Search results for: FACTA

The Fair and Accurate Credit Transactions Act (“FACTA”) forbids sellers who accept credit cards from including more than the last five digits of a buyer’s credit card number on a purchase receipt. Yet including more than those five digits will not, by itself, make a seller liable under FACTA, according to a decision issued by the Eleventh Circuit Court of Appeals on October 28, 2020. The decision — Muransky v. Godiva Chocolatier, Inc., No. 16-16486, 2020 WL 6305084 (11th Cir. Oct. 28, 2020) — could leave future FACTA litigants scratching their heads.

The controversy started when Dr. David S. Muransky traveled to a Godiva storefront in Florida to purchase a box of chocolates. Using his credit card, he spent $19.26. The cashier handed him his receipt, which contained the first six and last four digits of his sixteen digit credit card number, more than FACTA permits. As the Court put it, Muransky then “got busy, filing a class action complaint less than a week later” on behalf of anyone in the United States who received a Godiva receipt displaying more than the last five digits of the buyer’s credit card number. Because of the number of potential class members, Godiva faced potential liability of $342 million — $1,000 per violation.

Seeking to avoid paying such a hefty sum, Godiva eventually sought to settle the case for $6.3 million, which the lower court approved. But meanwhile, the Supreme Court of the United States decided the case of Spokeo, Inc. v. Robins, 136 S.Ct. 1540 (2016), which jeopardized the lower court’s ability to approve the settlement, or rule on the case in any other capacity at all, because of what it said about Constitutional standing. In order for a federal court to hear a case, the plaintiff must show that he was, in fact, injured by the defendant’s conduct. Spokeo, however, held that even though Congress can make certain conduct illegal through the passing of federal statutes (here, the inclusion of too many credit card digits on a receipt), a defendant’s violation of the terms of a statute, by itself, does not necessarily mean that the plaintiff has in fact been injured. No injury; no lawsuit.

Relying on Spokeo, the Eleventh Circuit reversed the lower court’s approval of the settlement and dismissed the case without prejudice. Specifically, the Court explained that a plaintiff can show a concrete harm in two ways: (1) That the defendant’s violation of a statute directly caused harm to the plaintiff; (2) That the defendant’s violation of a statute created a real risk of harm to the plaintiff. In an extensive analysis, the Court found Muransky’s arguments insufficient under either theory, and held that even though Godiva had clearly violated FACTA’s requirements, the suit could not proceed because Muransky failed to show that the violation caused him harm, or materially increased the risk that he could suffer identity theft.

The dissent in the case accused the majority of diluting FACTA’s core protections by forcing plaintiffs to prove more than what is typically feasible, as tracing identity thieves can prove nearly impossible. The dissent noted “by assuming that [FACTA’s limited-digit requirement] redresses only actual identity theft and nothing more, the majority overlooks that FACTA protects against a point-of-sale harm—the consumer suffers a heightened risk of identity theft the moment the business prints an untruncated receipt . . . The court’s mistake all but ensures that consumers in the Eleventh Circuit must now allege, support, and prove that they suffered actual identity theft (or at least soon will) because of a defendant’s FACTA violation in order to avail themselves of the law’s protections.”

The Muransky case thus summons Forest Gump’s old maxim. As in life, or a box of chocolates, plaintiffs may not know if they have Constitutional standing before the court hands down a ruling.

A fight over a receipt for chocolate could end up in the Supreme Court. The Eleventh Circuit affirmed a $6.3 million settlement between Godiva Chocolatier, Inc. and a class of plaintiffs who alleged that Godiva violated the Fair and Accurate Credit Transactions Act by printing too many digits of the plaintiffs’ credit cards on their receipts. In holding that the class representative, Dr. David Muransky, had standing to bring a FACTA claim, the Eleventh Circuit split with other circuits, teeing the issue up for the Supreme Court. 

Background 

Dr. Muransky made a purchase at a Godiva store and noticed that his receipt showed the first six and last four digits of his credit card number. Per FACTA’s “truncation requirement,” merchants cannot print “more than the last 5 digits of the card number . . . upon any receipt provided to the cardholder.” 15 U.S.C. § 1681c(g)(1). Dr. Muransky brought FACTA claims on behalf of himself and a class of plaintiffs, resulting in a $6.3 million settlement. One of the class members, Eric Isaacson, objected to the settlement by arguing, inter alia, that Dr. Muransky lacked Article III standing to bring a FACTA claim. The Court overruled Isaacson’s objections, and he appealed. 

FACTA Standing 

In Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), the Supreme Court held that “Article III standing requires a concrete injury even in the context of a statutory violation.” The Supreme Court explained that a “risk of real harm” might satisfy the requirement, but that not all statutory violations “cause harm or present any material risk of harm.” Id. at 1549–50. Since Spokeo, the Second, Third, Seventh, and Ninth circuits—as well as several district courts—have dismissed FACTA claims for a lack of standing.  

In Katz v. Donna Karan Co., L.L.C., 872 F.3d 114 (2d Cir. 2017), the Second Circuit held that printing the first six digits of a credit card number does not pose a risk of harm sufficient to confer standing. 872 F.3d at 120–21. As the Second Circuit explained, those digits simply “identify the institution that issued the card,” and “FACTA does not prohibit printing the issuer identity on a receipt.” Thus, although the printing of the digits themselves may be a technical violation of FACTA, the statute otherwise allows that same information to be printed on the receipt. 

The Third Circuit reached the same conclusion in Kamal v. J. Crew Group, Inc., 918 F.3d 102 (3d Cir. 2019). Similar to Dr. Muransky, the plaintiff in Kamal alleged that his receipt violated FACTA by showing the first six digits of his credit card number. The Third Circuit held that the plaintiff did not show a concrete risk of harm absent an allegation that a third person ever saw the receipt at issue. Like Katz, the Kamal Court also held that the plaintiff failed to allege that “the receipt included enough information to likely enable identity theft.” 

Now, the Eleventh Circuit stands alone in holding that a plaintiff has standing to bring a FACTA claim by simply alleging a procedural violation and a “heightened risk of identity theft.” Relying on pre-Spokeo precedent, the Eleventh Circuit held that the “risk [of harm] need be no more than an ‘identifiable trifle’ to be concrete” within the meaning of Spokeo.

Troutman Sanders will continue to monitor this developing circuit split.

On August 3, the U.S. District Court for the District of Columbia dismissed a putative class action brought under the Fair and Accurate Credit Transactions Act for lack of subject matter jurisdiction and Article III standing, relying on the 2016 U.S. Supreme Court ruling in Spokeo Inc. v. Robins. As is commonplace in FACTA litigation, the class complaint alleged that the defendant had printed the plaintiff’s entire 16-digit credit card number and expiration date on receipts.

U.S. District Judge Colleen Kollar-Kotelly ruled that plaintiff Doris Jeffries lacked standing to bring her FACTA suit since the few facts alleged in her case failed to show she suffered an injury in fact that is fairly traceable to the defendants’ challenged conduct and that could likely be redressed by a favorable judicial decision. The court also rejected Jeffries’ argument that she was at an increased risk of identity theft when the defendants handed her the receipt with her information printed on it.

In relevant part, the court held:

The receipt containing prohibited information allegedly was provided to plaintiff, and she does not allege any further disclosure of that receipt to anyone else. …  Nor does plaintiff cite any history to support any notion that additional inconvenience associated with review and disposal of an infringing receipt rises to the level of a concrete harm.

The case is Jeffries v. Volume Services America, Inc. et al., Civil Action No. 1:17-cv-01788, in the U.S. District Court for the District of Columbia.  A copy of the memorandum opinion and order can be found here.

Troutman Sanders will continue to monitor these developments and provide any further updates as they are available.

Even though both parties agreed the plaintiffs lacked standing to bring suit under the Fair and Accurate Credit Transaction Act (“FACTA”), the Seventh Circuit recently reversed the district court’s dismissal for lack of standing, and instead ordered the district court to remand the case to state court.

The FACTA putative class action, originally filed in the Circuit Court of Cook County, Illinois, arose out of receipts for the use of parking facilities operated by SP Plus at Dayton International Airport.  Plaintiffs Kathryn Collier and Benjamin Seitz alleged that the receipts included the expiration date of their credit and debit cards, in violation of FACTA.  Collier and Seitz brought a putative class action, claiming statutory damages and actual damages in excess of $25,000.  However, the complaint did not substantiate the actual damages and failed to describe any concrete harm suffered by either plaintiff.

SP Plus removed the case to federal court in the Northern District of Illinois based on federal question jurisdiction.  A week later, it moved to dismiss the suit for lack of subject matter jurisdiction, claiming the lack of concrete harm deprived the court of Article III jurisdiction.  Collier and Speitz responded with a motion to remand.  The district court sided with SP Plus, ultimately dismissing the case with prejudice.  Collier and Seitz appealed.

In reversing the district court, the Seventh Circuit explained that SP Plus, as the party invoking the federal court’s jurisdiction, had to establish all elements of jurisdiction, including Article III standing.  Because a “mere reference to actual damages in the complaint’s prayer for relief does not establish Article III standing,” it was clear the complaint had not sufficiently alleged an injury.  Thus, the court lacked subject matter jurisdiction.

The Court rejected SP Plus’s argument that once removal based on a federal question is accomplished, a defendant may challenge jurisdiction.  The slate was not wiped clean.  Instead, the removal statute mandates that a court remand a case if “at any time before final judgment it appears that the district court lacks subject matter jurisdiction.”  On the other side of the coin, if Collier and Speitz amended their complaint in state court to allege an actual injury, SP Plus then could remove the case to federal court.

The Court expressed disapproval of SP Plus’s “dubious strategy” because it “resulted in a significant waste of federal judicial resources, much of which was avoidable.”  However, it declined to award Collier and Speitz attorneys’ fees under the removal statute.

This case demonstrates the problems that continue to arise when plaintiffs who have suffered no injury file lawsuits seeking relief in court.  Although plaintiffs may successfully avoid removal to federal court by not alleging an injury, they may run into problems in state court.  Many states, including Illinois, also require a plaintiff to show a concrete injury in order to sue in state court.

The case is Collier et al. v. SP Plus Corp., No. 17-2431 (7th Cir. May 14, 2018).  A copy of the opinion can be found here.

On March 9, the Ninth Circuit affirmed dismissal of a putative FACTA class action on Article III standing grounds, citing the requirement of a “concrete injury” reinforced by the U.S. Supreme Court’s 2016 decision in Spokeo v. Robins. In Noble et al. v. Nevada Checker Cab Corp. et al., No. 16-16573, the court held that the plaintiffs had not alleged a concrete injury simply because the defendant taxi companies had included the first and last four digits of their credit card numbers on receipts. FACTA prohibits printing more than the last five digits of a card on receipts.

The panel noted that the plaintiffs failed to allege a breach of privacy or any tangible harms resulting from the first-digit disclosure. Further, the court relied on its February 2018 decision in Bassett v. ABM Parking Services Inc., in which it rejected standing for a plaintiff who claimed a FACTA violation for including his card expiration date on a receipt.

“As in Bassett, appellants here did not allege that anyone else had received or would receive a copy of their credit card receipts. As in Bassett, appellants’ alleged injury depended entirely on a FACTA violation,” the Ninth Circuit stated. “Bassett’s reasoning controls the issue in this case, and we are bound by it.”

Finally, the Ninth Circuit found that the alleged violation did not result in the disclosure of information envisioned by Congress in protecting against identity theft. Like the disclosed expiration date, the first digit of the card number (which simply identifies the brand of the card) by itself posed a minimal risk.

A copy of the decision can be found here.

Troutman Sanders will continue to monitor these developments and provide any further updates as they are available.

On February 21, the Ninth Circuit affirmed a district court’s dismissal of an action brought under the Fair and Accurate Credit Transactions Act (“FACTA”), finding that the plaintiff had not demonstrated Article III standing.  Plaintiff Steven Bassett alleged that ABM Parking Services and its affiliated businesses repeatedly printed the expiration date of his credit card on sales receipts.  Bassett argued that the failure to withhold this information from the credit card receipt could lead to identity theft, but the Western District of Washington dismissed his case for failure to plead injury.

In an opinion that included a step-by-step analysis of the Supreme Court’s reasoning in the landmark Spokeo decision, the Ninth Circuit affirmed the district court’s finding that Bassett had not alleged a concrete injury-in-fact to confer standing.  “We need not answer whether a tree falling in the forest makes a sound when no one is there to hear it,” wrote Judge M. Margaret McKeown for the panel.  “But when this receipt fell into Bassett’s hands in a parking garage and no identity thief was there to snatch it, it did not make an injury.”  Bassett’s credit card information was not disclosed to anyone but Bassett himself, the panel concluded, and his complaint failed to allege a risk of harm, “given that he could shred the offending receipt along with any remaining risk of disclosure.”

The court contrasted Bassett’s claims to those recently before the court in a Telephone Consumer Protection Act (“TCPA”) case.  In Van Patten v. Vertical Fitness Group, LLC, the Ninth Circuit held that a consumer who received unsolicited text messages in violation of the TCPA alleged an injury because “unrestricted telemarketing can be an intrusive invasion of privacy and is a nuisance.”  While a credit card receipt that has not been divulged to anyone but the credit card’s holder may not cause harm or present the material risk of harm, “unconsented text messages and consumer reports divulged to one’s employer necessarily infringe privacy interests and present harm.”

The decision unites the Ninth Circuit with the Second and Seventh circuits, which both affirmed dismissals of similar FACTA cases in Crupar-Weinmann v. Paris Baguette America, Inc. and Meyers v. Nicolet Restaurant of De Pere, LLC, which we covered here.

A district judge in the Southern District of Florida recently dismissed a FACTA class action on Spokeo grounds even though he had previously approved a near-$600,000 settlement in the same case.  In 2016, lead plaintiff Eric Kirchein filed suit against Pet Supermarket, Inc, contending that the retailer violated the Fair and Accurate Credit Transactions Act (“FACTA”) when it printed more than five digits of his and other consumers’ credit card numbers on sales receipts.  The parties reached a preliminary settlement agreement later that year, with Pet Supermarket agreeing to pay $580,000 to a class of almost 30,000 consumers.

The deal ran into trouble soon thereafter, as the parties had difficulty finding and locating individual class members.  Further complicating matters, the size of the class increased, as Pet Supermarket discovered the class was approximately ten percent larger than initially thought.  Plaintiffs’ counsel requested additional settlement funds to compensate for the additional class members, leading the parties to try to renegotiate the settlement.  Despite these issues, the court declined requests to vacate the settlement agreement.

Even though the parties had an agreement in principal, Pet Supermarket later challenged the court’s subject matter jurisdiction based on Spokeo grounds.  The court agreed with the retailer that Kirchein could not show he had suffered concrete harm resulting from the alleged FACTA violation.  Judge Robert N. Scola, Jr. chiefly relied on his own previous decisions in similar FACTA cases – specifically Gesten v. Burger King, which found that the plaintiff failed to allege that any disclosure of his private information actually occurred – to reach a similar conclusion regarding Kirchein’s claims.  Without any allegation that his private data had been divulged, the court found that Kirchein could not establish standing.

Though the court acknowledged that there was “substantive work that remains to be done” in the case, the absence of subject matter jurisdiction prevented further activity by the court, including a fairness hearing or issuing an order approving the proposed settlement agreement.

The case is Kirchein v. Pet Supermarket, Inc., Case No. 0:16-cv-60090.

On January 4, 2018, the United States District Court for the Western District of Pennsylvania adopted a Magistrate Judge’s Report and Recommendation, denying Kirkland’s, Inc. (“Kirkland’s”) motion to dismiss in a putative Fair and Accurate Credit Transactions Act (FACTA) class action.

As background, Plaintiffs Ashley Gennock and Jordan Budai allege that Kirkland’s handed them paper receipts on several occasions that displayed more than the last five digits of their credit card numbers, in violation of FACTA’s prohibition on “print[ing] more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.”  Plaintiffs further allege that they are at an “increased risk of identity theft and payment card fraud” because of the allegedly improper redaction.

Kirkland’s filed a motion to dismiss, arguing in part that Plaintiffs lacked standing to bring the case.  In opposition, Plaintiffs claimed that the receipts with more than five digits of their credit cards represent “the very harm that Congress sought to prevent” in enacting FACTA.

The Magistrate Judge, and ultimately the District Court Judge, sided with Plaintiffs, holding: “[A] plaintiff who can cite an explicit violation of FACTA’s truncation provision does not need to prove that he suffered or was at an increased risk of suffering actual identity theft in order to demonstrate standing for purposes of bringing suit.”  The Court denied Kirkland’s motion to dismiss for lack of standing.

This decision conflicts with other recent motion to dismiss decisions in FACTA cases, including decisions in Fullwood v. Wolfgang’s Stakehouse, Inc., et al. and Katz v. The Donna Karan Company, LLC.

The case is Gennock, et al. v. Kirkland’s, Inc., No. 2:17-cv-00454 (W.D. Pa.).  We will continue to monitor for developments.

On November 6, a judge in the Southern District of New York dismissed a proposed class action alleging that Wolfgang’s Steakhouse impermissibly printed payment card expiration dates on customers’ receipts, relying on the U.S. Supreme Court’s decision in Spokeo to find that customers were not actually harmed by any information revealed.

Relying on the Second Circuit’s recent decision in Crupar-Weinmann v. Paris Baguette America, Inc., District Judge Katherine Polk Failla concluded that plaintiff Cynthia M. Fullwood could not prove that the steakhouse’s disclosure of her credit card’s expiration date on her receipt harmed her because Wolfgang’s did not print Fullwood’s full credit card number.  Without any injury, Fullwood did not have standing to seek statutory damages under the Fair and Accurate Credit Transactions Act.  The court rejected Fullwood’s arguments that redacting credit cards’ expiration dates was the “core object” of FACTA and also dismissed her contention that requiring her to show actual harm would “write FACTA out of the statute books.”

Even though the court permitted Fullwood to amend three times previously, Judge Failla was convinced that further amendment would be futile.  “Plaintiff’s amendments to her pleading are no match for the rising tide of binding precedent holding that a bare procedural violation of FACTA, without more, does not confer Article III standing,” the judge wrote.  “Plaintiff never alleges that defendants made her receipts accessible to the public in any way, nor does she claim to have been the victim of identity theft or to have had her credit card used fraudulently.”  Without any explanation as to how she could establish standing, the court denied Fullwood further leave to amend.

A copy of the court’s opinion is available here.

On September 20, the Second Circuit Court of Appeals in Katz v. The Donna Karan Company, LLC, affirmed the lower court’s dismissal of a Fair and Accurate Credit Transactions Act putative class action for failure to establish a concrete injury sufficient to maintain Article III standing to bring suit.

As we previously reported, plaintiff Yehuda Katz alleged a class action claim against retailer Donna Karan and two subsidiaries under FACTA based on their alleged failure to truncate the credit card number on Katz’s receipt.  Katz’s complaint did not make any allegation of economic loss or harm, nor did he allege that any third party actually saw the receipt with the non-truncated number.  The District Court for the Southern District of New York granted the defendants’ motion to dismiss, finding that Katz had alleged only a “bare procedural violation” that was divorced from any concrete harm.  Specifically, the Court held that although Donna Karan violated FACTA’s prohibition on printing the first six digits of Katz’s credit card, “the first six digits [known as the “Issuer Identification Number (“IIN”)] do not disclose any information about Plaintiff; but rather ‘identity the institution that issued the card to the card holder.”

On appeal, the Second Circuit affirmed the district court’s dismissal.  “While Katz may be correct that every additional digit increases the risk of a brute force cryptological attack, printing the first six digits – the IIN – is the equivalent of printing the name of the issuing institution, information which need not be truncated under FACTA, and thus the district court did not clearly err in concluding that printing the IIN does not increase the risk of real harm.”  Furthermore, the receipt did not disclose Katz’s name, “a fact that also reduces the possibility that disclosure of the IIN would result in harm.”  The Second Circuit emphasized, however, that standing in other FACTA cases should proceed “on a case- and fact-specific basis.”