IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF OREGON
MADELINE KAY, ALEX ALANIZ, and Case No. 3:24-cv-1440-SI MATTHEW ENSIGN, individually and on behalf of all others similarly situated, OPINION AND ORDER
Plaintiffs,
v.
PLAID PANTRY, INC. and PLAID PANTRIES, INC.,
Defendants.
Kelly D. Jones, LAW OFFICE OF KELLY D. JONES, 819 SE Morrison Street, Suite 255, Portland, OR 97214; Michael R. Fuller, UNDERDOG LAW OFFICE, US Bancorp Tower, 111 SW Fifth Avenue, Suite 3150, Portland, OR 97204; and Paul B. Barton, OLSEN BARTON LLC, 4035 Douglas Way, Suite 200, Lake Oswego, OR 97035. Of Attorneys for Plaintiffs.
Christopher H. Wood, LEWIS BRISBOIS BISGAARD & SMITH LLP, 1700 Lincoln Street, Suite 4000, Denver, CO 80203; Jennifer K. Oetter and Meryl A. Hulteng, LEWIS BRISBOIS BISGAARD & SMITH LLP, 888 SW Fifth Avenue, Suite 900, Portland, OR 97204. Of Attorneys for Defendants.
Michael H. Simon, District Judge.
Madeline Kay, Alex Alaniz, and Matthew Ensign (collectively, “Plaintiffs”) filed this putative class action in Multnomah County Circuit Court against Plaid Pantry, Inc. and Plaid Pantries, Inc. (collectively, “Defendants”). Defendants timely removed this lawsuit to federal court under the Class Action Fairness Act of 2005 (“CAFA”), 28 U.S.C. §§ 1332, 1453, 1711-15. Now before the Court is Plaintiffs’ motion to remand or, alternatively, for leave to take jurisdictional discovery. Plaintiffs argue that this Court lacks subject matter jurisdiction because the allegations in Plaintiffs’ complaint do not establish Article III standing under the United States Constitution. See Polo v. Innoventions Int’l, LLC, 833 F.3d 1193, 1196 (9th Cir. 2016)
(“The rule that a removed case in which the plaintiff lacks Article III standing must be remanded to state court under § 1447(c) applies as well to a case removed pursuant to CAFA as to any other type of removed case.” (citing 28 U.S.C. § 1453(c)(1))). Plaintiffs also request attorney’s fees in connection with their motion to remand, arguing that Defendants did not remove this case in good faith because they knew that the Court lacked subject matter jurisdiction. Defendants respond that Plaintiffs’ allegations are sufficient to show Article III standing at the pleading stage because Plaintiffs allege violations of an Oregon statute that protects privacy rights. The Court held oral argument on February 18, 2025. For the reasons explained below, the Court concludes that Plaintiffs do not allege an injury-in-fact that is sufficient to support Article III standing.
Thus, the Court remands this case to Multnomah County Circuit Court. The Court denies Plaintiffs’ request for attorney’s fees. BACKGROUND Plaintiffs allege that Defendants violated § 807.750 of the Oregon Revised Statutes (“ORS”). Under that law, a private entity may not electronically “swipe”1 an individual’s driver license or identification card except for certain limited purposes, including “[t]o verify the
1 ORS § 807.750(1)(f) defines “swipe” as “the act of passing a driver license or identification card through a device that is capable of deciphering, in an electronically readable format, the information electronically encoded in a magnetic strip or bar code on the driver license or identification card.” individual’s age when providing an age-restricted good or service to any person about whom there is any reasonable doubt of the person’s having reached 21 years of age.” ORS § 807.750(2)(b). This statute also provides that “[a] private entity that swipes an individual’s driver license or identification card under subsection (2) . . . (b) of this section may not store, sell or share personal information2 collected from swiping the driver license or identification card.”
ORS § 807.750(3). In addition, this law permits the recovery of statutory damages in the amount of $1,000 per individual, plus equitable relief and prevailing plaintiff attorney’s fees. ORS § 807.750(8). It also provides that “[a]ny waiver of a provision of this section is contrary to public policy and is void and unenforceable.” ORS § 807.750(9). Oregon enacted ORS § 807.750 based on the following findings by the Oregon Legislative Assembly. (1) Oregon recognizes the importance of protecting the confidentiality and privacy of an individual’s personal information contained in driver licenses, driver permits and identification cards. (2) Machine-readable features found on driver licenses, driver permits and identification cards are intended to facilitate verification of age or identity, not to facilitate collection of personal information about individuals nor to facilitate the creation of private databases of transactional information associated with those individuals. (3) Easy access to the information found on driver licenses, driver permits and identification cards facilitates the crime of identity theft, which is a major concern in Oregon. ORS § 807.745.
2 “‘Personal information’ means an individual’s name, address, date of birth, photograph, fingerprint, biometric data, driver license number, identification card number or any other unique personal identifier or number.” ORS § 807.750(1)(d) Plaintiffs’ class action complaint (“Complaint”) begins with a discussion of “privacy” and “data privacy.” ECF 1-1, ¶ 1. It also recites the findings contained in ORS § 807.745. Id. Plaintiffs allege two distinct violations of ORS § 807.750. Plaintiffs allege that Defendants’ employees swiped driver licenses or other identification cards (collectively, “IDs”) of “all customers” who purchased an age-restricted item at a store owned or operated by Defendants.
Plaintiffs also allege that Defendants “store[d] the dates of birth from the driver licenses it swipes on its servers.”3 In their Complaint. Plaintiffs request class certification, equitable relief, and prevailing plaintiff attorney’s fees. Plaintiffs also state that they reserve the right to amend their Complaint to request damages and punitive damages. STANDARDS A civil action generally may be removed from state court to federal court if the federal district court would have had original, subject matter jurisdiction over the case. 28 U.S.C. § 1441(a). An objection that a federal court lacks subject matter jurisdiction may be raised by
3 In their Complaint, Plaintiffs cite and quote from the Declaration of Mark Ososke (“Ososke Decl.”) and the exhibit attached to that declaration, which Plaintiffs attach to their Complaint. ECF 1-1 at 11-13. Thus, based on the Complaint’s reference to and attachment of the Osoke Decl., under the Ninth Circuit’s doctrine of incorporation by reference, the Court considers the statements made in the declaration and its exhibit to the same extent as if those statements were expressly alleged in the text of the Complaint itself. See generally Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1002 (9th Cir. 2018) (“[I]ncorporation-by-reference is a judicially created doctrine that treats certain documents as though they are part of the complaint itself.”).
Mr. Ososke states that he visited six Plaid Pantry convenience stores in the Portland area to purchase alcoholic beverages with cash. He adds that he was born in 1969, that he looks his age, and that there is no doubt that he is older than 21 years of age. Ososke Decl. ¶ 2. He states that his driver license was swiped during each purchase and that “Plaid Pantry employees told [him] that swiping the driver license of every customer who purchases a product that requires ID is Plaid Pantry’s corporate policy, and that Plaid Pantry stores the dates of birth from the driver licenses it swipes on its servers.” Id. ¶ 3. The exhibit attached to the Ososke Declaration is a photograph of a sign displayed at one of Defendants’ stores, stating: “We Scan IDs, ALL CUSTOMERS: Please Have ID Ready.” ECF 1-1 at 13. any party, or by the court on its own initiative, at any time. Arbaugh v. Y&H Corp., 546 U.S. 500, 506 (2006); Fed. R. Civ. P. 12(b)(1). A federal court may not decide the merits of any case over which it lacks subject matter jurisdiction. Fed. R. Civ. P. 12(h)(3); see also Pistor v. Garcia, 791 F.3d 1104, 1111 (9th Cir. 2015) (noting that when a federal court lacks subject- matter jurisdiction, meaning it lacks the constitutional or statutory power to adjudicate a case, the
case may not proceed in that court). A plaintiff’s standing under Article III of the United States Constitution is a component of subject matter jurisdiction. Chandler v. State Farm Mut. Auto. Ins., 598 F.3d 1115, 1121 (9th Cir. 2010). A motion to remand is the proper procedure for a plaintiff to use when challenging removal. 28 U.S.C. § 1447; see also Moore-Thomas v. Ala. Airlines, Inc., 553 F.3d 1241, 1244 (9th Cir. 2009). In the context of a removal under CAFA, the removing party “bears the initial burden of establishing federal jurisdiction under § 1332(d)(2).” Serrano v. 180 Connect, Inc., 478 F.3d 1018, 1024 (9th Cir. 2007). After “federal jurisdiction has been established under that provision, the objecting party bears the burden of proof as to the applicability of any express
statutory exception.” Id. “[N]o antiremoval presumption attends cases invoking CAFA . . . .” Dart Cherokee Basin Operating Co. v. Owens, 574 U.S. 81, 82 (2014). DISCUSSION A threshold question in this case is whether Plaintiffs have alleged an injury-in-fact sufficient to confer standing under Article III of the United States Constitution. It is well established that if a plaintiff lacks Article III standing, the merits of that plaintiff’s claim may not be heard in federal court. If the Court answers this threshold question in the negative, the next issue that must be addressed concerns the proper remedy—remand or dismissal. As discussed below, the Court concludes that when a defendant removes a class action lawsuit and satisfies all of the requirements of CAFA removal, a federal court must remand the case to state court if the federal court determines that the plaintiffs lack Article III standing. A. Article III Standing 1. Standards The U.S. Constitution confers limited authority on the federal courts to hear only active cases or controversies brought by persons who demonstrate standing. See Spokeo, Inc. v.
Robins, 578 U.S. 330, 337-38 (2016); Already, LLC v. Nike, Inc., 568 U.S. 85, 90-91 (2013). Standing “limits the category of litigants empowered to maintain a lawsuit in federal court to seek redress for a legal wrong.” Spokeo, 578 U.S. at 338. To have standing, a plaintiff must have a “personal interest . . . at the commencement of the litigation.” Friends of the Earth, Inc. v. Laidlaw Env’t Servs. (TOC), Inc., 528 U.S. 167, 189 (2000). The required personal interest must satisfy three elements throughout the litigation: (1) an injury-in-fact, i.e., an invasion of a legally protected interest that is concrete and particularized, as well as actual or imminent; (2) a causal connection between the injury-in-fact and the defendant’s challenged behavior; and (3) a likelihood that the injury-in-fact will be redressed by a favorable ruling. Id. at 180-81; see also Spokeo, 578 U.S. at 338 (reiterating that the “irreducible constitutional minimum” of standing
consists of “an injury-in-fact . . . fairly traceable to the challenged conduct of the defendant, and . . . likely to be redressed by a favorable judicial decision”); TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021) (explaining that “a plaintiff must show (i) that he suffered an injury-in-fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief”). In this case, the Court focuses on the first element, injury-in-fact. As noted, injury-in-fact requires an invasion of a legally protected interest that is (1) concrete and (2) particularized, as well as (3) actual or imminent. An injury is “concrete” if it is “de facto; that is, it must actually exist,” meaning that it is “real and not abstract.” Spokeo, 578 U.S. at 340 (quotation marks omitted). “‘Concrete’ is not, however, necessarily synonymous with ‘tangible.’ Although tangible injuries are perhaps easier to recognize, [the Supreme Court has] confirmed in many . . . previous cases that intangible injuries can nevertheless be concrete.” Id. Congress may “elevat[e]
to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law,” Lujan v. Defs. of Wildlife, 504 U.S. 555, 578 (1992), but a plaintiff does not “automatically satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right,” Spokeo, 578 U.S. at 341. In considering whether a harm sufficiently is concrete, “history and tradition offer a meaningful guide to the types of cases that Article III empowers federal courts to consider.” TransUnion, 594 U.S. at 424 (quoting Sprint Commc’ns Co. v. APCC Servs., Inc., 554 U.S. 269, 274 (2008)). The Ninth Circuit uses a two-part test to determine whether statutory violations are
concrete injuries for standing purposes, analyzing: “(1) whether the statutory provisions at issue were established to protect [a plaintiff’s] concrete interests (as opposed to purely procedural rights), and if so, (2) whether the specific procedural violations alleged in this case actually harm, or present a material risk of harm, to such interests.” Tailford v. Experian Info. Sols., Inc., 26 F.4th 1092, 1099 (9th Cir. 2022) (alteration in original) (quotation marks omitted). An injury is “particularized” if it “affect[s] the plaintiff in a personal and individual way.” Spokeo, 578 U.S. at 339 (quoting Lujan, 504 U.S. at 560 n.1). In addition to an injury-in- fact being concrete and particularized, the injury must be “actual or imminent, not ‘conjectural’ or ‘hypothetical.’” Lujan, 504 U.S. at 560 (quotation marks omitted). “That ‘actual or imminent’ is disjunctive is critical: it indicates that a plaintiff need not wait until he or she has actually sustained the feared harm in order to seek judicial redress, but can file suit when the risk of harm becomes imminent.” Clemens v. ExecuPharm, Inc., 48 F.4th 146, 152 (3rd Cir. 2022) (emphasis in original). The Supreme Court recently clarified that “a person exposed to a [sufficiently imminent and substantial] risk of future harm may pursue . . . injunctive relief to prevent the
harm from occurring,” but a plaintiff in a suit for damages must show that the plaintiff was “independently harmed by [the] exposure to the risk itself.” TransUnion, 594 U.S. at 435, 437. “The question of whether a party has standing to sue under Article III is a threshold issue.” Shulman v. Kaplan, 58 F.4th 404, 407 (9th Cir. 2023).“If at any time before final judgment it appears that the district court lacks subject matter jurisdiction, the case shall be remanded.” 28 U.S.C. § 1447(c)). “Remand is the correct remedy because a failure of federal subject-matter jurisdiction means only that the federal courts have no power to adjudicate the matter. State courts are not bound by the constraints of Article III.” Polo, 833 F.3d at 1196 (emphasis in original) (citing ASARCO Inc. v. Kadish, 490 U.S. 605, 617 (1989)).
2. Analysis a. Injury from Statutory Violation As discussed, Plaintiffs allege two distinct violations of ORS § 807.750: (1) swiping IDs during the sale of all age-restricted items, in violation of § 807.750(2)(b); and (2) retaining personal information obtained through the swiping of IDs, in violation of § 807.750(3). Plaintiffs argue that they have not alleged an injury-in-fact sufficient to confer Article III standing, primarily under Spokeo and TransUnion. Defendants respond that Spokeo and TransUnion are distinguishable because those cases involved statutory procedural violations, while this case involves a statutory substantive violation. Defendants contend that Plaintiffs have articulated sufficient standing, at least at this stage of the lawsuit, because they have sued under a statute that protects concrete interests in privacy. The Court begins with the Supreme Court’s guidance in Spokeo and TransUnion. As noted above, in Spokeo, the Supreme Court explained that “Congress’ role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact
requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Spokeo, 578 U.S. at 341. In that case, the Supreme Court stated that “Article III standing requires a concrete injury even in the context of a statutory violation. [A plaintiff may] not, for example, allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III.” Id. In TransUnion, the Supreme Court clarified what is required for a statutory cause of action to establish an Article III injury. In that case, the plaintiffs alleged that a credit reporting agency violated the Fair Credit Reporting Act (“FCRA”) by (1) failing to “use reasonable procedures to ensure the accuracy of their credit files” and (2) sending consumers copies of their
credit files and summaries of their rights in two mailings, rather than in one mailing. TransUnion, 594 U.S. at 417, 420-21. The Supreme Court held that the subset of class members whose inaccurate credit files were provided to third-party businesses had standing as to the first claim because they demonstrated “concrete reputational harm,” but that the class members whose files were not sent to any third parties had not established a concrete harm and thus lacked standing. Id. at 417. For the written disclosure claims, although the plaintiffs alleged a statutory violation, “they [did] not demonstrate that they suffered any harm at all from the formatting violations.” Id. at 440 (emphasis in original). The Supreme Court stated that “[a]n asserted informational injury that causes no adverse effects cannot satisfy Article III.” Id. at 442 (quotation marks omitted). The Supreme Court therefore held that the class had no Article III standing for the written disclosure claims.4 Id. at 440. Here, Plaintiffs’ allegations are somewhat like the allegations of the TransUnion class members whose credit files were not disseminated to third-party businesses. The allegations here involve the internal storage of dates of birth (without names or other identifying information) and
the simple “swiping” (or checking) of IDs. There are no allegations that the information was transmitted to any outside party. Notably, in TransUnion the credit files inaccurately labeled the class members “as potential terrorists, drug traffickers, or serious criminals” in violation of FCRA, id. at 432, and still the collection and retention of that information without dissemination was not sufficiently injurious. Plaintiffs allege only that Defendants electronically retained their dates of birth—this is much less harmful information to collect and retain. As noted above, TransUnion suggests that courts look to history and tradition to consider whether the alleged injury has traditionally been cognizable in American courts. This requires evaluating whether the harm alleged “bears ‘a close relationship to harms traditionally
recognized as providing a basis for lawsuits in American courts,’ like ‘reputational harms, disclosure of private information, and intrusion upon seclusion.’” Phillips v. U.S. Customs & Border Prot., 74 F.4th 986, 992 (9th Cir. 2023) (quoting TransUnion, 594 U.S. at 425). This inquiry, which is particularly important in data privacy cases, centers on whether a plaintiff has alleged “a close historical or common-law analogue for their asserted injury[, but] does not require an exact duplicate in American history or tradition.” TransUnion, 594 U.S. at 424.
4 The Supreme Court concluded, however, that the named plaintiff had standing to assert his FCRA claims. TransUnion, 594 U.S. at 442. Defendants assert that “[d]isclosure of private information, in violation of Oregon law, is what Plaintiffs allege in the Complaint.” Defendants, however, do not cite where in the Complaint Plaintiffs purportedly make these allegations.5 Plaintiffs do not allege that their information was disclosed by Plaid Pantry, only that information was disclosed by customers to Plaid Pantry. Further, to allege a common-law analogue to the disclosure of private information,
a plaintiff must allege that unlawfully disclosed information “is so sensitive that another’s access to that information ‘would be highly offensive to a reasonable person.’” Phillips, 74 F.4th at 995- 96 (quoting Restatement (Second) of Torts § 652B). Here, Plaintiffs freely and knowingly disclosed to Defendants Plaintiffs’ personal information when they handed their IDs to Defendants’ store clerks upon request. Although Oregon law provides that this does not waive any claim that an individual may otherwise have, that is a separate question from whether there has been any substantive injury to a Plaintiff caused by the mere act of voluntarily showing an ID to Defendants’ employees. If an employee of Defendants would have asked to visually inspect a Plaintiff’s ID and the Plaintiff would have
complied, the resulting transfer of information would have been essentially the same (putting aside for the moment issues of data retention), yet there would be no violation of § 807.750(2)(b) because no electronic “swiping” would have occurred. With regard to Defendants’ alleged storing of birthdate information in violation of § 807.750(3), another’s access to someone’s date of birth, without any other identifiers to associate that date with a specific person, could not be “highly offensive to a reasonable person” as a matter of law. It is just a date.
5 Defendants cite the general introductory paragraphs of Plaintiffs’ Complaint. These allegations, however, do not support the proposition that Defendants “disclosed” Plaintiffs’ information or otherwise engaged in a common law violation of Plaintiffs’ “privacy” rights. Relying largely on pre-TransUnion Ninth Circuit caselaw,6 Defendants contend that ORS § 807.750 codifies substantive privacy rights under Oregon law, although Defendants do not explain how Plaintiffs were concretely harmed by the alleged statutory violations. Defendants cite Jones v. Ford Motor Co. in support of the proposition that any violation of the Oregon statute amounts to a concrete injury for Article III purposes. 85 F.4th 570 (9th Cir. 2023)
6 Defendants cite Eichenberger v. ESPN, Inc., in which the plaintiff alleged that ESPN violated the Video Privacy Protection Act of 1988 (“VPPA”) by disclosing to a third party, each time the plaintiff watched an ESPN video, the identity of the video and the device serial number. 876 F.3d 979, 981-82 (9th Cir. 2017). In Eichenberger, the Ninth Circuit relied on Spokeo in holding that the plaintiff had standing because “although the FCRA outlines procedural obligations that sometimes protect individual interests, the VPPA identifies a substantive right that suffers any time a video service provider discloses otherwise private information.” Id. at 983-84 (emphasis in original). Defendants also cite Patel v. Facebook, Inc., where the Ninth Circuit held that the plaintiffs had established a concrete injury sufficient to confer Article III standing. 932 F.3d 1264, 1267 (9th Cir. 2019). In that case, the complaint alleged that Facebook violated the Illinois Biometric Information Privacy Act (“BIPA”) by “collecting, using, and storing biometric identifiers . . . from their photos.” Id. at 1268. The court explained that “[b]ecause the privacy right protected by BIPA is the right not to be subjected to the collection and use of . . . biometric data, [the defendant’s] alleged violation of these statutory requirements would necessarily violate the plaintiffs’ substantive privacy interests.” Id. at 1274.
It is unclear whether the “substantive versus procedural” methodology applied in these cases survives TransUnion. See, e.g., Maddox v. Bank of N.Y. Mellon Tr. Co., 19 F.4th 58, 64 n.2 (2d Cir. 2021) (“TransUnion clarified, however, that the type of harm that a statute protects against is of little (or no) import . . . . In other words, plaintiffs must show that the statutory violation caused them a concrete harm, regardless of whether the statutory rights violated were substantive or procedural.”). Even if the pre-TransUnion methodology survives, however, Eichenberger and Patel each involve narrower privacy statutes than ORS § 807.750, under which a substantive right is violated every time a person engages in the prohibited conduct. Under ORS § 807.750, conduct that does not necessarily implicate another’s substantive privacy rights may be prohibited—and, indeed, subject to $1,000-per-individual statutory damages. It is a broad statute. This is demonstrated by the conduct alleged here. Plaintiffs allege that Defendants violated the Oregon statute simply by swiping their IDs for other than a statutorily permissible reason and by storing individuals’ dates of birth on their servers. This is unlike the viewing history information that was necessarily disclosed to a third party under the VPPA in Eichenberger or the biometric data that was collected and used or stored in violation of the BIPA in Patel. Thus, the Oregon statute is distinguishable from those considered in Eichenberger and Patel. Regardless, after TransUnion, the Court must evaluate the specific harm that is alleged by a plaintiff. (per curiam). In Jones, the Ninth Circuit analyzed standing under Article III without mentioning either Spokeo or TransUnion. The Ninth Circuit simply explained that “[a] statute that codifies a common law privacy right gives rise to a concrete injury sufficient to confer standing.” Id. at 574 (emphasis added) (quotation marks omitted). The plaintiffs in Jones alleged that Ford violated the Washington Privacy Act (“WPA”).7 The plaintiffs asserted that their vehicles’ hands-free
“infotainment” systems automatically “download[ed], copie[d], and indefinitely store[d] the call logs and text messages” from the plaintiffs’ cellphones, and “permanently store[d] the private communications without Plaintiffs’ knowledge or consent[,]” even after the communications were deleted from the cellphones. Id. at 572, 574. “[T]hose allegations plausibly articulate[d] an Article III injury because they claim[ed] violation of a substantive privacy right.” Id. at 574. Plaintiffs dispute Defendants’ reliance on Jones, asserting that Phillips is more on point and provides a better analysis under TransUnion. In Phillips, the Ninth Circuit specifically addressed Spokeo and TransUnion and engaged in the standing analysis as articulated by the Supreme Court. See Phillips, 74 F.4th at 992-96. The plaintiffs in Phillips alleged that several
government agencies collected, retained, and used data about the plaintiffs in violation of the plaintiffs’ constitutional rights. Id. at 990-92. Government agencies allegedly gathered information about the plaintiffs both from publicly available sources and from “preexisting law enforcement databases, which were not publicly available.” Id. at 989. The Ninth Circuit concluded that the plaintiffs did not sufficiently allege a concrete injury because the
7 Under the WPA, a plaintiff must claim “that a violation of [the] statute has injured his or her business, his or her person, or his or her reputation.” Wash. Rev. Code § 9.73.060. Although “[a] failure to plead the more-specific or more-demanding statutory injury shows a failure to state a claim, not a failure to establish standing[,]” Jones, 85 F.4th at 574, it is relevant that, here, ORS § 807.750(8) does not expressly require an injury other than a violation of the statute, stating that “an individual may bring an action . . . against an entity that swipes, stores, shares, sells, or otherwise uses the individual’s personal information in violation of this section.” government’s allegedly unlawful collection and retention of records, without more, did not show reputational harm, injury to the plaintiffs’ privacy interests, or a cognizable constitutional violation. Id. at 995-96. The Court finds Phillips more persuasive than Jones considering these facts and the Supreme Court’s guidance on analyzing injury for purposes of Article III standing. This case is
distinguishable from Jones for several reasons. First, Plaintiffs had knowledge of, and consented (at least implicitly) to, having their IDs “swiped.” Second, as discussed in footnote 6, supra, the Oregon statute is broad and encompasses conduct that does not implicate a violation of a common law privacy right. Third, Plaintiffs do not allege a “violation of a substantive privacy right”; instead, they allege that Defendants swiped their IDs and stored their dates of birth in violation of a data privacy statute. It is true that Oregon recognizes a legally protected interest in the confidentiality and privacy of an individual’s personal information contained in IDs. ORS §§ 807.745, 750. As TransUnion holds, however, bare statutory violations, absent allegations of harm, are insufficient to confer standing. Similarly, assuming that the storing of
the dates of birth by Defendants, as alleged, is unlawful, where the Ninth Circuit has held that “the retention of illegally obtained records resulted in a concrete injury, [it has] always identified something beyond retention alone . . . such as a material risk of future tangible harm, a violation of the common law right to privacy, or a cognizable constitutional violation.” Phillips, 74 F.4th at 993. For these reasons, the Court finds Defendants’ argument based on Jones unavailing. Violations of data privacy statutes may result in tangible or intangible harms that qualify as concrete injuries under Article III. Under the facts alleged in this case, however, it is not enough for Defendants to assert, without more, that ORS § 807.750 codifies a substantive privacy right. In light of Spokeo and TransUnion, simply alleging a violation of the Oregon statutes, by themselves, is insufficient to confer standing. A plaintiff cannot automatically satisfy the injury-in-fact requirement simply because Congress (or, here, the Oregon Legislature) created a statutory right and purported to authorize that person to sue to vindicate that right. Instead, a court must look to the actual harm that is alleged by a plaintiff. As discussed, ORS § 807.750(2)(b) allows for the swiping of IDs when there is any
reasonable doubt that a customer is at least 21 years of age, as well as the visual inspection of the personal information contained on any customer’s ID. Plaintiffs knowingly and voluntarily shared their personal information when they handed their IDs to store clerks. Thus, the Court finds no concrete injury to any Plaintiff caused by the swiping of a Plaintiff’s ID in violation of ORS § 807.750(2)(b). Defendants’ alleged storing of personal information in violation of ORS § 807.750(3), however, may create an increased risk that Plaintiffs someday may be the victims of identity theft. The Court turns next to whether Plaintiffs have alleged a future risk of harm that is sufficient to confer Article III standing. b. Future Risk of Harm The Court next considers whether there is any risk of future harm sufficient to establish
injury-in-fact resulting from the alleged violation of ORS § 807.750(3). The Oregon Legislative Assembly found, and this Court accepts, that “[e]asy access to the information found on [IDs]” increases the risk of identity theft. See ORS § 807.745(3). Because this is a suit for injunctive relief and not (yet) for damages, an allegation of a risk of future harm can establish injury-in-fact if it is “sufficiently imminent and substantial.” TransUnion, 594 U.S. at 435. The question then is whether the heightened risk of future identity theft caused by Defendants’ alleged retention of a Plaintiff’s date of birth, in the absence of an actual theft or data breach, is sufficiently “imminent and substantial” to confer standing. The standing analyses found in data breach cases are instructive. The Ninth Circuit has noted that “[a] plaintiff threatened with future injury has standing to sue ‘if the threatened injury is “certainly impending,” or there is a “substantial risk that the harm will occur.”” In re Zappos.com, Inc., 888 F.3d 1020, 1024 (9th Cir. 2018) (quoting Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014)). In Krottner v. Starbucks Corp., the Ninth Circuit held that employees of Starbucks had standing to sue the company based on the
risk of identity theft that they faced after a company laptop containing their unencrypted personal data was stolen. 628 F.3d 1139, 1143 (9th Cir. 2010). Employees’ names, addresses, and social security numbers were stored on the stolen laptop. Id. at 1140. In Zappos, the plaintiffs brought a putative class action against online retailer defendant Zappos.com, Inc. (“Zappos”) after hackers breached Zappos’s servers and allegedly stole the names, account numbers, passwords, email addresses, billing and shipping addresses, telephone numbers, and credit and debit card information of more than 24 million Zappos customers. Zappos, 888 F.3d at 1023. The Ninth Circuit concluded: “Assessing the sum of their allegations in light of Krottner, Plaintiffs have sufficiently alleged an injury-in-fact based on a substantial
risk that the Zappos hackers will commit identity fraud or theft.” Id. at 1029. The Ninth Circuit also noted that “we must determine whether Krottner remains good law after the Supreme Court’s more recent decision in Clapper v. Amnesty International USA, 568 U.S. 398 (2013), which addressed a question of standing based on the risk of future harm.” Id. at 1025. Zappos was the first case that required the Ninth Circuit to “consider whether Clapper and Krottner are clearly irreconcilable,” and the court “conclude[d] that they are not.” Id. In Clapper, the plaintiffs challenged surveillance procedures authorized by the Foreign Intelligence Surveillance Act of 1978 (“FISA”). Clapper, 568 U.S. at 401. The plaintiffs argued that they had established Article III standing “because there [was] an objectively reasonable likelihood that their communications [would] be acquired under § 1881a at some point in the future.” Id. The Supreme Court rejected this basis for standing, explaining that “an objectively reasonable likelihood” of injury was insufficient, and that the alleged harm needed to “satisfy the well-established requirement that threatened injury must be ‘certainly impending.’” Id. (quoting Whitmore v. Arkansas, 495 U.S. 149, 158 (1990)). The Court then held that the plaintiffs’ theory
of injury was too speculative to constitute a “certainly impending” injury. Id. at 410. The Ninth Circuit, in Zappos, explained that “[u]nlike in Clapper, the plaintiffs’ injury alleged in Krottner did not require a speculative multi-link chain of inferences. The Krottner laptop thief had all the information he needed to open accounts or spend money in the plaintiffs’ names—actions that Krottner collectively treats as ‘identity theft.’” Zappos, 888 F.3d at 1026 (citations omitted). Thus, in data breach cases, where a breach already has occurred, there is likely to be a substantial risk of the threatened injury of identity theft. But here, a data breach has not occurred, which distinguishes this case from Zappos and Krottner. If there were to be a data breach, especially if it were caused by a defendant’s negligence or negligence per se (e.g., a violation of § 807.750(3)), the defendants might be liable.8 The question before the Court, however, is
whether the voluntary disclosure of personal information by Plaintiffs to an employee of Defendants and the mere retention of a portion of that data by Defendants, as alleged by Plaintiffs, shows a substantial or certainly impending risk of harm sufficient to confer Article III standing. The answer is no. The alleged retention of dates of birth, without more, does not create a sufficiently imminent risk of harm.
8 The type of information involved in a breach is relevant to the standing analysis. See Zappos, 888 F.3d at 1027 (“[T]he sensitivity of the personal information, combined with its theft, led us to conclude that the plaintiffs had adequately alleged an injury-in-fact supporting standing.” (discussing Krottner)). Thus, access to a Plaintiff’s date of birth, without any other identifying information, still may not suffice to establish injury-in-fact. Because there is no evidence that the threatened injury of identity theft is “certainly impending” or that there is a “substantial risk” that the harm of identity theft will occur, the Court concludes that neither of Plaintiffs’ alleged statutory violations establish injury-in-fact for federal standing purposes. State courts, however, need not follow Article III; therefore, the case must be remanded based on lack of federal subject-matter jurisdiction. See Polo, 833 F.3d
at 1196 (“State courts are not bound by the constraints of Article III.”). B. Removal Under CAFA Through CAFA, Congress expanded removal jurisdiction over interstate class actions, providing that federal district courts have original jurisdiction to hear a “class action” where the plaintiff class has more than 100 members, the parties are minimally diverse, and the “matter in controversy exceeds the sum or value of $5,000,000.” 28 U.S.C. § 1332(d)(2), (d)(5)(B). CAFA also provides for discretionary and mandatory exceptions to CAFA jurisdiction. 28 U.S.C. § 1332(d)(3)-(4). As explained by the Ninth Circuit, [S]ection [1332(d)(2)] sets out the contours of original jurisdiction. In contrast, § 1332(d)(3) describes situations where district courts may “decline to exercise jurisdiction” “in the interests of justice and looking at the totality of the circumstances”; and § 1332(d)(4) sets out two circumstances that require district courts to decline jurisdiction, the so-called “local controversy” and “home-state controversy” exceptions. Implicit in both subsections (d)(3) and (d)(4) is that the court has jurisdiction, but the court either may or must decline to exercise such jurisdiction. See § 1332(d)(3)-(4). Serrano, 478 F.3d at 1022 (emphasis in original) (footnote omitted). Defendants assert that CAFA’s jurisdictional requirements are met because, based on the allegations in the Complaint, the putative class consists of at least 100 members in the aggregate, the amount in controversy exceeds $5,000,000, and the putative class is minimally diverse. Plaintiffs factually dispute Defendants’ assertions of CAFA jurisdiction and move in the alternative for jurisdictional discovery in order to (1) disprove defendants’ CAFA jurisdictional theory; and (2) gather the necessary evidence to prove that an exception to CAFA jurisdiction applies. As noted, if a plaintiff lacks Article III standing, a case removed under CAFA must be remanded to state court under § 1447(c). Polo, 833 F.3d at 1196; see also Atkinson v. Penney OpCo LLC, 2024 WL 3579910, at *2 (W.D. Wash. July 30, 2024) (remanding to state court after
finding that plaintiffs did not have Article III standing and without addressing arguments related to CAFA jurisdiction); Walker v. Kroger Co., 2022 WL 20208929, at *2-3 (N.D. Cal. June 21, 2022) (remanding to state court when plaintiffs lacked Article III standing but the parties agreed that CAFA’s jurisdictional requirements were met). Assuming without deciding that all elements of CAFA are met, the Court still must remand this case in light of its conclusion that it lacks subject matter jurisdiction based on standing. See Polo, 833 F.3d at 1196. Simply put, Congress (in enacting a statute like CAFA, for example) may not expand a federal court’s subject matter jurisdiction in a way that is prohibited by the United States Constitution in Article III. C. Attorney’s Fees Absent unusual circumstances, a court may require payment of just costs, including
attorney’s fees, as part of its remand order when the removing party lacked an objectively reasonable basis for seeking removal. Martin v. Franklin Cap. Corp., 546 U.S. 132, 138 (2005); see also 28 U.S.C. § 1447(c). “[A]n award of fees under § 1447(c) is left to the district court’s discretion, with no heavy congressional thumb on either side of the scales . . . .” Martin, 546 U.S. at 139. Courts in the Ninth Circuit apply “an objectively reasonable standard by looking to the clarity of the law at the time of removal.” Lussier v. Dollar Tree Stores, Inc., 518 F.3d 1062, 1066 (9th Cir. 2008) (citing Martin, 546 U.S. at 141). In Lussier, the Ninth Circuit affirmed the district court’s denial of attorney’s fees when the defendant sought removal under CAFA after it was “recently enacted” and unsuccessfully argued that the word “commenced” should be interpreted broadly for purposes of CAFA. Id. at 1063. Similarly, the Seventh Circuit held that the test for whether a defendant has an objectively reasonable basis for removal is “whether the relevant case law clearly foreclosed the defendant’s basis of removal.” Lott v. Pfizer, Inc., 492 F.3d 789, 794 (7th Cir. 2007). Plaintiffs argue that the Court should award reasonable attorney’s fees incurred by
Plaintiffs in bringing their motion to remand because Defendants did not remove in good faith. Plaintiffs point to Defendants’ “failure to stipulate during conferral that [Plaintiffs] have Article III standing, and [Defendants’] refusal to agree not to raise . . . standing in a dispositive motion or objection to class certification later in the case.” Plaintiffs also note that Defendants make multiple caveats throughout their briefing, including Defendants’ statement that “[w]hile standing may be an issue for Plaintiffs another day, now is not that day.” A defendant may not, in good faith, “remove[] [an] action to federal court only to move to dismiss for lack of standing.” Parrish v. Everi Payments Inc., 2023 WL 3276400, at *2 (D. Nev. May 4, 2023) (awarding attorney’s fees to plaintiffs); see also Mocek v. Allsaints USA Ltd.,
220 F. Supp. 3d 910, 914 (N.D. Ill. 2016) (awarding attorney’s fees to plaintiff when “defendant tried to have it both ways by asserting, then immediately disavowing, federal jurisdiction, apparently in hopes of achieving outright dismissal, with prejudice, rather than the remand required by § 1447(c)”). The Court understands Plaintiffs’ concern, particularly given Defendants’ statements about standing only for purposes of removal and the other comments made by Defendants that Plaintiffs highlight. At this stage of the proceedings, however, Defendants have removed and Plaintiffs have sought remand. Defendants have not moved to dismiss for lack of subject matter jurisdiction. In addition, Defendants argued in contesting the motion to remand that the statutory violations as alleged by Plaintiffs are sufficiently analogous to a violation of a common law privacy right to support Article III standing. Although the Court rejects this argument, it was not clearly foreclosed by the law, and Defendants’ arguments were not frivolous. See Lott, 492 F.3d at 794. Defendants cited Jones and pre-TransUnion Ninth Circuit cases. The Court considers
itself bound by TransUnion and finds Jones distinguishable and less persuasive than other post- TransUnion Ninth Circuit cases. Nonetheless, the law on these issues is not sufficiently clear to support an award of attorney’s fees as a sanction to the losing litigant. See Lussier, 518 F.3d at 1066. Accordingly, the Court denies Plaintiffs’ request for attorney’s fees in bringing its motion to remand. CONCLUSION The Court GRANTS Plaintiffs’ motion to remand (ECF 8) but DENIES Plaintiffs’ request for attorney’s fees. Id. The Court DENIES as moot Plaintiffs’ alternative motion for jurisdictional discovery. Id. IT IS SO ORDERED.
DATED this 27th day of February, 2025.
/s/ Michael H. Simon Michael H. Simon United States District Judge