Plaintiff Alleging FACTA Violations Must Show Concrete Injury

tom wolfe headshot
Tom Wolfe, Managing Partner of Moore Brewer Wolfe Jones Tyler & North.

A recent Third Circuit decision helps to rein in the potential for frivolous lawsuits in federal court alleging a violation of the Fair and Accurate Credit Transactions Act (“FACTA”).  In the case of Kamal v. J. Crew, Inc., 2019 WL 1087350 (3d Cir., Mar. 8, 2019), the U.S. Court of Appeals for the Third Circuit held that the plaintiff did not have standing to sue a retailer for violating FACTA because the plaintiff did not allege that the violation resulted in a concrete injury.  Bottom line, the existence of a violation of the law does not automatically grant the consumer a remedy.

FACTA is a federal law that was enacted in 2003 as an amendment to the Fair Credit Reporting Act (“FCRA”) to combat credit card and identity theft.  FACTA not only extends to consumers more rights regarding their credit reports, but it also prohibits anyone who accepts credit or debt card payments from printing the expiration date or more than the last five digits of the card number on the transaction receipt.[1]  In Kamal, the plaintiff alleged that the defendant, retailer J. Crew, printed the first six and the last four digits of his card number on each of the receipts for three separate transactions.  The defendant did not print the expiration date, or the remaining six digits of the card anywhere else on the receipt.  However, the plaintiff did not allege that anyone had seen the receipts, that his identity was stolen, or that his card number had been misappropriated in some way.  He simply alleged that the defendant had violated FACTA because it printed more than the last five digits of his card number on the receipt.  This indeed was a technical violation.  However, the Court did not consider this sufficient to afford the plaintiff a remedy and dismissed the case for lack of injury, causation and redressability (lack of standing).

While some laws will confer liability on a person for the mere act of violating a law (known as “strict liability”), most laws require that the party bringing the lawsuit show evidence of harm and a connection between the violation and the harm.  In other words, most laws do not automatically afford any person a right to sue someone and be awarded damages based solely on a technical violation of the law. 

Pursuant to Article III of the U.S. Constitution, a party seeking to file a lawsuit must demonstrate that they have “standing” to bring the action.  To demonstrate standing, they must allege that: (1) they have suffered an actual or threatened injury in fact; (2) that can be reasonably traced to the offending action of the defendant; (3) and that the harm is likely to be redressed by a favorable decision.  These requirements were analyzed in the U.S. Supreme Court decision Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), which also dealt with an alleged violation of FACTA.

The Court in Kamal analyzed the factors laid out in Spokeo in coming to its conclusion that the plaintiff did not have standing.  In the initial proceedings, the defendant was successful in having the case dismissed because the plaintiff failed to demonstrate that he had standing to sue.  In response, the plaintiff amended his complaint to allege that he had suffered two “concrete” harms: (1) the printing of the prohibited information; and (2) increased risk of identity theft caused by the printing.  Plaintiff also relied on legislative findings to conclude that the defendant’s conduct resulted in a “real non-speculative harm in the form of increased risk in identity theft.”  However, the Court rejected these arguments because they were mere allegations of increased risk and did not constitute concrete injury. 

In reaching this conclusion, the Court applied the analysis used in Spokeo.  To show concrete injury, the plaintiff would have needed to show that he suffered an invasion of a legally protected interest that is concrete, particularized, actual or imminent, not conjectural or hypothetical (quoting Spokeo, 136 S. Ct. at 1548).  The Kamal Court considered whether plaintiff’s alleged harm was “concrete” by comparing it to its most analogous harm, “unreasonable publicity,” which protects against unauthorized disclosures of information.  The Court held that the plaintiff’s alleged harm did not have a close enough proximity to this analogous harm because the plaintiff did not allege that that his credit card number was disclosed to a third party.  Concluding otherwise would require too much speculation as the plaintiff would have needed to lose or throw away his receipts, a third party would need to obtain the receipts, somehow discover the remaining six digits of the credit card number, as well as other information needed to use the card such as the expiration date, the CVV or the zip code, none of which were disclosed on the receipts.  Thus, plaintiff’s alleged harm was mere speculation, not rising to the level of “concrete harm.”

This decision is a positive one for those in the financial industry and is in keeping with other circuits, including the Ninth Circuit, that have applied the Spokeo factors in determining a plaintiff’s standing and reached the same holding.  However, be aware that a case that is dismissed for lack of standing in federal court may be re-filed in state court and not necessarily suffer the same fate.  Notwithstanding, this case reinforces the rule that in order to successfully bring an action for a violation of FACTA (in federal court), the plaintiff must allege more than just a procedural violation of the Act. 

[1] While not at issue in Kamal, California Civil Code §1747.09 also prohibits any person or entity that accepts credit or debit cards for the transaction of business from printing more than the last five digits of the credit or debit card account number or the expiration date on any receipt provided to the cardholder.

Article by Tom Wolfe, Managing Partner of Moore Brewer Wolfe Jones Tyler & North.

Pin It