential; relevant.” Maj. Op. at 16 (citing

New Oxford American Dictionary (3d ed. 2010)). I agree. In Spokeo, the Court

gave us the example of including the wrong zip code on a credit report as one

insufficiently “material” risk of harm. 136 S. Ct. at 1550. In the context of the

Fair Credit Reporting Act, which creates a statutory cause of action for

inaccuracies on credit reports, the Court puzzled about “how the dissemination of

an incorrect zip code, without more, could work any concrete harm.” Id. Since the

concrete interest intended to be protected by the FCRA is avoiding the harms that

come from false credit reporting, it was not obvious to the Court how a mistaken

zip code was “essential” or “relevant” to that interest.

The majority suggests here that Spokeo did not “br[eak] new ground” on the

amount or type of risk required to establish standing. Maj. Op. at 16. I think it did.

Although several earlier Supreme Court decisions described the required level of

risk as “substantial” or “certainly impending,” Clapper v. Amnesty Int’l USA, 568

U.S. 398, 414 & n.5, 133 S. Ct. 1138, 1150 & n.5 (2013) (listing cases), Spokeo

65 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 66 of 148

did not include this description. See 136 S. Ct. at 1550. This was no accident.

The cases in which the Court described the necessary risk as “substantial” or

“certainly impending” did not address a statutory cause of action itself designed to

prevent future harm. See, e.g., Clapper, 568 U.S. at 401, 133 S. Ct. at 1143

(holding that certain attorneys and organizations did not have standing to challenge

the constitutionality of a provision of the Foreign Intelligence Surveillance Act of

1978). With this in mind, the Third Circuit recognized that the Supreme Court

decided in Spokeo to require a lesser magnitude of risk for statutory injuries in

order to “strike[] a balance between Congress’s power to define injuries . . . and

the requirement that—absent a statutory right of action—a threatened harm be

certainly impending or based on a substantial risk of harm to amount to injury in

fact.” Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 113 n.4 (3d Cir. 2019) (citation

and quotation marks omitted).

I also part ways with the majority in its explanation of how courts decide

whether the risk of harm identified by Congress is sufficiently material for Article

III purposes. While the majority acknowledges that congressional judgment plays

a role in identifying intangible injuries of the “direct” variety (for example,

interference with free speech or free exercise rights), it effectively concludes that

congressional judgment plays no role when identifying whether a prohibited

practice presents a risk of real harm. Maj. Op. at 27–29. The implication of this

66 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 67 of 148

holding is that when courts are confronted with prophylactic legislation designed to

reduce a risk of harm from occurring—like the statute at issue here—we operate

with a blank canvas in deciding whether the risk of harm is sufficiently material.

Id. at 16. I don’t think this approach can be reconciled with Spokeo’s command

that the “judgment of Congress” plays an important role in determining whether an

injury satisfies Article III’s concreteness requirement. 136 S. Ct. at 1549. And

while it is surely the courts, and not Congress, that are ultimately responsible for

deciding whether an injury is sufficiently concrete under Article III, our role does

not require or allow us to ignore the judgment of Congress entirely.

It is these principles that frame the concreteness inquiry here. Dr.

Muransky’s complaint alleges that Godiva violated FACTA’s truncation

requirement when it issued him a receipt that displayed the first six and the last

four digits of his credit card number. He says he suffered irreparable harm from

Godiva’s violation of the truncation requirement because it “exposed [him] to an

elevated risk of identity theft.” This Court must therefore decide whether the risk

of identity theft that Dr. Muransky suffered on account of Godiva’s FACTA

violation constitutes a concrete injury. And in making this determination, this

Court must consider whether congressional judgment and the common law support

a finding of concreteness under these circumstances.

67 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 68 of 148

First, the judgment of Congress. When it enacted FACTA, Congress

prohibited merchants from printing “more than the last 5 digits of the card number

or the expiration date upon any receipt provided to the cardholder.” 15 U.S.C.

§ 1681c(g)(1). FACTA provides that any merchant willfully violating this

requirement is liable for “any actual damages sustained by the consumer . . . or

damages of not less than $100 and not more than $1,000.” Id. § 1681n(a)(1)(A).

While Congress’s creation of a statutory cause of action certainly evinces a

judgment that violations of the truncation requirement cause harm, Spokeo tells us

that this fact alone is not sufficient to satisfy Article III’s standing requirements.

See 136 S. Ct. at 1547–48. Congress’s decision to sanction lawsuits for violations

of the truncation requirement is therefore only the starting point of the inquiry into

Congress’s judgment.

We go next, then, to the history of FACTA. That history confirms that

Congress considered the violation at issue here—a receipt displaying the first six

and last four digits of the customer’s credit card—to pose a material risk of identity

theft. When it enacted FACTA, Congress sought to “protect[] consumers from

identity theft.” Harris v. Mexican Specialty Foods, Inc., 564 F.3d 1301, 1306

(11th Cir. 2009); see also S. Rep. 108-166 at *6 (Oct. 16, 2003) (observing that

68 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 69 of 148

FACTA was enacted to address “the emergence and impact of identity theft on the

credit granting and reporting systems”). FACTA was necessary, Congress found,

in light of the increased use of credit in the late 1990s and early 2000s, which

“create[d] a target-rich environment for . . . sophisticated criminals, many of whom

are organized and operate across international borders.” S. Rep. 108-166 at *8; see

also Credit and Debit Card Receipt Clarification Act of 2007 (“Clarification Act”),

Pub. L. No. 110-241, § 2(a)(1), 122 Stat. 1565, 1565 (finding that “the purpose[]”

of FACTA is to “reduce identity theft and credit card fraud”). When he signed

FACTA into law, President George W. Bush echoed Congress’s findings. He

stated that “this law will help prevent identity theft before it occurs, by requiring

merchants to delete all but the last five digits of a credit card number on store

receipts.” Remarks on Signing the Fair and Accurate Credit Transactions Act of

2003, 39 Weekly Comp. Pres. Doc. 1746, 1748 (Dec. 4, 2003); see also S. Rep.

108-166 at 6 (concluding that the truncation requirement “limit[s] the number of

opportunities for identity thieves to ‘pick off’ key card account information”).

The history of FACTA following its initial enactment confirms that

Congress considered the type of violation at issue here to pose a material risk of

harm. After FACTA’s truncation requirement went into effect, “hundreds of

lawsuits were filed” alleging that merchants violated FACTA by “fail[ing] to

remove the expiration date” as required by 15 U.S.C. § 1681c(g)(1). Clarification

69 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 70 of 148

Act § 2(a)(4). In June 2008, the Clarification Act became law, and gave amnesty

to merchants who printed a card’s expiration date in the years since FACTA was

enacted. Id. § 3(a). Congress gave this amnesty because a complaint alleging a

mere violation of the expiration date requirement did not “contain[] an allegation

of harm to any consumer’s identity.” Id. § 2(a)(5). Notably, while Congress was

at it, it gave no amnesty to merchants who printed more than the allowed number

of digits. See id. § 3(a). Rather, Congress observed that “[e]xperts in the field

agree that proper truncation of the card number, by itself as required by [FACTA],

. . . regardless of the inclusion of the expiration date, prevents a potential fraudster

from perpetrating identity theft or credit card fraud.” Id. § 2(a)(6). By granting

amnesty only as to the expiration date, the Clarification Act sought to curtail

“abusive lawsuits” concerning a requirement that “do[es] not protect consumers.”

Id. at § 2(b).1

This demonstrates that, while Congress did not consider all violations of the

truncation requirement to pose a serious threat to consumers, it maintained its

concern about the violation pled here—a receipt showing more than the last five

digits of a card number—to entail material risk of identity theft. Congress’s view

1 The majority reads the Clarification Act to imply that the FACTA violation alleged here was not concrete, because of its acknowledgment that some FACTA claims do not cause “actual harm.” Maj. Op. at 28. To the contrary, the fact that the Clarification Act left the digit truncation requirement in place while granting amnesty for violations of the expiration date requirement indicates that Congress continued to view the former as a category of FACTA violations that cause “actual harm.” Clarification Act § 2(b). 70 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 71 of 148

was based on a finding that “[e]xperts in the field agree that proper truncation of

the card number, by itself” minimizes the risk of identity theft. Clarification Act

§ 2(a)(6). Congress’s judgment thus supports a finding of concreteness here. See

Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1066 (D.C. Cir. 2019) (noting

that, while “every FACTA violation [does not] create[] a concrete injury in fact,” a

receipt displaying a card’s entire number and expiration date caused concrete

injury because it was the “nightmare scenario” Congress sought to prevent).

As I said at the start, when a statutory violation itself protects a concrete

interest, a plaintiff need not allege anything more than a violation of the statute

itself. See Perry, 854 F.3d at 1340. Because the judgment of Congress supports a

finding of concreteness here, Dr. Muransky was not required to allege any

additional harm beyond the statutory violation alleged in his complaint. On this

basis alone, I would hold that Dr. Muransky established Article III standing.

The majority opinion takes a dramatically different path. It starts by

eschewing any deference to congressional judgment in determining whether Dr.

Muransky’s FACTA violation entailed a sufficiently high risk of identity theft.

See Maj. Op. at 27–28. We cannot defer to Congress, the majority reasons, so we

must instead look to Dr. Muransky’s complaint to see if he has alleged facts

establishing that a receipt showing ten digits of a credit card number poses a risk of

71 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 72 of 148

identity theft. Id. at 28–29. Although Dr. Muransky alleged that he suffered an

elevated risk of identity theft as a result of the FACTA violation at issue here, the

majority says that allegation “is simply not enough.” In so holding, the majority

assumes, without offering any explanation, that Dr. Muransky did not face a

“material risk, or significant risk, or substantial risk, or anything approaching a

realistic danger” due to the receipt at issue. Id. at 29. This analysis errs at every

step.

To begin, the majority starts on incorrect footing by effectively concluding

that congressional judgment is owed no deference in deciding whether a risk of

harm clears the concreteness bar.2 Maj. Op. at 27–28. The majority says it is

required to do so because (1) Spokeo tells us that the creation of a statutory cause

of action does not automatically confer standing, and (2) courts have an

independent responsibility to decide whether a risk of harm meets the materiality

threshold. Id. Both of these premises are true, but neither lead to the conclusion

that courts may ignore the judgment of Congress.

2 The majority notes, in passing, that there is “good reason to doubt” that Congress’s judgment supports a finding of materiality because Congress did not “specifically address the kind of partial truncation that occurred in this case.” Maj. Op. at 28 (citing Kamal, 918 F.3d at 115–16 n.5). What Congress said was that proper truncation—i.e., revealing no more than the last five digits of a card—prevents the risk of identity theft, and Dr. Muransky’s receipt revealed more than the last five digits. See Clarification Act § 2(a)(6). That Congress did not separately address every possible fact scenario that could constitute a violation of the truncation requirement does not dilute its judgment supporting a finding of concreteness here. 72 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 73 of 148

First, it is true that Spokeo told us “Congress cannot erase Article III’s

standing requirements by statutorily granting the right to sue to a plaintiff who

would not otherwise have standing.” 136 S. Ct. at 1547–48. This premise does

not, however, erase Congressional judgment from the equation entirely. Indeed,

Spokeo says quite the opposite. It notes that Congressional judgment is

“instructive and important” in determining whether an injury is concrete because

Congress “is well positioned to identify intangible harms that meet minimum

Article III requirements.” Id. at 1549. I have already walked through the

application of these principles here. A violation of the truncation requirement is

not a concrete harm merely because Congress gave litigants the right to sue. It is a

concrete harm, however, because congressional factfinding in the FACTA context

lends significant support to the idea that a failure to adhere to the digit truncation

requirement results in a material risk of harm.

Relatedly, the majority repeats throughout its opinion that deference to the

judgment of Congress would mean, in practical terms, that “there is no violation of

FACTA that would not be” “enough to show standing.” Maj. Op. at 30. This is

not so, and we need not travel far for an example of why this is wrong. As set out

above, when Congress passed the Clarification Act, it expressed a judgment that

the expiration date requirement “do[es] not protect consumers” and does not result

in “consumers suffering from any actual harm.” Id. at § 2(b). So even though

73 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 74 of 148

FACTA continues to provide a statutory cause of action for violating the expiration

date requirement, see 15 U.S.C. § 1681c(g)(1), the judgment of Congress would

not lend itself to a finding of concreteness. Every one of our sister circuits to

consider the question of expiration dates has reached the same conclusion. See

Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 783 (9th Cir. 2018); Crupar-

Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 82 (2d Cir. 2017); Meyers v.

Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 728–29 (7th Cir. 2016).

The next reason the majority gives for rejecting congressional judgment in

its evaluation of the risk of harm, is that federal courts have an “independent

responsibility” to “decid[e] whether a given risk . . . meets the materiality

threshold.” Maj. Op. at 28. Again, this principle is accurate. After all, federal

courts must satisfy themselves of Article III standing even where a plaintiff alleges

a statutory violation. See, e.g., Summers v. Earth Island Inst., 555 U.S. 488, 497,

129 S. Ct. 1142, 1151 (2009) (observing that the “requirement of injury in fact is a

hard floor of Article III jurisdiction that cannot be removed by statute”). But as set

out above, there is nothing incompatible with the court satisfying itself of an

injury’s concreteness, and considering the judgment of Congress at the same time.

Deference to congressional judgment does not mean “no role for the courts.” Maj.

Op. at 27. To the contrary, I see at least a couple ways in which federal courts

might complement, rather than erase Congress’s judgment.

74 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 75 of 148

First, as discussed here, courts can and should determine whether the

judgment of Congress in fact supports the conclusion that a risk of harm was

sufficiently material. In that regard, the history of FACTA supports a finding of

materiality as to Dr. Muransky’s allegations. I recognize there are circumstances

in which congressional judgment would not support a finding of concreteness, as

with violations of FACTA’s expiration date requirement. And I agree with the

view of the majority that it is the responsibility of courts to make that evaluation,

even in the face of a statutory cause of action. See, e.g., Jeffries, 928 F.3d at 1066

(concluding that a FACTA violation presented a sufficiently material risk of harm

in part because it was the “nightmare scenario” Congress sought to prevent in

enacting the statute).

Second, I acknowledge there are instances in which courts must themselves

determine whether a risk of harm is sufficiently material. In Spokeo, for instance,

the Supreme Court noted that not all FCRA violations result in a material risk of

harm to the concrete interests the protected by that statute. 136 S. Ct. at 1550. The

example I have already given comes from the Court’s observation that “[i]t is

difficult to imagine how the dissemination of an incorrect zip code, without more,

could work any concrete harm.” Id. Whether a credit report containing inaccurate

personal information creates a risk of concrete harm is precisely the type of

standing question that is susceptible to this sort of commonsense analysis by

75 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 76 of 148

federal courts. See Robins v. Spokeo, Inc., 867 F.3d 1108, 1117 (9th Cir. 2017) (in

the context of an FCRA violation, concluding that inaccuracies concerning “age,

marital status, educational background, and employment history” present a

material risk of harm because this is “the type [of information] that may be

important to employers or others making use of a consumer report”).

After rejecting consideration of or giving weight to Congress’s judgment,

the majority concludes that the FACTA violation alleged in Dr. Muransky’s

complaint does not entail a material risk of harm, and so is not a concrete injury. It

assumes, without explanation, that Dr. Muransky’s allegation that he suffered an

elevated risk of harm from Godiva’s FACTA violation is not enough to meet the

materiality threshold because a receipt showing 10 of a card’s 16 digits does not

pose “anything approaching a realistic danger” of identity theft. Maj. Op. at 29. I

think this weighing of the facts goes too far. Some questions of materiality, like

whether an incorrect zip code on a credit report can cause harm, lend themselves to

such commonsense judgments. However, questions about the number of digits of

a credit or debit card an identity thief needs in order to steal one’s identity is not

one of them. And aside from the majority’s intuition about what card information

is (or is not) useful to identity thieves, there is nothing in the record of this case to

suggest that Congress was wrong when it decided that a FACTA violation of this

76 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 77 of 148

sort creates a material risk of identity theft. 3 In circumstances such as these—

where neither commonly held understandings nor the record undermine

congressional factfinding—Spokeo suggests that courts should be guided in their

risk analysis by the judgment of Congress. 136 S. Ct. at 1549 (observing that

“Congress is well positioned to identify intangible harms that meet minimum

Article III requirements”). On the issue of the number of digits that create risk,

Congress’s judgment, after hearing from experts on the matter, was that printing

anything more than the last five digits of a credit card number poses an intolerable

risk of harm to consumers. This judgment supports the conclusion that Dr.

Muransky faced a material risk of harm, and thus a concrete injury, when Godiva

printed a receipt showing the first six and last four digits of his credit card number.

3 Perhaps cognizant that this record is bereft of any factfinding on whether the risk posed by Godiva’s FACTA violation is sufficiently material, Mr. Isaacson sought to fill this gap in two ways. First, he argues on appeal that the first six digits of a card number equates to printing the name of the card’s issuing institution. But just as a plaintiff cannot raise “[l]ate-breaking allegations in unsworn briefs” to shore up standing, Maj. Op. at 30, neither can a defendant raise factual contentions in an unsworn brief to disprove standing. And Mr. Isaacson’s brief presents the only factual offering in this record about what these digits stand for. Second, Mr. Isaacson asks us to rely on opinions by our sister circuits recognizing that the first six digits of a card number identifies the issuing institution. Br. of Appellant Isaacson at 3 (citing Katz v. Donna Karan Co., 872 F.3d 114, 118 (2d Cir. 2017) (observing that the district court found on a factual challenge to standing that printing the first six digits of a credit card number poses no risk of identity theft)). Mr. Isaacson effectively asks us to take judicial notice of facts found in another court’s opinion. This we may not do. See McIvor v. Credit Control Servs., Inc., 773 F.3d 909, 914 (8th Cir. 2014) (“Judicial notice of another court's opinion takes notice of the existence of the opinion, which is not subject to reasonable dispute over its authenticity, but not of the facts summarized in the opinion.” (quotation marks omitted)). 77 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 78 of 148

I accept that Congress’s judgment as to the materiality of a risk is not

infallible. An example of this is the Second Circuit’s decision in Katz, 872 F.3d

114, which also involved a FACTA claim based on a receipt showing the first six

and last four digits of a credit card number. Id. at 116. There, the defendant raised

a factual challenge to standing in a Federal Rule of Civil Procedure 12(b)(1)

motion to dismiss. Id. at 119–20. As part of that motion, the defendant presented

extrinsic evidence supporting its argument that the first six digits of a credit card

number revealed only the cardholder’s issuing institution, and thus presented no

material risk of identity theft. Id. The district court found in favor of the

defendant, and the Second Circuit concluded that the district court’s factual

ruling—that the first six digits identify only the card’s issuer—was not clearly

erroneous. Id. at 120. Katz thus demonstrates how the introduction of extrinsic

evidence in the District Court may, in some circumstances, work to undermine

Congress’s judgment. Here, however, neither Mr. Isaacson nor Godiva raised any

factual challenge to Dr. Muransky’s standing in the District Court. For that reason,

no record was developed in this case like that available to the Second Circuit in

Katz. In the absence of record evidence suggesting that Congress misjudged the

number of card digits necessary to cause a material risk identity theft, we are left to

conclude that the FACTA violation at issue constitutes a concrete injury.

78 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 79 of 148

At the final step of its analysis, the majority says Dr. Muransky failed to

establish standing in his complaint because he pled only that he suffered a FACTA

violation. Maj. Op. at 29–30. Thus, the majority reasons, Dr. Muransky violated

the requirement that pleadings must contain more than conclusory allegations of

harm. Id. (citing Ashcroft v. Iqbal, 556 U.S. 662, 678–79, 129 S. Ct. 1937, 1949–

50 (2009)). But again, when a statute itself protects a concrete interest, an

allegation that the defendant violated that statutory requirement is anything but

conclusory. See Spokeo, 136 S. Ct. at 1549 (concluding that where the statutory

right at issue itself protects a concrete interest, a plaintiff need not allege

“additional harm” beyond the statutory violation). Because the FACTA violation

alleged by Dr. Muransky itself constitutes a concrete harm, he was not required to

plead additional facts showing how a receipt revealing the first six and last four

digits of a credit card creates a risk of identity theft. 4

4 Dr. Muransky argues for the first time on appeal that he suffered an injury because, as a result of Godiva’s FACTA violation, he was forced to safeguard his receipt to keep it from falling into the hands of identity thieves. Br. of Appellee Muransky at 39–42. I agree with the majority that Dr. Muransky cannot raise this new theory of standing at this late stage. Maj. Op. at 23 (citing Salcedo v. Hanna, 936 F.3d 1162, 1173 (11th Cir. 2019)). I also agree with the majority that the viability of Dr. Muransky’s safeguarding theory is in any event bound up in whether he faced a material risk of harm. Id. However, because I would hold that Dr. Muransky did face a material risk of identity theft stemming from Godiva’s FACTA violation, I would also hold that Dr. Muransky could have proceeded on his safeguarding theory had he raised it in his complaint. 79 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 80 of 148

I return now to the lesson from Spokeo that courts deciding whether an

injury is sufficiently concrete should be guided by “history and the judgment of

Congress.” Spokeo, 136 S. Ct. at 1543. I have set out how the judgment of

Congress alone supports a finding of concreteness in this case. I now address how

history also strongly suggests that Dr. Muransky’s alleged injury is concrete.

Spokeo says courts may find an injury to be sufficiently concrete if the

“alleged intangible harm has a close relationship to a harm that has traditionally

been regarded as providing a basis for a lawsuit in English or American courts.”

Id. at 1549. In this circumstance, it is sufficient for a plaintiff, at the pleading

stage, to allege only a violation of the statutory right bearing a close relationship to

the common law harm. See Perry, 854 F.3d at 1340–41 (finding a close

relationship between violations of the Video Privacy Protection Act and the tort of

intrusion upon seclusion). The match between the statutory violation and the tort

traditionally recognized at common law need not be perfect. See Golan v.

FreeEats.com, Inc., 930 F.3d 950, 958 (8th Cir. 2019) (“An alleged harm need not

actually have been actionable at common law to satisfy this inquiry, rather it must

have a ‘close relationship’ to the type of harm that has traditionally been

recognized as actionable.”); Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th

Cir. 2017) (recognizing a close relationship between a statutory violation and

80 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 81 of 148

common law tort where the statute “codifies a context-specific extension of

the substantive right to privacy” (emphasis omitted)).

I agree with Dr. Muransky that the injury asserted here bears a close

relationship to a common law breach of confidence tort. A breach of confidence

lies where a person offers private information to a third party in confidence, and

the third party discloses that information. Alan B. Vickery, Breach of Confidence:

An Emerging Tort, 82 Colum. L. Rev. 1426, 1427–28 (1982). The basic elements

of this tort are: “(1) the plaintiff conveyed confidential and novel information to

the defendant; (2) the defendant had knowledge that the information was being

disclosed in confidence; (3) there was an understanding between the defendant and

the plaintiff that the confidence be maintained; and (4) there was a disclosure or

use in violation of the understanding.” Berkla v. Corel Corp., 302 F.3d 909, 917

(9th Cir. 2002) (quotation marks omitted). The tort of breach of confidence “‘is

rooted in the concept that the law should recognize some relationships as

confidential to encourage uninhibited discussions between the parties involved.’”

Jeffries, 928 F.3d at 1064 (quoting Young v. U.S. Dep’t of Justice, 882 F.2d 633,

640 (2d Cir. 1989)).

A breach of confidence tort is not a perfect analogue to the FACTA violation

at issue here. As the majority notes, the two ways in which a breach of confidence

tort is distinguishable from the violation alleged by Dr. Muransky are (1) that a

81 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 82 of 148

breach of confidence requires a disclosure, and Dr. Muransky has not alleged his

credit card information was disclosed to anyone; and (2) the relationship between

Dr. Muransky and Godiva is not the prototypical confidential relationship giving

rise to breach of confidence torts. Maj. Op. at 26–27. The majority seems to think

this these differences make a breach of confidence tort ill-suited to the FACTA

violation at issue here. I think not.

To begin, history may support a finding of concreteness even if a plaintiff

cannot satisfy all the elements of a closely related tort. That is because, under

Spokeo, congressionally proscribed “conduct [need not] give rise to a cause of

action under common law.” Susinno v. Work Out World Inc., 862 F.3d 346, 351

(3d Cir. 2017) (quotation marks omitted). “If a plaintiff were required to satisfy

every element of a common law cause of action before qualifying for statutory

relief, Congress’s power to ‘elevate intangible harms’ by defining injuries and

chains of causation which will ‘give rise to a case or controversy where none

existed before’ would be illusory.” Trichell v. Midland Credit Mgmt., Inc., 964

F.3d 990, 1010 (11th Cir. 2020) (Martin, J., concurring in part and dissenting in

part) (alterations adopted) (quoting Spokeo, 136 S. Ct. at 1549)).

As to Dr. Muransky’s failure to allege that Godiva disclosed his credit card

information to a third party, Spokeo also recognized that a material risk of

intangible harm is sufficient to establish a concrete injury in fact. 136 S. Ct. at

82 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 83 of 148

1549. Here, the FACTA violation alleged by Dr. Muransky posed a material risk

that his identity would be stolen, which is “the very harm the breach of confidence

tort makes actionable—an unauthorized disclosure of privileged information to a

third party.” Jeffries, 928 F.3d at 1065. Thus, the fact that Dr. Muransky did not

actually fall victim to identity theft does not preclude our court from finding that

the violation he alleged here bears a close relationship to a breach of confidence

tort.

And with respect to the relationship between Dr. Muransky and Godiva, I

recognize that the breach of confidence tort has historically applied to traditional

confidential relationships, like that between a customer and his bank. See, e.g.,

Suburban Trust Co. v. Waller, 408 A.2d 758, 761 (Md. Ct. App. 1979). But I see

no reason why a relationship between a consumer and a point-of-sale merchant

should not be viewed as confidential. When a consumer makes a purchase using a

credit or debit card, he provides confidential identifying information to a merchant.

In doing so, the consumer places trust in the merchant to safeguard that

information from potential identity thieves. 39 Weekly Comp. Pres. Doc. 1746,

1748 (noting that receipts printed by merchants “should not hold the key to [a

consumer’s] savings and financial secrets”). I therefore view the confidential

relationship been a consumer and a merchant as an appropriate “context-specific

83 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 84 of 148

extension” of a traditional breach of confidence tort. See Eichenberger, 876 F.3d

at 983.

For these reasons, I believe Dr. Muransky has alleged a concrete injury that

is closely related to a harm traditionally protected at common law. Therefore, he

was not required to allege any further harm beyond the FACTA violation asserted

in his complaint.5

Congress enacted FACTA in an effort to reduce the risk of identity theft by

requiring merchants to truncate credit card numbers on printed receipts, and in

doing so, set the tolerable level of risk at no more than the last five digits of a card

number. Dr. Muransky alleges he suffered a concrete injury when Godiva printed

the first six and last four digits of his card number. Both the common law and the

judgment of Congress support a conclusion that the FACTA violation alleged in

Dr. Muransky’s complaint constitutes a concrete injury in fact. I believe Spokeo

5 As the majority points out, Maj. Op. at 25, the parties dispute whether a breach of confidence tort was “traditionally . . . regarded as providing a basis for a lawsuit in English or American courts.” Spokeo, 136 S. Ct. at 1549. Dr. Muransky notes that English courts recognized the tort as early as 1849, see Prince Albert v. Strange, 41 Eng. Rep. 1171 (Ch. 1849), while American courts recognized the tort as early as 1894, see Corliss v. E.W. Walker Co., 64 F. 280 (C.C.D. Mass. 1894). Mr. Isaacson, meanwhile, cites an article that (a) described the tort as “emerging” as of 1982; and (b) described the tort as “dy[ing] out in its infancy” in the United States, while forming the “basis of an extensive body of law” in England. Vickery, 82 Colum. L. Rev. at 1452–54. I believe Dr. Muransky has the better of this argument. The fact that a tort did not gain prominence in the United States until the 1980s does not mean it was not traditionally regarded as providing a basis for suit. And Mr. Isaacson has failed to cite a single court decision refusing to recognize a breach of confidence tort as actionable. 84 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 85 of 148

commands us to find that Dr. Muransky has satisfied the injury in fact requirement

of Article III. I therefore respectfully dissent.

85 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 86 of 148

JORDAN, Circuit Judge, dissenting:

I join the dissents of Judges Wilson and Martin. They each demonstrate, for

different reasons, that Dr. Muransky has Article III standing based on the allegations

of his complaint. I write to make two additional points, one procedural and one

substantive.

The procedural point is that, regardless of what one thinks about the

disagreement between the majority and the dissents on Article III standing, this case

should not be dismissed outright, and at most should be remanded for further

proceedings. Assuming for the sake of argument that the majority’s view of standing

is correct, Mr. Isaacson did not raise his standing argument until the fairness hearing,

and even then, he did so only obliquely. Supreme Court precedent and procedural

fairness dictate that Dr. Muransky have an opportunity to amend his complaint or

present facts in support of standing.

Not only is dismissal unfair to Dr. Muransky, but it requires the majority to

make assumptions about the risks of identity theft without the benefit of a factual

record, expert reports, or adversarial testing of the issue in the district court. The

majority essentially relies on its common sense to conclude that when a vendor prints

a receipt displaying the first six and last four digits of a credit card number, the risk

of identity theft is “remote.” But that is a fact-based and value-laden judgment,

which appellate courts are ill-equipped to make in the abstract.

86 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 87 of 148

The result of dismissing in this procedural context is problematic for another

reason. The majority does not and cannot explain what analysis or assumptions lead

to its conclusion of remoteness, and it fails to describe the standard it applies or

delineate the boundaries of Article III jurisdiction. The majority’s “I know it when

I see it” approach to standing, cf. Jacobellis v. Ohio, 378 U.S. 184, 197 (1964)

(Stewart, J., concurring), is a problem for future litigants and courts, especially in

data privacy cases, where the harm is perhaps difficult to quantify and describe, but

which Congress has nonetheless identified and attempted to prevent by legislation.

The second point, the substantive one, concerns the doctrine of Article III

standing. That we need to resolve what is essentially a policy question to determine

the boundaries of our subject-matter jurisdiction reminds us how far standing

doctrine has drifted from its beginnings and from constitutional first principles.

Standing, as we know it today, was a twentieth-century innovation. But to the extent

that the current doctrine can be reconciled with the Constitution, it is designed to

safeguard the separation of powers between the branches of government and ensure

that courts hear—in the words of James Madison—cases only “of a Judiciary

Nature.” Cases like this one, involving the alleged invasion of a congressionally-

created private right by a private party against another private party, do not implicate

structural or institutional concerns. They are exactly the type of cases suited for

initial congressional judgment and ensuing judicial resolution.

87 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 88 of 148

There has been a long tradition—before the Founding and after—of English

and American courts hearing cases involving the invasions or violations of private

legal rights, including new private rights created by statute, regardless of whether

the plaintiff could allege some injury beyond the invasion of the right itself. The

Supreme Court’s standing cases, from the early twentieth century to the present,

have not upset that tradition.

The better way to understand standing here is not through the lens of injury-

in-fact, but under the rights-based model that Justice Thomas and others have

outlined. That framework is grounded in the traditional distinction between public

and private rights, which early American jurists understood well, and which

perseveres in other areas of law. Properly rooted in history and tradition, this rights-

based framework harmonizes modern standing doctrine with Article III. It also

offers a straightforward and consistent method for resolving difficult standing

questions, such as the one presented here, which have been unnecessarily

complicated by a narrow focus on the injury-in-fact requirement.

Under this rights-based framework, Dr. Muransky easily alleged the invasion

of a private legal right—the right to receive a receipt truncating all but the last five

digits of his credit card number. That right was supposed to inure to his benefit

under a law that Congress enacted, and the violation itself was something that a

vendor did directly to him. The violation, in other words, was personal to him. By

88 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 89 of 148

requiring Dr. Muransky to demonstrate a separate injury in this context, we turn

Article III on its head.

I

To justify dismissal, the majority argues that “[t]his is not a case where a

surprise standing issue was thrust upon an unaware plaintiff.” I strongly disagree.

Dr. Muransky never had any reason to doubt that he met his burden to establish

standing, and he was led to believe that subject-matter jurisdiction was not an issue,

even after the Supreme Court decided Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).

To see why, we must review the district court proceedings in detail and without the

benefit of hindsight.

A

Dr. Muransky filed his complaint in June of 2015. He alleged that Godiva

printed a receipt displaying the last four and first six digits of his credit card number.

He claimed, correctly, that Godiva violated the FACTA, 15 U.S.C. § 1681c(g)(1).

And he asserted that the violation burdened him and putative class members with an

“elevated risk of identity theft”—the very risk that Congress sought to mitigate when

it enacted the FACTA.

When Dr. Muransky made these allegations, he was justified in believing they

were sufficient to establish Article III standing. The majority appears to concede

this point, acknowledging that “[p]erhaps before Spokeo there was an argument that

89 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 90 of 148

[Dr.] Muransky’s claim could have survived as pleaded[.]” But this

acknowledgment is an understatement, for it was clear that standing existed. Our

own cases reiterated that “Congress may enact statutes creating legal rights, the

invasion of which creates standing, even though no injury would exist without the

statute.” Houston v. Marod Supermarkets, Inc., 733 F.3d 1323, 1330 (11th Cir.

2013) (internal quotation marks omitted). This was not surprising given cases like

Havens Realty Corp. v. Coleman, 455 U.S. 363, 373–74 (1982), which held that a

“tester” plaintiff who received false information in violation of the Fair Housing Act

had standing to sue, even though he did not intend to rent or purchase a home or

apartment and did not suffer an actual injury.

With respect to the FACTA, the Eighth Circuit had relied on Coleman to hold

that a violation of §1681c(g) was, by itself, sufficient for an Article III injury. See

Hammer v. Sam’s E., Inc., 754 F.3d 492, 498–99 (8th Cir. 2014) (“[T]he actual-

injury requirement may be satisfied solely by the invasion of a legal right that

Congress created. This is not a novel principle within the law of standing.”). Lower

courts, including one in in this circuit, had reached the same conclusion. See Amason

v. Kangaroo Exp., No. 7:09–CV–2117–RDP, 2013 WL 987935, at *6–7 (N.D. Ala.

Mar. 11, 2013); Armes v. Sogro, Inc., 932 F. Supp. 2d 931, 938 (E.D. Wis. 2013);

90 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 91 of 148

Korman v. Walking Co., 503 F. Supp. 2d 755, 759 (E.D. Pa. 2007). The majority is

mistaken in suggesting that the law in 2015 was in a state of flux. 1

Understandably, then, Godiva did not make any real attempt to challenge Dr.

Muransky’s standing. The majority points to the fact that Godiva raised standing as

an affirmative defense in its answer to the complaint, but that defense was a mere

placeholder—a single, conclusory statement that “[n]either Dr. Muransky nor any

member of the proposed class has suffered any injury in fact.” Godiva did not say

anything more, and it is not clear whether this argument was even a facial attack on

the complaint or a factual attack. The defense therefore could have been stricken as

conclusory under Rule 12(f). See, e.g., Losada v. Norwegian (Bahamas) Ltd., 296

F.R.D. 688, 690 (S.D. Fla. 2013) (“Where an affirmative defense is ‘no more than

bare bones conclusory allegations, it must be stricken.’”) (quoting Microsoft Corp.

v. Jesse’s Computers & Repair, Inc., 211 F.R.D. 681, 684 (M.D. Fla. 2002)). In any

event, Godiva never pursued the standing argument. It did not move to dismiss

under Rule 12(b)(1) for lack of jurisdiction, and instead sought to dismiss on the

merits under Rule 12(b)(6).

1 In 2016, the Eighth Circuit, in a case involving the Cable Communications Policy Act, concluded that Spokeo had abrogated its decision in Hammer. See Braitberg v. Charter Commc’ns, Inc., 836 F.3d 925, 930 (8th Cir. 2016). In light of the public-private rights framework that I discuss below, I do not believe that Braitberg is correct. In any event, Braitberg was decided more than a year after Dr. Muransky filed his complaint. 91 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 92 of 148

Likewise, the district court—which had an independent duty to ensure that it

had subject-matter jurisdiction—declined to take up standing on its own. Had the

district court considered standing to be an issue, it would have been required to give

Dr. Muransky an opportunity to present facts supporting standing and, if necessary,

to hold an evidentiary hearing. See Colonial Pipeline Co. v. Collins, 921 F.2d 1237,

1243 (11th Cir. 1991) (explaining that a district court may “hear conflicting evidence

and decide for itself the factual issues that determine jurisdiction,” but “a plaintiff

must have ample opportunity to present evidence bearing on the existence of

jurisdiction”); Bischoff v. Osceola Cnty., 222 F.3d 874, 882 (11th Cir. 2000)

(faulting the district court for making findings regarding disputed facts related to

standing without holding an evidentiary hearing).

Dr. Muransky and Godiva negotiated toward a settlement after the close of

the pleadings. As the majority points out, they negotiated in the shadow of Spokeo,

which was pending before the Supreme Court at the time. The parties recognized

that the pending case could upend standing law in the consumer privacy area, and

they sought to mitigate risk and uncertainty, which cut both ways. But at no point

was there any guarantee about what the Supreme Court would say or hold in Spokeo.

Indeed, the Ninth Circuit in Spokeo had initially ruled that Article III standing

existed. See Robins v. Spokeo, Inc., 742 F.3d 409, 414 (9th Cir. 2014). So, even

though standing may have been a background issue for the parties, it was not a

92 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 93 of 148

contested matter in the case nor a jurisdictional problem under existing law. Any

suggestion that Dr. Muransky—and only Dr. Muransky—was trying to resolve the

case before the Supreme Court decided Spokeo is misleading. Just as class action

plaintiffs try to assess risk, so too do class action defendants like Godiva. See

generally Brian T. Fitzpatrick, The Conservative Case for Class Actions 107–08

(2019).

The parties eventually came to terms. In January of 2016, the district court

granted preliminary approval of their joint motion for class certification and class

settlement. But the court still did not ask Dr. Muransky to proffer facts supporting

standing, this time as part of its review of the settlement agreement. The court

provided topics to be addressed at a fairness hearing without mentioning any

jurisdictional concerns.

In May of 2016, four months after the preliminary approval of the class

settlement, the Supreme Court issued its decision in Spokeo. And here is the key

point: the parties—including Mr. Isaacson—and the district court still remained

silent. In the four months between Spokeo and the fairness hearing in September of

2016, no one thought to address Article III standing. Godiva did not seek to

withdraw from the settlement, move to dismiss under Rule 12(b)(1), or request

summary judgment. The court did not ask for supplemental briefing on Spokeo or

93 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 94 of 148

amend its preliminary approval order to include standing as a topic to be discussed

at the fairness hearing.

Significantly, Mr. Isaacson—the objector-appellant now challenging Dr.

Muransky’s standing on appeal—did not raise standing in his written objections to

the settlement, or in any of his other papers, all of which he filed months after Spokeo

was decided. So, by the time of the fairness hearing, standing was still entirely

uncontested, as though Spokeo had no effect on the case. Dr. Muransky had no

reason to amend his complaint or proffer additional facts to move the settlement

forward to completion.

Then, at the fairness hearing in September of 2016, Mr. Isaacson mentioned

standing for the first time. But he did not say much on the topic and certainly did

not present a fully formed argument that Spokeo precluded settlement. He pondered

whether further factual inquiry was necessary before the district court approved the

settlement, but he essentially conceded that Spokeo did not warrant dismissal on the

pleadings. When the court suggested that dismissal might harm the class members,

Mr. Isaacson responded: “Potentially. And I’m not saying necessarily that that’s

what should happen.” After this exchange, Mr. Isaacson quickly moved to the merits

of the settlement under Rule 23. The court did not subsequently ask the parties to

respond to Mr. Isaacson’s musings on standing, so Dr. Muransky still had no reason

to amend his complaint or proffer additional facts.

94 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 95 of 148

Within the broader legal landscape, it made sense not to take up standing.

After Spokeo came down, but before the district court approved the settlement in

September of 2016, two other district courts in this circuit concluded that the same

allegations that Dr. Muransky made against Godiva were sufficient to establish

standing under Spokeo. See Guarisma v. Microsoft Corp., 209 F. Supp. 3d 1261,

1264–67 (S.D. Fla. 2016); Altman v. White HouseBlack Mkt., Inc., No. 15-cv-2451-

SCJ, 2016 WL 3946780, at *4-7 (N.D. Ga. July 13, 2016). Two district courts in

that same time period also concluded that plaintiffs had standing based on FACTA

violations in which the vendor printed receipts displaying credit card expiration

dates. See Flaum v. Doctor’s Assocs., Inc., 204 F. Supp. 3d 1337, 1339–42 (S.D.

Fla. 2016); Wood v. J Choo USA, Inc., 201 F. Supp. 3d 1332, 1340 (S.D. Fla. 2016).

We addressed Spokeo only once in the four-month period leading up to the

final approval of the settlement. In Church v. Accretive Health, Inc., 654 F. App’x

990, 994–95 (11th Cir. 2016), an unpublished decision, we held that a plaintiff had

established a concrete injury based solely on an allegation that a debt collector sent

her a letter omitting required information under the Fair Debt Collection Practices

Act. The plaintiff “alleged an injury to her statutorily-created right to information,”

which was itself sufficient for Article III standing, without regard to whether she

alleged any additional injury. See id. This was not the type of “bare procedural

95 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 96 of 148

violation” discussed in Spokeo, but the invasion of a substantive right, which by

itself provided standing. See id. at 995 n.2.

Some district courts in our circuit eventually came to the opposite conclusion

regarding Article III standing and violations of the FACTA. But those cases were

decided after the settlement at issue here had been approved. See Tarr v. Burger

King Corp., No. 17-23776-CIV, 2018 WL 318477, at *1 (S.D. Fla. Jan. 5, 2018);

Gesten v. Burger King Corp., No. 17-22541-CIV, 2017 WL 4326101, at *4–6 (S.D.

Fla. Sept. 27, 2017). The same is true of the cases from our sister circuits that the

majority now cites as persuasive authority, three involving credit card numbers and

three involving expiration dates. All six decisions were handed down after

September of 2016. See Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 106, 119 (3d

Cir. 2019) (credit card number); Noble v. Nevada Checker Cab Corp., 726 F. App’x

582, 583–84 (9th Cir. 2018) (credit card number); Katz v. Donna Karan Co., LLC,

872 F.3d 114, 117, 121 (2d Cir. 2017) (credit card number); Bassett v. ABM Parking

Servs., Inc., 883 F.3d 776, 783 (9th Cir. 2018) (expiration date); Crupar-Weinmann

v. Paris Baguette Am., Inc., 861 F.3d 76, 81–82 (2d Cir. 2017) (expiration date);

Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016)

(expiration date / decided December 13, 2016). We also had not yet issued Nicklaw

v. CitiMortgage, Inc., 839 F.3d 998, 1000–03 (11th Cir. 2016) (decided October 6,

2016), a standing decision on which the majority also relies.

96 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 97 of 148

The district court approved the settlement shortly after the fairness hearing,

believing it had jurisdiction—correctly, given the existing legal landscape. Mr.

Isaacson appealed, and only then did he launch his full-throated attack against Dr.

Muransky’s standing (even though he had several months to make his arguments in

his written objections to the settlement). His initial brief was the first time that any

party briefed standing in this case or offered any meaningful argument as to why

Spokeo required dismissal of Dr. Muransky’s class complaint.2

B

Aware of this procedural history, the majority directs the dismissal of the

complaint, arguing that it was Dr. Muransky’s burden to prove standing and that he

should have known to “firm up” his jurisdictional allegations. That, I think, amounts

2 For the reasons I explained in my panel concurrence, see Muransky v. Godiva Chocolatier, Inc., 922 F.3d 1175, 1197–99 (11th Cir. 2019) (Jordan, J., concurring), I continue to doubt that Mr. Isaacson has standing on appeal to litigate for an outright dismissal of the case based on lack of subject-matter jurisdiction. Although we have an independent duty to ensure our jurisdiction and that of the district court, Mr. Isaacson decided not to opt out of the class and, rather than use the appeal to fine-tune the settlement in his favor, he is now attempting to wipe out the settlement entirely, even though it benefits him. The fact that Mr. Isaacson omitted any mention of Article III standing in his written objections to the settlement or in his other papers, all of which he filed several months after Spokeo, makes me further question the propriety of his litigation strategy. Mr. Isaacson makes 52-pages- worth of very specific arguments about Article III, Spokeo, and the FACTA in his initial brief, but he did not make a single one of these points in his objections to the class settlement and waited until the fairness hearing to raise only abstract concerns about standing. So either Mr. Isaacson is attempting to sandbag Dr. Muransky by waiting until appeal to articulate his arguments—in which case we should remand, if only to discourage such tactics—or he genuinely did not believe that his arguments were winners at the time given the legal landscape—in which case we should also remand because, just as Mr. Isaacson would have had no reason to raise the arguments, Dr. Muransky would have had no reason to anticipate them.

97 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 98 of 148

to Monday-morning quarterbacking. The majority’s decision to dismiss, in this

procedural context, is mistaken.

For one, it is not fair to expect parties to anticipate changes in the law and then

dismiss their case if they fail to do so. The proper resolution in that scenario is to

remand. See Deffenbaugh-Williams v. Wal-Mart Stores, Inc., 188 F.3d 278, 282 (5th

Cir. 1999) (“When law changes in unanticipated ways during an appeal . . . this court

will generally remand for a new trial to give parties the benefit of the new law and

the opportunity to present evidence relevant to that new standard. The motivation

of this rule is fairness: to prevent injustice to a party who had no reason to expect a

changed rule at the time of trial.”). Although our law on the FACTA did not change

during the pendency of this appeal, it has now changed at the end of the appeal. That

is, the majority’s decision is itself an expansion of Spokeo, which Dr. Muransky (and

Godiva, the district court, and other district courts in this circuit) had no reason to

expect or predict. Spokeo did not involve § 1681c(g)(1), the provision of the

FACTA at issue here, and the Supreme Court did not even decide the standing issue

before it. The Supreme Court reversed the Ninth Circuit because it failed to address

“concreteness” as a distinct requirement of an Article III injury. See 136 S. Ct. at

98 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 99 of 148

1550. But it remanded without deciding the issue of whether the plaintiff adequately

alleged an injury in fact. See id. 3

We have reiterated that “a plaintiff must have ample opportunity to present

evidence bearing on the existence of jurisdiction.” Colonial Pipeline, 921 F.2d at

1243–44. The Supreme Court followed the same path in Alabama Legislative Black

Caucus v. Alabama, 575 U.S. 254, 268– 71 (2015). In that case, a three-judge district

court sua sponte held that an organizational plaintiff lacked standing to sue Alabama

for racial gerrymandering because it did not proffer evidence that its members

resided in the relevant voting districts. See id. at 268–29. Alabama had only

challenged the individual co-plaintiffs’ standing, arguing that none claimed to live

in those districts. See id. at 270. Based on this challenge to its co-plaintiffs’

standing, the organization probably should have been aware of potential problems

with its own standing. But it did not take the opportunity to obviate the issue with

evidence of where its own members resided.

Rather than dismiss, the Supreme Court reversed and remanded so that the

organization could establish its standing. See id. at 271. It noted that certain

deposition testimony supported an “inference” that the organization had members in

the relevant districts, and that the inference was “strong enough to lead the

3 The Ninth Circuit on remand concluded that the plaintiff alleged a concrete injury. See Robins v. Spokeo, Inc., 867 F.3d 1108, 1118 (9th Cir. 2017).

99 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 100 of 148

[organization] reasonably to believe that, in the absence of a state challenge or a

court request for more detailed information, it need not provide additional

information such as a specific membership list.” Id. at 269–270. Had its standing

been directly challenged, i.e., “had it been asked,” then the organization could have

provided more evidence, such as a member residency list. See id. at 270–71. But

“elementary principles of procedural fairness” mandated that the organization have

“an opportunity to provide evidence of” standing. See id. at 271. I don’t understand

why those principles don’t warrant the same result here.

In two similar FACTA cases—Katz, 872 F.3d at 121, and Crupar-Weinmann,

861 F.3d at 81–82—the Second Circuit had remanded to give the plaintiffs an

opportunity to replead or proffer additional facts after Spokeo came down. See

Cruper-Weinmann v. Paris Baguette Am., Inc., 653 F. App’x 81, 82 (2d Cir. 2016)

(remanding the consolidated cases “to allow the district courts to address any

standing questions in the first instance”). The plaintiffs “did not seek the opportunity

to supplement the record with additional evidence,” however, and failed to carry

their burden on remand, which is why the majority now cites to these cases as

persuasive authority. But the key point is that the Second Circuit first gave the

plaintiffs an opportunity to adapt to the shifting law of standing. Indeed, the Second

Circuit recognized that there was confusion after Spokeo and cautioned courts to put

plaintiffs on “renewed notice of both the right to introduce such evidence and the

100 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 101 of 148

plaintiff’s burden of proof to do so even at the motion-to-dismiss stage.” Katz, 872

F.3d at 121.

Dr. Muransky was not given adequate notice at any stage of the proceedings

that Spokeo undermined his standing. To the contrary, he was led to believe, by the

contemporaneous legal authority and the parties’ silence after Spokeo, that standing

was not an issue. Mr. Isaacson’s muted observations about standing at the fairness

hearing did not alter this reality. In sum, Dr. Muransky had no reason to amend his

complaint or proffer additional facts. Outright dismissal at this stage is wrong, and

the majority offers no persuasive reasons why remand is inappropriate.

C

In addition to ensuring procedural fairness, there are important institutional

and precedential reasons for us to remand rather than dismiss.

I focus here on Dr. Muransky’s allegation that he and class members face an

increased risk of identity theft, even though I do not believe that this is the only basis

for standing. As Judges Wilson and Martin correctly explain, and as I describe

further below, Dr. Muransky suffered a violation of a substantive legal right (that is,

a private, congressionally-created right), which is sufficient to establish standing.

But even assuming that Godiva’s FACTA violation was merely “procedural,” as the

majority contends, Dr. Muransky would still have standing because he faced a “risk

101 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 102 of 148

of real harm.” Spokeo, 136 S. Ct. at 1549 (citing Clapper v. Amnesty Int’l USA, 568

U.S. 398 (2013)).

The majority acknowledges this point, but still dismisses at the pleading stage

in the face of a plausible allegation of an increased risk of a real harm—identity

theft. Dr. Muransky’s allegation was not conclusory, as the majority states, but was

a general factual contention subject to proof or disproof with evidence at later stages

of litigation. The Supreme Court has made this point repeatedly, but the majority

acts as if the Court’s decisions were written in vanishing ink. See Lujan v. Defs. of

Wildlife, 504 U.S. 555, 561 (1992) (explaining that “general factual allegations of

injury” suffice at the pleading stage and that the plaintiff must substantiate general

claims with “specific facts” at later stages of litigation); Lucas v. S.C. Coastal

Council, 505 U.S. 1003, 1012–13 n.3 (1992) (“Lujan, since it involved the

establishment of injury in fact at the summary judgment stage, required specific facts

to be adduced by sworn testimony; had the same challenge to a generalized

allegation of injury in fact been made at the pleading stage, it would have been

unsuccessful.”); Steel Co. v. Citizens for a Better Environment, 523 U.S. 83, 103

(1998) (explaining that courts “must presume that the general allegations in the

complaint encompass the specific facts necessary to support those allegations” of

jurisdiction). See also Bennett v. Spear, 520 U.S. 154, 165–169 (1997) (explaining

102 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 103 of 148

that the burden for establishing jurisdiction at the pleading stage is “relatively

modest”).4

Dr. Muransky’s claim to an elevated risk of identity theft is plausible on its

face and bolstered by his allegations that identity theft is pervasive in his area and

that Godiva had already been the target of hackers. When we properly construe all

reasonable inferences in his favor, see, e.g., Hi-Tech Pharm., Inc. v. HBS Int’l Corp.,

910 F.3d 1186, 1193 (11th Cir. 2018), it is fair to conclude that a receipt displaying

the ten digits of a credit card number made it more likely that identity thieves

(concentrated in his area) could obtain that information and use it to steal his identity.

The majority may doubt that Dr. Muransky will be able to prove that the risks are

truly substantial, but that is not a reason to dismiss the complaint. See Twombly, 550

U.S. at 556 (“[A] well-pleaded complaint may proceed even if it strikes a savvy

judge that actual proof of those facts is improbable[.]”).

The majority, in other words, fails to appreciate the distinction between a

substantive standing requirement—that the plaintiff must demonstrate a substantial

risk of a future injury—with the procedural principle that an allegation need only be

4 Several of our own cases—including some decided after Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007)—make the same point. See Wilding v. DNC Servs. Corp., 941 F.3d 1116, 1124 (11th Cir. 2019) (explaining that general factual allegations of an Article III injury suffice at the pleading stage because we presume that the general allegations “embrace those specific facts that are necessary to support the claim”) (internal quotation marks omitted). Accord Mulhall v. UNITE HERE Local 355, 618 F.3d 1279, 1286 (11th Cir. 2010); Amnesty Int’l, USA v. Battle, 559 F.3d 1170, 1177 (11th Cir. 2009); Bischoff, 222 F.3d at 878. But they too appear to mean little to the majority.

103 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 104 of 148

plausible at the pleading stage. Indeed, not one of the cases that majority cites for

the proposition that a risk of harm must be “substantial” requires that a plaintiff

prove or describe substantiality at the pleading stage, or even allege the precise

degree of risk of harm. To the contrary, the cases either accept the general

allegations of an elevated risk at the pleading stage, or they accept or reject standing

at the summary judgment stage based on the record evidence. See Dep’t of

Commerce v. New York, 139 S. Ct. 2551, 2565 (2019) (relying on the district court’s

findings of fact at a bench trial to conclude that the plaintiffs had standing); Susan

B. Anthony List v. Driehaus, 573 U.S. 149, 161 (2014) (accepting standing at the

pleading stage based on the plaintiffs’ allegations that they intended to engage in

conduct proscribed by the challenged statute); Clapper, 568 U.S. at 412 (holding

that the plaintiffs lacked standing because they “set forth no specific facts [at

summary judgment] demonstrating that the communications of their foreign contacts

will be targeted”); Pennell v. City of San Jose, 485 U.S. 1, 7–8 (1988) (accepting

standing based only on the allegation that the plaintiffs were “subject to the terms”

of the challenged ordinance); Blum v. Yaretsky, 457 U.S. 991, 1001 (1982)

(dismissing certain claims and explaining that “[n]othing in the record” shows that

the plaintiffs had been “threatened” with the alleged harm). Cf. Thole v. U. S. Bank

N.A, 140 S. Ct. 1615, 1621–22 (2020) (rejecting an increased-risk-of-harm theory of

104 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 105 of 148

standing offered by amici, as the plaintiffs did not assert that theory and did not

allege a substantially increased risk of harm in their complaint).

To dismiss at the pleading stage, the majority must fall back on its common

sense and intuition to conclude that Dr. Muransky’s risk of identity theft is “remote.”

But that conclusion is factual in nature and cannot be based on common sense. All

that common sense can really tell us at this point is that the more private information

is displayed, the more likely it is to be obtained and used to steal one’s identity. Cf.

Redman v. RadioShack, Corp., 768 F.3d 622, 626 (7th Cir. 2014) (“[T]he less

information the receipt contains the less likely is an identity thief who happens to

come upon the receipt to be able to figure out the cardholder’s full account

information and thus be able to make purchases[.]”). Common sense, no matter how

acute, cannot pinpoint the degree of elevated risk caused by a FACTA violation, nor

can it assist us in determining whether an elevated risk of identity theft is

“substantial.” When the majority concludes that Dr. Muransky’s risk is “remote,”

that conclusion must be based on some unknown underlying premise or assumed

facts. 5

5 The Supreme Court may have thought that it was helping courts apply Twombly by allowing them to use their common sense at the pleading stage. See Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009). But this case demonstrates that judicial common sense has its own problems. See, e.g., David L. Noll, The Indeterminacy of Iqbal, 99 Geo. L.J. 117, 138 (2010) (“If judicial experience and common sense constitutes a license to rely on broad new categories of extrinsic information at a motion to dismiss, the critics’ fears that motion to dismiss practice will be unduly influenced by individual judges’ differing views of life, the universe, and everything may be

105 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 106 of 148

The majority appears to recognize that its conclusion is fundamentally factual.

It points out, for example, that “[a]ccording to [Mr.] Isaacson . . . the extra numbers

on [Dr.] Muransky’s receipt merely contain information that is already allowed to

be printed on it elsewhere—the card issuer, for example.” The majority also

acknowledges Dr. Muransky’s counterargument, noting that, “[f]or his part, [Dr.]

Muransky argues that the six digits do contain information that can be exploited by

identity thieves, such as the card level or industry program, and that access to it

enables identity thieves to conduct ‘phishing inquiries.’” But the majority does not

resolve these competing factual claims because it cannot sit as a trier of fact on a

barren evidentiary record.

The majority also cites to Katz, 872 F.3d at 120, quoting it for the proposition

that the printing of “the first six digits of a credit card . . . is the equivalent of printing

the name of the issuing institution.” As Judge Martin explained in the second panel

majority opinion, however, we cannot impose factfinding from another district court

on Dr. Muransky: “Judicial notice of another court’s opinion takes notice of the

warranted.”) (internal quotation marks and citation omitted); Ion Meyn, The Haves of Procedure, 60 Wm. & Mary L. Rev. 1765, 1806 (2019) (“Iqbal instructs a judge to rely on her experience and common sense in determining plausibility, inviting judicial bias to inform whether a case remains on the docket.”); Access to Justice Denied: Ashcroft v. Iqbal: Hearing Before the Subcomm. on the Constitution, Civil Rights, and Civil Liberties of the H. Comm. on the Judiciary, 111th Cong. 17 (2009) (statement of Arthur Miller, Professor, New York University School of Law) (“The subjectivity at the heart of Twombly-Iqbal raises the concern that rulings on motions to dismiss may turn on individual ideology regarding the underlying substantive law, attitudes toward private enforcement of federal statutes, and resort to extra-pleading matters hitherto far beyond the scope of a Rule 12(b)(6) motion to dismiss.”).

106 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 107 of 148

existence of the opinion, which is not subject to reasonable dispute over its

authenticity, but not of the facts summarized in the opinion.” Muransky, 922 F.3d

at 1190 (quoting McIvor v. Credit Control Servs., Inc., 773 F.3d 909, 914 (8th Cir.

2014)). It has been the law of this circuit for at least 25 years that the factual findings

contained in a court order or opinion (1) cannot be judicially noticed by another

court, and (2) constitute inadmissible hearsay if they are offered for the truth of the

matter asserted. See United States v. Jones, 29 F.3d 1549, 1553–54 (11th Cir. 1994)

(“If it were permissible for a court to take judicial notice of a fact merely because it

has been found to be true in some other action, the doctrine of collateral estoppel

would be superfluous. . . . [T]he plain language of Rule 803(8)(C) [of the Federal

Rules of Evidence] does not apply to judicial findings of fact.”).

The majority’s fact-borrowing from Katz is especially problematic because

the Second Circuit “admitted[ ] [that] the fact-finding procedure below was more

abbreviated than might be conventionally expected,” and that “the plaintiff did not

seek the opportunity to supplement the record with additional evidence.” Katz, 872

F.3d at 120, 121. And, as Judge Martin explained in the first panel majority opinion,

this factual proposition originally came from one expert’s declarations submitted in

two district court cases more than a decade ago, which have not since been

challenged “in light of technological changes related to brute-force cryptological

attack on credit card numbers.” Muransky v. Godiva Chocolatier, Inc., 905 F.3d

107 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 108 of 148

1200, 1213–14 (11th Cir. 2018) (citing Bateman v. Am. Multi-Cinema, Inc., 252

F.R.D. 647, 651 (C.D. Cal. 2008), rev’d and remanded, 623 F.3d 708 (9th Cir. 2010),

and Lopez v. KB Toys Retail, Inc., 2:07–cv–00144, Dkt. No. 28 at 5 (C.D. Cal. July

17, 2007)).

It is not clear—at least to me—how these factual assertions influence the

majority’s assessment of the risks. For the majority quickly pulls back and says that

the factual dispute is “beside the point” because Dr. Muransky failed to plead the

“specific risks from the sequence of numbers included on his receipt, and did not

address the issue before the district court at any time.” But, again, Dr. Muransky

did not amend his pleadings or address the issue in the district court because he had

no opportunity or any reason to do so, either before or after Spokeo. And, in any

event, his general allegations suffice at the pleading stage.6

6 Assuming that it is correct in saying that the risk of identity theft is remote, the majority fails to consider how damaging and costly identity theft can be to a victim. It is not unreasonable to imagine losses in the hundreds or thousands of dollars, factoring in the value of lost time, attorneys’ fees, and actual monetary loss. Even a 1 in 100 chance of that event occurring—i.e., a remote risk—is still “substantial” because it could lead to a significant mathematical loss. See Jonathan Remy Nash, Standing’s Expected Value, 111 Mich. L. Rev. 1283, 1297–98 (2013). See also Nat. Res. Def. Council v. EPA, 464 F.3d 1, 7 (D.C. Cir. 2006) (concluding that a plaintiff organization had standing to challenge an EPA rule: “The lifetime risk that an individual will develop nonfatal skin cancer as a result of EPA’s rule is about 1 in 200,000 . . . Even if a quantitative approach is appropriate—an issue on which we express no opinion—this risk is sufficient to support standing.”). This is why people spend money, lots of it, to protect against identity theft. Of course, Dr. Muransky does not need to allege a hypothetical loss amount, as there is no way for him to predict how much he would or could lose or spend due to identity theft. But if the majority is going to rely on its non-empirical intuition to determine the materiality of threatened injuries, it ought to incorporate other reasonable assumptions about the financial and psychological magnitude of those threatened injuries.

108 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 109 of 148

This brings me to the institutional and precedential concerns with the

majority’s failure to remand. As an appellate court we are not suited to resolve

factual disputes bearing on jurisdiction in the first instance. See Lewis v. Cont’l Bank

Corp., 494 U.S. 472, 481 (1990) (“[W]henever possible . . . the evaluation of such

factual contentions bearing upon Article III jurisdiction should not be made by this

Court in the first instance.”); Connecticut v. Am. Elec. Power Co., 582 F.3d 309, 347

(2d Cir. 2009) (noting that the causation prong of Article III standing “is an issue

best left to the rigors of evidentiary proof at a future stage of the proceedings, rather

than dispensed with as a threshold question of constitutional standing”), rev’d on

other grounds, 131 S. Ct. 2527 (2011). Yet this case clearly turns on factual

questions, as the majority seems to recognize. Whether the extra numbers on a

receipt reflect the credit card brand, or whether the digits can be exploited for

“phishing inquiries,” for example, are precisely the types of questions that must be

resolved prior to determining whether a risk of identity theft is substantial. These

questions should be addressed in an adversarial posture in the district court, with

evidence and experts, and an evidentiary hearing if necessary, but not on appeal in

the first instance.

The Second Circuit recognized as much in Katz, explaining that jurisdictional

discovery and evidentiary production would be necessary to resolve fact-based

standing challenges to FACTA claims. See 872 F.3d at 120–21. With respect to

109 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 110 of 148

information privacy statutes more generally, it noted that a “fact-finding hearing

with expert witness testimony may very well be appropriate, depending on the

novelty of the issue, the extent of the material dispute of facts, and the statutory

prohibition in question.” Id.

The majority ignores this lesson from Katz, as it confronts a complex and

novel question about credit card numbers and the risk of identity theft. The majority

tries to take the question head on, but without a factual record it can only venture a

guess in the abstract and therefore cannot explain the logic underlying its decision.

The result is that it cannot meaningfully describe the applicable standard or offer any

guidance for litigants or courts.

The majority tries to offer some suggestions, but they are vague and not of

any help to Dr. Muransky—should he decide to refile—or other litigants who may

sue for FACTA violations. For example, the majority asks for more “insight” into

the elevated risks of harm at the pleading stage. But how does one more precisely

describe a “risk” of something like identity theft, which is perpetrated by criminals,

and what level of detail is needed? Percentages? Anecdotal information? Empirical

data? Law-enforcement reports? Affidavits of IT consultants or reformed hackers?

The majority cannot say. By demanding more facts beyond the allegation of a risk

of harm, the majority comes close to returning us to the fact-pleading regime of a

bygone era. See Casillas v. Madison Ave. Assocs., Inc., 926 F.3d 329, 340 (7th Cir.

110 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 111 of 148

2019) (Wood, J., dissenting from denial of rehearing en banc) (“In demanding proof

of injury, we need to guard against pushing a merits judgment into the Article III

injury-in-fact inquiry [and] to be sure that we are not returning to a fact pleading

regime[.]”). Yet the Supreme Court has told us that Twombly and its progeny do not

require hyper-detailed allegations. See Johnson v. City of Shelby, 574 U.S. 10, 12

(2014) (“Having informed the city of the factual basis for their complaint, [the

plaintiffs] were required to do no more to stave off threshold dismissal for want of

an adequate statement of their claim.”).

As this all demonstrates, Dr. Muransky cannot possibly make his allegations

anymore “clearly and specifically,” as the majority requires. Detailed allegations

about who, what, when, or how his identity could be stolen in the future would be

speculation, as Dr. Muransky is alleging an injury, in part, based on a risk of a future

event. But Congress has already explained that “[e]xperts in the field agree that

proper truncation of the card number . . . prevents a potential fraudster from

perpetrating identity theft or credit card fraud,” Credit and Debit Card Receipt

Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(6), 122 Stat. 1565, and that is

exactly what Dr. Muransky is trying to prevent. See Spokeo, 136 S. Ct. at 1549

(explaining that Congress can “articulate chains of causation that will give rise to a

case or controversy where none existed before”). It is befuddling why the majority

111 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 112 of 148

treats Congress’ findings about the risk of identity theft in the FACTA with such

skepticism.7

The majority also suggests that Dr. Muransky should have “indicate[d] how

much risk” of identity theft the FACTA violation caused. But it does not and cannot

specify what probability standard would meet its threshold (nor does it incorporate

the magnitude of the injury into the mathematical loss, as noted above). Future

litigants will have to guess a number, and then hope that it matches the next panel’s

definition of “substantial.” So much for guidance.

And what is the precedential effect of this case? Assume that Dr. Muransky

estimates that his risks of identity theft increased by 25% due to the FACTA

7 In a number of cases, the Supreme Court has relied on and deferred to congressional findings with respect to the harms caused by certain conduct. See Turner Broad. Sys., Inc. v. F.C.C., 520 U.S. 180, 196 (1997) (“We owe Congress’ findings an additional measure of deference out of respect for its authority to exercise the legislative power. Even in the realm of First Amendment questions where Congress must base its conclusions upon substantial evidence, deference must be accorded to its findings as to the harm to be avoided and to the remedial measures adopted for that end, lest we infringe on traditional legislative authority to make predictive judgments when enacting nationwide regulatory policy.”); Gonzales v. Carhart, 550 U.S. 124, 165 (2007) (deferring to congressional findings about the harms to society and the medical profession caused by partial-birth abortion); Tennessee v. Lane, 541 U.S. 509, 526–28 (2004) (deferring to congressional findings regarding discrimination against persons with disabilities in the provision of public services in support of its exercise of power under § 5 of the Fourteenth Amendment). The Court has been especially deferential to congressional fact-finding with regard to complex problems and empirical questions. See Columbia Broad. Sys., Inc. v. Democratic Nat. Comm., 412 U.S. 94, 103 (1973) (“[W]hen we face a complex problem with many hard questions and few easy answers we do well to pay careful attention to how the other branches of Government have addressed the same problem.”). That cautious deference ought to apply in the standing context as well, particularly when standing is based on empirical questions about data privacy. See Autolog Corp. v. Regan, 731 F.2d 25, 31 (D.C. Cir. 1984) (“[W]e must give great weight to this congressional finding in our standing inquiry.”).

112 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 113 of 148

violation, and he refiles making that exact allegation. Would the district court still

be required to dismiss based on today’s holding that a receipt displaying the first six

and last four digits creates only a “remote” risk? And what if a future litigant alleges

that a vendor printed 12 out of 16 digits (or 14 out of 16 digits) of his credit card

number; would that allegation suffice? Apparently 16 out of 16 digits is enough at

the pleading stage, see Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1066 (D.C.

Cir. 2019), but then why not 15? And if not 15, then why not 14, 13, etc.? At what

point would the majority draw the line between Jeffries—where the identity thief

apparently had “sufficient information” to defraud the plaintiff—and a case where

the identity thief would not have sufficient information?

From my perspective, these are inevitable consequences of the standing

framework that the majority derives from Spokeo, a problem which I explain in more

detail below. But in a post-Spokeo world, if we are going to take on “a robust judicial

role” in assessing risks of harm to plaintiffs and push legislative findings to the side,

then we should endeavor to conduct a careful analysis with as much information as

possible. That is particularly necessary in complex areas like consumer and

informational privacy, where problems are not easily resolved by so-called common

sense. See Katz, 872 F.3d at 120–21.

There is no shame in admitting our institutional limitations and taking up these

issues at a later stage on a complete record. The Supreme Court frequently remands

113 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 114 of 148

when faced with these types of questions, recognizing that Article III standing is a

malleable and evolving area of law. In Frank v. Gaos, 139 S. Ct. 1041, 1043 (2019),

for example, the Supreme Court granted certiorari to review whether a cy pres class

settlement was “fair, reasonable, and adequate” under Rule 23. But the Court

determined that there were “substantial questions about whether any of the named

plaintiffs ha[d] standing to sue” in light of Spokeo. See id. at 1043–44. The Court

requested supplemental briefing on the issue, but it concluded that the briefs raised

a “wide variety of legal and factual issues.” Id. at 1046. Rather than pass on these

novel standing issues itself, the Supreme Court remanded for further proceedings.

See id. The procedure that was good for the Supreme Court in Gaos should be good

enough for us.

Similarly, in Gill v. Whitford, 138 S. Ct. 1916, 1931–33 (2018), the Supreme

Court concluded that the plaintiffs in a voting rights case had not established an

Article III injury. But rather than direct dismissal, it remanded “so that the plaintiffs

may have an opportunity to prove concrete and particularized injuries using evidence

. . . that would tend to demonstrate a burden on their individual votes.” Id. at 1934.

Even though those plaintiffs had been given an opportunity to develop the record

(unlike Dr. Muransky), the Court was still wary of dismissal because the case

involved an “unsettled kind of claim [it] ha[d] not agreed upon, the contours and

114 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 115 of 148

justiciability of which are unresolved.” Id. Why the Gill approach is inappropriate

here remains a mystery.

Whether the Supreme Court remands out of fairness or caution, or some

combination of both, we ought to proceed accordingly. If we do not affirm, we

should instead treat this case as having properly survived the pleading stage and give

Dr. Muransky an opportunity to support his Article III standing with additional

allegations or evidence. He may or may not be able to carry that burden, but he is

owed the chance. If we take up the standing issue at a later time, moreover, we can

do so on a developed factual record and with the benefit of adversarial framing of

the factual issues. This will lead to a more precise and detailed opinion on our part,

which will inure to the benefit of future litigants and courts, who may be wondering

what exactly we have decided.

II

Although remanding this case would mitigate some of the problems of the

majority’s decision, a better outcome would be to affirm based on the public-private

rights framework that Justice Thomas outlined in his concurrence in Spokeo and

others have echoed. “Private rights” are those “belonging to individuals, considered

as individuals.” Spokeo, 136 S. Ct. at 1551 (Thomas, J., concurring) (quoting 3

William Blackstone, Commentaries *2 (1768)). Public rights are those “owed ‘to

115 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 116 of 148

the whole community, considered as a community, in its social aggregate capacity.’”

Id. (quoting 4 William Blackstone, Commentaries *5 (1769)).

Dr. Muransky alleged that Godiva violated his congressionally-created private

right—the right of individual “cardholders” to receive receipts truncating all but the

last five digits of their credit card number. See 15 U.S.C. § 1681c(g)(1). Cf. Spokeo,

136 S. Ct. at 1553–54 (Thomas, J., concurring) (concluding that § 1681e(b) of the

Fair Credit Reporting Act arguably confers private rights because it requires

reporting agencies to “follow reasonable procedures to assure maximum possible

accuracy of the information concerning the individual about whom the report

relates”); Gaos, 139 S. Ct. at 1047 (Thomas, J., dissenting) (concluding that the

Stored Communications Act confers a private right insofar as it prohibits electronic

service providers from “knowingly divulg[ing] . . . the contents of a communication’

sent by a ‘user,’ ‘subscriber,’ or ‘customer’ of the service”). For that reason alone,

Dr. Muransky has Article III standing to proceed with this lawsuit.

The Constitution provides that “[t]he judicial Power shall extend to all Cases,

in Law and Equity, arising under . . . the Laws of the United States[.]” U.S. Const.

Art. III, § 2. Because there was little discussion about this provision at the

Constitutional Convention, and because the text does not lead to any “linguistically

inevitable conclusion,” Antonin Scalia, The Doctrine of Standing as an Essential

116 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 117 of 148

Element of the Separation of Powers, 17 Suffolk U. L. Rev. 881, 882 (1983), the

Supreme Court has looked instead to the common law to define the scope of Article

III jurisdiction. See Coleman v. Miller, 307 U.S. 433, 460 (1939) (separate opinion

of Frankfurter, J.) (“Judicial power could come into play only in matters that were

the traditional concern of the courts at Westminster and only if they arose in ways

that to the expert feel of lawyers constituted ‘Cases’ or ‘Controversies.’”). Indeed,

in modern cases where the common law in the eighteenth century recognized a cause

of action, the Supreme Court has held that Article III standing exists. See Vt. Agency

of Nat. Res. v. U.S. ex rel. Stevens, 529 U.S. 765, 774, 777 (2000) (holding that a qui

tam relator has Article III standing in part because qui tam actions were “cases and

controversies of the sort traditionally amenable to, and resolved by, the judicial

process,” as evidenced by “the long tradition of qui tam actions in England and the

American Colonies”) (internal quotation marks omitted).

The common law provides a clear answer for this case. English courts at

common law heard suits involving private rights, regardless of whether the plaintiff

suffered actual damage, as was true, for example, in cases of trespass, assault, and

battery. See, e.g., Entick v. Carrington, 2 Wils. K. B. 275, 291, 95 Eng. Rep. 807,

817 (1765) (“[W]hen one man placed his foot on another’s property, the property

owner needed to show nothing more to establish a traditional case or controversy.”);

3 Blackstone, Commentaries *124 (explaining that with respect to assault, “no actual

117 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 118 of 148

suffering is proved, yet the party injured may have redress,” and as to battery, every

unlawful touching is actionable, whether “accompanied with pain . . . [or] attended

with none”).

That tradition continued in early America. Jurists understood that a plaintiff

alleging the violation of a private right had a justiciable case, regardless of whether

he could demonstrate actual damage. See Webb v. Portland Manufacturing Co., 29

F. Cas. 506, 509 (C.C.D. Me. 1838) (Story, J.) (explaining that “whenever there is a

clear violation of a right, it is not necessary in an action of this sort to show actual

damage” because “every violation imports damage; and if no other be proved, the

plaintiff is entitled to a verdict for nominal damages.”). The principle was repeated

in state courts and treatises throughout the nineteenth century. See, e.g., Parker v.

Griswold, 17 Conn. 288, 302–03 (1845) (explaining that where there has been a

violation of a right, a person is entitled at least to nominal damages “to vindicate the

right which has been invaded,” and for that reason, he may sustain an action of

trespass “although he shows no actual specific damage to have thereby accrued to

him”); Blanchard v. Baker, 8 Me. 253, 269 (1832) (“[O]ne commoner might

maintain an action against another, for an injury to his right, without proof of actual

damage.”); 1 Theodore Sedgwick, Measure of Damages 43–44 (5th ed. 1869)

(explaining that wherever “the invasion of a right is established, the English law

118 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 119 of 148

infers some damage to the plaintiff; and if no evidence is given of any particular

amount of loss, it declares the right by awarding what it terms nominal”).

It was also understood that Congress could create private rights by statute and

that a plaintiff could sue based on a violation of that statutory right without regard

to actual damages. See Thomas M. Cooley, The Law of Torts 271 (2d ed. 1888)

(explaining that where “statutes fix a minimum of recovery. . . there would seem to

be no doubt of the right of one who establishes a technical ground of action to

recover this minimum sum without any specific showing of loss”). As Theodore

Sedgwick explained in his influential treatise on damages, the question was whether

the statute “obviously prohibited [an act] for the protection of a particular party”; if

it did, “then it [was] not necessary [for the protected party] to allege special damage.”

1 Sedgwick, Measure of Damages, at 661 (quoting Chamberlaine v. Chester &

Birkenhead R. Co., 154 Eng. Rep. 371, 1 Exch. R. 870 (1848)).

In the Copyright Act of 1790, for example, the First Congress imposed

statutory damages on those infringing on an individual’s patent, even if the patent-

holder could not show monetary loss. See Act of May 31, 1790, ch. 15, § 2, 1 Stat.

124, 124–25. Justice Story, riding circuit, presided over a case in which the

defendant infringed on a patent by building a similar machine. See Whittemore v.

Cutter, 29 F. Cas. 1120 (C.C.D. Mass. 1813) (Story, J.). The defendant argued that

“the making of a machine cannot be an offence, because no action lies, except for

119 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 120 of 148

actual damage, and there can be no actual damages, or even a rule for damages, for

an infringement by making a machine.” Id. at 1121. Justice Story rejected this

argument: “[W]here the law gives an action for a particular act, the doing of that act

imports of itself a damage to the party. Every violation of a right imports some

damage, and if none other be proved, the law allows a nominal damage.” Id.

The Framers did not demonstrate any intent to depart from this common-law

understanding, which fit well within the broader idea that the judiciary was tasked

with protecting the rights of individuals. In Marbury v. Madison, 5 U.S. (1 Cranch)

137, 170 (1803), Chief Justice Marshall stated that “the province of the court is,

solely, to decide on the rights of individuals[.]” And in Osborn v. Bank of the United

States, 22 U.S. (9 Wheat.) 738, 819 (1824), he described the judicial power as

“capable of acting only when the subject is submitted to it by a party who asserts his

rights in the form prescribed by law.” Justice Story echoed Justice Marshall, and

described an Article III “case” as one “touching the Constitution, laws, or treaties of

the United States” and “submitted to the court by a party, who asserts his rights in

the form prescribed by law.” 3 Joseph Story, Commentaries on the Constitution of

the United States § 1640 (1833). The law professor and former antifederalist St.

George Tucker described the judiciary as “that department of the government to

whom the protection of the rights of the individual is by the constitution especially

confided.” 1 St. George Tucker, Blackstone’s Commentaries 140 (1803). And as

120 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 121 of 148

one state supreme court explained, “the very object of all suits, both at law and in

equity,” is “[t]o preserve and enforce the rights of persons, as individuals, and not as

members of the community at large.” Bigelow v. Hartford Bridge Co., 14 Conn.

565, 578 (1842).

In short, the Framers and contemporary jurists would have considered Dr.

Muransky’s lawsuit to be the quintessential “case or controversy” involving the

adjudication of private rights created by statute. The FACTA “obviously

prohibit[s]” acts for the protection of “particular parties”—i.e., cardholders—and so

had English or early American courts heard this case, I think they would not have

demanded damages beyond the statutory violation. I have not found any cases or

authorities around the time of the Founding that would have required a court to

evaluate Dr. Muransky’s separate “injury” in order to determine whether it had

subject-matter jurisdiction.

We are, of course, bound by Supreme Court precedent. But a review of

standing doctrine, from its infancy in the twentieth century to the present, leads me

to the same conclusion.

The Supreme Court has never cabined the redress of private wrongs through

its Article III jurisprudence. Standing grew out of public law litigation in the early

twentieth century, not out of private disputes. As Justice Douglas put it in 1942,

121 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 122 of 148

reflecting on the developments of the prior decades, “[r]epeated attempts of private

litigants to obtain a special stake in public rights have been consistently denied.”

Scripps-Howard Radio v. F.C.C., 316 U.S. 4, 20 (1942) (Douglas, J., dissenting)

(emphasis added) (collecting cases).

The same is true for the injury-in-fact requirement. It expressly emerged in

the 1970s and 1980s amidst a fast-growing administrative state and questions about

the extent to which citizens could challenge agency action as representatives of the

public. In that context, the Supreme Court began referring to injury in fact as part

of an “irreducible minimum” of Article III. See Valley Forge Christian Coll. v.

Americans United for Separation of Church & State, Inc., 454 U.S. 464, 472 (1982).

See also Simon v. E. Ky. Welfare Rights Org., 426 U.S. 26, 64 (1976) (Brennan, J.,

concurring); Warth v. Seldin, 422 U.S. 490, 499 (1975). The phrase was cemented

in Lujan, 504 U.S. at 560, and has been treated as gospel ever since. Yet the Supreme

Court could not have meant exactly what it said, as it has always allowed individuals

to sue upon the invasions of private rights, even without showing actual damages.

The Court’s “one-size-fits-all standing doctrine” for both public and private

rights cases, see F. Andrew Hessick, Standing, Injury in Fact, and Private Rights,

93 Cornell L. Rev. 275, 277 (2008), is therefore a conceptual mistake that needs

fixing. Either injury in fact is not a constitutional prerequisite, except when a

plaintiff purports to assert rights of the public at large, or, injury is a constitutional

122 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 123 of 148

requirement, but the concept encompasses invasions of private legal rights. See, e.g.,

Parker, 17 Conn. at 302–03 (“An injury, legally speaking, consists of a wrong done

to a person, or, in other words, a violation of his right.”); Hendrick v. Cook, 4 Ga.

241, 261 (1848) (“[W]henever there has been an illegal invasion of the rights of

another, it is an injury, for which he is entitled to a remedy by an action.”).

Modern standing doctrine began to take shape in the early twentieth century.

Some commentators argue that it was the brainchild of Justices Brandeis and

Frankfurter, who sought to “insulate progressive and New Deal legislation from

frequent judicial attack” and thwart “efforts by citizens at large to invoke the

Constitution to invalidate democratic outcomes.” Cass R. Sunstein, What’s Standing

After Lujan? Of Citizen Suits, “Injuries,” and Article III, 91 Mich. L. Rev. 163, 179

(1992). See also Maxwell L. Stearns, Standing and Social Choice: Historical

Evidence, 144 U. Pa. L. Rev. 309, 370 (1995); Steven L. Winter, The Metaphor of

Standing and the Problem of Self-Governance, 40 Stan. L. Rev. 1371, 1374 (1988).

In any event, the main issues in the early standing cases concerned public rights, not

the vindication of private rights. The seminal cases in the 1920s involved individuals

suing for proper administration of the law and basing “standing”—a word that had

not yet entered the legal lexicon—on their citizen or taxpayer status alone. See

Fairchild v. Hughes, 258 U.S. 126, 129–130 (1922) (dismissing a challenge to the

123 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 124 of 148

ratification process of the Nineteenth Amendment because the plaintiff “ha[d] only

the right, possessed by every citizen, to require that the government be administered

according to law and the public moneys not be wasted”); Frothingham v. Mellon,

262 U.S. 447, 488–89 (1923) (dismissing a challenge to social welfare legislation,

brought by a plaintiff who claimed the scheme would increase her tax burden,

because the suit would not involve “a judicial controversy,” but would require the

Court “to assume a position of authority over the governmental acts of another and

coequal department, an authority which plainly we do not possess”).

As the Court imposed limitations on the ability of citizens or taxpayers to sue

in the public interest, however, it did not deviate from the common-law rule that one

individual could sue another based on the violation of a private right. That remained

uncontroversial. See Aetna Life Ins. Co. of Hartford, Conn. v. Haworth, 300 U.S.

227, 241 (1937) (“[T]he judicial function may be appropriately exercised although

the adjudication of the rights of the litigants may not require the award of process or

the payment of damages.”). A private legal right was still the sine qua non of

justiciability. See Tenn. Elec. Power Co. v. Tenn. Valley Auth., 306 U.S. 118, 137–

38 (1939) (denying standing where there was no invasion of a “legal right,”

including “one founded on a statute which confers a privilege”); Alabama Power

Co. v. Ickes, 302 U.S. 464, 479–80 (1938) (holding that an electric company had no

124 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 125 of 148

standing to challenge the legality of federal loans to competitors because it had not

suffered the deprivation of a private legal right).

In 1940s, the Court entered a relatively brief era of broad statutory standing.

In a landmark case, F.C.C. v. Sanders Bros. Radio Station, 309 U.S. 470, 477 (1940),

the Supreme Court permitted a radio station to sue to enjoin a Federal

Communications Commission order granting a license to a market competitor, even

though the station did not have a legal right to the grant or denial of the license, or a

common-law right to be free from market competition. See Tenn. Elec. Power Co.,

306 U.S. at 140 (“[T]he damage consequent on competition . . . will not support a

cause of action or a right to sue.”). But Congress had included a provision in the

Communications Act permitting judicial review for any person “aggrieved” by an

FCC order. See 47 U.S.C. § 402(b). And the Court reasoned that Congress “may

have been of opinion that one likely to be financially injured by the issue of a license

would be the only person having a sufficient interest to bring to the attention of the

appellate court errors of law in the action of the Commission in granting the license.”

Id. at 477. In Scripps-Howard, 316 U.S. at 14, the Court read Sanders Brothers as

permitting private litigants to stand in court, “only as representatives of the public

interest.” See also Associated Indus. of New York State v. Ickes, 134 F.2d 694, 704

(2d Cir.) (describing Sanders Brothers as holding that the Constitution allows

Congress to “empower[ ] any person, official or not, to institute a proceeding

125 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 126 of 148

involving such a controversy, even if the sole purpose is to vindicate the public

interest,” and coining the phrase “private Attorney Generals”), vacated, 320 U.S.

707 (1943).

The Court’s expansion of statutory standing to so-called private attorneys

general in the Sanders Brothers/Scripps-Howard era of course did not prevent

individuals from suing on private rights alone. To the contrary, the Court’s

substantial deference to Congress and its ability to create standing by statute would

have supported standing in the case before us. The FACTA, in addition to creating

a private right for cardholders to receive truncated receipts, includes a cause-of-

action provision. See 15 U.S.C. § 1681n(a) (“Any person who willfully fails to

comply with any requirement imposed under this subchapter with respect to any

consumer is liable to that consumer.”).8

8 The Supreme Court eventually interpreted these cases not as giving Congress carte blanche to enlist private attorneys general, but as permitting plaintiffs to make merits arguments in the public interest only after they had established standing based on economic injury. See Sierra Club v. Morton, 405 U.S. 727, 737–38 (1972) (“Taken together, Sanders and Scripps-Howard thus established a dual proposition: the fact of economic injury is what gives a person standing to seek judicial review under the statute, but once review is properly invoked, that person may argue the public interest in support of his claim that the agency has failed to comply with its statutory mandate.”). That reading of Sanders Brothers and Scripps-Howard effectively ended the era of individual standing as a representative of the public, and presaged the limitation on citizen-suit provisions in cases like Lujan. For an interesting study about this era, see Elizabeth Magill, Standing for the Public: A Lost History, 95 Va. L. Rev. 1131 (2009). 126 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 127 of 148

As Justice Thomas observed in his concurrence in Spokeo, the Court’s recent

decisions have “not required a plaintiff to assert an actual injury beyond the violation

of his personal legal rights to satisfy the ‘injury-in-fact’ requirement.” 136 S. Ct. at

1552 (Thomas, J., concurring). That is, even while the Court has assumed that injury

in fact is a universal requirement, it has not, in practice, denied standing to plaintiffs

who allege invasions of private rights.

Injury in fact traces back to Association of Data Processing Organizations v.

Camp, 397 U.S. 150, 153 (1970), a case in which the Court first shifted from a rights-

based to an injury-based standing framework. In 1946, Congress had enacted the

Administrative Procedure Act, which created statutory review for any person

“adversely affected or aggrieved by agency action.” 5 U.S.C. § 702. The Court in

Data Processing held that whether a plaintiff possessed any legal right regarding the

agency action went to the merits of his claim, and that the plaintiff only needed to

allege an “injury in fact, economic or otherwise” in order to sue under the APA. See

Data Processing, 397 U.S. at 152. This was a novel interpretation of the APA at the

time, and the Court’s first use of the term “injury in fact” in the standing context.

See Scalia, The Doctrine of Standing, 17 Suffolk U. L. Rev. at 888; Magill, Standing

for the Public, 95 Va. L. Rev. at 1160–63.

127 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 128 of 148

We now think of the injury-in-fact requirement as an obstacle for plaintiffs.

But the Court at the time intended to “broaden[ ] access to federal courts” for

plaintiffs to sue the government. See E. Ky. Welfare Rights Org., 426 U.S. at 39.

See also Linda R.S. v. Richard D., 410 U.S. 614, 616–17 (1973) (explaining that the

Court intended to “expand[ ] the types of ‘personal stake(s)’ which are capable of

conferring standing on a potential plaintiff”). Therefore, even if Congress had not

created a personal legal right in an agency decision or action, a plaintiff could still

obtain judicial review by demonstrating some harm, which the Court defined broadly

as including economic, aesthetic, conservational, recreational, and spiritual interests.

See Data Processing, 397 U.S. at 154–55. This was perhaps the culmination of the

Warren Court’s loosening of standing restrictions, a trend that had begun in the

1940s with Sanders Brothers. See, e.g., Flast v. Cohen, 392 U.S. 83, 106 (1968)

(granting standing to a taxpayer seeking to enjoin government expenditures

allegedly in violation of the Establishment Clause).

Throughout the 1970s and 1980s, however, the Burger Court pulled back on

the previously liberalized standing doctrine. Justice Powell had expressed concern

particularly with taxpayer lawsuits, which he thought corresponded to “the

expansion of judicial power” and “a remarkably illogical system of judicial

supervision of the coordinate branches of the Federal Government.” United States

v. Richardson, 418 U.S. 166, 188–90 (1974) (Powell, J., concurring). And his

128 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 129 of 148

separation-of-powers theory of standing eventually carried the day. But instead of

returning to a rights-based model, the Court stuck with injury in fact. At the same

time, it narrowed the universe of cognizable injuries and imposed causation and

redressability requirements, thereby making the threshold obstacle of Data

Processing much more difficult to surpass. See Hessick, Standing, Injury in Fact,

and Private Rights, 93 Cornell L. Rev. at 297 (arguing that Data Processing had

created a “quasi-public model of standing,” but that the Court implicitly returned to

a private rights model by narrowing the category of acceptable injuries to those that

were “actual,” “distinct,” “palpable,” and “concrete,” rather than merely “abstract”)

(quoting Allen v. Wright, 468 U.S. 737, 750–51, 756 (1984)).

But again, the important cases in this era arose in the public law context. They

involved plaintiffs asserting (often generalized) grievances about alleged

government misconduct. See, e.g., Whitmore v. Arkansas, 495 U.S. 149, 160 (1990)

(denying standing in a lawsuit to prevent another prisoner’s execution based on “the

public interest protections of the Eighth Amendment”); Valley Forge, 454 U.S. at

470 (denying standing to taxpayers seeking to enjoin the transfer of federal property

to a religious organization); United States v. Richardson, 418 U.S. 166, 170 (1974)

(dismissing a taxpayer suit challenging the government’s failure to disclose CIA

expenditures); Schlesinger v. Reservists Comm. to Stop the War, 418 U.S. 208, 209

129 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 130 of 148

(1974) (dismissing a taxpayer lawsuit seeking to prevent members of Congress from

serving in the Armed Forces Reserve).

In the private rights context, the Court continued to maintain that “Congress

may enact statutes creating legal rights, the invasion of which creates standing, even

though no injury would exist without the statute.” Linda R.S., 410 U.S. at 617 n.3.

See also Diamond v. Charles, 476 U.S. 54, 65 n.17 (1986) (“The Illinois Legislature

. . . has the power to create new interests, the invasion of which may confer

standing.”); E. Ky. Welfare Rights Org., 426 U.S. at 41 n.22 (recognizing “Congress’

power to create new interests the invasion of which will confer standing”).

In Coleman, 455 U.S. at 373–74, for example, the Supreme Court held that

“tester” plaintiffs had standing to sue under the Fair Housing Act, even though they

did not intend to purchase homes and therefore did not experience any injury in fact

from the FHA violation. The FHA created private rights, imposing duties upon

private parties to act a certain way toward others. It made it unlawful for any

individual or firm covered by the statute “[t]o represent to any person because of

race, color, religion, sex, or national origin that any dwelling is not available for

inspection, sale, or rental when such dwelling is in fact so available,” or “[t]o

discriminate against any person in the terms, conditions, or privileges of sale or

rental of a dwelling, or in the provision of services or facilities in connection

therewith, because of race, color, religion, sex, or national origin.” 42 U.S.C. §

130 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 131 of 148

3604(b), (d) (emphases added). Individuals therefore had private rights

corresponding to the duties imposed upon realtors, and the plaintiffs were able to

sue without showing damage. See Coleman, 455 U.S. at 373–74. Accord Gladstone

Realtors v. Vill. of Bellwood, 441 U.S. 91, 100–09 (1979).9

One of the most important cases in the modern era is Lujan, in which the Court

denied standing to environmental plaintiffs challenging an Interior Department rule

allegedly promulgated in violation of the Endangered Species Act. See 504 U.S. at

578. The Court reiterated and cemented the tripartite Article III test of injury in fact,

causation, and redressability that had developed since Data Processing. It held that

9 The Supreme Court has also recognized that Congress can create enforceable private rights vis-à-vis the government. For example, the Freedom of Information Act requires government agencies to provide “any person” with unexempted records if that person requests them. See 5 U.S.C.A. § 552(3)(A). The requester—qua individual—obtains the private right to the information he requested from the government. Fittingly, the Supreme Court’s “decisions interpreting the Freedom of Information Act have never suggested that those requesting information under it need show more than that they sought and were denied specific agency records.” Pub. Citizen v. U.S. Dep’t of Justice, 491 U.S. 440, 449 (1989) (collecting cases). See also Spokeo, 136 S. Ct. at 1549–50 (citing Public Citizen as the type of case in which a plaintiff “need not allege any additional harm beyond the one Congress has identified”). The same has been true for violations of constitutional rights, which do not require actual damage for vindication. See Carey v. Piphus, 435 U.S. 247, 266 (1978); Al–Amin v. Smith, 511 F.3d 1317, 1335 (11th Cir. 2008). To be sure, this is a much easier case than the FOIA or § 1983 cases because it does not involve the government as a defendant, but is merely a private dispute between private parties. Cf. United States v. Jicarilla Apache Nation, 564 U.S. 162, 174 (2011) (“The distinction between ‘public rights’ against the Government and ‘private rights’ between private parties is well established.”).

131 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 132 of 148

the plaintiffs did not assert a sufficiently imminent injury, or one that was redressable

by a favorable decision against the government. See id. at 562–67, 568–71.

More significant was the Court’s holding the plaintiffs’ alleged “procedural

injury” under a citizen-suit provision of the Endangered Species Act was insufficient

under Article III. See id. at 571–77. The question for our purposes is whether this

holding rejected the rule—which dated back to the common law and early American

cases like Whittemore v. Cutter—that Congress could fashion private legal rights,

the invasion of which created standing.

Lujan did not repudiate this rule, simply because the ESA provision at issue

did not create private legal rights, unlike, for example, the FHA. The citizen-suit

provision in the ESA created a cause of action for “any person” to sue for violations

of “this chapter.” See id. at 571–72 (quoting 16 U.S.C. § 1540(g)). But the actual

provision at issue—the one that the Secretary of the Interior allegedly violated—

required agencies to consult with one another on certain decisions. See id. at 558,

571 (quoting 16 U.S.C. § 1536(a)(2)). It did not direct the agency, for example, to

provide information, funds, or benefits to designated individuals. Nor did it

“obviously prohibit[ ]” certain government conduct “for the protection of a particular

party.” 1 Sedgwick, Measure of Damages, at 661. The duty of consultation, in other

words, did not create a corollary private right “belonging to individuals, considered

as individuals.” Spokeo, 136 S. Ct. at 1551 (Thomas, J., concurring) (quoting 3

132 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 133 of 148

Blackstone, Commentaries *2). The government’s compliance with the consultation

provision was a public duty “owed ‘to the whole community, considered as a

community, in its social aggregate capacity.’” Id. at 1551 (quoting 4 Blackstone,

Commentaries *5). As the majority in Lujan pointed out, “[t]his is not a case where

plaintiffs are seeking to enforce a procedural requirement the disregard of which

could impair a separate concrete interest of theirs”; the plaintiffs sought to enforce

the right of “all persons . . . to have the Executive observe the procedures required

by law.” 504 U.S. at 572–73. In this way, the Court was channeling the observations

of Fairchild in the 1920s.

Lujan can therefore be seen as limited to the public rights context. And it can

be read as holding that, while Congress can create private rights (as it always has),

it cannot convert a public interest into a private right merely by including a citizen-

suit provision. To do so would allow Congress to “transfer from the President to the

courts the Chief Executive’s most important constitutional duty, to ‘take Care that

the Laws be faithfully executed.’” Id. (quoting U.S. const. Art. II, § 3). “It would

enable the courts, with the permission of Congress, to assume a position of authority

over the governmental acts of another and co-equal department, and to become

virtually continuing monitors of the wisdom and soundness of Executive action.”

Id. (internal quotation marks and citations omitted). But nothing in the opinion

133 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 134 of 148

suggests that these separation-of-powers concerns would arise when Congress

created a private right that a plaintiff sought to vindicate against a private defendant.

Notably, the major cases since Lujan that have denied standing based on

insufficient injury in fact have also done so in the public rights context. See, e.g.,

Clapper, 568 U.S. at 401–02 (denying standing to plaintiffs seeking a declaration

that § 702 of the Foreign Intelligence Surveillance Act of 1978 is unconstitutional);

Arizona Christian Sch. Tuition Org. v. Winn, 563 U.S. 125, 130 (2011) (dismissing

a taxpayer suit under the Establishment Clause); Summers v. Earth Island Inst., 555

U.S. 488, 490 (2009) (denying standing to an environmental group that sought to

enjoin enforcement of regulations that “exempt[ed] small fire-rehabilitation and

timber-salvage projects from the notice, comment, and appeal process used by the

Forest Service”); Hein v. Freedom From Religion Found., Inc., 551 U.S. 587, 592

(2007) (dismissing a taxpayer suit under the Establishment Clause). I have not found

a contemporary Supreme Court case in which a plaintiff had a private statutory right

but was denied standing.10

10 The majority quotes Thole, 140 S. Ct. at 1620, for the proposition that a plaintiff does not automatically have standing “whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” But as Justice Thomas pointed out in his Thole concurrence, the provision at issue in that case, a part of the Employee Retirement Income Security Act of 1974, did not create private rights belonging to the plaintiffs; the plaintiffs sought to enforce fiduciary duties under ERISA that were “owed to the plan, not [the plaintiffs].” Id. at 1623 (Thomas, J., concurring). 134 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 135 of 148

At this point, I pause to examine Spokeo and explain why it does not conflict

with the public-private rights framework. For starters, the Court in Spokeo did not

issue a direct holding as to whether the plaintiff there had standing; it reversed the

Ninth Circuit for failing to consider separately the “concreteness” requirement under

the Court’s test for an Article III injury, and remanded for a new determination of

standing. See Spokeo, 136 S. Ct. at 1548, 1550.

Moreover, nothing that the Court said was inconsistent with the public-private

rights model. The Court advised the Ninth Circuit that the plaintiff could not obtain

standing based on a “bare procedural violation” divorced from factual injury. See

id. at 1549. But it also acknowledged Congress could still “elevat[e] to the status of

legally cognizable injuries concrete, de facto injuries that were previously

inadequate in law.” Id. (quoting Lujan, 504 U.S. at 572). Not surprisingly, courts

have struggled to reconcile these two apparently conflicting statements. See, e.g.,

Hagy v. Demers & Adams, 882 F.3d 616, 623 (6th Cir. 2018) (“It’s difficult, we

recognize, to identify the line between what Congress may, and may not, do in

creating an ‘injury in fact.’”). But the two statements make more cohesive sense

when considered through a rights-based lens.

Recall that the Court in Lujan had suggested that a procedural requirement in

a statute could protect individuals (i.e., create private rights), rather than protect the

135 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 136 of 148

public at large. See 504 U.S. at 572 & n.7. But the plaintiffs in Lujan had not argued

that the “consultation” provision protected them individually. They argued that the

citizen-suit provisions, which applied to “all persons,” vested in them a procedural

right. See id. at 571–72. In other words, they attempted to read the cause of action

into the substantive provision in order to manufacture a “procedural” right that

belonged to them individually. The Court rejected that theory. Because the

substantive provision imposed a public duty upon the agency to consult with other

agencies, Congress could not turn that public duty into a private right through a

citizen-suit provision. A “bare” procedural violation, in other words, was the

violation of a public duty, without any additional, particularized harm to the

individual. A bare procedural violation was not the same thing as an invasion of a

private right.

In that way, Spokeo—although not entirely clear on its face—may be in line

with Lujan. Just as Congress cannot confer blanket standing on “all persons” to

oversee the Department of the Interior’s duty to comply with the consultation

provision, it cannot delegate to the public what would otherwise be executive

authority to enforce general regulatory obligations of covered, third-party entities.

The decision to bring enforcement actions has traditionally been “committed to

agency discretion by law.” 5 U.S.C. § 701(a)(2). See also Heckler v. Chaney, 470

U.S. 821, 827–835 (1985). A plaintiff therefore has standing only if the procedural

136 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 137 of 148

duty was “obviously intended” to protect the particular plaintiff (i.e., created a

private right that he may vindicate), or if the procedural violation created a public

duty but also harmed the plaintiff in some concrete and particularized manner as

distinct from the general public (i.e., caused an “injury-in-fact”).11

The difficulty in Spokeo was that the statute at issue, the FCRA, creates a web

of regulatory obligations which arguably confer both private and public rights. For

example, § 1681e(b) requires reporting agencies to “follow reasonable procedures

to assure maximum possible accuracy of the information concerning the individual

11 For this reason, Fed. Election Comm’n v. Akins, 524 U.S. 11 (1998), may be wrongly decided, at least under the public-private rights framework. There, the Court held that voters had standing to challenge the FEC’s determination that an organization was not a “political committee” as defined by the Federal Election Campaign Act. See id. at 13. The FECA imposed disclosure requirements upon political committees, and the plaintiffs asked the FEC, first, to find that the organization had violated the FECA and, second, to order the organization to disclose the requisite information. See id. at 16. The Court rejected the government’s “prudential standing” argument, as the FECA provided a cause of action for “[a]ny person who believes a violation of the [FECA] . . . has occurred,” and has been “aggrieved” by the violation. See id. at 19 (quoting 2 U.S.C. § 437g(a)(1)). It held that the voters suffered an Article III injury, insofar as they could not obtain information that they needed to evaluate candidates for public office. See id. at 21. Viewing this case through the public-private rights lens, the FECA imposed a duty upon the executive branch (1) to determine whether entities were “political committees,” and (2) to enforce the disclosure of information. Under Lujan, Congress would not be able to convert that public interest in administration of laws into a private right, lest any citizen be able to compel the executive to enforce the law. Only if the plaintiffs had suffered an injury distinct from that of the general public could they have standing to sue. But Richardson, 418 U.S. at 166–67, had dismissed for lack of standing a suit in which the plaintiff claimed to have been aggrieved by the government’s refusal to disclose information to the public. As a result, Akins may raise separation-of-powers problems. See 524 U.S. at 36 (Scalia, J., dissenting) (“A system in which the citizenry at large could sue to compel Executive compliance with the law would be a system in which the courts, rather than the President, are given the primary responsibility to ‘take Care that the Laws be faithfully executed.’”). The case is in that way reminiscent of the bygone Sanders Brothers era. But, again, the fact that the Court may have improperly expanded standing in Akins does not mean that Dr. Muransky lacks standing here.

137 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 138 of 148

about whom the report relates.” This provision, Justice Thomas pointed out, seems

to create private rights for the individual qua individual. See Spokeo, 136 S. Ct. at

1553–54 (Thomas, J., concurring). But the plaintiff in Spokeo alleged violations of

other FCRA provisions, such as one requiring reporting agencies to post toll-free

numbers on their website. See Spokeo, 136 S. Ct. at 1545 (majority opinion) (citing

§ 1681j(c)(i)). See also First Amended Complaint, Robins v. Spokeo, Inc., 2011 WL

7782796 (C.D. Cal. Feb. 17, 2011) (alleging that the defendant “failed to post a toll-

free telephone number on its website through which consumers can request free

annual file disclosures”). At oral argument, Justice Scalia expressed concern that

citizens could have roving standing to sue for violations of the defendant’s

regulatory obligations. See Oral Argument Tr., Spokeo, Inc., v. Robins, No. 13-1339,

at 26–27, 43 (Nov. 2, 2015). This makes sense under Lujan: a plaintiff should not

be able to pursue violations of an entity’s procedural duties (notwithstanding the

FCRA cause of action provision), unless (1) the procedural duty protected particular

individuals like the plaintiff, or (2) the violation was not “bare” and caused some

additional and unique harm to the plaintiff. It is otherwise the executive branch’s

role and duty to investigate and enforce violations of general regulatory obligations.

See Chaney, 470 U.S. at 827–835.

The Court in Spokeo did not, in the end, untangle the statutory web of the

FCRA, and it remanded for further proceedings in the circuit court. But we are faced

138 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 139 of 148

with a much easier case here. The FACTA imposes a duty upon Godiva to truncate

the credit card numbers in its receipts, a duty clearly intended to protect individual

cardholders, like Dr. Muransky, who purchase goods from its stores. Dr. Muransky

alleged that Godiva did not provide him with a truncated receipt and therefore

violated his private statutory right. That allegation alone suffices for standing. 12

If the common-law tradition and contemporary Supreme Court cases are not

sufficiently convincing, then consider the characteristics of an Article III “Case or

Controversy” that justiciability doctrines aim to ensure.

First, there is adverseness—that the parties “face each other in an adversary

proceeding” and that their dispute “relates to legal rights and obligations[.]”

Haworth, 300 U.S. at 242. There must be an “honest and actual antagonistic

assertion of rights” by one individual against another, which is neither “feigned” nor

“collusive.” See United States v. Johnson, 319 U.S. 302, 305 (1943) (quoting

Chicago & G.T. Ry. Co. v. Wellman, 143 U.S. 339, 345 (1892)). See also Lord v.

Veazie, 49 U.S. (8 How.) 251, 254 (1850). “Concrete adverseness . . . sharpens the

12 Viewing Spokeo through the rights-based lens also leads to the conclusion that Dr. Muransky’s injury was both “concrete” and “particularized.” The invasion of the private right was concrete—i.e., real, and not abstract—insofar as Godiva engaged in affirmative conduct that explicitly violated Dr. Muransky’s private right to a truncated receipt. The injury was also particularized because Godiva printed a receipt specifically for Dr. Muransky and that receipt displayed only his unique credit card number.

139 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 140 of 148

presentation of issues upon which the court so largely depends[.]” Linda R.S., 410

U.S. at 616 (internal quotation marks omitted).

Second, a court must not issue an “advisory opinion”—it must issue a “decree

of a conclusive character, as distinguished from an opinion advising what the law

would be upon a hypothetical state of facts.” Haworth, 300 U.S. at 242. See also 2

The Records of the Federal Convention of 1787, at 341 (M. Farrand ed. 1966)

(hereinafter “Farrand”) (describing the failed proposal at the Convention that would

have given Congress and the Executive the “authority to require the opinions of the

supreme Judicial Court upon important questions of law, and upon solemn

occasions”); 3 Correspondence and Public Papers of John Jay 486–89 (H. Johnston

ed. 1891) (relating that the Justices of the Supreme Court refused to offer an opinion

requested by the President and Secretary of State regarding foreign treaties, as such

advice would be “extra-judicial[ ]”). The final judgment should not be subject to

review or revision by another branch of government. See United States v. Ferreira,

54 U.S. (13 How.) 40, 52–53 (1851). See also Hayburn’s Case, 2 U.S. (2 Dall.) 408,

410 n* (1792) (opinion of Wilson and Blair, JJ., and Peters, D.J.) (“[R]evision and

control” of an Article III judgment by the legislature or executive officer is “radically

inconsistent with the independence of that judicial power which is vested in the

courts”).

140 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 141 of 148

Third, federal courts have traditionally avoided difficult political questions.

These include the validity of a foreign treaty or the lawful authority of a state

government. See Ware v. Hylton, 3 U.S. (3 Dall.) 199, 260 (1796) (Iredell, J.,

concurring) (explaining that to declare a foreign treaty void would turn on

“considerations of policy, considerations of extreme magnitude, [which are]

certainly entirely incompetent to the examination and decision of a Court of

Justice”); Luther v. Borden, 48 U.S. (7 How.) 1, 42 (1849) (“Congress must

necessarily decide what government is established in the State before it can

determine whether it is republican or not. . . . And its decision is binding on every

other department of the government, and could not be questioned in a judicial

tribunal.”). See also Marbury, 5 U.S. (1 Cranch) at 169–170 (explaining that there

are “peculiarly irksome” and “delicate” “[q]uestions, in their nature political” that

should not be resolved by federal courts). 13

Not even one of these concerns is present here. Dr. Muransky faces Godiva

as an adversary, hoping to vindicate the invasion of his private legal rights. The use

of “judicial power” to find the existence of a statutory right and violation, and then

13 I recognize that the Supreme Court’s political question checklist, see, e.g., Baker v. Carr, 369 U.S. 186, 217 (1962) (listing six factors), has been subject to criticism, but that does not eliminate the reality that some matters are inappropriate for judicial resolution.

141 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 142 of 148

to provide a remedy by awarding statutory damages, would not require the court to

issue an advisory opinion or tackle a political question.14

For example, compare Dr. Muransky’s claim to that of the plaintiff in Jeffries,

who, as I mentioned above, alleged that a vendor printed a receipt with all 16 digits

of her credit card number and the expiration date. See Jeffries, 928 F.3d at 1062.

The D.C. Circuit found standing based on the allegations in the plaintiff’s complaint

because that was the “nightmare scenario” the FACTA was intended to prevent. See

id. at 1066. The majority here appears to accept Jeffries as correctly decided but

distinguishes it as having a different “factual scenario.” Although the plaintiff in

Jeffries perhaps faced a higher risk of identity theft, how could that difference be of

constitutional magnitude? The defendants in both cases violated the express terms

of a statute, which were intended to protect the plaintiffs in the same way. In terms

of adverseness, style of proceedings, type of judicial decision-making, and remedy,

the two cases are entirely indistinguishable.

The attempt to distinguish these two cases is in a way an “extra-judicial” act,

insofar as a court must draw lines beyond those already drawn by Congress. See

14 If the majority has some unstated concern that Dr. Muransky is not a sufficiently motivated adversary to represent absent class members due to the unlikelihood of his experiencing identity theft, then that should be dealt with under Rule 23, not Article III. In certifying the class here, the district court found that Dr. Muransky was an adequate class representative. And for Article III purposes, he is undoubtedly an adversary of Godiva’s. Godiva allegedly invaded his private right, he seeks to vindicate that right, and the two parties do not have aligned interests. There is no suggestion that this is a feigned or collusive suit. 142 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 143 of 148

Hollingsworth v. Perry, 570 U.S. 693, 700 (2013) (explaining that the threshold

standing requirement “ensures that we act as judges, and do not engage in

policymaking properly left to elected representatives”). The majority here in effect

amends the FACTA by denying its protections to a subgroup of plaintiffs—those

who received receipts displaying ten digits of a credit card number. Presumably the

FACTA still works for plaintiffs like the one in Jeffries, whose receipts included all

16 digits, and maybe even for other subgroups of plaintiffs whose receipts display

11 or more digits. But at the end of the day, there is no constitutional principle—

whether based on text, structure, or history—that can provide a manageable rule of

decision for distinguishing between any two cases involving explicit FACTA

violations. Cf. William Baude, Standing in the Shadow of Congress, 2016 Sup. Ct.

Rev. 197, 224 (arguing that the Supreme Court’s “so far unsuccessful quest to define

the limits of statutory standing is reminiscent of the path of another doctrine—that

of substantive due process”).

Consider how much damage the majority’s decision does to the actual text of

Article III, which limits the “judicial Power” to “Cases or Controversies.” If

anything, those terms import a qualitative notion about justiciability. See 2 Farrand,

at 430–32 (noting James Madison’s concern that the judicial power should extend

only “to cases of a Judiciary Nature”); Osborn, 22 U.S. (9 Wheat.) at 819 (Marshall,

C.J.) (describing cases and controversies as taking on a certain “form that the judicial

143 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 144 of 148

power is capable of acting on”). The words do not and cannot have any inherent

quantitative parameters. One would not think of a lawsuit alleging battery as being

any more or less of a “case” than another lawsuit alleging battery, simply based on

the extent of the plaintiff’s injuries or the amount of damages awarded.

The same is true for threatened injuries caused by violations of private rights.

In my view, there is no textual basis in Article III to distinguish between two

plaintiffs who experience a violation of the same statutory private right, even though

one might face a more imminent factual injury than the other as a result of the

violation. One, both, or neither of the two plaintiffs could eventually suffer the harm

that Congress sought to prevent; but the plaintiffs’ use of the courts to vindicate their

legal rights would be identical in character. There would be an assessment of the

legal right, a finding that it had been violated, and an imposition of a corresponding

remedy. This would be a typical case—the “regular course of judicial procedure.”

Muskrat v. United States, 219 U.S. 346, 356 (1911). It is not only unnecessary to

superimpose an injury-in-fact inquiry at the threshold of such a private rights

dispute, but, as we have seen, it turns Article III upside down.

I leave for another day the scope and role of injury in fact in public rights

litigation, which is part of an ongoing and important debate. But suffice it to say

that an injury in fact is not required for a private rights dispute, and Dr. Muransky

should have standing here.

144 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 145 of 148

D

There has been profound confusion about current standing doctrine. See, e.g.,

Robert J. Pushaw, Jr., Justiciability and Separation of Powers: A Neo-Federalist

Approach, 81 Cornell L. Rev. 393, 480 (1996) (describing the doctrine as

“theoretically incoherent”); Cass R. Sunstein, Standing and the Privatization of

Public Law, 88 Colum. L. Rev. 1432, 1458 (1988) (calling standing “manipulable”

and permeated with “doctrinal confusion”). This has only gotten worse since

Spokeo, as courts have been asked to address standing under complex data and

consumer privacy statutes. See, e.g. Beck v. McDonald, 848 F.3d 262, 273 (4th Cir.

2017) (summarizing a circuit split with respect to threatened injuries in data privacy

and security breach cases); Note, Cyberlaw-Data Breach Litigation, 133 Harv. L.

Rev. 1095, 1095, 1101 (2020) (describing a “pattern of lower courts struggling to

reconcile Supreme Court guidance with a theory of future injury” and a “pattern of

lower court confusion over how Clapper and Spokeo apply to data breaches”). Time

will tell whether the Supreme Court will step in to sort out the doctrinal incoherence.

See Bradford C. Mank, Data Breaches, Identity Theft, and Article III Standing: Will

the Supreme Court Resolve the Split in the Circuits?, 92 Notre Dame L. Rev. 1323,

1324 (2017).

In the meantime, Justice Thomas’ concurrence in Spokeo provides some

much-needed clarity in this area. His “framework,” to be sure, is not a new concept,

145 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 146 of 148

but merely an explanation of something that has been true since the common law

and which has persisted in contemporary standing jurisprudence: public rights and

private rights are treated differently for purposes of Article III justiciability.15

Because “the requirements of standing turn on whether the plaintiff seeks to

vindicate a private or public right, the first step in any standing case is to classify the

asserted right.” Springer v. Cleveland Clinic Employee Health Plan Total Care, 900

F.3d 284, 290 (6th Cir. 2018) (Thapar, J., concurring) (emphasis added). The

majority here fails to take that initial step, however, and blindly applies the injury-

in-fact requirement where it is not needed. That is not all the majority’s fault. As I

have explained, the Supreme Court has frequently, but incautiously, identified

factual injury as part of an “irreducible constitutional minimum,” and so naturally

the majority would think to apply it in any case where standing is at issue. But a

closer look at the Court’s decisions shows that this is not quite right. At most, an

injury in fact is only necessary when the plaintiff purports to stand on and vindicate

public rights.

The rights-based framework may not immediately resolve all of the difficult

questions in the public litigation context. See id at 290 (noting that “a lawsuit

15 The public-private rights distinction is also not unique to standing doctrine. See, e.g., Stern v. Marshall, 564 U.S. 462, 488–92 (2011) (discussing a category of “public rights,” dating back to Murray’s Lessee v. Hoboken Land & Improvement Co., 59 U.S. (18 How.) 272 (1856), which could be adjudicated outside of the Article III judicial branch). 146 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 147 of 148

seeking to vindicate a public right presents a harder question” with respect to

standing). But at least it gives us a starting point, and reminds us that an injury is

not a requirement for its own sake, but is instead a way for a plaintiff to distinguish

himself from the public at large and to demonstrate that he seeks to vindicate his

own particularized rights or injuries. Where a statute creates a private right, on the

other hand, the injury-in-fact inquiry serves little or no purpose. It does not preserve

any of the traditional characteristics of a “Case or Controversy,” which are already

present simply because the plaintiff is seeking to vindicate personal legal rights that

the defendant violated. With that basic understanding in mind, we should have a

much easier time navigating complex data and consumer privacy statutes, many of

which, like the FACTA, create straightforward private rights.

I close by acknowledging that I am not the first to express interest in

refocusing standing doctrine based on Justice Thomas’ concurrence in Spokeo.

Justice Gorsuch recently signed onto an opinion applying the rights-based rubric.

See Thole, 140 S. Ct. at 1622 (Thomas, J., concurring). And several other judges

and commentators have cited to, applied, or endorsed it. See Bryant v. Compass

Grp. USA, Inc., No. 20-1443, 2020 WL 2121463, at *5 (7th Cir. May 5, 2020)

(applying Justice Thomas’ “rubric” in the alternative for claims under the Biometric

Information Privacy Act, and having “no trouble concluding that [the plaintiff] was

asserting a violation of her own rights [which was] enough to show injury-in-fact

147 USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 148 of 148

without further tangible consequences”); Huff v. TeleCheck Servs., Inc., 923 F.3d

458, 469 (6th Cir. 2019) (“The theory deserves further consideration at some point.

It seems to respect history and cuts a path in otherwise forbidding terrain.”);

Springer, 900 F.3d at 290 (Thapar, J., concurring) (“Since the founding, a lawsuit

seeking to vindicate an individual’s private rights has counted as a case or

controversy for purposes of Article III.”); Robins, 867 F.3d at 1116 (citing Justice

Thomas’ Spokeo concurrence and noting that the plaintiff’s claim “clearly

implicates, at least in some way, [his] concrete interests in truthful credit reporting”);

Zink v. First Niagara Bank, N.A., 206 F. Supp. 3d 810, 816 (W.D.N.Y. 2016)

(“Justice Thomas’s concurring opinion in Spokeo offers a reasonable (to me, at least)

resolution to the confusion” of modern standing doctrine.”); Baude, Standing in the

Shadow of Congress, 2016 Sup. Ct. Rev. at 229 (explaining that the public-private

rights framework “may need to be articulated more fully in the future,” but

concluding that it is more realistic and workable than other post-Spokeo attempts to

define a “platonic class of real injuries”). Hopefully, I also won’t be the last.

III

Dr. Muransky has standing to assert Godiva’s violation of the FACTA. But

even if I am mistaken on this point, we should remand to give him an opportunity to

satisfy the majority’s newly articulated Article III standard. With respect, I dissent.