Doris Jeffries v. Volume Services America, Inc.

Karen Lecraft Henderson, Circuit Judge: *1062 Doris Jeffries made a credit card purchase at a Centerplate 1 location and received a receipt that displayed her sixteen-digit credit card number and credit card expiration date. Jeffries sued Centerplate for violating the Fair and Accurate Credit Transactions Act of 2003 (FACTA), Pub. L. No. 108-159, § 113, 117 Stat. 1952 , 1959-60 (codified at 15 U.S.C. § 1681c(g) ), which prohibits printing "more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. § 1681c(g)(1). The district court granted Centerplate's motion to dismiss, concluding that Jeffries lacked standing. Jeffries v. Volume Servs. Am., Inc. , 319 F. Supp. 3d 525 , 527 (D.D.C. 2018). Jeffries timely appealed and we now reverse and remand. I. BACKGROUND "The crime of identity theft-in which a perpetrator assumes the identity of a victim in order to obtain financial products and services or other benefits in the victim's name-ha[d] reached almost epidemic proportions" in the early 2000s. H.R. Rep. No. 108-263, at 25 (2003). "A hotline established by the Federal Trade Commission to field consumer complaints and questions about identity theft logged over 160,000 calls in 2002 alone." Id. "[E]lectronically printed receipts" provided criminals with "easy access to" credit and debit card information. S. Rep. No. 108-166, at 3 (2003). In response to the increasing identity theft threat, the Congress enacted FACTA, which mandates ( inter alia ): "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. § 1681c(g)(1). Any person who willfully violates this truncation requirement-that is, anyone who willfully prints more than five digits or the expiration date on a receipt-is liable for "any actual damages sustained by the consumer ... or damages of not less than $100 and not more than $1,000" and for "such amount of punitive damages as the court may allow." Id. § 1681n(a)(1)(A), (a)(2). Doris Jeffries made a purchase at a Centerplate location. Centerplate provided Jeffries with a receipt containing all sixteen digits of her credit card number, her credit card expiration date and her credit card provider. She immediately recognized that the receipt contained her personal information and held on to it for safekeeping. Jeffries then filed this class action lawsuit against Centerplate, alleging willful *1063 violations of FACTA's truncation requirement. According to the complaint, Centerplate's conduct violated Jeffries' statutory right and, as a result, exposed her to an increased risk of identity theft. Because of Centerplate's conduct, Jeffries was also forced to take steps to safeguard the non-compliant receipt. Centerplate moved to dismiss the case for lack of standing. Jeffries, 319 F. Supp. 3d at 528 . The district court determined that Jeffries did not suffer an increased risk of identity theft because Jeffries-and only Jeffries-viewed the receipt containing her credit card information. Id. at 533-34 . The district court also concluded that the burden of safeguarding the non-compliant receipt-the second form of harm identified in the complaint-was insufficiently concrete to support standing. Id. at 530 . Finding both harms alleged in the complaint inadequate, the district court held that Jeffries lacked standing and dismissed her case for lack of subject-matter jurisdiction. Id. at 534 . Jeffries appeals the dismissal. "Our review is de novo." Nat'l Ass'n of Home Builders v. U.S. Fish & Wildlife Serv. , 786 F.3d 1050 , 1052 (D.C. Cir. 2015). II. ANALYSIS Article III of the United States Constitution limits the federal "judicial Power" to "Cases" and "Controversies." U.S. Const. art. III, § 2, cl. 1. A case or controversy does not exist "unless the plaintiff has standing." West v. Lynch , 845 F.3d 1228 , 1230 (D.C. Cir. 2017). Standing has three elements. "The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins , --- U.S. ----, 136 S. Ct. 1540 , 1547, 194 L.Ed.2d 635 (2016). An injury in fact is "an invasion of a legally protected interest which is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical." Lujan v. Defs. of Wildlife , 504 U.S. 555 , 560, 112 S.Ct. 2130 , 119 L.Ed.2d 351 (1992) (quotation marks and internal citations omitted). The district court dismissed this action at the pleading stage, when a plaintiff is required only to state plausibly that each standing element exists. Attias v. Carefirst, Inc. , 865 F.3d 620 , 625 (D.C. Cir. 2017). Causation and redressability are not in dispute. The issue is whether Jeffries alleged an adequate injury in fact. Jeffries contends that the violation of her statutory right under FACTA constitutes an injury in fact without any additional showing of harm. "[T]he violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact." Spokeo, Inc. , 136 S. Ct. at 1549 . The United States Supreme Court has long recognized that the "Congress may create a statutory right or entitlement the alleged deprivation of which can confer standing to sue even where the plaintiff would have suffered no judicially cognizable injury in the absence of statute." Warth v. Seldin , 422 U.S. 490 , 514, 95 S.Ct. 2197 , 45 L.Ed.2d 343 (1975). The concreteness component of injury in fact sharply limits when a plaintiff can establish standing based solely on a violation of his statutory rights. An injury in fact must always be "concrete"-that is, "real" and " de facto ," not "abstract." Spokeo, Inc. , 136 S. Ct. at 1548 ; Hancock v. Urban Outfitters, Inc. , 830 F.3d 511 , 514 (D.C. Cir. 2016) ("[T]he legislature cannot dispense with the constitutional baseline of a concrete injury in fact."). This means the Congress cannot authorize a lawsuit based on a "bare procedural violation" of a statute divorced from any "real" or " de facto " harm. Spokeo, Inc. , 136 S. Ct. at 1549 . *1064 After all, a "procedural right in vacuo " is nothing more than an abstract "interest in the proper administration of the law." Summers v. Earth Island Inst. , 555 U.S. 488 , 496-97, 129 S.Ct. 1142 , 173 L.Ed.2d 1 (2009). For a statutory violation to constitute an injury in fact, then, the statute must protect the plaintiff's concrete interest- i.e. , afford the putative plaintiff a right to be free of a harm capable of satisfying Article III. Accord Strubel v. Comenity Bank , 842 F.3d 181 , 190 (2d Cir. 2016) ("[A]n alleged procedural violation can by itself manifest concrete injury where Congress conferred the procedural right to protect a plaintiff's concrete interests."); Robins v. Spokeo, Inc. , 867 F.3d 1108 , 1113 (9th Cir. 2017) (same). Jeffries believes FACTA is such a statute and vests consumers with a concrete interest in using their credit and debit cards without incurring an increased risk of identity theft. We agree. FACTA's truncation requirement imposes on the merchant the duty not to print "more than the last 5 digits of the card number or the expiration date." 15 U.S.C. § 1681c(g)(1). The duty applies at the "point of the sale or transaction" and a violation occurs regardless whether a plaintiff ever becomes the victim of any crime. Id. ; see also id. § 1681n (making available statutory damages). In other words, FACTA itself does not prohibit the crimes of identity theft or fraud; its truncation requirement is a " 'procedure[ ] designed to decrease th[e] risk' that a consumer would have his identity stolen." Muransky v. Godiva Chocolatier, Inc. , 922 F.3d 1175 , 1188 (11th Cir. 2019) (first alteration in original) (quoting Spokeo, Inc. , 136 S. Ct. at 1550 ). The requirement thus vests consumers with an interest in using their credit and debit cards without facing an increased risk of identity theft. 2 The question now becomes whether the interest protected by FACTA-avoiding an increased risk of identity theft-is concrete. "In determining whether an intangible harm" like risk is concrete, "both history and the judgment of Congress play important roles." Spokeo, Inc. , 136 S. Ct. at 1549 . The historical analysis focuses on "whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Id . "In addition, because Congress is well positioned to identify intangible harms that meet minimum Article III requirements, its judgment is also instructive and important." Id. History tilts toward concreteness. "A common law breach of confidence lies where a person offers private information to a third party in confidence and the third party reveals that information" to another. Muransky , 922 F.3d at 1190-91 . This tort "is rooted in the concept that the law should recognize some relationships as confidential to encourage uninhibited discussions between the parties involved." Young v. U.S. Dep't of Justice , 882 F.2d 633 , 640 (2d Cir. 1989). The harm in a breach-of-confidence case "occurs when the plaintiff's trust in the breaching party is violated, whether or not the breach has other consequences." Muransky , 922 F.3d at 1190 . FACTA's truncation requirement establishes a similar relationship of trust between consumer and merchant, requiring the merchant to safeguard the consumer's *1065 credit or debit card information and thus preventing an increased risk of identity theft. See 15 U.S.C. § 1681c(g)(1). That is not to say a FACTA violation and a breach of confidence are identical. Part of the harm involved in a breach of confidence is actual disclosure to a third party. See Kamal v. J. Crew Grp., Inc. , 918 F.3d 102 , 114 (3d Cir. 2019) ("[A] breach of confidence involves 'the unconsented, unprivileged disclosure to a third party of nonpublic information that the defendant has learned within a confidential relationship.' " (quoting Alan B. Vickery, Note, Breach of Confidence: An Emerging Tort , 82 Colum. L. Rev. 1426 , 1455 (1982) )). FACTA punishes conduct that increases the risk of third-party disclosure, not the actual disclosure itself. Muransky , 922 F.3d at 1191 . Even so, "risk" is nothing more than a "possibility of loss, injury, disadvantage, or destruction." Webster's Third New International Dictionary 1961 (1976). And FACTA protects against the risk of the very harm the breach of confidence tort makes actionable-an unauthorized disclosure of privileged information to a third party. This is the type of "close relationship" with " a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts" that weighs in favor of concreteness. Spokeo, Inc. , 136 S. Ct. at 1549 (emphasis added). Compare Muransky , 922 F.3d at 1191 (FACTA "has a sufficiently close relationship to breach of confidence to satisfy Spokeo "), with Kamal , 918 F.3d at 114 (finding relationship too remote because FACTA does not require actual disclosure to third party). We also give weight to the Congress's determination that printing too much credit card information on a receipt creates a "real" or " de facto " harm. It found that printing excess credit card information gives "criminals ... easy access to such key information" and thus contributes to identity theft. S. Rep. No. 108-166, at 3. "After hearing from experts on the matter, Congress decided to set the tolerable level of risk at printing the last five digits of a card number." Muransky , 922 F.3d at 1188 . The line between a concrete and an abstract risk is, understandably, hard to draw. For that reason, the Congress's judgment about when increased risk becomes intolerable is entitled to respect. See Spokeo, Inc. , 136 S. Ct. at 1549 . Our analysis does not stop with the conclusion that FACTA protects a concrete interest. See id. at 1550 (some statutory violations "may result in no harm" and thus do not constitute injury in fact); Owner-Operator Indep. Drivers Ass'n, Inc. v. U.S. Dep't of Transp. , 879 F.3d 339 , 343 (D.C. Cir. 2018) (even if statute protects concrete interest, "the putative plaintiff" must have "suffered a de facto injury resulting from the procedural violation"). We must also determine whether the challenged violation of Jeffries' statutory right harmed or created a "risk of real harm" to the concrete interests protected by FACTA. Spokeo, Inc. , 136 S. Ct. at 1549 . Jeffries views the inquiry as open and shut, arguing that every FACTA violation creates a risk of identity theft. Her view finds support in a recent Eleventh Circuit decision, which determined that "Congress decided to set the tolerable level of risk at printing the last five digits of a card number." Muransky , 922 F.3d at 1188 . The Eleventh Circuit therefore "decline[d] to substitute [its] judgment for Congress's by saying that, as a matter of law, the risk of identity theft is not concrete until a merchant prints the first eight or ten digits instead of the first six." Id. But not every violation of FACTA's truncation requirement creates a risk of identity theft. Several years after enacting FACTA, the Congress found that "hundreds of lawsuits were filed alleging that *1066 the failure to remove the expiration date was a willful violation of" FACTA "even where the account number was properly truncated" and that "[n]one of these lawsuits contained an allegation of harm to any consumer's identity." Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(4)-(5) 122 Stat. 1565 , 1565. According to the Congress, "proper truncation of the card number, by itself as required by" FACTA, "regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud." Id. § 2(a)(6), 122 Stat. at 1565. Thus, printing an expiration date on a receipt without more-although a technical violation of FACTA-does not create a risk of identity theft; accordingly, a plaintiff who has suffered this type of FACTA violation has been able to use his credit card without incurring an increased risk of identity theft- i.e. , has not suffered a concrete injury in fact. That is why our sister circuits, applying Spokeo , have unanimously concluded that a FACTA violation based solely on a failure to truncate an expiration date does not qualify as a concrete injury in fact. Accord Bassett v. ABM Parking Servs., Inc. , 883 F.3d 776 , 783 (9th Cir. 2018) (no standing where plaintiff alleged FACTA violation by printing only expiration date on receipt); Crupar-Weinmann v. Paris Baguette Am., Inc. , 861 F.3d 76 , 81 (2d Cir. 2017) (same); Meyers v. Nicolet Rest. of De Pere, LLC , 843 F.3d 724 , 727 (7th Cir. 2016) (same). As explained infra , however, none of these courts encountered a FACTA violation as egregious as the one committed by Centerplate. Although not every FACTA violation creates a concrete injury in fact, we conclude that the alleged violation of Jeffries' right does so. The Act requires the truncation of two categories of information at the point of sale: credit card digits and expiration date. 15 U.S.C. § 1681c(g)(1) ("[N]o person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt."). Centerplate printed all of the information in both categories, creating the nightmare scenario FACTA was enacted to prevent, see Remarks on Signing the Fair and Accurate Credit Transactions Act of 2003, 39 Weekly Comp. Pres. Doc. 1746, 1748 (Dec. 4, 2003) ("Slips of paper that most people throw away should not hold the key to their savings and financial secrets."). Unlike a receipt containing only an expiration date, Jeffries' receipt bore sufficient information for a criminal to defraud her. At the point of sale-the time at which FACTA measures liability-there was no way to know whether Jeffries would recognize Centerplate's mistake and mitigate any harm or whether the receipt would end up in the trash for anyone to find or otherwise be accessed by a malevolent third party ( e.g. , an employee or fellow customer). Accordingly, Jeffries was not able to use her credit card without incurring an increased risk of identity theft and, as a result, suffered a concrete injury in fact. She has pleaded enough facts to establish standing. Centerplate focuses much of its defense on the fact that Jeffries has not become a victim of identity theft because, through her own efforts, she has mitigated any risk of a third party accessing her credit card information. These facts, although true, are irrelevant. As noted earlier, FACTA itself does not prohibit the crime of identity theft; instead, it establishes a procedural requirement to ensure that consumers can use their credit and debit cards without incurring an increased risk of identity theft. Moreover, there was no guarantee at the point of sale that Jeffries would recognize and safeguard the non-compliant receipt. Just as someone who replaces the *1067 pin in a grenade remains, nonetheless, previously at risk of getting blown up, Jeffries' effort to safeguard her receipt does not change the fact that she was prevented from using her credit card without at the same time facing exposure to increased identity theft risk. Because the receipt contained enough information to defraud Jeffries, she suffered an injury in fact at the point of sale. Centerplate also contends that a decision in Jeffries' favor will create tension with the Third Circuit's opinion in Kamal v. J. Crew Group , which held that a plaintiff failed to establish standing when a merchant printed the first six digits of his credit card number on a receipt, 918 F.3d at 116-17 . Yet the Third Circuit determined that a FACTA violation can support standing if the plaintiff faces a real or material risk of identity theft. Id. at 116 . The court found no standing in that case because the plaintiff failed to allege that "the receipt included enough information to likely enable identity theft." Id. It expressly stated its "analysis would be different if, for example, [the plaintiff] had alleged that the receipt included all sixteen digits of his credit card number, making the potential for fraud significantly less conjectural." Id. In other words, the Third Circuit recognized its analysis would be different if it were presented with the facts Jeffries presents to us. 3 See id. Finally, and on a separate score, Centerplate argues Jeffries' injury fails the imminence requirement of injury in fact because the risk of her suffering future identity theft is speculative. An injury in fact must be "actual or imminent" as opposed to " 'conjectural' or 'hypothetical.' " Lujan , 504 U.S. at 560 , 112 S.Ct. 2130 (quoting Whitmore v. Arkansas , 495 U.S. 149 , 155, 110 S.Ct. 1717 , 109 L.Ed.2d 135 (1990) ). Centerplate makes a fair point. We have repeatedly expressed skepticism of increased-risk-of-harm injuries because any future injury-no matter how speculative-can be recast as a present risk of future harm, thus purportedly meeting the imminence requirement of Article III. E.g. , Ctr. for Law & Educ. v. Dep't of Educ. , 396 F.3d 1152 , 1161 (D.C. Cir. 2005) ; Pub. Citizen, Inc. v. Nat'l Highway Traffic Safety Admin. , 489 F.3d 1279 , 1294 (D.C. Cir. 2007). But Jeffries does not rely on increased risk of future identity theft as her injury in fact; she relies on an invasion of her concrete interest as protected by FACTA's truncation requirement. The alleged violation of her statutory right has already occurred: there is nothing "conjectural" or "hypothetical" about it. Accord Robins , 867 F.3d at 1117-18 ; Macy v. GC Servs. Ltd. P'ship , 897 F.3d 747 , 759-60 (6th Cir. 2018). For the foregoing reasons, we reverse the judgment of the district court and remand for further proceedings consistent with this opinion. So ordered . Rogers, Circuit Judge, concurring in part and concurring in the judgment: *1068 The question before the court is whether appellant Doris Jeffries has plausibly alleged an Article III injury by pleading a violation of the Fair and Accurate Credit Transactions Act of 2003 ("FACTA"), Pub. L. No. 108-159, § 113, 117 Stat. 1952 , 1959-60 (codified at 15 U.S.C. § 1681c(g) ). See Op. 1063; Lujan v. Defs. of Wildlife , 504 U.S. 555 , 560-61, 112 S.Ct. 2130 , 119 L.Ed.2d 351 (1992). The Supreme Court has clarified that to satisfy Article III, an injury-in-fact must be not only particularized but also concrete. Spokeo v. Robins , --- U.S. ----, 136 S. Ct. 1540 , 1548, 194 L.Ed.2d 635 (2016). In the context of a statutory violation, our sister circuits have responded to Spokeo by examining (1) whether the statutory provision at issue "protect[s] a plaintiff's concrete interests," and (2) whether the specific statutory violation alleged in a given case "actually harm[ed], or present[ed] a material risk of harm to, such interests." Robins v. Spokeo , 867 F.3d 1108 , 1113 (9th Cir. 2017) (citing Strubel v. Comenity Bank , 842 F.3d 181 , 190 (2d Cir. 2016) ); see Muransky v. Godiva Chocolatier, Inc. , 922 F.3d 1175 , 1186 (11th Cir. 2019) ; Kamal v. J. Crew Grp., Inc. , 918 F.3d 102 , 112-13 (3d Cir. 2019). Jeffries' allegations meet this two-part test and I join the court in reversing the dismissal of her complaint for lack of standing. See Op. 1062, 1063-64, 1065. I write separately because in my view Jeffries has shown FACTA protects her concrete interests (part one of the test) by pointing to "Congress's determination that printing too much credit card information on a receipt creates a 'real' or ' de facto ' harm," id. at 1065 (quoting Spokeo , 136 S. Ct. at 1548 ), regardless of whether she can also show that her injury is analogous to the harm associated with a common law breach of confidence, see id. at 1064. In 2003, Congress found that identify theft had reached "almost epidemic proportions," H.R. REP. NO. 108-263, at 25 (2003), and that "electronically printed receipts" provided criminals with "easy access to" credit and debit card information, S. REP. NO. 108-166, at 3 (2003). To lower the risk of identity theft, Congress enacted FACTA, which imposes a duty on persons accepting credit or debit cards for the transaction of business not to "print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of sale or transaction." 15 U.S.C. § 1681c(g)(1). A private party who receives a non-conforming receipt may sue for actual damages in a case of negligent noncompliance, id. § 1681 o (a), and for statutory damages (up to $1,000) and punitive damages in a case of willful noncompliance, id. § 1681n(a). Thus, "Congress decided to set the tolerable level of risk at printing the last five digits of a card number," Op. 1065-66 (quoting Muransky , 922 F.3d at 1188 ), and chose private lawsuits as its enforcement mechanism. Further, when Congress amended FACTA in 2008 to "limit[ ] abusive lawsuits that do not protect consumers," it left the truncation requirement and enforcement mechanism untouched. See Credit and Debit Card Receipt Clarification Act, Pub. L. No. 110-241, §§ 2(b), 3(a), 122 Stat. 1565 , 1566 (2008). The Supreme Court has long held that Congress has the power to "define injuries" and articulate "new rights of action that do not have clear analogs in our common law tradition." Steel Co. v. Citizens for a Better Env't , 523 U.S. 83 , 126 n.22, 118 S.Ct. 1003 , 140 L.Ed.2d 210 (O'Connor, J., concurring) (1998) (quoting Lujan , 504 U.S. at 580 , 112 S.Ct. 2130 (Kennedy, J., concurring)); see *1069 Zivotofsky ex rel. Ari Z. v. Sec'y of State , 444 F.3d 614 , 617-19 (D.C. Cir. 2006) ; see also William Baude, Standing in the Shadow of Congress , 2016 SUP. CT. REV. 197, 199-203 (2016). For example, the Court has recognized Congress's authority to create new rights that allow individuals to be free from competitive injury, Hardin v. Ky. Utils. Co. , 390 U.S. 1 , 6, 88 S.Ct. 651 , 19 L.Ed.2d 787 (1968) ; receive "truthful information considering the availability of housing," Havens Realty Corp. v. Coleman , 455 U.S. 363 , 373, 102 S.Ct. 1114 , 71 L.Ed.2d 214 (1982) ; and access a wide range of government documents, see, e.g. , Pub. Citizen v. U.S. Dep't of Justice , 491 U.S. 440 , 449, 109 S.Ct. 2558 , 105 L.Ed.2d 377 (1989). None of these cases involved an analogy to a common law harm. Instead, the Court has indicated that the violation of a private statutory right constitutes an injury-in-fact so long as the plaintiff alleges the type of harm against which the statute is meant to guard. See Havens , 455 U.S. at 373-74 , 102 S.Ct. 1114 ; Hardin , 390 U.S. at 5-7 , 88 S.Ct. 651 ; see also FEC v. Akins , 524 U.S. 11 , 20-22, 118 S.Ct. 1777 , 141 L.Ed.2d 10 (1998) ; Owner-Operator Indep. Drivers Ass'n, Inc. v. U.S. Dep't of Transp. , 879 F.3d 339 , 344-45 (D.C. Cir. 2018) ; Friends of Animals v. Jewell , 828 F.3d 989 , 992 (D.C. Cir. 2016). Spokeo did not overrule this line of precedent. See 136 S. Ct. at 1549-50 (citing Akins and Public Citizen with approval). On the one hand, the Court observed that in assessing concreteness it can be "instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts" because such an historical inquiry may shed light on the case-or-controversy requirement of Article III. Id. at 1549 (citing Vermont Agency of Nat. Res. v. United States ex rel. Stevens , 529 U.S. 765 , 775-77, 120 S.Ct. 1858 , 146 L.Ed.2d 836 (2000) ). At the same time, the Court reaffirmed Congress's "power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before." Id. (quoting Lujan , 504 U.S. at 580 , 112 S.Ct. 2130 (Kennedy, J., concurring)). Thus, while the Court indicated that "historical practice" can be evidence of what constitutes a concrete injury-in-fact, it did not suggest that every plaintiff who alleges her statutory rights have been violated must analogize her injury to a harm recognized at common law. See id. Here, it is unclear whether the proffered analogy between a FACTA violation and a breach of confidence supports Jeffries' claim of standing. In Spokeo , 136 S. Ct. at 1549 , the Court cited Vermont Agency , 529 U.S. at 775-77 , 120 S.Ct. 1858 , to illustrate how history can be "instructive." Vermont Agency involved a qui tam action; a private individual brought a False Claims Act suit against a state agency on behalf of the United States. Id. at 768-70 , 120 S.Ct. 1858 . The Court held that the individual had Article III standing, explaining that qui tam actions are "Cases" or "Controversies" within the meaning of Article III because they were "prevalent" in England and America "in the period immediately before and after the framing of the Constitution." Id. at 776-77 , 120 S.Ct. 1858 . That historical relationship was much more straightforward - and compelling - than Jeffries' view, accepted by this court, that the harm suffered by a FACTA plaintiff is analogous to the harm associated with a breach of confidence. See Pet'r's Br. 25-26; Op. 1064. The Third Circuit has concluded that the two harms differ in character because a breach of confidence requires disclosure to a third party but a FACTA violation does not. Kamal , 918 F.3d at 114 . The Eleventh Circuit disagrees, concluding that the harms have a "sufficiently close relationship" because each occurs when a defendant's mishandling of confidential information creates a heightened risk of future *1070 harm. Muransky , 922 F.3d at 1190-92 . The vagueness of the "close relationship" test leaves ample room for a court to reach either conclusion and therefore does little to advance the standing analysis here. Further, even if the breach-of-confidence analogy were persuasive, it would be unnecessary; Jeffries has "independently" shown that FACTA protects her concrete interests "based on Congress's judgment" that printing a full credit card number on a receipt creates a "heightened risk of identity theft." Id. at 1190 ; see id. at 1187 . It also bears mentioning that FACTA lawsuits do not implicate traditional separation-of-powers concerns. The Supreme Court has long held that "[t]he law of Article III standing ... serves to prevent the judicial process from being used to usurp the powers of the political branches." Town of Chester v. Laroe Estates, Inc. , --- U.S. ----, 137 S. Ct. 1645 , 1650, 198 L.Ed.2d 64 (2017) (quoting Clapper v. Amnesty Int'l USA , 568 U.S. 398 , 408, 133 S.Ct. 1138 , 185 L.Ed.2d 264 (2013) ); see, e.g. , Lujan , 504 U.S. at 573-78 , 112 S.Ct. 2130 . Standing doctrine preserves the separation of powers by limiting the circumstances in which "a private individual [may] invoke the judicial power to determine the validity of executive or legislative action." Id. at 575 , 112 S.Ct. 2130 (quoting Ex parte Lévitt , 302 U.S. 633 , 634, 58 S.Ct. 1 , 82 L.Ed. 493 (1937) ); see Zivotofsky , 444 F.3d at 618 . Separation-of-powers concerns are "generally absent," however, "when a private party seeks to enforce only his personal rights against another private party." Spokeo , 136 S. Ct. at 1551, 1553 (Thomas, J., concurring) (citing F. Andrew Hessick, Standing, Injury in Fact, and Private Rights , 93 CORNELL L. REV. 275, 317-321 (2008) ). Here, "Congress has created a private duty owed personally to [Jeffries] to protect [ her ] information," so Jeffries' allegation that Centerplate breached that duty "suffices for Article III injury in fact." Id. at 1554 . Far from preserving the separation of powers, Centerplate's contrary position invites the court to "substitute [its] judgment for Congress's" by holding that printing a receipt displaying a full credit card number and expiration date is harmless. See Muransky , 922 F.3d at 1188 . Finally, because the parties have not raised the issue and it is unnecessary to the resolution of this appeal, I would leave for another day the question whether "printing an expiration date on a receipt without more," in violation of FACTA, causes an Article III injury. Op. 1065-66; see Muransky , 922 F.3d at 1189 n.5. Footnotes [1] The named defendant is Volume Services America, LLC, which does business as Centerplate. The parties refer to the defendant as Centerplate and we follow suit. [2] There are other indirect harms attendant on a violation of FACTA's truncation requirement. The requirement relieves consumers of having to worry about the content of printed receipts and of having to safeguard or destroy receipts containing too much information. These additional harms, although not the focus of our inquiry, bolster Jeffries' assertion that FACTA protects a concrete interest. [3] We are not necessarily in full agreement with the Third Circuit, which takes the position that FACTA protects an interest in avoiding actual identity theft, rather than increased risk of identity theft. See Kamal , 918 F.3d at 115 ("[T]he FACTA provision at issue was part of Congress's effort to prevent the concrete harm of identity theft."). As noted earlier, we disagree with that determination because FACTA (1) does not prohibit identity theft, (2) imposes a truncation duty at the point of sale when identity theft cannot yet have occurred and (3) does not make liability contingent on a showing of actual harm. See supra at 1064. The distinction between risk of identity theft and actual identity theft as the relevant interest makes a difference in the concreteness inquiry. Where we have looked to see whether the alleged statutory violation increased Jeffries' risk of identity theft, the Third Circuit analyzed how close the plaintiff came to suffering actual identity theft, a more onerous burden.