Cruper-Weinmann v. Paris Baguette America, Inc.

OPINION AND ORDER . JED S. RAKOFF, United States District Judge. To bring any lawsuit, a plaintiff must have constitutional “standing” to do so, which means, among other things, that the plaintiff must have suffered a concrete injury in fact as a result of the defendant’s conduct. The plaintiff here, on the face of her own complaint, lacks such standing. Plaintiff Devorah Cruper-Weinmann, individually and on behalf of those similarly situated, initiated this putative class action against defendant Paris Baguette America, Inc. (“Paris Baguette”) on October 3, 2013. She alleged that defendant willfully violated the Fair and Accurate Credit Transactions Act of 2003 (“FACTA”), Pub. L. No. 108-159,117 Stat. 1952 (codified as amended in 15 U.S.C. § 1681e(g)), by providing her with a receipt that contained the expiration date of her credit card, and she sought statutory and punitive damages as prescribed for willful violations under the Act, as well as costs and reasonable attorneys’ fees. Defendant subsequently moved to dismiss the Complaint under Federal Rule of Civil Procedure 12(b)(6), and, on January 16, 2014, this Court granted the motion, on the ground that plaintiff could not plausibly plead that defendant’s alleged violation was willful. Plaintiff appealed the dismissal of the Complaint. After the Court of Appeals heard oral argument but before it had rendered a decision, the Supreme Court decided Spokeo, Inc. v. Robins, — U.S. -, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016), which addressed the standard for pleading an injury in fact for the purposes of Article III standing when the alleged injury arises from the violation of a statutory requirement. In light of Spokeo, the Second Circuit remanded the case “to allow plaintiff[] an opportunity to replead [her] claims to comport with the pleading standards set forth in Spokeo, and to allow the district court[ ] to address any standing questions in the first instance.” Cruper-Weinmann v. Paris Baguette, Inc., 653 Fed.Appx. 81, 82 (2d Cir. 2016) (summary order). Plaintiff accordingly filed an Amended Complaint; defendant filed a motion to dismiss the Amended Complaint under Federal Rule of Civil Procedure 12(b)(1) and (6); and the parties were instructed to submit briefing that addressed whether, under Spokeo, plaintiff had now adequately alleged that she suffered a “concrete” injury, a requirement for Article III standing. Having reviewed the parties’ submissions, including supplemental authority consisting of recently decided cases that analyze whether plaintiffs have standing to bring claims for violations of FACTA’s requirements, the Court concludes that plaintiff lacks standing and dismisses the Amended Complaint. Congress enacted FACTA, which amended the Fair Credit Reporting Act of 1970 (“FCRA”), with the purpose of preventing identity theft facilitated by information on discarded credit card receipts. In relevant part, FACTA requires businesses that accept credit and debit cards to redact on customers’ receipts all but the last five digits of the credit card number, as well as the expiration date. 15 U.S.C. § 1681c(g)(1). In 2007, FACTA was amended in order to provide a retrospective safe harbor to persons who had previously printed an expiration date on a receipt but otherwise complied with FAC-TA’s requirements. Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. [573] No. 110-241, 122 Stat. 1565. That amendment contained Congress’s finding that “[e]xperts in the field agree that proper truncation of the card number, by itself as required by [FACTA], regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud.” § 2(a)(6). Despite that finding, FACTA’s redaction requirements remained unchanged going forward. In the Amended Complaint, Plaintiff alleges that on September 19, 2013, she ate at Paris Baguette’s location on West 32nd Street in Manhattan, paid for her meal with a credit card, and received an electronically printed receipt that displayed the expiration date of her card. Am. Compl. ¶ 16, ECF No. 40. She does not allege that she suffered identity theft as a result of the printing of the receipt, or that anyone else ever saw or accessed the receipt. The doctrine of standing, rooted in Article Ill’s restriction of, the judicial power to adjudicating cases or controversies, limits the categories of litigants that may maintain a lawsuit in federal court. The Supreme Court has established that that “the irreducible constitutional minimum of standing contains three elements.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). “The .plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, 136 S.Ct. at 1547. An injury in fact, in turn, must be “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.” Lujan, 504 U.S. at 560, 112 S.Ct. 2130 (internal quotation marks omitted). The question here is whether plaintiff has sufficiently pleaded that she suffered an injury in fact by merely alleging that she received a receipt containing her card’s expiration date in violation of FACTA. In Spokeo, the Supreme Court discussed the requirement of “concreteness.” Robins, the plaintiff in that case, had alleged that defendant Spokeo, Inc., a “people search engine,” collected inaccurate personal information about him and disseminated that information on the internet, in violation of FCRA, which is designed to ensure “fair and accurate credit reporting” by regulating consumer reports that contain certain types of personal information. Spokeo, 136 S.Ct. at 1544-45. The Supreme Court, finding that the decision below had elided the concreteness and particularization prongs of the injury-in-fact analysis and thereby neglected to address whether Robins’ alleged injury was sufficiently concrete, vacated the decision and remanded the case so that the Ninth Circuit Court of Appeals could determine “whether the particular procedural violations alleged in this case entail a degree of risk sufficient to meet the concreteness requirement.” Id at 1550. While the Supreme Court did not decide whether Robins adequately alleged an injury in fact, it did set out principles that inform such a determination. “A concrete injury must be ’de facto,”’ which means it “must actually exist,” and it must be “real” rather than “abstract.” Id. at 1548. However,, intangible injuries may still qualify as concrete. Id. at 1549. Of particular relevance .here is the Court’s discussion of Congress’s ability to “identify[ ] and elevat[e] intangible harms” such that allegations of those harms meet the injury-in-fact requirement. Id (citing Lujan, 504 U.S. at 578, 112 S.Ct. 2130). It is not the case “that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Id. [574] Thus, the. allegation of a “bare procedural violation” of - a statutory directive, on its own, does not establish an injury in fact. Id. Nonetheless, “the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact,” which means “a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified.” Id. (emphasis in original). Spokeo provides as examples two cases in which the violations of procedures required by Congress were, on their own, sufficient to establish injury in fact, each of •which held that the inability to obtain information that was subject to disclosure constituted, an injury sufficient for standing purposes. See Federal Election Comm’n v. Akins, 524 U.S. 11, 118 S.Ct. 1777, 141 L.Ed.2d 10 (1998); Public Citizen v. Dep’t of Justice, 491 U.S. 440, 109 S.Ct. 2558, 105 L.Ed.2d 377 (1989). It also points out two hypothetical procedural violations of FCRA that would not be sufficient: the failure to provide a user with a required disclosure when the information provided to the user happens to be entirely accurate, and the dissemination of an incorrect zip code. Spokeo, 136 S.Ct. at 1550. The Court of Appeals for the Second Circuit recently had occasion to interpret the standard set out in Spokeo. In Strubel v. Comenity Bank, the plaintiff, Strubel, alleged four violations of the Truth in Lending Act (“TILA”) based on the defendant’s failure to make certain required disclosures in the credit card agreement that it provided, and the defendant argued that Strubel failed to demonstrate that the violations caused her concrete injuries. 842 F.3d 181 (2d Cir. 2016).1 The Court of Appeals formulated the rule implied in Spokeo as follows: “an alleged procedural violation can by itself manifest concrete injury where Congress conferred the procedural right to protect a plaintiffs concrete interests and where the procedural violation presents a risk of real harm to that concrete-interest.” Id. at 190 (internal quotation marks omitted). Applying that test, the Court of Appeals found that Stru-bel had satisfied the injury-in-fact requirement with regard to two of the four alleged violations. The defendant’s failure to disclose two aspects of the plaintiffs obligations under the credit card agreement necessarily threatened the plaintiffs interest in the “informed use of.credit,’’.which TILA’s requirements were, designed .to protect, since a consumer cannot use credit in an informed way if she is unaware of the obligations she must fulfill in order to exercise her rights under the agreement. Id. However, the failure to disclose the plaintiffs obligations with regard to a payment plan that was never available to plaintiff could not affect her use of credit, nor could the failure to disclose the defendant’s obligation to make certain reports affect such use in the absence of additional violations, and therefore those two failures of disclosure, despite violating the requirements of TILA, did not give rise to concrete injuries. Id. at 191-94. Thus, following Spokeo and Stru-bel, to determine whether a procedural violation alone constitutes an injury in fact, a court must inquire (1) whether Congress conferred the procedural right at issue in order to protect a concrete interest of the plaintiff, and (2) whether the violation of the procedure at issue presented a material risk of harm to that interest. A plaintiff may fail to satisfy the sécond condition when the violation in question could not result in harm to the interest protected by statute either as a general matter, see [575] Spokeo, 136 S.Ct. at 1550 (“It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work ■any concrete harm.’’)» or under the particular circumstances alleged, see Strubel, 842 F.3d at 191-92. Paris Baguette contends that the alleged violation in this case was merely procedural, divorced from any allegation of harm to the interests that Congress in enacting PACTA sought to protect, viz., the prevention of actual identity theft by means of a third party obtaining a credit card receipt. Moreover, it argues that such a violation could not possibly put plaintiff at risk of harm according to Congress’s own finding, made when it amended FAC-TA, that the redaction of the credit card number alone, with or with or without redaction of the expiration date, is sufficient to eliminate the risk of identity theft. Defendant is correct that plaintiff has failed to allege facts demonstrating that the violation in question put her at an increased risk of identity theft. The Amended Complaint’s spare account of the circumstances in which plaintiff received an improperly redacted receipt does not include any allegation that any third party ever saw or accessed the receipt. Under those circumstances, it is' not apparent how the presence of the full expiration date of her credit card on that receipt might have threatened the security of her identity. Therefore, it is not the case that “the procedural violation present[ed] a risk of real harm to [plaintiffs] concrete interest” in protecting her identity. Strubel, 842 F.3d at 190. Having failed to satisfy that element of the test set out' in Strubel, plaintiff lacks . standing to assert her claim.2 This conclusion finds support in several cases that have addressed plaintiffs’ standing to bring claims for FACTA violations following the Spokeo decision. The Seventh Circuit recently held that a plaintiff who had received a receipt that contained the expiration date of his card had no standing because the allegations did riot show that the plaintiff suffered any actual harm, nor that the FACTA violation gave rise to any risk of harm, since the plaintiff “discovered the violation immediately and nobody else ever saw the non-compliáht receipt. In these circumstances, it is hard to imagine how the expiration date’s presence could have increased the risk that [plaintiffs] identity would be compromised.” Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016); see also Stelmachers v. Verifone Sys., No. 5:14-cv-4912-EJD, 2016 WL 6835084, at *4 (N.D. Cal. Nov. 21, 2016)(holding that plaintiff who received receipt displaying more .than the last five digits of his card number had no standing because, given that only he had seen the. receipt, the risk of identity theft was too. speculative to constitute a certainly impending harm); Kamal v. J. Crew Group, Inc., No. 2:15-cv-190(WJM), 2016 WL 6133827, at 3 (D.N.J. Oct. 20, 2016) (holding that plaintiff who received receipt displaying the first six and last four digits of his card number had no standing because the allegations did not demonstrate an actual or. imminent risk, given that only plaintiff accessed the receipt); Thompson v. Rally House of Kansas City et al., 15-cv-00886-GAF, 2016 U.S. [576] Dist. LEXIS 146146, at *12-14 (W.D. Mo. Oct. 6, 2016) (same).3 Plaintiff resists this conclusion by arguing that the alleged violation categorically poses a risk to the interests FACTA was designed to protect. She argues that the redaction requirements are closely tied to FACTA’s goal of reducing the risk of identity theft, and that their violation in itself raises that risk, thereby inflicting a concrete harm on the consumer whose card information was improperly redacted. While a statutory violation that leads to an increased risk of real harm may constitute a concrete injury in some cases, see Spokeo, 136 S.Ct. at 1549, Strubel makes clear that there still must be some showing that the violation of the right actually threatened the harm in question if the plaintiff is to have standing. Were plaintiffs position correct, the second part of Strubel’s test would mean little, since it would always be satisfied when applied to a requirement intended to reduce the risk of harm in some circumstances, even if there were no risk under the circumstances alleged. Yet that cannot be the case: as noted above, Strub'el denied that the failure to disclose a consumer’s obligation under a certain payment plan, even though a violation of a requirement intended to protect a consumer’s informed use of credit, threatened the consumer’s interests, since, under the circumstances alleged, there was no such plan available to the consumer and therefore no risk to her use of credit in that regard. Taking another tack, plaintiff also asserts that FACTA grants consumers a “substantive procedural right” to receive a redacted copy of their credit card receipts, such that they automatically sustain an injury in fact from any violation of the redaction requirements. Plaintiff explains that a right conferred by statute is substantive when its violation “goes to the very core of the statute’s purpose.” Pl.’s Br. 16.4 Again, though, while the connec [577] tion between the purpose of the statute and the harm threatened by a statutory violation is a necessary condition for a plaintiff to have standing based on the violation, it is not a sufficient condition under Strubel. Finally, plaintiff contends that FACTA’s redaction requirements vindicate a traditionally recognized privacy interest, whose historical pedigree may weigh in favor of finding a basis for standing according to Spokeo. See 136 S.Ct. at 1549. However, plaintiff does not establish that Congress, in enacting FACTA, aimed to protect consumers’ privacy rights, as opposed to the security of their identities. Accordingly, the Court hereby grants defendant’s motion to dismiss and directs entry of final judgment dismissing plaintiffs claims with prejudice. SO ORDERED. Footnotes [1] Strubel was decided after the briefing on the instant motion was complete, but the decision was submitted by plaintiff, on consent, as supplemental authority. [2] Because the Court finds that, on the circumstances alleged here, the alleged violation did not pose a risk of harm, sufficient to satisfy the concreteness requirement, the Court need not reach Paris Baguette's argument—based on Congress’s finding when it amended FACTA in 2007 that redaction of the credit card number alone is sufficient to thwart identity theft— that failures to redact the .card expiration date categorically do not subject consumers to an increased risk of identity theft. [3] Courts addressing the issue have not been unanimous, as some post-Spokeo decisions have held that procedural violations of FAC-TA’s requirements give rise to standing because Congress, in enacting FACTA, intended to confer a substantive right to have one’s credit card information properly redacted. See Wood v. J Choo USA, 201 F.Supp.3d 1332, 1340, 2016 WL 4249953, at *6 (S.D. Fla. 2016); Guarisma v. Microsoft, 209 F.Supp.3d 1261, 1265-67, 2016 WL 4017196, at *4 (S.D. Fla. 2016); Altman v. White House Black Mkt., Inc., No. 15-cv-2451-SCJ, 2016 WL 3946780, at *4-6 (N.D. Ga. July 13, 2016) (same). However, there is reason to question those cases' basis for concluding that FACTA confers such a substantive right. Altman and Guarisma each rely in part on Hammer v. Sam's E., Inc., 754 F.3d 492 (8th Cir. 2014), a pre-Spokeo decision holding that FACTA violations in themselves give rise to standing; but the Eighth Circuit subsequently recognized that Hammer was abrogated by Spokeo. See Braitberg v. Charter Communications, Inc., 836 F.3d 925, 930 (8th Cir. 2016). Altman and Guarisma also rely on an unpublished decision by the Eleventh Circuit, Church v. Accretive Health, Inc., 654 Fed.Appx. 990 (11th Cir. 2016) (per curiam), which held that the FDCPA conferred a substantive right to receive certain disclosures, yet neither case explains why FDCPA and FACTA violations should be treated the same for standing purposes. Wood provides no additional support, as it relies entirely on the reasoning of Guar-isma and Altman. [4] Rendered in fuller detail, plaintiff's theory is that "Congress enjoys the authority to grant substantive procedural rights as a means of deterring conduct that causes risk-based harm that is difficult to trace or quantify, and that the violation of such rights causes an injury in fact for Article III purposes.” Pl.’s Br. 18. In support of this claim, plaintiff cites Donoghue v. Bulldog Investors General Partnership, which held that a shareholder had standing to bring a derivative action for disgorgement of defendant's short-swing trading profits under Section 16(b) of the Securities Exchange Act, 15 U.S.C. § 78p (b), despite defendant’s argument that plaintiff had suffered no injury in fact from the trading. 696 F.3d 170 (2d Cir. 2012). Plaintiff here at [577] tempts to analogize the function of that statute, which used a flat rule to deter difficult-to-detect insider trading, with FACTA’s redaction requirements. However, FACTA provides no analogue for § 16(b)’s grant to the issuer of a “right to profits ... deriving] from breach of a fiduciary duty created by the statute in favor of the issuer,” Id. at 178.