Soto v. Great America LLC

2020 IL App (2d) 180911

• Court: Appellate Court of Illinois
• Decided: April 8, 2021
• Docket: 2-18-0911
• Status: Published

Opinion

Digitally signed by Reporter of Decisions Reason: I attest to Illinois Official Reports the accuracy and integrity of this document Appellate Court Date: 2021.04.07 11:12:00 -05'00'

Soto v. Great America LLC, 2020 IL App (2d) 180911

Appellate Court HUGO SOTO and SHARON SOTO, Individually and on Behalf of Caption Similarly Situated Persons, Plaintiffs-Appellants, v. GREAT AMERICA LLC, d/b/a Six Flags Great America and Six Flags Hurricane Harbor, and DOES 1 TO 20, Defendants-Appellees.

District & No. Second District No. 2-18-0911

Filed January 22, 2020

Decision Under Appeal from the Circuit Court of Lake County, No. 17-CH-1118; the Review Hon. Luis A. Berrones, Judge, presiding.

Judgment Reversed and remanded.

Counsel on Daniel A. Edelman, Julie Clark, and David Kim, of Edelman, Combs, Appeal Latturner & Goodwin, LLC, of Chicago, and Curtis C. Warner, of Warner Law Firm, LLC, of Park Ridge, for appellants.

Bevin Brennan, of Pedersen & Houpt, P.C., of Chicago, and Spencer Persson, of Norton Rose Fulbright US LLP, of Los Angeles, California, for appellee. Panel JUSTICE McLAREN delivered the judgment of the court, with opinion. Justices Jorgensen and Bridges concurred in the judgment and opinion.

OPINION

¶1 Plaintiffs, Hugo and Sharon Soto, individually and on behalf of similarly situated persons, filed a complaint against defendants, Great America LLC, doing business as Six Flags Great America and Six Flags Hurricane Harbor, and Does 1 to 20 (collectively Six Flags), alleging that Six Flags willfully violated the federal Fair and Accurate Credit Transactions Act of 2003 (FACTA) (15 U.S.C. § 1681c(g)(1) (2012)) when it printed more than the last five digits of their debit card numbers on its sales receipts. On defendants’ motion, the trial court dismissed the complaint under section 2-619(a)(9) of the Code of Civil Procedure (Code) (735 ILCS 5/2- 619(a)(9) (West 2016)), relying on federal case law to find that plaintiffs lacked standing to pursue their claim in state court. Plaintiffs appeal, and for the following reasons, we reverse and remand for further proceedings.

¶2 I. BACKGROUND ¶3 FACTA was enacted in 2003 to amend the Fair Credit Reporting Act (FCRA) (15 U.S.C. § 1681 et seq. (2012)). Section 1681c(g)(1), as amended by FACTA, prohibits a merchant who accepts credit or debit cards from “print[ing] more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.” 15 U.S.C. § 1681c(g)(1) (2012). FACTA sought to protect the consumer from identity theft and credit- and debit-card fraud. See 15 U.S.C. § 1681c(g) (2012). A merchant in willful noncompliance with FACTA’s requirements is liable to the affected consumer for actual damages resulting from the violation or statutory damages of $100 to $1000. 15 U.S.C. § 1681n(a)(1)(A) (2012). ¶4 On August 11, 2017, plaintiffs filed a class action complaint alleging that defendants issued printed receipts in willful violation of FACTA. Plaintiffs’ claim arose on August 5, 2017, when they used their debit cards to make five food purchases at Six Flags, each time receiving an electronically printed receipt that included at least the first six digits of their debit card numbers in addition to the last four digits. 1 Plaintiffs alleged that Six Flags’ conduct exposed them and the members of the class to “an increased risk that their payment card could be compromised.” Plaintiffs further alleged that Six Flags either knowingly violated FACTA’s truncation requirements or engaged in “reckless conduct” by failing to take necessary steps to prevent the requirements from being violated. Plaintiffs sought statutory damages, punitive damages “if the evidence warrants,” and attorney fees and costs. ¶5 Defendants removed the case to federal district court, citing diversity and federal-question jurisdiction. The district court granted plaintiffs’ motion to remand the case to state court,

Plaintiffs’ complaint variously alleges that the first six and the first eight debit card digits were 1

compromised. Because defendants admit to printing the first six digits in addition to the last four digits, we will use the agreed-upon first-six-digits figure.

-2- stating: “The parties agree that federal subject matter jurisdiction does not exist here, and Defendant has not demonstrated that Illinois state courts will undeniably dismiss this case on the basis of federal law. As such, remand is the appropriate course of action.” ¶6 In state court, defendants filed a combined motion to dismiss plaintiffs’ complaint under section 2-619.1 of the Code (735 ILCS 5/2-619.1 (West 2016)). Defendants argued, pursuant to section 2-619(a)(9), that plaintiffs lacked standing because they did not allege any injury beyond the improper disclosure of the first six digits of their debit card numbers. According to defendants, plaintiffs could not have been injured by the disclosure because, under the numbering system set by the International Standards Organization, the first six digits, defined as the Issuer Identification Number (IIN), identify only the card issuer and reveal no personally identifying information. Defendants also argued, pursuant to section 2-615, that plaintiffs failed to allege facts showing a willful violation of FACTA in issuing the receipts. ¶7 The trial court granted defendants’ motion to dismiss under section 2-619(a)(9) based on standing. The court declined to reach the issue of willfulness and did not rule on the section 2- 615 portion of defendants’ motion.

¶8 II. ANALYSIS ¶9 A. Standard of Review ¶ 10 Defendants’ motion to dismiss the complaint was filed pursuant to section 2-619.1 of the Code (id.), which allows a party to move to dismiss under both section 2-615 and section 2- 619. Garlick v. Bloomingdale Township, 2018 IL App (2d) 171013, ¶ 24. A motion for involuntary dismissal under section 2-615 challenges the legal sufficiency of the pleadings; a section 2-619 motion to dismiss admits the legal sufficiency of the pleadings but asserts certain defects or defenses that defeat the claim. Davidson v. Gurewitz, 2015 IL App (2d) 150171, ¶ 8. A dismissal under section 2-619.1 is reviewed de novo. Garlick, 2018 IL App (2d) 171013, ¶ 24. ¶ 11 Defendants cited section 2-619(a)(9), which allows involuntary dismissal where the claim is barred by other affirmative matter avoiding the legal effect of or defeating the claim. 735 ILCS 5/2-619(a)(9) (West 2016). Lack of standing is “affirmative matter” that is properly raised under section 2-619(a)(9). Muirhead Hui L.L.C. v. Forest Preserve District, 2018 IL App (2d) 170835, ¶ 21 (citing Glisson v. City of Marion, 188 Ill. 2d 211, 220-21 (1999)). The issue of standing presents a question of law and is subject to de novo review. Malec v. City of Belleville, 384 Ill. App. 3d 465, 468 (2008).

¶ 12 B. Standing ¶ 13 Plaintiffs argue that the trial court erred in determining that they lacked standing to bring this action under FACTA because they did not plead an injury in fact. According to plaintiffs, the statute does not require a plaintiff to plead an injury or actual damages in addition to a statutory violation, and therefore, the court’s ruling on standing is incorrect. Defendants contend that Illinois’s principles of standing require a “concrete and palpable” injury in fact and that their failure to truncate the first six digits of plaintiffs’ debit cards was harmless. Both sides also contest whether defendants adequately pleaded a willful failure to comply with FACTA.

-3- ¶ 14 FACTA imposes liability on any person who violates the digit truncation requirements for credit or debit card transactions: “(g) Truncation of credit card and debit card numbers (1) In general Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.” 15 U.S.C. § 1681c(g)(1) (2012). “(a) In general Any person who willfully fails to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer in an amount equal to the sum of— (1)(A) any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000[.]” (Emphasis added.) 15 U.S.C. § 1681n(a)(1)(A) (2012). ¶ 15 We consider first whether section 1681n required plaintiffs to plead actual damages in addition to a statutory violation in order to establish standing. The primary goal of statutory construction is to ascertain and give effect to the intent of the legislature. Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶ 24. The most reliable indicator of the legislature’s intent is the plain language of the statute itself, which must be given its plain and ordinary meaning. Id. When the statutory language is plain and unambiguous, the court may not depart from the law’s terms by reading into it “exceptions, limitations, or conditions the legislature did not express, nor may [it] add provisions not found in the law.” Id. If the resolution of an appeal turns on a question of statutory interpretation, de novo review is appropriate. Id. ¶ 18. ¶ 16 When given its plain and ordinary meaning, the language of section 1681n(a)(1)(A) indicates the legislature’s intent that the statute provide alternative recovery for actual damages, if any, or statutory damages of not less than $100 and not more than $1000. The statute uses the word “or,” which in its “ ‘ordinary use is almost always disjunctive, that is, the words it connects are to be given separate meanings’ ” (Dinerstein v. Evanston Athletic Clubs, Inc., 2016 IL App (1st) 153388, ¶ 45 (quoting Loughrin v. United States, 573 U.S. ___, ___, 134 S. Ct. 2384, 2390 (2014)); see also In re E.B., 231 Ill. 2d 459, 468 (2008) (“[g]enerally, use of the disjunctive indicates alternatives and requires separate treatment of those alternatives” (internal quotation marks omitted)). Under the plain and ordinary meaning of section 1681n(a)(1)(A), actual damages must be pleaded and proved only if the relief sought is actual damages; if the alternative relief of statutory damages is sought, actual damages need not be pleaded or proved. ¶ 17 The disjunctive language in section 1681n is consistent with the statute’s intent set forth in section 1681c(g), that is, “to protect consumers from the risk posed when credit card account information is displayed on printed receipts at the point of sale.” Lee v. Buth-Na-Bodhaige, Inc., 2019 IL App (5th) 180033, ¶ 64. Because each alternative stated in section 1681n imposes liability to the consumer, our interpretation furthers FACTA’s preventative and deterrent purposes. Accordingly, we conclude that when a person willfully fails to comply with FACTA’s truncation requirements, the statute provides a private cause of action for statutory

-4- damages and does not require a consumer to suffer actual damages before seeking recourse. See id. ¶¶ 64-68 (reversing dismissal on standing grounds where sales receipt provided to the plaintiff contained the first six digits and last four digits of his credit card number); cf. Rosenbach, 2019 IL 123186, ¶ 40 (addressing a violation of the Biometric Information Privacy Act (740 ILCS 14/1 et seq. (West 2016)) and holding that “an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the [Biometric Information Privacy] Act, in order to *** be entitled to seek liquidated damages *** pursuant to the Act”). ¶ 18 Here, defendants do not propose an interpretation of section 1681n(a)(1)(A); rather, they contend that Illinois courts follow federal standing principles, which require pleading actual damages in addition to a statutory violation. Defendants’ cited authority persuades otherwise. They rely primarily on Greer v. Illinois Housing Development Authority, 122 Ill. 2d 462, 491 (1988), which reiterates the established rule that Illinois courts are not required to follow federal law on “issues of justiciability and standing” and further states that Illinois courts tend to “vary in the direction of greater liberality,” that is, to be less restrictive than federal courts in recognizing a plaintiff’s standing to bring a claim. ¶ 19 Although defendants acknowledge that Illinois need not follow federal law on standing, they nonetheless argue that federal standing principles apply because Greer (“and its progeny”) rely on standing criteria under article III of the United States Constitution to define Illinois’s requirement of “some injury in fact to a legally cognizable interest”: the claimed injury, whether “actual or threatened” must be “distinct and palpable,” “fairly traceable” to the defendant’s actions, and substantially likely to be redressed by the grant of the requested relief. (Internal quotation marks omitted.) Id. at 492-93. ¶ 20 Standing in federal and Illinois courts, however, is controlled by the forums’ distinct constitutional provisions. Article III of the United States Constitution limits federal court jurisdiction to actual cases and controversies. U.S. Const., art. III, § 2. “As a result, the doctrine of article III standing has developed to ensure federal courts do not exceed this authority.” Lee, 2019 IL App (5th) 180033, ¶ 66 (citing Spokeo, Inc. v. Robins, 578 U.S. ___, ___, 136 S. Ct. 1540, 1547 (2016)). The Illinois Constitution, on the other hand, vests the circuit courts with “jurisdiction to adjudicate all controversies.” Steinbrecher v. Steinbrecher, 197 Ill. 2d 514, 530 (2001); Ill. Const. 1970, art. VI, § 9. Standing in Illinois is not jurisdictional; it is an affirmative defense that the defendant must plead and prove. People v. $ 1,124,905 U.S. Currency & One 1988 Chevrolet Astro Van, 177 Ill. 2d 314, 330 (1997). Although “designed to preclude persons having no interest in a controversy from bringing suit,” standing in Illinois “should not be an obstacle to the litigation of a valid claim.” Id. ¶ 21 Accordingly, Illinois courts may interpret the federal standing criteria less restrictively than federal courts do. See Soto v. Great America LLC, No. 17-cv-6902, 2018 WL 2364916, at *5 (N.D. Ill. May 24, 2018) (remanding the instant matter from federal court to circuit court and noting “the fact that both Illinois courts and federal courts impose an injury-in-fact standing requirement on litigants does not necessarily mean that both forums define that requirement in the same way”); Greer, 122 Ill. 2d at 494 (threatened with a “distinct and palpable” injury— diminution in the value of their property “fairly traceable” to approval of a projected housing development, which was not a “generalized grievance common to all members of the public”— landowners had standing to seek injunctive and declaratory relief and did not need to plead actual harm or injury to maintain their claim (internal quotation marks omitted)). Guided by

-5- the above principles and FACTA’s plain language, we hold that plaintiffs had standing to pursue their statutory claims without pleading an actual injury beyond the violation of their statutory rights. ¶ 22 On the one hand, defendants argue that most federal courts view a violation of FACTA’s truncation requirements as merely “technical” or “procedural” and hold that such failure is insufficient to establish the actual harm necessary for standing under federal law. On the other hand, defendants acknowledge, through their efforts to distinguish the cases, that some federal courts have held that FACTA does not require a plaintiff to plead an “actual injury” in addition to a statutory violation to have standing. See Lee, 2019 IL App (5th) 180033, ¶ 66 n.7 (listing cases that have found that the harm from a FACTA violation is complete at the moment of a statutory violation); Guarisma v. Microsoft Corp., 209 F. Supp. 3d 1261, 1266 (S.D. Fla. 2016) (harm is “concrete as soon as a company prints the offending receipt”). Because we are not required to follow federal law on issues of standing, we need not consider the inconsistent positions of the federal courts. Greer, 122 Ill. 2d at 491. ¶ 23 According to defendants, printing the first six credit card digits, or the IIN, was a harmless technical violation because it revealed “no personally identifying information” and “did not expose [plaintiffs] to a risk of identity theft or payment fraud.” First, this assertion ignores FACTA’s unambiguous prohibition against printing more than the last five digits of a consumer’s card number. Second, the assertion effectively challenges the legal sufficiency of the claim, making it inappropriate for a motion to dismiss pursuant to section 2-619(a)(9) of the Code. ¶ 24 Section 2-619(a)(9) permits dismissal where the asserted claim is barred by other affirmative matter, avoiding the legal effect of or defeating the claim. 735 ILCS 5/2-619(a)(9) (West 2016). “ ‘Affirmative matter’ encompasses any defense other than a negation of the essential allegations of the cause of action.” Klein v. DeVries, 309 Ill. App. 3d 271, 273 (1999) (citing Kedzie & 103rd Currency Exchange, Inc. v. Hodge, 156 Ill. 2d 112, 115 (1993)). A motion brought under section 2-619(a)(9), therefore, admits the legal sufficiency of the plaintiff’s cause of action. Id. Further, “[i]f the ‘affirmative matter’ asserted is not apparent on the face of the complaint, the motion must be supported by affidavit.” Kedzie, 156 Ill. 2d at 116. ¶ 25 Since defendants’ motion admitted the legal sufficiency of plaintiffs’ cause of action and was not supported by affidavit, defendants’ assertion that no injury resulted from printing the first six digits of plaintiffs’ debit card numbers were improperly raised in the context of a section 2-619(a)(9) motion. See Greer, 122 Ill. 2d at 494 (“Even in the Federal courts, where lack of article III [citation] standing is a bar to jurisdiction, it has been noted that controversies regarding standing are best resolved by motions for summary judgment rather than motions for judgment on the pleadings.”). Even if we were to consider defendants’ harmless-violation theory, it would not impact our disposition of the standing issue, as plaintiffs are not required under Illinois law to plead an injury other than a willful violation of their statutory rights to pursue their claims of statutory damages under FACTA. See Lee, 2019 IL App (5th) 180033, ¶¶ 64-68 (holding that an alleged willful violation of FACTA’s truncation requirements is sufficient to confer standing upon a customer in state court). ¶ 26 Although Lee was published after the parties filed their briefs, we granted plaintiffs’ motion to cite it as additional authority. For the above reasons, we conclude that Lee was correctly decided. FACTA provides a private cause of action for statutory damages for a willful violation

-6- of the statute’s truncation requirements, and Lee does not require a consumer to suffer actual damages before seeking recourse. See id. ¶ 64; cf. Rosenbach, 2019 IL 123186, ¶ 40 (“an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the [Biometric Information Privacy] Act, in order to qualify as an ‘aggrieved’ person and be entitled to seek liquidated damages and injunctive relief pursuant to the Act”). Accordingly, we reverse the trial court’s dismissal of plaintiffs’ complaint pursuant to section 2-619(a)(9). 2

¶ 27 C. Willfulness ¶ 28 The question remains whether plaintiffs also pleaded a willful violation of the statute. The trial court declined to consider the section 2-615 portion of defendants’ section 2-619.1 motion, apparently on the ground that plaintiffs’ failure to plead an actual injury sufficient to establish standing could not be cured by further pleading. Defendants nevertheless urge us to affirm the trial court’s dismissal of the complaint on the alternative ground that plaintiffs failed to state a claim under FACTA, pursuant to section 2-615. The parties have fully briefed the issue, and as the question of whether willfulness was adequately pleaded is certain to arise on remand, we address defendants’ contention that plaintiffs failed to allege a willful violation for which statutory damages would be available. ¶ 29 First, defendants claim an ambiguity in section 1681c(g)(1) as amended by FACTA: “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.” (Emphasis added.) 15 U.S.C. § 1681c(g)(1) (2012). Defendants rely upon Broderick v. 119TCbay, LLC, 670 F. Supp. 2d 612, 618 (W.D. Mich. 2009), for the proposition that this language does not clarify what “more” modifies— more “card number digits” or more “personally identifying information.” In Broderick, the printed receipt revealed the first digit of the plaintiff’s credit card number, which, the parties agreed, was merely the numeric representation of the card’s brand identity, MasterCard. Id. at 613-14. The brand name “MasterCard” was also printed out in letters on the receipt, which, the parties further agreed, was legal. Id. at 614. The Broderick court found that printing both the brand name and brand number of the credit card did not thwart Congress’s interest in “preventing the actual harm of real identity theft” (id. at 619) and concluded that “Congress meant to limit the personal identifying information that could be printed on a credit card receipt, but not to regulate receipt content of innocuous, non-identifying information, such as the brand name or associated brand number of the credit card” (id. at 621). ¶ 30 We are unpersuaded by Broderick’s conclusion that section 1681c(g)(1) is ambiguous. See Gennock v. Kirkland’s, Inc., No. 17-454, 2017 WL 6883933, at *8 (W.D. Pa. Nov. 29, 2017) (referring to Broderick as “a bizarre outlier” and noting that “it would have been difficult for Congress to be more clear in its language” (internal quotation marks omitted)). Furthermore,

2 In a nearly identical case, Duncan v. FedEx Office & Print Services, Inc., 2019 IL App (1st) 180857, the Appellate Court, First District, reached the same conclusion. After agreeing upon a settlement, however, the parties moved to dismiss FedEx’s appeal to the Illinois Supreme Court. In an order entered November 20, 2019, the supreme court allowed the motion and directed the First District to vacate its judgment and remand the case to the circuit court with directions to dismiss the complaint. Duncan v. FedEx Office & Print Services, Inc., No. 124727 (Ill. Nov. 20, 2019) (supervisory order).

-7- we question Broderick’s relevance here, where defendants printed on their receipts not just the first debit card digit but the first six digits. See Tchoboian v. Fedex Office & Print Services, Inc., No. SACV 10-1008 AG (MLGx), 2011 WL 12842228, at *3 (C.D. Cal. Jan. 28, 2011) (questioning Broderick’s relevance because the defendants printed the first two credit card digits on their receipt). ¶ 31 Defendants next argue that printing the first six digits of plaintiffs’ debit card numbers was not a violation of FACTA, let alone a willful violation, because doing so revealed no private financial information and, therefore, plaintiffs were not harmed. We reject the suggestion that only harmful violations can be willful and further note that the question of whether printing the first six digits was harmful has not been resolved at this pleading stage. ¶ 32 Defendants also contend that plaintiffs’ specific allegations inadequately allege a FACTA violation that was willful. Liability for “willfully” failing to comply with FCRA (and by extension FACTA) extends to acts known to violate FCRA and also to reckless disregard of statutory duty. Safeco Insurance Co. of America v. Burr, 551 U.S. 47, 56-57 (2007). A reckless violation is conduct that violates an objective standard—i.e., “action entailing an unjustifiably high risk of harm that is either known or so obvious that it should be known.” (Internal quotation marks omitted.) Id. at 68 (citing Farmer v. Brennan, 511 U.S. 825, 836 (1994)). ¶ 33 Here, plaintiffs allege that defendants acted willfully, because (1) FACTA mandated compliance by December 4, 2006; (2) defendants failed to audit their point-of-sale terminals after software changes; (3) at least once a year, VISA, MasterCard, Discover, and American Express issued updated rules and regulations that included FACTA’s truncation requirements; and (4) defendants’ contracts with card-issuing organizations required defendants to comply with VISA’s and MasterCard’s rules and regulations on FACTA’s truncation requirements. Plaintiffs’ complaint avers that defendants were on notice of FACTA’s truncation requirements, and therefore it is plausible to infer from the facts pleaded either a knowing or a reckless violation. See id. at 56-57. ¶ 34 Moreover, issues of willfulness frequently involve facts beyond the pleadings and thus “often cannot be resolved at the motion to dismiss stage.” Lavery v. RadioShack Corp., No. 13-cv-05818, 2014 WL 2819037, at *2 (N.D. Ill. June 23, 2014). Illinois courts have recognized that determining whether there has been willful conduct “necessitates close scrutiny of the facts as disclosed by the evidence.” Yuretich v. Sole, 259 Ill. App. 3d 311, 313 (1994) (“[w]here facts of necessity are within defendant’s knowledge and not within plaintiff’s knowledge, a complaint which is as complete as the nature of the case allows is sufficient”). Under the circumstances, we hold that plaintiffs adequately alleged a knowing violation or a reckless disregard of FACTA’s truncation requirements. ¶ 35 We conclude that, in addition to establishing standing by praying for statutory damages, plaintiffs pleaded sufficient facts to allege a willful violation of FACTA and, therefore, pleaded a justiciable claim over which the trial court had jurisdiction. See Lee, 2019 IL App (5th) 180033, ¶ 68.

¶ 36 III. CONCLUSION ¶ 37 For the reasons stated, we reverse the judgment of the circuit court of Lake County and remand for further proceedings.

-8- ¶ 38 Reversed and remanded.

-9-