The Fair and Accurate Credit Transactions Act of 2003 (FACTA) prohibits anyone who accepts credit or debit cards as payment from printing more than the last five digits of a customer’s credit card number on a receipt. A plaintiff, Ahmed Kamal, sued several J. Crew entities after receiving three receipts that included both the first six and last four digits of his credit card number. The United States District Court for the District of New Jersey dismissed the lawsuit for lack of standing based upon its determination that Kamal did not suffer a concrete injury from the alleged violation. On appeal, the United States Court of Appeals affirmed the determination that Kamal lacked standing to litigate his FACTA claims. Kamal v. J. Crew Group, Inc., et. al, Nos. 17-2345 and 17-2453 (3rd Cir. Mar. 8, 2019).
Kamal pled a technical violation of FACTA’s ban on printing more than the last five digits of a consumer’s credit card number, but the Third Circuit addressed whether the alleged resulting harm is sufficiently concrete to create case or controversy under Article III of the United States Constitution. The United States Supreme Court held in Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1549 (2016), that “Article III standing requires concrete injury even in the context of a statutory violation.” A procedural violation must yield or risk actual harm to meet the requirements of Article III. Interpreting Spokeo, the Third Circuit held that an alleged procedural violation manifests a concrete injury if the violation actually harms or presents a material risk of harm to the underlying concrete interest.
Kamal pled two alleged concrete injuries: the printing of the prohibited receipts and the increased risk of identity theft resulting from that printing. Kamal failed to allege the actual disclosure of his information to a third party. The Third Circuit held that Kamal failed to plausibly allege how J. Crew’s printing of the six digits presented a material risk of concrete, particularized harm. Absent a sufficient degree of risk, J. Crew’s alleged violation of FACTA was a “bare procedural violation” that is insufficient to confer Article III standing. The Third Circuit noted that its analysis would have differed if Kamal had alleged that the receipt included all sixteen digits of his credit card number, making the potential for fraud significantly less conjectural. The appellate court also rejected Kamal’s contention that his alleged injuries were sufficiently concrete because they are similar to common law privacy torts or breach of confidence actions that have been recognized by courts, concluding that those common law causes of action require that the actionable harm occurs when a third party gains unauthorized access to a plaintiff’s personal information, which Kamal had not shown.
Overall, the Third Circuit concluded that Kamal’s speculative chain of alleged potential events does not satisfy the requisite showing of material risk of harm. The Third Circuit concluded that its conclusions were consistent with sister federal circuit courts of appeals that have addressed similar FACTA issues.
As we have discussed on our blog, federal courts interpreting Spokeo have often reached differing results that can often turn on nuances. We will continue to analyze and report on how federal courts interpret the requisite showing of an Article III case and controversy in light of Spokeo.