UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
) NEIL H. HEUER, ) ) Plaintiff, ) ) v. ) Civil Action No. 17-cv-0147 (TSC) ) SMITHSONIAN INSTITUTION, et al., ) ) Defendants. ) )
MEMORANDUM OPINION
Plaintiff Neil H. Heuer has filed a class action lawsuit against Defendants—the
Smithsonian Institution and the United States of America—alleging they violated the Fair Credit
Reporting Act (“FCRA”). Defendants have moved to dismiss Plaintiff’s lawsuit pursuant to
Federal Rule of Civil Procedure 12(b)(1) and 12(b)(6). ECF No. 35. For reasons explained
below, the court will GRANT Defendants’ motion.
I. BACKGROUND
The facts in this case are straightforward and not in dispute. Plaintiff, a resident of
Florida, alleges that on or about April 9, 2015, he visited the Smithsonian Institution’s National
Air and Space Museum in Washington, DC. ECF No. 34, Amended Complaint (“Am. Compl.”)
¶¶ 8, 26, 55. While there, he used a credit card to purchase tickets to watch a movie in the
museum’s IMAX theater and to enter the museum’s planetarium. Id. ¶ 55. A museum employee
issued Plaintiff a printed receipt captioned “SALES RECEIPT,” which also listed Plaintiff’s first
and last name, as well as the name of his card issuer (“AMEX”), and the first and last four digits
of his credit card number. Id. ¶ 29. Plaintiff was required to hand this receipt to another
museum employee to enter the IMAX theater, and the employee then handed the receipt back to
Page 1 of 12 Plaintiff. Id. ¶¶ 30-31. Plaintiff kept the receipt in his wallet until he returned home to Florida,
whereupon he disposed of it using a paper shredder. Id. ¶¶ 33-34.
Plaintiff then filed suit on behalf of himself and persons he alleges to be similarly
situated, claiming that Defendants violated the Fair and Accurate Credit Transactions Act of
2003 (FACTA)—an amendment to FCRA—which prohibits any “person” from printing “more
than the last 5 digits of the card number or the expiration date upon any receipt provided to the
cardholder at the point of the sale or transaction.” Pub. L. No. 108-159, § 113, 117 Stat. 1952,
1959–60 (codified at 15 U.S.C. § 1681c(g)(1)). Plaintiff alleges that Defendants breached this
provision by printing a receipt containing the first four and last four digits of his credit card
number, and that this breach violated his “substantive right to privacy, entrustment and bailment
of credit card information,” his “right to receive an electronic receipt with truncated credit card
information as established” by statute, and “caused [him] to safe keep and later destroy the
electronically printed receipt.” Am. Compl. ¶ 57. He seeks damages and a court order enjoining
Defendants from printing receipts in violation of the “receipt provision.” Id. at 18 (Prayer for
Relief).
Defendants have moved to dismiss the Amended Complaint, arguing that the court lacks
subject matter jurisdiction over Plaintiff’s lawsuit because it is barred by the doctrine of
sovereign immunity and, in the alternative, that Plaintiff lacks standing to sue, because any
violation of the statute has not caused him to suffer a concrete injury in fact.
II. LEGAL STANDARD
A. Rule 12(b)(1)
Pursuant to Federal Rule of Civil Procedure 12(b)(1), a defendant may move to dismiss a
complaint for lack of subject matter jurisdiction. The law presumes that “a cause lies outside [a
Page 2 of 12 federal court’s] limited jurisdiction” unless the party asserting jurisdiction establishes otherwise.
Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994); see also Georgiades v.
Martin-Trigona, 729 F.2d 831, 833, n.4 (D.C. Cir. 1984) (“It is the burden of the party claiming
subject matter jurisdiction to demonstrate that it exists.”). In evaluating a motion to dismiss
under Rule 12(b)(1), a court must assume the truth of all factual allegations and must review
“‘the complaint liberally, granting plaintiff the benefit of all inferences that can be derived from
the facts alleged.’” Am. Nat’l Ins. Co. v. F.D.I.C., 642 F.3d 1137, 1139 (D.C. Cir. 2011)
(quoting Thomas v. Principi, 394 F.3d 970, 972 (D.C. Cir. 2005)). Nevertheless, “‘the court
need not accept factual inferences drawn by plaintiffs if those inferences are not supported by
facts alleged in the complaint, nor must the [c]ourt accept plaintiff’s legal conclusions.’” Disner
v. United States, 888 F. Supp. 2d 83, 87 (D.D.C. 2012) (quoting Speelman v. United States, 461
F.Supp.2d 71, 73 (D.D.C. 2006)). Finally, a court “may consider materials outside the pleadings
in deciding whether to grant a motion to dismiss for lack of jurisdiction.” Jerome Stevens
Pharm., Inc. v. Food and Drug Admin., 402 F.3d 1249, 1253 (D.C. Cir. 2005) (citation omitted).
B. Rule 12(b)(6)
Rule 12(b)(6) permits a party to move for dismissal on the grounds that the complaint has
failed “to state a claim upon which relief can be granted.” Fed. R. Civ. P. 12(b)(6). A Rule
12(b)(6) motion “tests the legal sufficiency of a complaint.” Browning v. Clinton, 292 F.3d 235,
242 (D.C. Cir. 2002). To withstand a motion to dismiss under Rule 12(b)(6), “a complaint must
contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its
face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation marks and citation
omitted). A claim is facially plausible “when the plaintiff pleads factual content that allows the
Page 3 of 12 court to draw the reasonable inference that the defendant is liable for the misconduct alleged.”
Id.; see also Rollins v. Wackenhut Servs., Inc., 703 F.3d 122, 129–130 (D.C. Cir. 2012).
III. ANALYSIS
A. Sovereign Immunity
Defendants argue that the court lacks subject matter jurisdiction over Plaintiff’s suit
because Defendants are entitled to sovereign immunity from civil lawsuits, and Congress has not
waived their immunity from damages claims under FCRA. The court disagrees.
A waiver of sovereign immunity “must be unequivocally expressed in statutory
text.” F.A.A. v. Cooper, 566 U.S. 284, 290 (2012) (cleaned up). Any ambiguities must be
“construed in favor of immunity,” and ambiguity exists if there is a “plausible interpretation of
the statute that would not authorize money damages against the Government.” Id. at 290–91. At
the same time, waiving sovereign immunity does not require “magic words.” Id. at 291. The
Supreme Court instead requires only that the waiver “be clearly discernable from the statutory
text in light of traditional interpretive tools.” Id.
The FCRA provides that “[a]ny person who willfully fails to comply with any
requirement imposed under this subchapter with respect to any consumer is liable to that
consumer” for either “actual damages” or statutory “damages” within specified dollar ranges. 15
U.S.C. § 1681n(a)(1)(A). Likewise, the FCRA provides that “[a]ny person who is negligent in
failing to comply with any requirement imposed under this subchapter with respect to any
consumer is liable to that consumer” for “actual damages.” Id. § 1681o(a)(1). The FCRA also
defines the term “person” as used in sections 1681n and 1681o: “for the purposes of this
subchapter . . . [t]he term ‘person’ means any individual, partnership, corporation, trust, estate,
cooperative, association, government or governmental subdivision or agency, or other
Page 4 of 12 entity.” Id. § 1681a(a)–(b). For willful violations, the FCRA provides one cause of action
against “[a]ny person,” id. § 1681n(a)(1)(A), and an additional cause of action against any
“natural person,” id. § 1681n(a)(1)(B).
As the D.C. Circuit recently held in a FCRA case, “these provisions speak clearly enough
to waive federal sovereign immunity.” Mowrer v. U.S. Dep’t of Transp., 14 F.4th 723, 729 (D.C.
Cir. 2021). The Act’s definition of “person,” which includes “any . . . government,” 15 U.S.C. §
1681a(a)–(b), “surely includes the federal government,” Mowrer, 14 F.4th at 729. And by
distinguishing between liability that runs against “any” person and liability that runs only against
“natural” persons, the FCRA reflects “a calibrated approach to the question of which persons
should bear which liabilities.” Id. Consequently, the court finds that Congress has waived
Defendants’ federal sovereign immunity from FCRA damages claims. 1
B. Standing
Article III of the Constitution confines federal judicial power to the resolution of “Cases”
and “Controversies.” For there to be a case or controversy under Article III, the plaintiff must
have a “personal stake” in the case—in other words, standing. Raines v. Byrd, 521 U.S. 811, 819
(1997). Standing is a necessary predicate to any exercise of federal jurisdiction and, when it is
lacking, the dispute fails to present a concrete case or controversy under Article III. Ariz.
Christian Sch. Tuition Org. v. Winn, 131 S. Ct. 1436, 1442 (2011); Dominguez v. UAL Corp.,
666 F.3d 1359, 1361 (D.C. Cir. 2012).
1 The parties disagree on whether the Smithsonian Institution is entitled to assert sovereign immunity. See ECF No. 35, Defs. Mot. at 5-6; ECF No. 36, Pl. Opp’n at 11 n.2. Without deciding the issue, the D.C. Circuit has noted “[s]everal elements of the Smithsonian’s congressional design” that suggest “it does have sovereign immunity.” Forman v. Small, 271 F.3d 285, 295 (D.C. Cir. 2001). The court need not reach this question here because, regardless of whether the Smithsonian Institution is entitled to assert sovereign immunity, such immunity has been waived. Mowrer, 14 F.4th at 729. Page 5 of 12 To have Article III standing to sue in federal court, a plaintiff must show (1) that they
suffered an injury in fact that is concrete, particularized, and actual or imminent; (2) that the
injury was likely caused by the defendant; and (3) that the injury would likely be redressed by
the relief sought. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–561 (1992). As the party
invoking federal jurisdiction, a plaintiff bears the burden of demonstrating that they have
standing. See id. at 561. At the pleading stage, “a plaintiff is required only to state plausibly that
each standing element exists.” Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1063 (D.C.
Cir. 2019) (citing Attias v. Carefirst, Inc., 865 F.3d 620, 625 (D.C. Cir. 2017)).
Defendants argue that Plaintiff has not plausibly stated that he suffered a concrete,
particularized, and actual or imminent injury. Plaintiff does not allege that Defendants’ conduct
caused him any physical or monetary harm. See generally Am. Compl. He instead contends that
Defendants’ conduct violated his statutory right and, as a result, exposed him to an increased risk
of identity theft. Id. ¶¶ 23, 65. He also alleges that because of Defendants’ conduct, he was
forced to take steps to safeguard the non-compliant receipt. Id. ¶¶ 34, 57.
“[T]he violation of a procedural right granted by statute can be sufficient in some
circumstances to constitute injury in fact.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1549 (2016).
Indeed, “Congress may create a statutory right or entitlement the alleged deprivation of which
can confer standing to sue even where the plaintiff would have suffered no judicially cognizable
injury in the absence of statute.” Warth v. Seldin, 422 U.S. 490, 514 (1975). But for “a statutory
violation to constitute an injury in fact, . . . the statute must protect the plaintiff’s concrete
interest—i.e., afford the putative plaintiff a right to be free of a harm capable of satisfying
Article III.” Jeffries, 928 F.3d at 1064.
Page 6 of 12 The D.C. Circuit has held that FACTA “vests consumers with a concrete interest in using
their credit and debit cards without incurring an increased risk of identity theft.” Id. The Act’s
truncation requirement imposes on the merchant the duty not to print “more than the last 5 digits
of the card number or the expiration date,” 15 U.S.C. § 1681c(g)(1), a duty that applies at the
“point of the sale or transaction” regardless of whether a plaintiff ever becomes the victim of
identity theft or fraud, Jeffries, 928 F.3d at 1064. In other words, FACTA’s “truncation
requirement is a procedure designed to decrease the risk that a consumer would have his identity
stolen.” Id. (cleaned up). The Act “thus vests consumers with an interest in using their credit
and debit cards without facing an increased risk of identity theft.” Id. And that interest is
concrete in that it is closely related to “a harm that has traditionally been regarded as providing a
basis for a lawsuit in English or American courts,” specifically, a common law breach of
confidence. Id. (citing Spokeo, 136 S. Ct. at 1549). “FACTA protects against the risk of the
very harm the breach of confidence tort makes actionable—an unauthorized disclosure of
privileged information to a third party.” Id. at 1065. Accordingly, the interest protected by
FACTA—avoiding an increased risk of identity theft—is concrete.
But the analysis does not end there. Having determined that FACTA protects a concrete
interest, the court must determine whether Defendants’ alleged violation of FACTA harmed or
created a “risk of real harm” to Plaintiff’s concrete interest. Id.
In Jeffries, the defendant printed a receipt containing all sixteen digits of the plaintiff’s
credit card and its expiration date, in violation of FACTA. Id. at 1062. This presented a
“nightmare scenario” for the plaintiff, who was unable to use her credit card without incurring an
increased risk of identity theft. Id. at 1066. As a result, the court concluded that the plaintiff
suffered a concrete injury in fact. Id. The D.C. Circuit in Jeffries noted, however, that “not
Page 7 of 12 every violation of FACTA’s truncation requirement creates a risk of identity theft.” Id. at 1065.
For example, “printing an expiration date on a receipt without more—although a technical
violation of FACTA—does not create a risk of identity theft” and thus does not cause a concrete
injury in fact. Id. at 1066; accord Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 783 (9th
Cir. 2018) (no standing where plaintiff alleged FACTA violation when only expiration date was
printed on receipt); Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 81 (2d Cir.
2017) (same); Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir.
2016) (same).
This case lies somewhere between the “nightmare scenario” in Jeffries and those cases
involving the mere printing of an expiration date, in that Plaintiff’s receipt contained the first and
last four digits of his credit card number. The D.C. Circuit has not considered whether such a
disclosure increases the risk of identity theft sufficient to constitute concrete injury. Other
Circuits, however, have.
In Kamal v. J. Crew Grp., Inc., the defendant printed a receipt containing the first six
and last four digits of the plaintiff’s credit card, as well as the name of his card issuer (Discover).
918 F.3d 102, 107 (3d Cir. 2019). The plaintiff broadly alleged that the defendant’s conduct
“created a real risk of identity theft” and that “identity thieves . . . obtain Card receipts that are
lost or discarded, or through theft, and use the information on them to commit fraud and theft.”
Id. at 116. Based on these allegations, the Third Circuit affirmed the district court’s dismissal for
lack of standing because the plaintiff failed to allege that “the receipt included enough
information to likely enable identity theft.” Id. The court noted, however, that its “analysis
would be different if the plaintiff had alleged that the receipt included all sixteen digits of his
Page 8 of 12 credit card number, making the potential for fraud significantly less conjectural,” as was the case
in Jeffries. Id.
Other Circuits have reached the same conclusion in similar circumstances. See Thomas
v. TOMS King (Ohio), LLC, 997 F.3d 629, 636 (6th Cir. 2021) (no concrete injury where
defendant printed receipt containing first six and last four digits of plaintiff’s credit card); Noble
v. Nev. Checker Cab Corp., 726 F. App’x 582 (9th Cir. 2018) (same regarding first digit and last
four digits); Katz v. Donna Karan Co., 872 F.3d 114 (2d Cir. 2017) (same regarding first six and
last four digits). In each of these cases, the courts found it important that (1) the first digits of a
card number reveal nothing more than the card issuer, and (2) FACTA does not prohibit printing
the identity of the card issuer on a receipt. “In other words, ‘printing the first six digits—the
[issuer identification number]—is the equivalent of printing the name of the issuing institution,
information which need not be truncated under FACTA.’” Thomas, 997 F.3d at 636 (quoting
Katz, 872 F.3d at 120); see also Noble, 726 F. App’x at 584 (“[T]he first digit of a credit card
number merely identifies the brand of the card, and Congress has not prohibited printing the
identity of the credit card issuer along with the last five digits of the credit card number.”);
Kamal, 918 F.3d at 107 (noting that “the first six digits identify the issuing bank and card type”).
Defendants attach to their motion a declaration from John Duven, the Payment Card
Industry Accessor in the Smithsonian Institution’s Office of Chief Information Officer. See
Defs. Mot., Duven Decl. ¶ 2. Duvan attests that the first four digits of an American Express
credit card—such as the one used by Plaintiff—do not provide any sensitive information specific
to a cardholder. Id. ¶ 3. Specifically, the first two digits identify the issuing financial institution
(in this case, American Express), and the next two digits identify the type and currency of the
card. Id. In his opposition to Defendants’ motion, Plaintiff did not respond to this assertion, and
Page 9 of 12 the court therefore treats it as conceded. See Wannall v. Honeywell, Inc., 775 F.3d 425, 428
(D.C. Cir. 2014) (explaining that if a party files an opposition addressing only some of the
movant’s arguments, the court may treat the unaddressed arguments as conceded).
Because the first four digits of Plaintiff’s credit card do not reflect any sensitive
information specific to him, but rather information that merchants are otherwise permitted to
print on receipts, that disclosure alone appears less likely to have increased the risk of any “real
harm” to Plaintiff. See, e.g., Thomas, 997 F.3d at 636; Katz, 872 F.3d at 120; Noble, 726 F.
Appx. at 584. This finding is consistent with the D.C. Circuit’s reasoning in Jeffries.
In Jeffries, the D.C. Circuit emphasized the deference courts must afford to Congress’s
judgment about what credit card information—when presented on a receipt—presents a tolerable
versus intolerable risk of identity theft. 928 F.3d at 1065 (“Congress’s judgment about when
increased risk becomes intolerable is entitled to respect.”) (citing Spokeo, 136 S. Ct. at 1549). In
determining whether printing an expiration date on a receipt presents an intolerable risk of
identity theft, the D.C Circuit looked to Congress’s actions, specifically, to the Credit and Debit
Card Receipt Clarification Act of 2007. There, Congress observed that the inclusion of
expiration dates did not raise a material risk of identity theft and thus suspended the damages
provisions of FACTA as they relate to printing expiration dates. Id. (citing Credit and Debit
Card Receipt Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(4)–(5) 122 Stat. 1565,
1565). Bearing this in mind, the D.C. Circuit reasoned that printing a receipt with an expiration
date—though still a violation of FACTA—does not increase the risk of identity theft to an
“intolerable” level, and thus does not constitute a concrete injury in fact. Id.
The same reasoning applies to receipts showing the first four digits of a credit card
number. Those numbers reveal nothing more than the credit card issuer, type of currency, and
Page 10 of 12 type of card, information that Congress did not prohibit from printing on a receipt presumably
because it has judged that the disclosure of this information does not present an intolerable risk
of identity theft. See Thomas, 997 F.3d at 636; Katz, 872 F.3d at 120; Noble, 726 F. Appx. at
584; cf. Jeffries, 928 F.3d at 1066. Accordingly, the court concludes that printing a receipt with
the first four digits of a credit card—though a violation of FACTA—does not increase the risk of
identity theft to the level where it constitutes a concrete injury in fact.
Plaintiff also alleges that Defendant violated FACTA by including his name on the
printed receipt. Am. Compl. ¶¶ 4, 36. Plaintiff is incorrect: FACTA does not prohibit printing a
consumer’s name on a receipt, see generally Pub. L. No. 108-159, § 113, 117 Stat. 1952, and
Defendant’s doing so is therefore not material to the concrete interest FACTA seeks to protect or
the concrete harm it seeks to prevent. See Jeffries, 928 F.3d at 1065 (considering whether
statutory violation constitutes injury in fact) (emphasis added); see generally id. (giving no
weight to district court’s finding—319 F. Supp. 3d 525, 531 (D.D.C. 2018)—that credit card did
not contain plaintiff’s name). Plaintiff does not show that printing his name on his receipt
invaded any legally protected interest, Spokeo, 136 S. Ct. at 1549 (“Congress is well positioned
to identify intangible harms that meet minimum Article III requirements.”), or that such a
disclosure “has a close relationship to a harm that has traditionally been regarded as providing
the basis for a lawsuit in English or American courts,” id. For instance, as previously explained,
a FACTA violation bears a “close relationship” to the common law breach of confidence because
FACTA creates a “relationship of trust between the consumer and merchant, requiring the
merchant to safeguard the consumer’s credit or debit card information.” Jeffries, 928 F.3d at
1064–65. Plaintiff does not point to any law or tradition that establishes the same relationship of
trust for a person’s name.
Page 11 of 12 Mindful of the D.C. Circuit’s finding that “not every violation of FACTA’s truncation
requirement creates a risk of identity theft,” Id. at 1065, the court concludes that this is one such
case in which the plaintiff has not plausibly stated that the alleged violation of FACTA has
created a risk of identity theft that amounts to a concrete injury in fact.
Plaintiff has also failed to plausibly state that the time he spent safeguarding the receipt
and disposing of it amounts to a concrete injury in fact. Where a “hypothetical future harm” is
not “certainly impending,” plaintiffs “cannot manufacture standing merely by inflicting harm on
themselves.” Clapper v. Amnesty Int’l USA, 568 U.S. 398, 416, 422 (2013). Plaintiff’s
management-of-risk claim is intertwined with his arguments about actual risk. If the receipt he
received on April 9, 2015, offered no advantage to identity thieves, Plaintiff can “hardly say that
he was injured because of the efforts he took to keep it out of their hands.” Muransky v. Godiva
Chocolatier, Inc., 979 F.3d 917, 931 (11th Cir. 2020) (noting that “any assertion of wasted time
and effort necessarily rises or falls along with [a court’s] determination of whether the risk posed
by [the defendant’s] FACTA violation, as pleaded by [the plaintiff], is itself a concrete harm”).
Plaintiff also does not allege that he treated the Smithsonian receipt any differently than any
other receipt, or that he spent any additional time safeguarding it. Without more, Plaintiff has
not adequately pled that he suffered a concrete injury in fact.
IV. CONCLUSION
For reasons explained above, the court will GRANT Defendants’ motion to dismiss
Plaintiff’s Amended Complaint.
Date: August 1, 2022 Tanya S. Chutkan TANYA S. CHUTKAN United States District Judge
Page 12 of 12