KAMAL v. J. CREW GROUP, INC.

• Court: District Court, D. New Jersey
• Decided: September 10, 2019
• Docket: 2:15-cv-00190
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW JERSEY

AHMED KAMAL, Plaintiff, Civ. No.: 2:15-0190 v. OPINION J. CREW GROUP, INC,, et al., Defendants. WILLIAM J. MARTINI, U.S.D.J.: , Plaintiff Ahmed Kamal (“Plaintiff”) brings this putative class action against the J. Crew Group, Inc. and various related entities (“Defendants”) under the Fair and Accurate Credit Transactions Act of 2003 (““FACTA”). This matter comes before the Court on Defendants’ motion to dismiss Plaintiff's Third Amended Complaint (“TAC”) without leave to amend. ECF No. 107 (“Motion”). For the reasons set forth below, the Motion is GRANTED. I. BACKGROUND Despite lengthy litigation, the facts of this case are relatively simple. FACTA mandates that “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt.” 41 U.S.C. § 1681c(g)(1). Plaintiff alleges that despite that prohibition, Defendants issued him three receipts displaying the first six and last four digits of his credit card number for his Discover-branded card (“Receipts”). TAC ff 2, 105, 107, 109, ECF No. 103. ‘Il. PROCEDURAL HISTORY Within weeks of receiving the offending Receipts, Plaintiff filed suit. After Plaintiff amended his complaint, the Court denied Defendants’ attempt to dismiss under Federal Rule of Civil Procedure (“FRCP”) 12(b)(6). Aug. 6, 2015 Op. & Ord., ECF Nos. 32-33. On May 16, 2016, the Supreme Court issued its opinion in Spokeo, Inc. v. Robins, finding that “standing requires a concrete injury even in the context of a statutory violation.” Spokeo, Inc. v. Robins, 1368. Ct. 1540, 1549 (2016). Defendants moved to dismiss under Spokeo pursuant to FRCP 12(b)(1). ECF No. 50. The Court granted the motion and dismissed the Amended Complaint without prejudice. Oct. 20, 2016 Op. & Ord., ECF Nos. 63-64. In November 2016, Plaintiff filed their Second Amended Complaint (“SAC”). ECF No. 65. Defendants once again moved to dismiss under FRCP 12(b)(1). ECF No. 68. The Court granted the motion, dismissing the SAC without prejudice. June 6, 2016 Op. & Ord., ECF Nos. 84-85. Plaintiff moved for reconsideration or, alternatively, requested that the Court amend its Opinion and Order to dismiss with prejudice to permit an appeal. ECF

No. 87. The Court denied the motion for reconsideration, but amended its Opinion and Order to dismiss with prejudice. Amend. June 14, 2016 Op. & Ord., ECF No. 88-89 (“Kamal I’). Plaintiff appealed. The Third Circuit affirmed this Court’s opinion that Plaintiff lacked standing. Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 106 (3d Cir. 2019) (“Kamal IF’). The court also found, however, that this Court lacked authority to dismiss the case with prejudice. Jd. at 118. Therefore, it remanded for dismissal without prejudice. Jd. This Court did so on April 15, 2019. Ord., ECF No. 97. Plaintiff filed the TAC on May 14, 2019. Il. NEW ALLEGATIONS The TAC is largely identical to the SAC. Almost all the new or amended allegations are conclusory statements of law or congressional intent, not facts regarding an alleged injury. See generally TAC 993, 5-7, 27, 58, 60-62, 111-18 (edited paragraphs). New factual allegations from which the Court could infer a concrete injury are limited to: (1) a study regarding illicit use of the first six digits of a credit card number, id. J 5; (2) that the fifth and sixth digits printed on the Receipts show more than the card brand and help hackers determine card zip codes, id.; (3) that Plaintiff incurred costs associated with legal representation, id. 4 114; (4) that Plaintiff expected his credit card number to remain secret, but Defendants created a risk that the information would fall into a third party’s hands by printing more digits than FACTA permits, id. 116-117, and (5) that Plaintiff could no longer merely throw out the Receipts, and instead must incur the cost of safely keeping or destroying them, id. { 6, 111-13, 115. IV. STANDARD OF REVIEW Defendants once again challenge Plaintiff’s standing to bring this lawsuit. [FRCP] 12(b)(1) is the proper vehicle for challenging a plaintiffs Article [II standing. Challenges to standing are either “facial” or “factual.” [A facial challenge] does not dispute what facts are, but rather whether the facts as plead create standing. In such cases, a presumptive truthfulness attaches to the plaintiff's allegations.... Nonetheless, plaintiffs always bear the burden of establishing subject matter jurisdiction. Although general factual allegations of injury resulting from the defendant’s conduct may suffice, the complaint must still clearly and specifically set forth facts sufficient to satisfy Article III. Kamal I at 3 (cleaned up). As before, Defendants’ challenge here is facial. See Mot. Vv. DISCUSSION Defendants challenge Plaintiffs standing. Because the requirements of standing were discussed in detail in Kamal IJ, the Court will not do so again here. In short, Article III standing requires plaintiffs to have “suffered an injury in fact.” Spokeo, 136 S. Ct. at 1547. “To establish injury in fact, a plaintiff must show that he or she suffered an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical.” Jd. at 1548 (cleaned up). “Although imminence is concededly a somewhat elastic concept, it cannot be stretched beyond its purpose, which is to ensure that

the alleged injury is not too speculative.” Clapper v. Amnesty Int'l USA, 568 U.S. 398, 409 (2013). “[T]he violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact.” Spokeo, 1368S. Ct. 1549. In that context, plaintiffs “need not allege any additional harm beyond the one Congress has identified.” /d. But a procedural violation does not “automatically satisfy[y] the injury-in-fact requirement.” Jd. Plaintiffs must have suffered “a concrete injury even in the context of a statutory violation.” Id. Where a technical violation of a statute does not “cause harm or present any material risk of harm,” standing will not automatically attach. Jd. at 1550 (explaining dissemination of improper zip code violated statute but did not cause harm or a material risk of harm and thus, without more, would not produce standing). But even if a statutory violation alone is insufficient, the “risk of real harm” can satisfy the injury “injury in fact” requirement. Kamal 115. A. Theories Already Addressed by this Court and the Third Circuit Defendants argue this Court and the Third Circuit already considered and rejected Plaintiff's various injury theories. See generally Mot. Rather than focus on his new allegations, Plaintiff accuses the Third Circuit of, inter alia, “impermissible second-guessing” of Congress and, citing to other courts, argues “the weight of authority confirms Plaintiff's standing.” Opp. at 5-7 (capitalization adjusted). However, “[a] circuit split between our Court of Appeals and the courts of appeals for other circuits does not make Third Circuit precedent any less binding.” Freedom Med., Inc. v. Gillespie, 06-cv-3195, 2013 WL 3819366, at *5 (E.D. Pa. July 24, 2013). As the Third Circuit addressed most of Plaintiff's arguments, they can be disposed of quickly. Citing various circuit courts (including a vacated Eleventh Circuit opinion), Plaintiff reasserts that (1) the technical violation of FACTA or (2) the increased risk of identity theft resulting therefrom (without any other facts or injuries) establish standing. Opp. at 6-10. The Third Circuit addressed these arguments head on. See Kamal IJ at 113 (“Kamal has pleaded two allegedly ‘concrete’ injuries: ‘the printing of the prohibited information itself,’ 1e., a violation of FACTA’s plain text, and the ‘increased risk of identity theft’ resulting from that printing.”). It found the technical violation of FACTA insufficient to produce standing because “the FACTA violation alleged by Kamal is not itself a concrete injury.” /d. at 115. Absent a sufficient degree of associated risk, printing the Receipts was “‘a bare procedural violation’ that does not create Article III standing.” Jd. at 117 (quoting Spokeo, 136 S.Ct. at 1549). The Third Circuit also analyzed the alleged increased risk of identity theft. Jd. at 115 (analyzing risk of real harm “[bJecause the FACTA violation [was] not itself a concrete injury” and “the FACTA provision at issue was part of Congress’s effort to prevent the concrete harm of identity theft”). It found that Plaintiffs “conclusory allegations of risk [were] insufficient.” /d. at 116. Agreeing with this Court, the Third Circuit found that the “speculative chain of events” before an actual injury occurrs—Plaintiff loses the Receipts, which are found by a third party, who then obtains the remaining information needed to use his card, and then makes purchases—‘“does not constitute a material risk of harm.” Jd.

B. Additional Allegations As this Court cannot overturn the Third Circuit’s binding precedent on the harms alleged in the SAC, it will now turn to the new allegations added to the TAC. 1. Fraud Study Plaintiff alleges “[a] study has shown that an identity thief, using the prohibited first six digits in addition to the allowed last five digits... can generate the entire credit card number in as little as six seconds. ... [T]he identity thief can then charge purchases against the victim’s credit card.” TAC 4 5. Plaintiff identifies the incorporated study in his motion papers. Opp. at 8 n.9 (referring to Mohammed Aamir Ali et al., Does the Online Card Payment Landscape Unwittingly Facilitate Fraud?, IEEE Security & Privacy (Mar.—Apr. 2017) (“Study”)).! The Study describes how hackers can exploit weaknesses and inconsistencies in merchant websites to generate usable credit card data, starting with a card number. See Study at 3. It does not—as could be relevant to Plaintiffs claim—discuss how the revelation of the first six and last four digits of an individual’s card number could put them at a particularly increased risk of identity theft. See id. Nor does it mention criminals utilizing receipts containing such information to steal identities. Instead, it suggests two methods of obtaining credit card numbers, the Study’s “starting point”: (1) buying known card numbers from criminals or (2) exploiting the “contactless feature” available in new cards to skim data. Study at 3-4. The closest the Study gets to supporting a conclusion that printing the first six digits materially increased Plaintiff’s risk was a single passing sentence that: “[i]t is also possible to generate [a full card number] using the first six digits of a [card number] and the Luhn’s algorithm and getting it verified.” Jd. at4. While the Study points out this possibility, it says nothing about the effort required to do so, how one would “get[] it verified,” or the increased risk resulting from the first six digits appearance on a receipt. /d. As Plaintiff admits, “[o]nline databases such as BinDb and ExactBins contain lists of many (but not all) of the first-six-digit combinations in existence.” Opp. at 10. Therefore, it is unlikely that the Receipt’s additional publication of a six-digit combination would materially increase Plaintiffs risk, given that the first six digits of most cards in existence are available online. In other words, the Study does not sufficiently link the FACTA violation—printing of the first six digits—to an increased risk of identity theft particular to Plaintiff to create standing. Kamal IJ at 117 (after

' Plaintiff attempted to rely on the Study before the Third Circuit as well. While the circuit court did not formally consider the Study, in dicta, it noted the Study’s irrelevance to Plaintiff's claim. Kamal 116-17. On full consideration of the Study, this Court agrees with the Third Circuit’s conclusion. While the TAC’s language makes the Study appear to test the use of the same data printed on the Receipts (i.e., opening and closing digits), “[i]t is a well-settled rule that when a written instrument contradicts allegations in the complaint to which it is attached, the exhibit trumps the allegations.” S. Jersey Gas Co. v. Mueller Co., Ltd., 09-cv-4194, 2012 WL 12898818, at *3 (D.N.J. Jan. 30, 2012), aff'd, 12-cv-1547, 2013 WL 870339 (3d Cir. Mar. 11, 2013) (quoting Northern Indiana Gun & Outdoor Shows, Inc. v. City of South Bend, 163 F.3d 449, 454 (7th Cir. 1988)).

discussing study, concluding the “alleged violation of FACTA is a bare procedural violation that does not create Article III standing”). 2. Digits Showing Issuing Bank or Merchant Plaintiff argues that because the fifth and sixth digits can identify the issuing bank or sponsoring merchant, and “[b]ecause ascertaining the consumer’s geographical location is often the key to successfully hacking his account, the additional pieces of information... make the hacker’s job that much easier.” Opp. at 10 (citing Study). According to Plaintiff, the Third Circuit therefore “got it wrong” in noting that the addition of the first six digits does not provide any additional information than is permissibly on the Receipts. Opp. at 10 (citing Kamal I] at 117 n.7 (noting Receipts displayed “Discover” brand and thus the “first six digits provide[d] no more information than [was] permissibly printed”)). As an initial matter, the Third Circuit noted elsewhere that the first six digits also “identify the issuing bank and card type.” Kamal IJ at 107. Regardless, access to this additional information does not materially increase the risk of harm to Plaintiff. True, a fraudster could conceivably narrow his search for a card’s zip code by starting in regions close to the issuing bank or merchant’s branches. See Study at 3. But like the chain of inferences discussed above, that possibility does not sufficiently increase the chance of Plaintiff being harmed. Hackers could use the same technique on any publicly available six-digit combination. See id. Further, the location of any recovered receipt or the issuing store give criminals at least as good a clue of the card’s assigned zip code. Most significantly, the chain of causation deemed too remote to confer standing in Kamal II remains largely unchanged: “Kamal loses or throws away the receipt, which is then discovered by a hypothetical third party, who then obtains the six remaining truncated digits along with any additional information required to use the card, such as the expiration date, security code or zip code.” Kamal IT at 116 (quoting Kamal J at 5). The only new allegation is that the fifth and sixth digits provide a hint on the zip code, which could conceivably be exploited using “brute force guesses from a list of issuing bank postcodes from a particular city where the card details have been skimmed from.” Study at 3. The increased risk particular to Plaintiff from the possibility of reverse engineering his zip code based on the Receipts’ display of the fifth and sixth digits is insufficient to produce standing. See Kamal IT at 116 (“Kamal must plausibly aver how [Defendants’] printing of the six digits presents a material risk of concrete, particularized harm.”’). For Plaintiff to suffer a real harm due to the fifth and sixth digits’ exposure, someone would have to (1) find the Receipts, (2) determine the remaining digits of Plaintiffs card, (3) guess the correct zip code because they knew the issuing bank or merchant (and not because they found a receipt near Plaintiff's home or by guessing every possible zip code through a brute force attack), and finally (4) successfully use the card. The added information exposed by the fifth and sixth digits is insufficiently dangerous to pass Article III muster. See Clapper, 568 U.S. at 409 (barring “too speculative” injuries); Kamal II at 115 (finding statutory violation alone insufficient).

3. Transportation and Litigation Costs Plaintiff alleges he “has suffered the cost . . . of transportation to his attorney to discuss the Defendants’ violation of Federal law and to discuss what he needs to do with the credit card receipts.” As Defendants argue, if this were enough, any plaintiff that visits their attorneys’ office to discuss a matter would have standing. Mot. at 2 n.1. That is not the state of the law. See Clapper, 568 at 416 (“Respondents’ contention that they have standing because they incurred certain costs as a reasonable reaction to a risk of harm is unavailing— because the harm respondents seek to avoid is not certainly impending.”’). 4. Violated Expectation of Secrecy The TAC includes a new allegation that Plaintiff provided Defendants “with his credit card number with the expectation that it will remain secret, not least because of the risk of credit card fraud if the merchant reveals it.” TAC J 116. Defendants argue “[a]ny so-called ‘privacy’ interest in the receipts was not invaded because there was no disclosure of the information to any unauthorized party.” Mot. at 13 (citing Kamal IJ at 114). Plaintiff fails to respond to the argument. See Aiellos v. Zisa, 09-cv-3076, 2010 WL 421081, at *5 & n.8 (D.N.J. Feb. 2, 2010) (finding failure to meaningfully respond waived claims). In any event, there is no allegation that any third party viewed the Receipt, potentially violating any expectation of secrecy. See Kamal II at 114. Thus, the “expectation of secrecy” allegation does not help Plaintiff's case. 5. Incurring Burden of Keeping or Destroying Receipts The TAC alleges an injury based on the cost and burden of keeping or destroying the Receipts. TAC J 6, 111-14. This too is insufficient. Plaintiffs “cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.” Clapper, 568 U.S. at 416. Here, the hypothetical future harm (credit card fraud) is not “certainly impending.” See id. Therefore, shouldering the burden and cost of preventing that harm is insufficient for standing to attach. As the Ninth Circuit explained on remand in Spokeo: where the violative conduct and intangible injury have already occurred, and the “intangible injury itself is sufficiently concrete[, i]t is of no consequence how likely [plaintiffs are] to suffer additional concrete harm as well.” Robins v. Spokeo, Inc., 867 F.3d 1108, 1118 (9th Cir. 2017), cert. denied, 138 S. Ct. 931, 200 L. Ed. 2d 204 (2018) (cleaned up). But where an injury is only predicted, “a plaintiff cannot show injury-in-fact unless the threatened injury is certainly impending as opposed to merely speculative.” Jd. (cleaned up) (discussing Clapper, 568 U.S. at 1145-48). Here, Plaintiff has suffered an intangible injury, but the intangible injury itself was not sufficiently concrete to confer standing. Kamal II at 113 (“T]he procedural violation is not itself an injury in fact.”); Cf Robins, 867 F.3d at 1118 (explaining imminent injury unnecessary because intangible injury (i.e., statutory violation) was sufficiently concrete). Therefore, the threatened injury—identity theft—must be “certainly impending” for Plaintiff to have standing. Clapper, 568 U.S. at 1147-48. Fortunately for Plaintiff, there is no indication that his identity is at imminent risk. See id. Unfortunately for Plaintiff's case, that means steps taken to protect himself from identity theft do not create standing. See Clapper,

568 U.S. at 416 (finding costs associated with “not certainly impending” future injury incapable of creating standing). The Court is aware that precedent from other circuits counsels otherwise. See Muransky v. Godiva Chocolatier, Inc., 922 F.3d 1175, 1192 (11th Cir. 2019) (“The effort [plaintiff] put into doing away with the risky receipt would suffice for standing.”); Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1064 n.2 & 1067 n.2 (D.C. Cir. 2019). However, in those cases, the courts found standing due to the technical FACTA violations alone. See Muranksy, 922 F.3d at 1188 (“[Plaintiff] alleged he suffered a heightened risk of identity theft as a result of a FACTA violation. That allegation suffices for standing under Spokeo.”); Jeffries, 928 F.3d at 1067 n.3 (“Although not every FACTA violation creates a concrete injury in fact, we conclude that the alleged violation of Jeffries’ right does so.”). Those conclusions stemmed, in part, from the determination that FACTA’s purpose is to reduce the risk of identity theft, not to actually avoid it. Muranksy, 922 F.3d at 1188 (“Congress conferred the procedural right in FACTA to reduce the risk of identity theft.”); Jeffries, 928 F.3d at 1067 n.3 (“We are not necessarily in full agreement with the Third Circuit, which takes the position that FACTA protects an interest in avoiding actual identity theft, rather than increased risk of identity theft.”). In contrast, Kamal I found “the FACTA provision at issue was part of Congress’s effort to prevent the concrete harm of identity theft.” Kamal II at 115. Thus, the “increased risk of identity theft resulting from [] printing” the Receipts was insufficient to confer standing. /d. at 113 (“[T]he procedural violation is not itself an injury in fact, and [Plaintiff] has not otherwise alleged a risk of harm that satisfies the requirement of concreteness.”). As the Third Circuit held the increased risk of identity theft was insufficient, taking steps to mitigate that risk does not create standing either. See Clapper, 568 U.S. at 416 (“Respondents’ contention that they have standing because they incurred certain costs as a reasonable reaction to a risk of harm is unavailing—because the harm respondents seek to avoid is not certainly impending.”). Because none of the new allegations allow the Court to conclude Plaintiff suffered a sufficient injury-in-fact, Defendants’ motion to dismiss is GRANTED. VI. VOLUNTARY DISMISSAL AND COSTS Plaintiff requests that in the event the Court is inclined to grant the Motion, it should “accept his notice of voluntary dismissal, with prejudice, pursuant to Rule 41(a)(1)(A)(i), each side to bear its own costs.” Opp. at 15. Defendants reply by requesting costs and dismissal without leave to amend. Reply at 12-13. A. Costs “Whenever any action or suit is dismissed in any district court... for want of jurisdiction, such court may order the payment of just costs. 28 U.S.C. §1919. “The awarding of costs under § 1919 turns on whether such an award is ‘just.’”” Hygienics Direct Co. v. Medline Indus., Inc., 33 F. App’x 621, 625 (3d Cir. 2002). The decision is within the Court’s discretion. Jd. Here, costs will not be awarded. While the Court is disappointed Plaintiff's counsel spent pages of his brief arguing directly against binding precedent and citing to overturned

authority, the TAC was not filed frivolously. The Third Circuit explicitly stated that it did not consider the Study or the burden of storing or disposing of the Receipts in its analysis. Kamal I at 116, 118.10. Accordingly, amending the complaint to test those allegations was legitimate. B. Prejudice and Leave to Amend Defendants do not oppose Plaintiff's request for a stipulation of dismissal with prejudice. Reply at 11. They separately request Plaintiff not be granted leave to replead. Mot. at 19. Plaintiff does not address Defendants’ arguments regarding further amendment. See Opp. The Third Circuit made clear that where this Court lacks jurisdiction, “the case should be dismissed without prejudice.” Kamal IJ at 119. As to leave to amend, amendment is generally permitted absent “undue delay, bad faith or dilatory motive . . . , repeated failure to cure deficiencies by amendments previously allowed . . . , [or] futility of amendment.” Great W. Mining & Mineral Co. v. Fox Rothschild LLP, 615 F.3d 159, 174 (3d Cir. 2010) (quoting Foman y. Davis, 371 U.S. 178, 182 (1962)). Here, Plaintiff has repeatedly failed to cure deficiencies by amendments previously allowed and failed to respond to Defendants’ contention that further amendment would be futile. See Mot. at 19-20. Accordingly, this case is DISMISSED WITHOUT PREJUDICE and further leave to amend is DENIED. See Aiellos, 2010 WL 421081, at *5 & n.8. VII. CONCLUSION For the reasons set forth above, none of the additional allegations (nor those already analyzed in Kamal II) are sufficient for the Court to conclude Plaintiff has standing to bring this suit. Accordingly, Defendants’ motion to dismiss pursuant to FRCP 12(b)(1), ECF No. 107, is GRANTED. An appropriate Order follows.

Date: September Mt 2019 Zig J. MARTINI, U.S.D.J.