PETRIS v. SPORTSMAN'S WAREHOUSE, INC.

IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF PENNSYLVANIA ADAM PETRIS, on behalf of himself and all others similarly situated, Plaintiff, Civil Action No. 2:23-cv-1867 Vv. Hon. William 8S. Stickman IV SPORTSMAN’S WAREHOUSE, INC. and SPORTSMAN’S WAREHOUSE HOLDINGS, INC., Defendants. OPINION WILLIAM S. STICKMAN IV, United States District Judge I. INTRODUCTION Plaintiff Adam Petris (“Petris”), on behalf of himself and all others similarly situated (the “Class Members”), brings this case against Defendants Sportsman’s Warehouse, Inc. and Sportsman’s Warehouse Holdings, Inc. (collectively, “Sportsman’s Warehouse”), which operate, control, and manage the website, sportsmans.com. (ECF No. 19, p. 1). Petris filed a First Amended Class Action Complaint (‘Amended Complaint”) on January 26, 2024, alleging that Sportsman’s Warehouse disclosed personal information related to consumers’ private gun purchases, including his own, to third parties in violation of Pennsylvania's Wiretapping and Electronic Surveillance Control Act (““WESCA”), 18 PA. STAT. AND CONS. STAT. ANN. § 5701 ef seq. (‘Count I’), and Uniform Firearms Act (“Firearms Act”), 18 PA. STAT. AND CONS. STAT. ANN. § 61114) (“Count IT”). (Ud. at pp. 21-24).! In turn, Sportsman’s Warehouse filed a Motion to Petris filed the initial Class Action Complaint on October 27, 2023. (ECF No. 1). Dismiss Plaintiff's First Amended Class Action Complaint (“Motion”) (ECF No. 21).? The Motion turns on the issue of whether Petris alleged a concrete harm, which is a requirement of Article HI standing. For the following reasons, the Court will deny Sportsman’s Warehouse’s Motion as to both Counts I and II. I. FACTUAL BACKGROUND Sportsman’s Warehouse Holdings, Inc. and its wholly owned subsidiary, Sportsman’s Warehouse, Inc., own and operate sportsmans.com, which sells sporting goods and firearms. (ECF No. 19, pp. 2-3). Petris purchased a Smith & Wesson M&P FPC 9mm Luger 16.25-inch Black Anodized Semi-Automatic Modern Sporting Rifle from sportsmans.com. (Ud. at p. 2). After purchasing his firearm, Petris alleges that Sportsman’s Warehouse, through sportsmans.com, assisted third parties, including Meta Platforms, Inc. (“Facebook”) and Listrak Inc. (“Listrak’’), with intercepting his communications, including those that contained personally identifiable information and protected information about the purchase of his firearm. (/d. at pp. 1, 3). According to Petris, the “Facebook Tracking Pixel” captures a user’s web activity on sites like sportsmans.com and sends a record of it back to Facebook. (Ud. at p. 5). Petris also claims that sportsmans.com hosts code for Listrak, which allows Listrak to intercept consumers’ electronic communications, including Petris’s. Ud. at p. 14). Petris’s lawsuit, however, is limited to the personally identifiable information that sportsmans.com disclosed to Facebook and Listrak without his consent after he purchased his firearm. (/d. at p. 3). * Sportsman’s Warehouse brings this Motion under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). Yet, Sportsman’s Warehouse advances no actual argument as to a Rule 12(b)(6)-related motion. Petris, in turn, only addresses Sportsman’s Warehouse’s Rule 12(b)(1) related arguments. Consequently, the Court will treat the Motion as seeking relief under Rule 12(b)(1). It denies Sportsman’s Warehouse’s Motion on Rule 12(b)(6) grounds. Petris claims that Sportsman’s Warehouse sent personally identifiable information, including his name, address, Facebook ID, and the type of firearm he purchased, via sportsmans.com to Facebook and Listrak. (Wd. at p. 24). Petris also alleges Sportsman’s Warehouse assisted with these interceptions without Petris’s knowledge, consent, or express written authorization. (Ud at p. 3). By failing to receive the requisite consent, Petris states Sportsman’s Warehouse breached confidentiality and unlawfully disclosed Petris’s personally identifiable information and protected information about his firearm purchase. (/d.). Petris brings this class action lawsuit seeking to represent a class of all Pennsylvania residents who have purchased guns from sportsmans.com. (/d. at p. 1). In turn, Sportsman’s Warehouse has moved to dismiss, arguing that Petris lacks standing under Article II to bring the Amended Complaint. (ECF No. 21). I. STANDARD OF REVIEW Under Rule 12(b)(1), a court must grant a motion to dismiss if there is a lack of subject matter jurisdiction. FED. R. Civ. P. 12(b)(1). A plaintiff bears the burden of persuasion that federal jurisdiction is present. Saint Vincent Health Ctr. y. Shalala, 937 F. Supp. 496, 501 (W.D. Pa. 1995) (citing Kehr Packages, Inc. v. Fidelcor, Inc., 926 F.2d 1406, 1409 (3d Cir. 1991)). The threshold to survive a motion to dismiss under Rule 12(b)(1) is lower than that under Rule 12(b)(6). Lunderstadt v. Colafella, 886 F.2d 66, 70 (3d Cir. 1989). This is because dismissal for lack of jurisdiction cannot be predicated on the mere probability that a plaintiffs legal theories are false; a court will only dismiss for a lack of jurisdiction if a plaintiff's legal theories (1) are solely proffered to obtain federal jurisdiction but otherwise are immaterial, or (2) are “insubstantial on their face.” Growth Horizons, Inc. y. Del. Cnty., Pa., 983 F.2d 1277 , 1280 Gd Cir. 1993) (quoting Bell v. Hood, 327 U.S. 678, 773, 776 (1946)). Standing is a jurisdictional requirement rooted in Article HI of the Constitution, which limits federal courts to resolving cases or controversies. U.S. Const. art. III, § 2. For there to be standing under Article III, plaintiffs must have a “personal stake” in the outcome of a given case. Baker y. Carr, 369 U.S. 186, 204 (1962). To show they have a personal stake, the party invoking federal jurisdiction must have “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (citation omitted). The party invoking federal jurisdiction here, the plaintiff, bears the burden of establishing each element. Jd. (citation omitted). An injury in fact is an “invasion of a legally protected interest which is (a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992) (citations omitted). Particularization and concreteness are quite different. “For an injury to be particularized, it must affect the plaintiff in a personal and individual way.” Spokeo, 578 U.S. at 339 (citations and internal quotation marks omitted). “[E]ven named plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong.” Id. at 338 n.6 (cleaned up). Accordingly, whether a suit may be a class action does not factor into a court’s standing analysis. While particularization is necessary to establish injury in fact, it is not sufficient. Jd. at 340. An injury in fact still must be real, and not abstract, or concrete. TransUnion LLC v. Ramirez, 594 U.S. 413, 424 (2021). In other words, it is concrete if it is de facto, meaning that it must actually exist. Spokeo, 578 U.S. at 340 (citation omitted). Yet, “concrete” is not synonymous with “tangible.” Jd. While tangible harms, such as physical and monetary harms, may more readily qualify as concrete injuries under Article III, intangible harms can also be concrete. TransUnion, 594 US. at 425. IV. ANALYSIS Sportsman’s Warehouse contends in its Motion that Petris does not have standing to bring his claims under WESCA and the Firearms Act because he does not plead any actual concrete and particularized injury. (ECF No. 22, p. 9). More specifically, it asserts that the Supreme Court’s precedent from Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) and TransUnion LLC v, Ramirez, 594 U.S. 314 (2021) directs the Court to find that Petris did not suffer a concrete harm because none of the information at issue constitutes highly sensitive personal information. (/d. at p. 11). In other words, Sportsman’s Warehouse avers that its alleged disclosure of Petris’s personal information to third parties did not constitute an injury under Article II]. (See id.). Petris counters that the Court can plausibly infer that he did suffer concrete harm, one closely related to two common-law torts, intrusion upon seclusion and public disclosure of private information. (ECF No. 24, p. 10). Before determining whether Petris has standing, the Court must examine the applicable law regarding Article II. The parties’ dispute primarily concerns the first element of standing—whether Petris has alleged that he suffered an injury in fact. In further distilling the parties’ dispute to its core, the Court is left with the question of whether Petris alleges a concrete harm. In five recent decisions, the United States Supreme Court and the United States Court of Appeals for the Third Circuit addressed the metaphysical quandary of what specifically constitutes an injury in fact in the context of electronic communications. The Court’s analysis begins with Spokeo. In that case, a consumer sued an online background check company under the Fair Credit Reporting Act (“FCRA”) after it allegedly reported inaccurate information about him to its customers. Spokeo, 578 U.S. at 333, 335-36 . The case made its way to the Supreme Court after the Ninth Circuit concluded the consumer satisfied the Article III standing injury-in-fact requirement due to his personal interests in handling his credit information and the alleged statutory violations created by the FCRA. Jd. at 336-37. Rather than address whether Congress can create a concrete injury in fact by authorizing a private right of action predicated on a bare statutory violation, the Supreme Court vacated the Ninth Circuit’s judgment and remanded the case. Id. at 343 . The Supreme Court held that the Ninth Circuit’s standing analysis was incomplete. /d. at 342. It observed that the Ninth Circuit had concentrated on the particularization of the consumer’s alleged injury without properly evaluating concreteness. /d. at 343. The Supreme Court ruled that the plaintiffs, including the consumer in the case, could not satisfy the requirements of Article II standing by alleging a bare procedural violation. Jd. at 342. It explained that “Congress’ [s] role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Jd. at 341. The Supreme Court, however, maintained that history and Congress still play critical roles in determining whether an intangible harm constitutes an injury in fact. Jd. at 340-41. In evaluating whether a harm qualifies as an injury in fact, Spokeo guides federal courts to inquire whether “an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Jd. at 341. Spokeo also directs federal courts to look at Congress’s judgment, as it has the power to “elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.” Id. (quoting Lujan, 504 U.S. at 578 ) (internal quotes omitted). In the wake of Spokeo, the Third Circuit confronted the issue of concreteness in the electronic communications context in Jn re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016) and In re Google Inc. Cookie Placement Consumer Privacy Litigation, 934 F.3d 316 (3d Cir. 2019). In Nickelodeon, the Third Circuit considered whether a concrete injury existed when a website operator informed users that it would not track the browsing and videowatching habits of children but then proceeded to compile their web activity with their account information to sell targeted advertising. Nickelodeon, 827 F.3d at 269 . Google similarly dealt with an internet company’s surreptitious capture and collection of web users’ personal information. There, web users claimed that an internet search engine collected private data regarding their personal internet browsing by circumventing their cookie blockers and attaching tracking cookies to their web browsers. Google, 934 F.3d at 321, 325 . In both cases, the Third Circuit applied the Spokeo framework as to concrete harm As the Third Circuit articulated in Nickelodeon, and reiterated in Google, the intangible harms resulting from the furtive capture of web users’ personal information are “concrete” as they involve “clear de facto injurfies], i.e., the unlawful disclosure[s] of legally protected information.” Nickelodeon, 827 F.3d at 274 ; see also Google, 934 F.3d at 325 . According to the Third Circuit, Spokeo’s instruction—to “consider whether an alleged injury-in-fact ‘has traditionally been regarded as providing a basis for a lawsuit’”—-supports both of those findings. Nickelodeon, 827 F.3d at 274 . It stated, [plrivacy torts have become “well-ensconced in the fabric of American law.” In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 638 (3d Cir. 2017). Indeed, as Justice Thomas has explained, private actions to remedy intrusions on the private sphere trace back to England, where a property owner needed only to show that another person placed a foot on his property to establish a traditional case or controversy. See Spokeo, 136 S. Ct. at 1551 (Thomas, J., concurring) (citing Entick v. Carrington, 2 Wils. K.B. 275, 291 (1765)). Likewise, “Congress has long provided plaintiffs with the right to seek redress for unauthorized disclosures of information that, in Congress's judgment, ought to remain private.” Nickelodeon, 827 F.3d at 274 . In an era when millions of Americans conduct their affairs increasingly through electronic devices, the assertion ... that federal courts are powerless to provide a remedy when an internet company surreptitiously collects private data [] is untenable. Nothing in Spokeo or any other Supreme Court decision suggests otherwise. Google, 934 F.3d at 325 (emphases added). The Supreme Court later revisited its Spokeo decision in TransUnion to provide clarity on the type of concrete harm needed to establish Article II] standing. Like Spokeo, TransUnion involved a federal class action complaint brought under the FCRA, which creates a cause of action for consumers to sue and recover damages for certain violations. TransUnion, 594 U.S. at 421 . In the case, a credit reporting agency allegedly placed an inaccurate alert on some of its consumers’ credit reports indicating that the consumer’s name was a potential match to a name on the U.S. Treasury Department’s Office of Foreign Assets Control’s (“OFAC”) terrorist and narcotics trafficker list. Jd. at 420-21. Consequently, 8,185 consumers with OFAC alerts in their credit files sued the credit reporting agency for failing to use reasonable procedures to ensure the accuracy of their files. Jd at 421. Prior to trial, however, the parties stipulated that only 1,853 of those consumers had their misleading credit reports shared with third parties. /d. The Supreme Court began by reinforcing the notion that, although harder to discern, intangible harms can qualify as concrete injuries under Article III, especially ones traditionally recognized, such as “reputational harms, disclosure of private information, and intrusion upon seclusion.” Jd. at 425 (citation omitted). It also emphasized that Congress may not enact an injury into existence (that otherwise would not exist). Jd. at 426 (citation omitted). While “Congress’s views may be instructive,” TransUnion bolstered the Spokeo principle that “Article IH standing requires a concrete injury even in the context of a statutory violation.” Jd. at 425, 426 (citation and internal quotation marks omitted). TransUnion then expounded upon Spokeo’s standard in applying these principles of the facts of the case. In TransUnion, the Supreme Court found that the 1,853 consumers whose inaccurate credit reports had been disseminated to third parties were personally harmed and thus suffered a concrete reputational harm akin to the tort of definition. /d. at p. 433. After holding that plaintiffs’ asserted harm has a “close relationship” to the traditionally recognized reputational harm of defamation, the Supreme Court reasoned that “[t]he harm from being labeled a ‘potential terrorist’ bears a close relationship to the harm from being labeled a ‘terrorist.’” Jd. However, it held that the remaining 6,332 consumers whose credit reports had not been shared with third parties did not demonstrate an intangible concrete harm since their alleged inaccurate credit reports were never disseminated to third parties. Jd. at 439. The Supreme Court explained that no historical or common-law analog supports the proposition that “the mere existence of inaccurate information, absent dissemination, amounts to concrete injury.” /d. at 434 (citation and internal quotation marks omitted). In other words, the Anglo-American legal tradition has never recognized an actionable harm with respect to or arising out of the failure to keep accurate records in good order. In conferring standing to 1,853 consumers whose reports had been transmitted to third parties but not the others, the Supreme Court did not create such a high bar to Article III that it precludes causes of action for statutory violations where harm is: (1) clearly defined by the statute and (2) conceptually analogous to recognized harms. TransUnion instead curtailed the statutory broadening of injuries that may be alleged to support a claim for standing. It instructs federal courts to filter out litigants who assert intangible harms derived from bare procedural violations that are not “remotely harmful” in a traditional sense. In the Court’s view, neither Trans Union nor Spokeo prevents Congress from legislating enforceable statutory rights where the nature of the harm, not the remedy, is akin to one traditionally recognized by the law. Nor does TransUnion abrogate Nickelodeon or Google. Both Third Circuit decisions postdate Spokeo, the precedent TransUnion primarily relied on. The facts are largely congruent as well. The litigants of all three cases—-TransUnion, Google, Nickelodeon—were all found to have standing after they were allegedly personally harmed, whether it be the furtive capture or surreptitious disclosure of their personal information. While TransUnion can be differentiated from Nickelodeon or Google by the nature of the harm at issue, all three cases deal with traditionally recognized harms. Guided by TransUnion, Spokeo, Nickelodeon, and Google, the Court will evaluate whether Petris’s alleged intangible harm is merely procedural or concrete. Petris claims that he has standing because his injury “bears a close relationship to two common-law torts: intrusion upon seclusion and the public disclosure of private information.” (ECF No. 24, p. 10). In response, Sportsman’s Warehouse argues both analogies fail. (ECF No. 25, pp. 6). First, Sportsman’s Warehouse argues that the public disclosure of private information more appropriately matches the type of harm alleged rather than an intrusion upon seclusion. (/d.). Second, Sportsman’s Warehouse claims that, even if intrusion upon seclusion were the correct analog, Petris has failed to plead a key element of the tort, a highly offensive act. (/d. at p. 8). Third, Sportsman’s Warehouse contends that public disclosure of private information analog fails because Petris did not plead the necessary “publicity” element. (/d. at p. 16). From Sportsman’s Warehouse’s perspective, the alleged disclosure of Petris’s name, address, Facebook ID, and the type of firearm that he purchased is not a sufficiently concrete injury because the information allegedly disclosed does not constitute highly sensitive personal information, such as medical diagnosis information or financial data from banks or credit cards. (ECF No. 22, pp. 10-11). The Court disagrees with both parties. First, the Court finds that Sportsman’s Warehouse is misguided because at least some of the information Petris alleged was intercepted and shared — 10 — with third parties amounts to a clear de facto injury. A “de facto injury, 7.e., the unlawful disclosure of legally protected information,” is enough to confer standing. Nickelodeon, 827 F.3d at 274 . Here, the Firearms Act explicitly prohibits the disclosure of information furnished by purchasers in firearm transactions. See 18 PA. STAT. AND Cons. STAT. ANN. § 6111G) (AIL information provided by the potential purchaser, transferee or applicant, including, but not limited to, the potential purchaser, transferee or applicant's name or identity, furnished by a potential purchaser or transferee under this section ... shall be confidential and not subject to public disclosure.”). Additionally, the information at issue is personally identifiable. If true, Petris’s name, address, Facebook ID, and other information are all now connected to the firearm he purchased and shared with two prominent social media and digital marketing platforms. Under these circumstances, the Court can plausibly infer that Petris suffered a concrete harm. Second, the Court holds that Petris’s purported harms are more analogous to the right to privacy in communications embodied in the common law and WESCA than the two common-law torts he posits. The common law right to privacy has its roots in the long-established recognition that citizens have a protectable interest in their private information and in the sanctity of their communications that may not be disseminated to third parties without their knowledge and consent.? Originally ingrained into the common law, the right to privacy as to wiretapping has largely been supplanted by federal and state statutes, like the Federal Wiretap Act, 18 U.S.C. §§ > “Ravesdropping is indictable at the common law, not only in England but in our states. It is seldom brought to the attention of the courts, and our books contain too few decisions upon it to enable an author to define it with confidence ...._ It never occupied much space in the law, and it has nearly faded from the legal horizon.” 1 BISHOP, COMMENTARIES ON THE CRIMINAL LAW, 670 (1882). — 11 — 2510-2522, and its state analog, WESCA.’ Like the common law, WESCA protects the privacy rights of individuals. See Commonwealth v. Spangler, 809 A.2d 234, 237 (Pa. 2002). Specifically, WESCA guards these privacy rights by regulating the interception and disclosure of wire, electronic, and oral communications. See 18 PA. STAT. AND CONS. STAT. ANN. § 5703. It is critical to note that both Spokeo and TransUnion look to whether a statutory cause of action bears a “close relationship fo a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Spokeo, 578 U.S. at 341 (emphasis added); see also TransUnion, 594 U.S. at 440 (citation omitted). The focus of the analysis for Article JI purposes is the harm, not the cause of action or the remedy. In other words, neither Spokeo nor TransUnion can be read to preclude the creation of a cause of action for a statutory violation that seeks redress for an injury that is analogous to one for which Anglo-American courts have traditionally provided an avenue for relief. It is not necessary, as Sportsman’s Warehouse argues here, for a plaintiff asserting such a claim to plead or establish the elements of a traditional cause of action, but rather, only that an analogous harm exists. By way of example, a legislature may enact a consumer protection statute that provides redress for harm that is of a similar nature to the common law tort of fraud. The legislature may designate the elements of the statutory cause of action and even provide for a different measure of damages. A plaintiff will have standing, consistent with Article ID, to maintain a suit in federal court under the statutory consumer protection without regard to whether he could establish the traditional common law elements of 1918, Congress enacted the first federal wiretap statute to prevent the disclosure of government secrets during World War I. CHARLES DOYLE, CONG. RSCH. SERV., R41733, PRIVACY: AN OVERVIEW OF THE ELECTRONIC COMMUNICATIONS PRIVACY AcT 2. (2012), https://crsreports.congress.gov/product/pdf/R/R41733/9. Later in 1927, it prohibited the |. interception and disclosure of private radio messages. Jd. By 1928, “at least forty-one of the fortyeight states had banned wiretapping or forbidden telephone and telegraph employees and officers from disclosing the content of telephone or telegraph messages or both.” Jd. — 12 — fraud provided that the injury is analogous. In other words, neither Spokeo nor TransUnion can be read for the proposition that a federal court cannot entertain a cause of action for a statutory violation provided that the cause of action aims to redress a harm that is analogous to a traditionally recognized injury. Both the common law right to privacy and a cause of action under WESCA address the same interest: a person’s control of private information concerning his or her private information. See U.S. Dep’t of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 763 (1989). WECSA grants a statutory cause of action to “[alny person whose wire, electronic or oral communication is intercepted, disclosed or used in violation of [the statute]” against “any person who intercepts, discloses or uses or procures any other person to intercept, disclose or use, such communication.” 18 PA. STAT. AND CONS. STAT. ANN. § 5725(a). A person also has an actionable right under the common law to be free from an invasion of their right to privacy. However, “the extent of the protection accorded [to] a privacy right at common law rested in part on the degree of dissemination of the allegedly private fact and the extent to which the passage of time rendered it private.” Reporters Comm., 489 U.S. at 763 . Where a record is not open to public inspection, such as one’s tax returns, “it is not public and there is an invasion of privacy when it is made so.” Id. at 763 n.15 (citing Restatement (Second) of Torts § 652D (Am. L. Inst. 1977)). In the instant case, Petris has adequately alleged a harm to his privacy interests. The common-law right of privacy and WESCA give Petris the right to control the flow of information concerning his person, which includes his firearm purchase. As alleged, Sportsman’s Warehouse surreptitiously disclosed Petris’s personal information related to his firearm purchase, which is not information “open to public inspection,” to third parties without his consent. Such information is — 13 — prohibited from being amassed. See 18 U.S.C. § 926 .° Additionally, the disclosure amounted to a high degree of dissemination as it reportedly shared Petris’s personal information with social media and digital marketing services. With that level of dissemination, Petris has sufficiently alleged that he was personally harmed as he did not have a meaningful opportunity to control the unauthorized dissemination of his firearm purchase. Accordingly, as pled, Petris purportedly suffered a harm with a close relationship to the harm associated with the historically recognized right to privacy. As TransUnion dictates, Congress’s judgment on such matters is also “instructive.” TransUnion, 594 U.S. at 425 . Yet, legislative judgment does not alter the Court’s application of the TransUnion standard of concrete harm. On this exact issue, the Third Circuit has noted that “Congress has long provided plaintiffs with the right to seek redress for unauthorized disclosures of information that, in Congress’s judgment, ought to remain private.” Nickelodeon, 827 F.3d at 274 (citations omitted). As to firearm sales, Congress has shielded such information from the public. Since 1986, federal law has prohibited a database containing gun registration information or gun permit holders from being maintained. See 18 U.S.C. § 926 . The Firearms Owners’ Protection Act of 1986 (“FOPA”) is a direct reflection of Congress’s judgment to keep information related to firearm purchases private. With Congress’s judgment viewed as instructive by TransUnion, it is evident to the Court that, if true, Petris’s alleged harm is sufficiently concrete. > Section 6 of FOPA amended § 926 to prohibit a registry of firearms, firearms owners, or firearms transactions. The pertinent language of § 926 reads: No such rule or regulation prescribed after the date of the enactment of the Firearms Owners' Protection Act may require that records required to be maintained under this chapter or any portion of the contents of such records, be recorded at or transferred to a facility owned, managed, or controlled by the United States or any State or any political subdivision thereof, nor that any system of registration of firearms, firearms owners, or firearms transactions or dispositions be established. — 14 — As to Sportsman’s Warehouse’s contention that Petris’s alleged harm cannot be concrete because none of the information related to the firearm purchase constitutes highly sensitive personal information, the Court disagrees. (ECF No. 22, p. 10). As explained above, there are other kinds of privacy rights at issue in this case besides the public disclosure of private information and intrusion upon seclusion. Here, Petris’s right to privacy embraces his ability to control the information that concerns him. It does not require that the information amount to highly sensitive personal information. The common law traditionally extended protection to a record that was not open to public inspection. See Reporters Comm. at 763. Even if the common law necessitated that the information shared amounted to highly sensitive personal information, FOPA suggests that Congress may view information related to a firearm purchase as private. Finally, Petris must also meet the particularization requirement for his alleged harm to qualify as an injury in fact. Concreteness alone is not enough. Spokeo, 578 U.S. at 339-40 . Petris’s purported injury, however, is particularized, as his Amended Complaint relates to the capture and disclosure of his protected personal information to third parties. (See ECF No. 19, p. 3). These specific allegations described in the Amended Complaint show that Petris properly alleges that he has been personally injured. With the concreteness and particularization requirements met, Petris has sufficiently established standing by alleging an invasion of the historically recognized right to privacy. As such, Petris overcomes Sportsman’s Warehouse’s 12(b)(1) Motion as to his privacy claims under WESCA and the Firearms Act. — 15 — V. CONCLUSION For these reasons, Sportsman’s Warehouse’s Motion will be denied as to Counts [ and I. An Order of Court will follow. BY THE COURT: > C Cog pepe3r : □ fi — x A Asel anc WILLIAM S. STICKMAN IV G&-3- 24 UNITED STATES DISTRICT JUDGE Dated — 16 —