Coleman v. Exxon Mobil Corporation et al

Filing 26

MEMORANDUM AND ORDER: IT IS HEREBY ORDERED that defendants motion to dismiss (#16) is GRANTED. Signed by District Judge Stephen N. Limbaugh, Jr on 4/13/2018. (JMC)

UNITED STATES DISTRICT COURT
EASTERN DISTRICT OF MISSOURI
SOUTHEASTERN DIVISION
MICHAEL COLEMAN, on behalf of
himself and others similarly situated,
Plaintiff,
v.
EXXON MOBIL CORPORATION,
REEVES BOOMLAND, INC., and
BI-STATE SOUTHERN OIL
COMPANY
Defendants.

)
)
)
)
)
)
)
)
)
)
)
)
)

Case No. 1:17-CV-119-SNLJ

MEMORANDUM AND ORDER
“Is receiving an overly revealing credit card receipt—unseen by others and unused
by identity thieves—a sufficient injury to confer Article III standing?” Bassett v. ABM
Parking Servs., Inc., 883 F.3d 776, 777 (9th Cir. 2018). Under the facts of this case, it is
not.
Plaintiff alleges defendants violated the Fair and Accurate Credit Transactions Act
(“the Act”) by printing the first six digits of his credit card on the receipts they provided
after he purchased gas. Defendants claim plaintiff does not have standing and have
moved to dismiss (#16). Because plaintiff failed to allege a concrete injury, the motion
will be granted.
I.

Factual Background
Plaintiff alleges he got gas at one of the defendants’ locations several times during

the summer of 2017. Each time, after processing plaintiff’s credit card, defendants
1

provided a printed receipt that listed the first six and last four digits of plaintiff’s sixteendigit credit card number. Plaintiff alleges defendants “willfully” violated the Act, which
prohibits defendants from printing more than the last five digits of plaintiff’s credit card
number on any receipt provided at the point of sale.
“On occasion, . . . [p]laintiff believes he has forgotten to pull his receipt out of the
machine, leaving it hanging in public view.” (#1 at 8, ¶ 58.) “At other times, . . .
[p]laintiff believes he has thrown his receipt in the trash next to the pump.” (#1 at 8, ¶
59.) He does not allege anyone tried stealing his identity by using the information on his
receipts. In fact, he does not allege anyone even saw the receipts, let alone the ten digits
of his credit card number. Instead, plaintiff alleges the defendants caused him to “suffer
a heightened risk of identity theft, and potentially exposed [his] private information to
third parties who may have come into contact with those receipts.” (#1 at 11–12, ¶ 84)
(emphases added). As such, he seeks statutory and punitive damages.
II.

Legal Standard
Under Rule 12(b)(1) of the Federal Rules of Civil Procedure, a court must dismiss

a complaint if it lacks subject-matter jurisdiction. Arbaugh v. Y&H Corp., 546 U.S. 500,
514 (2006). At the motion-to-dismiss stage, the Court must “accept the allegations
contained in the complaint as true and draw all reasonable inferences in favor of the
nonmoving party.” Cole v. Homier Dist. Co., 599 F.3d 856, 861 (8th Cir. 2010) (quoting
Coons v. Mineta, 410 F.3d 1036, 1039 (8th Cir. 2005)).
III.

Discussion

2

The Act. Congress passed the Act, an amendment to the Fair Credit Reporting
Act, to curb identity theft by reducing the personal information printed on credit and
debit card receipts. Fair & Accurate Credit Transactions Act of 2003, Pub. L. No. 108–
159, 117 Stat. 1952 (Dec. 4, 2003) (codified at 15 U.S.C. §§ 1681–1681x). The Act
provides “no person that accepts credit cards or debit cards for the transaction of business
shall print more than the last 5 digits of the card number or the expiration date upon any
receipt provided to the cardholder at the point of the sale or transaction.” 15 U.S.C. §
1681c(g)(1). A plaintiff may recover actual damages resulting from a negligent violation,
id. § 1681o(a), or actual, statutory, and punitive damages for a willful violation, id. §
1681n(a).
After the Act’s compliance deadline, consumers filed “hundreds of lawsuits”
alleging merchants that failed to remove the expiration date (a requirement not at issue in
this case) willfully violated the Act. Credit & Debit Card Receipt Clarification Act of
2007, Pub. L. No. 110–241, § 2(a)(4), 122 Stat. 1565 (June 3, 2008) (codified at 15
U.S.C. § 1681n(d)). Yet none of these consumers alleged their identity had been harmed.
Id. § 2(a)(5). Congress responded by amending the Act so that persons who only violated
the Act by printing expiration dates could not be sued for a willful violation for roughly
four years. See id. § 3. In doing so, Congress stated the purpose of the amendment “is to
ensure that consumers suffering from any actual harm to their credit or identity are
protected while simultaneously limiting abusive lawsuits that do not protect consumers
but only result in increased cost to business and potentially increased prices to
consumers.” Id. § 2(b) (emphasis added).
3

Accepting plaintiff’s allegations as true, there is no doubt that defendants violated
the statute. But that does not mean plaintiff automatically has standing to bring this
claim. “Indeed, Congress does not have the final word on whether a plaintiff has alleged
a sufficient injury for the purposes of standing[.]” Meyers v. Nicolet Rest. of De Pere,
LLC, 843 F.3d 724, 727 (7th Cir. 2016), cert. denied, 137 S. Ct. 2267 (2017).
Article III Standing. Article III of the Constitution gives federal courts the
power to decide actual cases and controversies only. U.S. Const. art. III, § 2. In fact,
“[n]o principle is more fundamental to the judiciary’s proper role in our system of
government than the constitutional limitation of federal-court jurisdiction to actual cases
or controversies.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016), as revised (May
24, 2016) (alteration in original) (quoting Raines v. Byrd, 521 U.S. 811, 818 (1997)).
Ruling without a case or controversy “create[s] the potential for abuse of the judicial
process, distort[s] the role of the Judiciary in its relationship to the Executive and the
Legislature[,] and open[s] the Judiciary to an arguable charge of providing government
by injunction.” Schlesinger v. Reservists Comm. to Stop the War, 418 U.S. 208, 222
(1974) (internal quotations omitted).
“Standing to sue is a doctrine rooted in the traditional understanding of a case or
controversy.” Spokeo, 136 S. Ct. at 1547. To satisfy the standing requirements, “plaintiff
must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged
conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial
decision.” Id. “The plaintiff, as the party invoking federal jurisdiction, bears the burden
of establishing these elements.” Id.
4

This case deals with the injury-in-fact element. “To establish injury in fact, [the]
plaintiff must show that he . . . suffered ‘an invasion of a legally protected interest’ that is
[a] ‘concrete and particularized’ and [b] ‘actual or imminent, not conjectural or
hypothetical.’” Id. at 1548 (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560
(1992)). Narrowing further, this case deals with the concrete component of the injury-infact element. A “concrete” injury “must actually exist” and be real, not abstract. Id.
Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), is the Supreme Court’s last word
on the concrete component. In Spokeo, the Supreme Court analyzed when a statutory
violation amounts to a concrete injury that satisfies Article III’s injury-in-fact
requirement. Id. at 1549. It explained a plaintiff does not automatically satisfy the
injury-in-fact requirement just by alleging the violation of a statutory right. Id. For
example, “a bare procedural violation, divorced from any concrete harm, [does not]
satisfy the injury-in-fact requirement of Article III. Id.
Finally, the Supreme Court explained that while “tangible injuries are perhaps
easier to recognize, we have confirmed in many of our previous cases that intangible
injuries can nevertheless be concrete.” Id. When analyzing an intangible injury, like the
“heightened risk of identity theft” (#1 at 11, ¶ 84) alleged in this case, “both history and
the judgment of Congress play important roles.” Id. As for history, “it is instructive to
consider whether an alleged intangible harm has a close relationship to a harm that has
traditionally been regarded as providing a basis for a lawsuit in English or American
courts.” Id. As for Congress, it “may ‘elevat[e] to the status of legally cognizable
injuries concrete, de facto injuries that were previously inadequate in law.’” Id.
5

(alteration in original) (quoting Lujan, 504 U.S. at 578). While not always the case, “the
violation of a procedural right granted by statute can be sufficient in some circumstances
to constitute injury in fact. In other words, a plaintiff in such a case need not allege any
additional harm beyond the one Congress has identified.” Id.
When a plaintiff alleges the violation of a procedural right granted by statute, the
standing question boils down to this: “‘whether the particular procedural violations
alleged in this case entail a degree of risk sufficient to meet the concreteness
requirement,’ which in turn depends on ‘whether the particular bare procedural violation
may present a material risk of harm to the underlying concrete interest Congress sought
to protect’ in enacting the statutory requirement.” 1 Katz v. Donna Karan Co., L.L.C., 872
F.3d 114, 118 (2d Cir. 2017) (internal citations omitted) (quoting Crupar–Weinmann v.
Paris Baguette Am., Inc., 861 F.3d 76, 80–81 (2d Cir. 2017)). Of course, the Court also
is guided by history and the judgment of Congress.
No Material Risk of Identify Theft. Both parties agree Congress passed the Act
to protect consumers from identity theft by limiting the personal data printed on credit

1

As best this Court can tell, the Eighth Circuit has not yet framed the question so directly, but it
has implicitly endorsed this framing. See Braitberg v. Charter Commc’ns, Inc., 836 F.3d 925,
930 (8th Cir. 2016) (noting the plaintiff failed to identify any “material risk of harm” from the
procedural violation). Other courts of appeals interpreting Spokeo have framed the issue this
way, see Katz v. Donna Karan Co., L.L.C., 872 F.3d 114, 118 (2d Cir. 2017); Robins v. Spokeo,
Inc., 867 F.3d 1108, 1113 (9th Cir. 2017), cert. denied, 138 S. Ct. 931 (2018); Dreher v.
Experian Info. Sols., Inc., 856 F.3d 337, 346 (4th Cir. 2017), and the parties seem to agree this
question controls (#17 at 6; #21 at 3). The Third Circuit, however, rejected this framing and
found that a plaintiff alleging a statutory violation need not always show the violation caused a
material risk of harm. In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625,
637 (3d Cir. 2017) (explaining the Eighth Circuit requires a material-risk-of-harm showing and
rejecting Eighth Circuit’s reading of Spokeo).

6

and debit card receipts. The question now is whether plaintiff has alleged a material risk
of identity theft. The Court finds that he has not for at least two reasons.
First, plaintiff’s identity can be stolen only if another person actually steals it. So
naturally, many courts answering this question analyze whether any third party actually
saw or possessed the overly revealing receipt. See, e.g., Katz v. Donna Karan Int’l, Inc.,
No. 14 CIV. 740 (PAC), 2017 WL 2191605, at *5 (S.D.N.Y. May 17, 2017), aff’d and
remanded sub nom. Katz v. Donna Karan Co., L.L.C., 872 F.3d 114 (2d Cir. 2017);
Thompson v. Rally House of Kan. City, Inc., No. 15-00886-CV-W-GAF, 2016 WL
8136658, at *5 (W.D. Mo. Oct. 6, 2016). Plaintiff does not allege that any third party (1)
possessed his receipts, (2) read his receipts, (3) tried to figure out his entire credit card
number, (4) successfully figured out his credit card number, or (5) fraudulently used his
credit card number.
At best, plaintiff has shown only that he left receipts in the printing machine and
that he threw other receipts away. Yet plaintiff does not allege any material risk that
machine watchers or dumpster divers will snatch his left-behind receipts. Nor does he
give the Court any reason to believe there is a material risk these machine watchers or
dumpster divers or would try to steal his identity. Or that they would be successful if
they tried. In fact, if plaintiff actually thought this bizarre hypothetical presented a
material risk of identity theft, he probably would not have tossed his receipts or left them
in the machines. In that respect, the Eighth Circuit has found that plaintiffs—whose
credit card information was stolen when hackers infiltrated a business’s computer
network—failed to allege a “substantial risk” of identity theft and thus did not allege an
7

imminent injury. In re SuperValu, Inc., 870 F.3d 763, 771 (8th Cir. 2017). Although the
Eighth Circuit was not using the material-risk standard, its holding supports this Court’s
conclusion. After all, hackers—criminals—actually stole the plaintiffs’ information in
SuperValu. Here, plaintiff has alleged only that his receipts are there for the taking (and
not that anyone wants to take them or has even tried doing so), which undermines his
allegation that there is a material risk his identity will be stolen. See, e.g., Katz, 2017 WL
2191605, at *5; Kamal v. J. Crew Grp., Inc., No. 2:15-0190 (WJM), 2016 WL 6133827,
at *3 (D.N.J. Oct. 20, 2016); Thompson, 2016 WL 8136658, at *5; Taylor v. Fred’s, Inc.,
285 F. Supp. 3d 1247, 1264 (N.D. Ala. 2018); Gesten v. Burger King Corp., No. 1722541-CIV, 2017 WL 4326101, at *3 (S.D. Fla. Sept. 27, 2017); Hendrick v. Aramark
Corp., 263 F. Supp. 3d 514, 520–21 (E.D. Pa. 2017), appeal dismissed, No. 17-2120,
2017 WL 5664867 (3d Cir. Oct. 31, 2017).
Second, the first six digits of plaintiff’s sixteen-digit credit card number do not
convey any personal information about him. Instead, as plaintiff concedes, the first six
digits identify only the bank that issued the card, and Congress does not prohibit printing
the card issuer in word form on the receipt. In fact, each issuer’s six-digit code is
publicly available on the internet. “[B]ecause Congress did not prohibit the printing of
issuer information on the credit card receipt, there is no possibility that the printing of the
first six digits could have resulted in a risk of harm greater than that prohibited by
Congress.” In re Toys “R” Us – Del., Inc. - Fair & Accurate Credit Transactions Act
(FACTA) Litig., No. CV 06-08163 MMM FMOX, 2010 WL 5071073, at *12 (C.D. Cal.
Aug. 17, 2010); see also Katz, 872 F.3d at 120; Noble v. Nev. Checker CAB Corp., No.
8

215CV02322RCJVCF, 2016 WL 4432685, at *2 (D. Nev. Aug. 19, 2016), aff’d, No. 1616573, 2018 WL 1223484 (9th Cir. Mar. 9, 2018).
Plaintiff argues disclosing the first six digits “allow[s] an identity thief to learn the
card issuer, issuing country, brand of card, and card category, all potentially valuable
information to an identity thief that would not be available had Defendants complied with
the [Act].” (#21 at 8.) This is not necessarily true, even assuming defendants printed
receipts that included (in word form) the issuer of plaintiff’s credit card, and also
assuming one of plaintiff’s receipts fell into the hands of a fraudster. After briefly
searching the internet, the fraudster would know the six-digit code associated with the
issuer of plaintiff’s credit card. That is, the fraudster would have the information that
plaintiff claims should be unavailable, but actually is available, and defendants would not
have violated the Act.
Plaintiff goes on to argue “[d]isclosing this information contravenes the purpose
behind the [Act]’s restriction on printing more than the last five digits of a card number,
which is specifically intended ‘to limit the number of opportunities for identity thieves to
“pick off” key card account information.’” (#21 at 8) (quoting S. Rep. No. 108–166, at
13 (2003)). Printing the first six digits violates only the statutory ban on printing more
than the last five digits. But whether the statute was violated is not at issue. Printing the
first six digits does not make it easier to “pick off key card account information” for the
reasons explained above. That is, the risk of identity theft “has not been made materially
more likely to occur, because printing the first [six] number[s] plus the last four numbers
gives an identity thief no more personal information about a person’s account than
9

Congress has permitted to be printed on receipts.” Noble, 2016 WL 4432685, at *3; see
also Katz, 872 F.3d at 120; Taylor, 285 F. Supp. 3d at 1261; Gesten, 2017 WL 4326101,
at *3; Tarr v. Burger King Corp., No. 17-23776-CIV, 2018 WL 318477, at *3 (S.D. Fla.
Jan. 5, 2018); Kamal, 2016 WL 6133827, at *3; Kamal, 2017 WL 2587617, at *4–5.
Plaintiff has not alleged a material risk of identity theft.
History. Historical practice also supports the conclusion that plaintiff has not
alleged a concrete injury. Although plaintiff acknowledges history plays an important
role when deciding whether an intangible injury in concrete, he failed to brief the issue.
But under Spokeo, this Court must still consider whether the alleged intangible harm—
here, the heightened risk of identity theft—“has a close relationship to a harm that has
traditionally been regarded as providing a basis for a lawsuit in English or American
courts.” Spokeo, 136 S. Ct. at 1549.
Plaintiff’s alleged harm probably has the closest relationship to “privacy-based
torts centered on wrongful disclosures of information.” Bassett, 883 F.3d at 780. But not
close enough. “Without disclosure of private information to a third party, it hardly
matters that ‘[a]ctions to remedy . . . invasions of privacy, intrusion upon seclusion, and
nuisance have long been heard by American courts, and the right of privacy is recognized
by most states.” Id. (quoting Van Patten v. Vertical Fitness Grp., LLC, 847 F.3d 1037,
1043 (9th Cir. 2017)); see also Taylor, 285 F. Supp. 3d at 1261 (listing cases); Gesten,
2017 WL 4326101, at *3; Kamal v. J. Crew Grp., Inc., No. CV 2:15-0190 (WJM), 2017
WL 2587617, at *3 (D.N.J. June 14, 2017); Braitberg v. Charter Commc’ns, Inc., 836

10

F.3d 925, 930–31 (8th Cir. 2016). Again, plaintiff has not alleged anyone else ever saw
the first six digits of his credit card number.
Judgment of Congress. The judgment of Congress also supports the conclusion
that plaintiff has not alleged a concrete injury. Again, printing the first six digits “is the
equivalent of printing the name of the issuing institution,” Katz, 872 F.3d at 120, which
the Act allows, at least in word form. Moreover, the six-digit code for each issuer is
publicly available online. This strongly suggests Congress did not think disclosing the
first six digits exposed consumers to a risk of identity theft. Also, when amending the
Act in 2007, Congress reaffirmed that “[t]he purpose of this [amendment] is to ensure
that consumers suffering from any actual harm to their credit or identity are protected
while simultaneously limiting abusive lawsuits that do not protect consumers but only
result in increased cost to business and potentially increased prices to consumers.” Pub.
L. No. 110–241, § 2(b) (emphasis added). 2
All in all, plaintiff claims Congress’s ban on printing more than the last five digits
shows “its judgment was that any more digits unnecessarily exposes consumers to an
increased risk of identity theft.” (#21 at 8 n.7.) If this were true, Congress also would
have banned printing in word form the name of the issuer. Thus, this argument fails.
IV.

Conclusion

2

If the Court were simply interpreting the statutory language, it would not rely on legislative
history like this. Indeed, the statute is clear, and the problems with relying on legislative history
are well documented, Digital Realty Tr., Inc. v. Somers, 138 S. Ct. 767, 783–84 (2018) (Thomas,
J., concurring in part and concurring in the judgment). But when deciding whether an intangible
injury is concrete, Spokeo makes clear that courts must consider the judgment of Congress.

11

Plaintiff has not alleged a concrete injury because he has not shown that there is a
material risk he will have his identity stolen. History and the judgment of Congress
support this conclusion. As such, defendants’ motion to dismiss will be granted, and the
Court need not address defendants’ arguments that plaintiff failed to plead facts showing
willfulness and that plaintiff failed to allege the Act applies to Exxon Mobil.
Accordingly,
IT IS HEREBY ORDERED that defendants’ motion to dismiss (#16) is
GRANTED.

So ordered this

13th

day of April 2018.

STEPHEN N. LIMBAUGH, JR.
UNITED STATES DISTRICT JUDGE

12