Ahead of the Class

On Wednesday of last week, the Eleventh Circuit did what no other post-Spokeo federal court of appeals has done.  It held that a plaintiff alleging a willful violation of the Fair and Accurate Credit Transactions Act (“FACTA”) based on being given a receipt that showed more than the last five digits of his credit card number—and specifically a receipt that the plaintiff kept and apparently showed to no one but his lawyers—has Article III standing to sue the company that gave him the receipt for statutory damages.  The decision in Muransky v. Godiva Chocolatier, Inc., No. 16-16486 & 16-16783, 2018 WL 4762434 (11th Cir. Oct. 3, 2018), acknowledged decisions rejecting standing in other FACTA cases by the Second, Seventh, and Ninth Circuits but distinguished those decisions and cautioned district courts against adopting “a bright-line no-standing rule” in FACTA cases because, it said, decisions on standing in FACTA cases should be “based on the case and facts of each distinct case . . . .”  2018 WL 4762434, at *7.

Since the Supreme Court’s decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), reminded lower courts to separately address whether a claimed injury was “concrete,” litigants in cases alleging violations of statutory requirements—like FACTA’s prohibition on printing “more than the last 5 digits of the card number or the expiration date” on credit card receipts, 15 U.S.C. § 1681c(g)(1)—have fought renewed battles over whether plaintiffs alleging such violations have Article III standing without alleging some injury other than being subjected to the violation.  In many contexts, courts have identified the statutory violation itself as constituting a sufficiently concrete injury.  See, e.g., Susinno v. Work Out World, Inc., 862 F.3d 346 (3d Cir. 2018) (finding standing to assert violation of Telephone Consumer Protection Act based on plaintiff’s receipt of a single unsolicited call on her cell phone); In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625 (3d Cir. 2017) (finding standing to assert claims under Fair Credit Reporting Act based on alleged unauthorized disclosure of plaintiffs’ personal health information).  But until now, most courts have concluded that simply being handed a receipt that displays more digits of a person’s own credit card number than FACTA allows is not, without more, a concrete injury.  See, e.g., Noble v. Nevada Checker Cab Corp., 726 F. App’x 582 (9th Cir. 2018); Katz v. Donna Karan Co., 872 F.3d 114 (2d Cir. 2017); Kamal v. J. Crew Grp., Inc., 2017 WL 2587617 (D.N.J. June 13, 2017), appeal pending, No. 17-2345 & 17-2452 (3d Cir.).

The Eleventh Circuit’s Muransky decision came on an appeal from final approval of a $6.3 million class settlement of a FACTA case brought by a single named plaintiff who alleged that “after Dr. Muransky made a purchase at a Godiva store, Godiva gave him a receipt that showed his credit card’s first six and last four digits.”  2018 WL 4762434, at *1.  The court noted that “all indications are that he still has it [i.e., the receipt].”  Id. at *6.  The complaint alleged that the FACTA violations exposed Dr. Muransky and the class “to an elevated risk of identity theft.”  Id. at *1 (quoting complaint).  One objector to the settlement argued, however, that the settlement should be rejected because the named plaintiff did not have Article III standing to bring the lawsuit.  Id. at *2-3.

The Eleventh Circuit disagreed.  It held that Dr. Muransky’s complaint alleged a concrete injury in two ways—although neither was the claimed “elevated risk of identity theft” the complaint asserted.  The court did not directly address the sufficiency of that assertion.  Rather, it held that Dr. Muransky’s allegation of a FACTA violation itself sufficed as a concrete injury and also that the “additional burden” imposed on him of having to “use [his] time (and wallet space) to safely dispose of or keep the untruncated receipt so as to avoid someone finding [his] credit card number on [his] receipt” also sufficed as a concrete injury.  2018 WL 4762434, at *4-6.

Muransky is the first circuit court decision to hold that a violation of FACTA’s truncation provision, by itself, injures the recipient of the noncompliant receipt in a concrete way.  The Eleventh Circuit reached that conclusion by looking, as the Supreme Court instructed in Spokeo, to “both history and the judgment of Congress” (136 S. Ct. at 1549) to assess whether a claimed intangible injury constitutes a concrete injury in fact.  The Eleventh Circuit found that a violation of FACTA’s card-number-truncation provision is analogous to the common law claims of breach of confidence and breach of an implied bailment agreement—where the injury is said to occur as soon as the plaintiff’s trust is violated or his property is returned to him in a manner other than the way it was agreed to be returned.  2018 WL 4762434, at *4-5.  The court specifically rejected any need to base any historical comparison on privacy torts—as some district courts have done in finding a lack of standing in FACTA cases.  Id. at *5 & n.3.  As to the judgment of Congress, the opinion says less, but it notes that Congress concluded that the truncation provision would reduce identity theft and credit card fraud and that Congress made willful violations actionable, even when the consumer suffers no actual damages.  The Eleventh Circuit said, “We can infer from these two provisions that Congress conceived of the harm as happening when the merchant provides a customer with an untruncated receipt.”  Id. at *5.

The court then hedged its conclusion that the claimed FACTA violation, by itself, sufficed as a concrete injury by recognizing a separate injury:  “Time spent safely disposing of or keeping the untruncated receipt is, of course, a small injury, but it is enough for standing purposes.”  2018 WL 4762434, at *6 (citing previous Eleventh Circuit authority for the notion that “a small injury, an identifiable trifle, is sufficient to confer standing.”).

The Muransky court devoted seven pages of the slip opinion to explaining its view that the determination of Article III standing in FACTA cases is “‘a case- and fact- specific’ question” (quoting Katz, 872 F.3d at 121) and that, therefore, its decision to find standing does not conflict with other circuit court decisions that found no standing in FACTA cases.  See 2018 WL 4762434, at *6-9.   The court said that its ruling was “in keeping with” the decisions of the Second, Seventh and Ninth Circuits that had found no standing in FACTA cases involving the printing of a card’s expiration date because those decisions each relied on a declaration Congress made in the Credit and Debit Card Receipt Clarification Act of 2007 suggesting that a failure to truncate the expiration date does not, without more, heighten the risk of identity theft.  Id. at *6 (citing Bassett v. ABM Parking Servs., Inc., 883 F.3d 776 (9th Cir. 2018); Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76 (2d Cir. 2017); and Meyers v. Nicolet Rest. of de Pere, LLC, 843 F.3d 724 (7th Cir. 2016)).  And it viewed the Second Circuit’s decision in Katz—which upheld a dismissal for lack of standing in a FACTA case based on receipts that (like Dr. Muransky’s receipt) displayed the first six and last four digits of the card number—as “distinguishable” because the standing challenge in Katz was a factual challenge and the Second Circuit was reviewing a lower court’s factual findings.  2018 WL 4762434, at *7.  By contrast, the challenge in Muransky was a facial challenge to the plaintiff’s standing, requiring the court to “take the allegations in the complaint as true and evaluate whether those allegations plausibly allege standing.”  Id. at *9.  Finally, the Eleventh Circuit offered its view that, rather than relying on what courts and experts said in 2007 or 2008 cases about whether disclosing the first six digits of a card number poses a risk of harm, district courts should take “a fresh look” at what would-be identity thieves could now do “in light of technological changes related to brute-force cryptological attack on credit card numbers.”  Id. at *8.

Plaintiffs in FACTA cases will, of course, applaud the Eleventh Circuit’s approach to Article III standing in Muransky.  Defendants are likely to criticize the decision as missing the forest for the trees.  The fundamental question in determining whether a plaintiff alleging a statutory violation has standing to sue is whether “he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 136 S. Ct. at 1548 (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)).  The interest the FACTA truncation provision protects is an interest in preventing identity theft and credit card fraud.  If no one but the cardholder sees the first six numbers printed on the receipt, it is certainly fair to ask, “How has an ‘actual’ invasion of an interest in preventing identity theft or credit card fraud occurred?”  Even as described in the Muransky opinion, the common law claims of breach of confidence and breach of an implied bailment agreement would seem to require some type of disclosure of the protected information to someone who is not authorized to see it.  See 2018 WL 4762434, at *4-5.

The Eleventh Circuit is right that “district courts should take ‘a fresh look’ at what would-be identity thieves could now do ‘in light of technological changes related to brute-force cryptological attack on credit card numbers.’”  Id. at *8.  But a brute-force attack succeeds only if the massive numbers of possibilities it generates can be submitted to the credit card issuer for acceptance, and it is hard to believe that credit card acceptance systems permit a merchant to submit hundreds of thousands of possible numbers and then approve the transaction when a valid one is finally received.  Defendants will likely pursue this as a factual defense to standing.

The Muransky decision seems ripe for a petition for review to the Eleventh Circuit en banc and/or a petition for certiorari to the Supreme Court—particularly since the panel decision takes such pains to explain why its finding of Article III standing does not conflict with the series of no-standing decisions from other circuits in the past two years.  The Third Circuit has had the Kamal v. J. Crew appeal—another FACTA case involving a receipt displaying the first six and last four digits—before it since oral argument in February of this year, so another circuit is soon likely to weigh in on Article III standing in a  too-many-digits case.

For now, however, the Eleventh Circuit has bucked what appeared to be the trend of courts finding no Article III standing in FACTA cases.  And the lesson from Muransky is that, at least in the Eleventh Circuit, challenges to Article III standing in FACTA card-number-truncation cases will need to be factual challenges.