KAMAL v. J. CREW GROUP, INC. et al

Filing 110

OPINION. Signed by Judge William J. Martini on 9/10/19. (gh, )

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF NEW JERSEY
AHMED KAMAL,

Civ. No.: 2:15-0190

Plaintiff,
V.

OPINION
J. CREW GROUP, INC., et at.,
Defendants.
WILLIAM J. MARTINI, U.S.D.J.:

Plaintiff Ahmed Kamal (“Plaintiff’) brings this putative class action against the J.
Crew Group, Inc. and various related entities (“Defendants”) under the Fair and Accurate
Credit Transactions Act of 2003 (“FACTA”). This matter comes before the Court on
Defendants’ motion to dismiss Plaintiffs Third Amended Complaint (“TAC”) without leave
to amend. ECf No. 107 (“Motion”). For the reasons set forth below, the Motion is
GRANTED.
I.

BACKGROUND

Despite lengthy litigation, the facts of this case are relatively simple. FACTA
mandates that “no person that accepts credit cards or debit cards for the transaction of business
shall print more than the last 5 digits of the card number or the expiration date upon any
receipt.” 41 U.S.C. § 168 lc(g)(1). Plaintiff alleges that despite that prohibition, Defendants
issued him three receipts displaying the first six and last four digits of his credit card number
for his Discover-branded card (“Receipts”). TAC ¶ 2, 105, 107, 109, ECF No. 103.
II.

PROCEDURAL HISTORY

Within weeks of receiving the offending Receipts, Plaintiff filed suit. After Plaintiff
amended his complaint, the Court denied Defendants’ attempt to dismiss under Federal Rule
of Civil Procedure (“FRCP”) 12(b)(6). Aug. 6, 2015 Op. & Ord., ECF Nos. 32-33. On May
16, 2016, the Supreme Court issued its opinion in Spokeo, Inc. v. Robins, finding that
“standing requires a concrete injury even in the context of a statutory violation.” Spokeo, Inc.
v. Robins, 136 5. Ct. 1540, 1549 (2016). Defendants movedto dismiss underSpokeo pursuant
to FRCP 12(b)(l). ECF No. 50. The Court granted the motion and dismissed the Amended
Complaint without prejudice. Oct. 20, 2016 Op. & Ord., ECF Nos. 63-64.
In November 2016, Plaintiff filed their Second Amended Complaint (“SAC”). ECf
No. 65. Defendants once again moved to dismiss under FRCP 12(b)(l). ECF No. 68. The
Court granted the motion, dismissing the SAC without prejudice. June 6, 2016 Op. & Ord.,
ECF Nos. 84-85. Plaintiff moved for reconsideration or, alternatively, requested that the
Court amend its Opinion and Order to dismiss with prejudice to permit an appeal. ECF
1

No. $7. The Court denied the motion for reconsideration, but amended its Opinion and Order
to dismiss with prejudice. Amend. June 14, 2016 Op. & Ord., ECf No. 88-89 (“Karnal T’).
Plaintiff appealed.
The Third Circuit affirmed this Court’s opinion that Plaintiff lacked standing. Kamat
v.1 Crew Grp., Inc., 918 F.3d 102, 106 (3d Cir. 2019) (“KamaliT’). The court also found,
however, that this Court lacked authority to dismiss the case with prejudice. Id. at 11$.
Therefore, it remanded for dismissal without prejudice. Id. This Court did so on April 15,
2019. Ord.. ECF No. 97. Plaintiff filed the TAC on May 14, 2019.
III.

NEW ALLEGATIONS

The TAC is largely identical to the SAC. Almost all the new or amended allegations
are conclusory statements of law or congressional intent, not facts regarding an alleged injury.
See generally TAC ¶ 3, 5-7, 27, 5$, 60-62, 111-18 (edited paragraphs). New factual
allegations from which the Court could infer a concrete injury are limited to: (1) a study
regarding illicit use of the first six digits of a credit card number, Id. ¶ 5; (2) that the fifth and
sixth digits printed on the Receipts show more than the card brand and help hackers determine
card zip codes, Id.; (3) that Plaintiff incurred costs associated with legal representation, Id.
¶ 114; (4) that Plaintiff expected his credit card number to remain secret, but Defendants
created a risk that the information would fall into a third party’s hands by printing more digits
than FACTA permits, Id. ¶J 116-117, and (5) that Plaintiff could no longer merely throw out
the Receipts, and instead must incur the cost of safely keeping or destroying them, Id. ¶ 6,
111—13, 115.
IV.

STANDARD OF REVIEW

Defendants once again challenge Plaintiffs standing to bring this lawsuit.
[FRCP] 12(b)(1) is the proper vehicle for challenging a plaintiffs Article III
standing. Challenges to standing are either “facial” or “factual.” tA facial
challenge] does not dispute what facts are, but rather whether the facts as plead
create standing. In such cases, a presumptive truthfulness attaches to the
plaintiffs allegations.
Nonetheless, plaintiffs always bear the burden of
establishing subject matter jurisdiction. Although general factual allegations of
injury resulting from the defendant’s conduct may suffice, the complaint must
still clearly and specifically set forth facts sufficient to satisfy Article III.
.

.

.

Kamal I at 3 (cleaned up). As before, Defendants’ challenge here is facial. See Mot.
V.

DISCUSSION

Defendants challenge Plaintiffs standing. Because the requirements of standing were
discussed in detail in Karnal II, the Court will not do so again here. In short, Article III
standing requires plaintiffs to have “suffered an injury in fact.” Spokeo, 136 S. Ct. at 1547.
‘To establish injury in fact, a plaintiff must show that he or she suffered an invasion of a
legally protected interest that is concrete and particularized and actual or imminent, not
conjectural or hypothetical.” Id. at 154$ (cleaned up). “Although imminence is concededly
a somewhat elastic concept, it cannot be stretched beyond its purpose, which is to ensure that
2

the alleged injury is not too speculative.” Clapper v. Amnesty Int’l USA, 56$ U.S. 398, 409
(2013).
“[T]he violation of a procedural right granted by statute can be sufficient in some
circumstances to constitute injury in fact.” Spokeo, 136 5. Ct. 1549. In that context, plaintiffs
“need not allege any additional hann beyond the one Congress has identified.” Id. But a
procedural violation does not “automatically satisfy[y] the injury-in-fact requirement.” Id.
Plaintiffs must have suffered “a concrete injury even in the context of a statutory violation.”
Id. Where a technical violation of a statute does not “cause harm or present any material risk
of hann,” standing will not automatically attach. Id. at 1550 (explaining dissemination of
improper zip code violated statute but did not cause hanri or a material risk of harm and thus,
without more, would not produce standing). But even if a statutory violation alone is
insufficient, the “risk of real harm” can satisfy the injury “injury in fact” requirement. Kamal
hat 115.
A.

Theories Already Addressed by this Court and the Third Circuit

Defendants argue this Court and the Third Circuit already considered and rejected
Plaintiffs various injury theories. See generally Mot. Rather than focus on his new
allegations, Plaintiff accuses the Third Circuit of, inter alia, “impermissible second-guessing”
of Congress and, citing to other courts, argues “the weight of authority confirms Plaintiffs
standing.” 0pp. at 5-7 (capitalization adjusted). However, “[a] circuit split between our Court
of Appeals and the courts of appeals for other circuits does not make Third Circuit precedent
any less binding.” Freedom Med., Inc. v. Gillespie, 06-cv-3 195, 2013 WL 3819366, at *5
(E.D. Pa. July 24, 2013). As the Third Circuit addressed most of Plaintiffs arguments, they
can be disposed of quickly.
Citing various circuit courts (including a vacated Eleventh Circuit opinion), Plaintiff
reasserts that (1) the technical violation of FACTA or (2) the increased risk of identity theft
resulting therefrom (without any other facts or injuries) establish standing. Opp. at 6-10. The
Third Circuit addressed these arguments head on. See Kamal II at 113 (“Kamal has pleaded
two allegedly ‘concrete’ injuries: ‘the printing of the prohibited information itself,’ i.e., a
violation of FACTA’s plain text, and the ‘increased risk of identity theft’ resulting from that
printing.”). It found the technical violation of FACTA insufficient to produce standing
because “the FACTA violation alleged by Kamal is not itself a concrete injury.” Id. at 115.
Absent a sufficient degree of associated risk, printing the Receipts was “a bare procedural
violation’ that does not create Article III standing.” Id. at 117 (quoting Spokeo, 136 S.Ct. at
1549).
The Third Circuit also analyzed the alleged increased risk of identity theft. Id. at 115
(analyzing risk of real harm “[b]ecause the FACTA violation twas] not itself a concrete
injury” and “the FACTA provision at issue was part of Congress’s effort to prevent the
concrete harm of identity theft”). It found that Plaintiffs “conclusory allegations of risk
[were] insufficient.” Id. at 116. Agreeing with this Court, the Third Circuit found that the
“speculative chain of events” before an actual injury occurrs—Plaintiff loses the Receipts,
which are found by a third party, who then obtains the remaining information needed to use
his card, and then makes purchases—”does not constitute a material risk of hanm” Id.
3

B.

Additional Allegations

As this Court cannot overturn the Third Circuit’s binding precedent on the harms
alleged in the SAC, it will now turn to the new allegations added to the TAC.
1.

Fraud Study

Plaintiff alleges “[a] study has shown that an identity thief, using the prohibited first
six digits in addition to the allowed last five digits.
can generate the entire credit card
number in as little as six seconds.
[T]he identity thief can then charge purchases against
the victim’s credit card.” TAC ¶ 5. Plaintiff identifies the incorporated study in his motion
papers. Opp. at 8 n.9 (referring to Mohammed Aamir All et al., Does the Online Card
Payment Landscape Unwittingly Facilitate Fraud?, IEEE Security & Privacy (Mar.—Apr.
2017) (“Study”)).’
.

.

.

.

.

The Study describes how hackers can exploit weaknesses and inconsistencies in
merchant websites to generate usable credit card data, starting with a card number. See Study
at 3. It does not—as could be relevant to Plaintiffs claim—discuss how the revelation of the
first six and last four digits of an individual’s card number could put them at a particularly
increased risk of identity theft. See id. Nor does it mention criminals utilizing receipts
containing such information to steal identities. Instead, it suggests two methods of obtaining
credit card numbers, the Study’s “starting point”: (1) buying known card numbers from
criminals or (2) exploiting the “contactless feature” available in new cards to skim data. Study
at3-4.
The closest the Study gets to supporting a conclusion that printing the first six digits
materially increased Plaintiffs risk was a single passing sentence that: “[i]t is also possible
to generate [a full card number] using the first six digits of a [card number] and the Luhn’s
algorithm and getting it verified.” Id. at 4. While the Study points out this possibility, it says
nothing about the effort required to do so, how one would “get[] it verified,” or the increased
risk resulting from the first six digits appearance on a receipt. Id. As Plaintiff admits, “[o]nline
databases such as BinDb and ExactBins contain lists of many (but not all) of the first-six-digit
combinations in existence.” Opp. at 10. Therefore, it is unlikely that the Receipt’s additional
publication of a six-digit combination would materially increase Plaintiffs risk, given that
the first six digits of most cards in existence are available online. In other words, the Study
does not sufficiently link the FACTA violation—printing of the first six digits—to an
increased risk of identity theft particular to Plaintiff to create standing. Kamal II at 117 (after
Plaintiff attempted to rely on the Study before the Third Circuit as well. While the circuit court did
not formally consider the Study, in dicta, it noted the Study’s irrelevance to Plaintiffs claim. Kamal
II at 116-17. on full consideration of the Study, this Court agrees with the Third Circuit’s conclusion.
While the TAC’s language makes the Study appear to test the use of the same data printed on the
Receipts (i.e., opening and closing digits), “[i]t is a well-settled rule that when a written instrument
contradicts allegations in the complaint to which it is attached, the exhibit trumps the allegations.” S.
Jersey Gas Co. v. Mueller Co., Ltd., 09-cv-4194, 2012 WL 1289881$, at *3 (D.N.J. Jan. 30, 2012),
aff’d, 12-cv-1547, 2013 WL $70339 (3d Cir. Mar. 11, 2013) (quoting Northern Indiana Gun &
Outdoor Shows, Inc. v. City ofSouth Bend, 163 F.3d 449, 454 (7th Cir. 1988)).
4

discussing study, concluding the “alleged violation of FACTA is a bare procedural violation
that does not create Article III standing”).
2.

Digits Showing Issuiitg Bank or Merchant

Plaintiff argues that because the fifth and sixth digits can identify the issuing bank or
sponsoring merchant, and “[b]ecause ascertaining the consumer’s geographical location is
often the key to successfttlly hacking his account, the additional pieces of information.
make the hacker’s job that much easier.” Opp. at 10 (citing Study). According to Plaintiff,
the Third Circuit therefore “got it wrong” in noting that the addition of the first six digits does
not provide any additional information than is permissibly on the Receipts. Opp. at 10 (citing
Kamal II at 117 n.7 (noting Receipts displayed “Discover” brand and thus the “first six digits
provide[d] no more information than [was] permissibly printed”)).
As an initial matter, the Third Circuit noted elsewhere that the first six digits also
“identify the issuing bank and card type.” Kamat II at 107. Regardless, access to this
additional information does not materially increase the risk of harm to Plaintiff True, a
fraudster could conceivably narrow his search for a card’s zip code by starting in regions close
to the issuing bank or merchant’s branches. See Study at 3. But like the chain of inferences
discussed above, that possibility does not sufficiently increase the chance of Plaintiff being
harmed. Hackers could use the same technique on any publicly available six-digit
combination. See id. Further, the location of any recovered receipt or the issuing store give
criminals at least as good a clue of the card’s assigned zip code. Most significantly, the chain
of causation deemed too remote to confer standing in Kamat II remains largely unchanged:
“Karnal loses or throws away the receipt, which is then discovered by a hypothetical third
party, who then obtains the six remaining truncated digits along with any additional
information required to use the card, such as the expiration date, security code or zip code.”
Kamat II at 116 (quoting Kamal Iat 5).
The only new allegation is that the fifth and sixth digits provide a hint on the zip code,
which could conceivably be exploited using “brute force guesses from a list of issuing bank
postcodes from a particular city where the card details have been skimmed from.” Study at
3. The increased risk particular to Plaintiff from the possibility of reverse engineering his zip
code based on the Receipts’ display of the fifth and sixth digits is insufficient to produce
standing. See Kamal II at 116 (“Kamal must plausibly aver how [Defendants’] printing of the
six digits presents a material risk of concrete, particularized hanm”). For Plaintiff to suffer a
real harm due to the fifth and sixth digits’ exposure, someone would have to (1) find the
Receipts, (2) determine the remaining digits of Plaintiffs card, (3) guess the correct zip code
because they knew the issuing bank or merchant (and not because they found a receipt near
Plaintiffs home or by guessing every possible zip code through a brute force attack), and
finally (4) successfully use the card. The added information exposed by the fifth and sixth
digits is insufficiently dangerous to pass Article III muster. See Clapper, 568 U.S. at 409
(barring “too speculative” injuries); Kamal II at 115 (finding statutory violation alone
insufficient).

5

3.

Transportation aitd Litigation Costs

Plaintiff alleges he “has suffered the cost. of transportation to his attorney to discuss
the Defendants’ violation of Federal law and to discuss what he needs to do with the credit
card receipts.” As Defendants argue, if this were enough, any plaintiff that visits their
attorneys’ office to discuss a matter would have standing. Mot. at 2 n. 1. That is not the state
of the law. See Clapper, 568 at 416 (“Respondents’ contention that they have standing
because they incurred certain costs as a reasonable reaction to a risk of harm is unavailing—
because the harm respondents seek to avoid is not certainly impending.”).
.

4.

.

Violated Expectation ofSecrecy

The TAC includes a new allegation that Plaintiff provided Defendants “with his credit
card number with the expectation that it will remain secret, not least because of the risk of
credit card fraud if the merchant reveals it.” TAC ¶ 116. Defendants argue “ta]ny so-called
‘privacy’ interest in the receipts was not invaded because there was no disclosure of the
information to any unauthorized party.” Mot. at 13 (citing Kamal II at 114). Plaintiff fails to
respond to the argument. See Aiellos v. Zisa, 09-cv-3076, 2010 WL 421081, at *5 & n.8
(D.N.J. Feb. 2, 2010) (finding failure to meaningfully respond waived claims). In any event,
there is no allegation that any third party viewed the Receipt, potentially violating any
expectation of secrecy. See Kamat II at 114. Thus, the “expectation of secrecy” allegation
does not help Plaintiffs case.
5.

Incurring Burden ofKeeping or Destroying Receipts

The TAC alleges an injury based on the cost and burden of keeping or destroying the
Receipts. TAC ¶ 6, 111-14. This too is insufficient. Plaintiffs “cannot manufacture standing
merely by inflicting harm on themselves based on their fears of hypothetical future harm that
is not certainly impending.” Clapper, 568 U.S. at 416. Here, the hypothetical future hann
(credit card fraud) is not “certainly impending.” See id. Therefore, shouldering the burden
and cost of preventing that harm is insufficient for standing to attach.
As the Ninth Circuit explained on remand in Spokeo: where the violative conduct and
intangible injury have already occurred, and the “intangible injury itself is sufficiently
concrete[, i]t is of no consequence how likely [plaintiffs are] to suffer additional concrete
harni as well.” Robins v. Spokeo, Inc., 867 f.3d 1108, 1118 (9th Cir. 2017), cert. denied, 138
S. Ct. 931, 200 L. Ed. 2d 204 (2018) (cleaned up). But where an injury is only predicted, “a
plaintiff cannot show injury-in-fact unless the threatened injury is certainly impending as
opposed to merely speculative.” Id. (cleaned up) (discussing Clapper, 568 U.S. at 1145-48).
Here, Plaintiff has suffered an intangible injury, but the intangible injury itself was not
sufficiently concrete to confer standing. Kamal II at 113 (“[T]he procedural violation is not
itself an injury in fact.”); Cf Robins, 867 F.3d at 1118 (explaining imminent injury
unnecessary because intangible injury (i.e., statutory violation) was sufficiently concrete).
Therefore, the threatened injury—identity theft—must be “certainly impending” for Plaintiff
to have standing. Clapper, 568 U.S. at 1147-48. Fortunately for Plaintiff, there is no
indication that his identity is at imminent risk. See id. Unfortunately for Plaintiffs case, that
means steps taken to protect himself from identity theft do not create standing. See Clapper,
6

568 U.S. at 416 (finding costs associated with “not certainly impending” future injury
incapable of creating standing).

The Court is aware that precedent from other circuits counsels otherwise. See
litcransky v. Godiva Chocolatier, Inc., 922 f.3d 1175, 1192 (11th Cir. 2019) (“The effort
[plaintiff] put into doing away with the risky receipt would suffice for standing.”); Jejfries v.
Volume Servs. Am., Inc., 928 F.3d 1059, 1064 n.2 & 1067 n.2 (D.C. Cir. 2019). However, in
those cases, the courts found standing due to the technical FACTA violations alone. See
Muranksy, 922 F.3d at 1188 (“[Plaintiff] alleged he suffered a heightened risk of identity theft
as a result of a FACTA violation. That allegation suffices for standing under Spokeo.”);
Jeffries, 928 F.3d at 1067 n.3 (“Although not every FACTA violation creates a concrete injury
in fact, we conclude that the alleged violation of Jeffries’ right does so.”). Those conclusions
stemmed, in part, from the determination that FACTA’s purpose is to reduce the risk of
identity theft, not to actually avoid it. Muranksy, 922 F.3d at 1188 (“Congress conferred the
procedural right in FACTA to reduce the risk of identity theft.”); JeJfries, 928 F.3d at 1067
n.3 (“We are not necessarily in full agreement with the Third Circuit, which takes the position
that FACTA protects an interest in avoiding actual identity theft, rather than increased risk of
identity theft.”). In contrast, Kamal II found “the FACTA provision at issue was part of
Congress’s effort to prevent the concrete harm of identity theft.” Kamal II at 115. Thus, the
“increased risk of identity theft resulting from [] printing” the Receipts was insufficient to
confer standing. Id. at 113 (“[T]he procedural violation is not itself an injury in fact, and
[Plaintiff] has not otherwise alleged a risk of harm that satisfies the requirement of
concreteness.”). As the Third Circuit held the increased risk of identity theft was insufficient,
taking steps to mitigate that risk does not create standing either. See Clapper, 568 U.S. at 416
(“Respondents’ contention that they have standing because they incurred certain costs as a
reasonable reaction to a risk of harm is unavailing—because the harm respondents seek to
avoid is not certainly impending.”).
Because none of the new allegations allow the Court to conclude Plaintiff suffered a
sufficient injury-in-fact, Defendants’ motion to dismiss is GRANTED.
VI.

VOLUNTARY DISMISSAL AND COSTS

Plaintiff requests that in the event the Court is inclined to grant the Motion, it should
“accept his notice of voluntary dismissal, with prejudice, pursuant to Rule 41(a)(l)(A)(i), each
side to bear its own costs.” Opp. at 15. Defendants reply by requesting costs and dismissal
without leave to amend. Reply at 12-13.
A.

Costs

“Whenever any action or suit is dismissed in any district court.
for want of
jurisdiction, such court may order the payment of just costs. 28 U.S.C. § 1919. “The
awarding of costs under § 1919 turns on whether such an award is ‘just.” Hygienics Direct
Co. v. Medline Indtts., Inc., 33 F. App’x 621, 625 (3d Cir. 2002). The decision is within the
Court’s discretion. Id.
.

.

Here, costs will not be awarded. While the Court is disappointed Plaintiffs counsel
spent pages of his brief arguing directly against binding precedent and citing to overturned
7

authority, the TAC was not filed frivolously. The Third Circuit explicitly stated that it did
not consider the Study or the burden of storing or disposing of the Receipts in its analysis.
Karnal II at 116, 118 n. 10. Accordingly, amending the complaint to test those allegations was
legitimate.
B.

Prejudice and Leave to Amend

Defendants do not oppose Plaintiffs request for a stipulation of dismissal with
prejudice. Reply at 11. They separately request Plaintiff not be granted leave to replead.
Mot. at 19. Plaintiff does not address Defendants’ arguments regarding further amendment.
See Opp.
The Third Circuit made clear that where this Court lacks jurisdiction, “the case should
be dismissed without prejudice.” Kamal II at 119. As to leave to amend, amendment is
generally permitted absent “undue delay, bad faith or dilatory motive
repeated failure to
cure deficiencies by amendments previously allowed.
[or] futility of amendment.” Great
W. Mining & Mineral Co. v. fox Rothschild LLP, 615 f.3d 159, 174 (3d Cir. 2010) (quoting
foman v. Davis, 371 U.S. 178, 182 (1962)).
.

.

.

.

.

,

,

Here, Plaintiff has repeatedly failed to cure deficiencies by amendments previously
allowed and failed to respond to Defendants’ contention that further amendment would be
futile. See Mot. at 19-20. Accordingly, this case is DISMISSED WITHOUT PREJUDICE
and further leave to amend is DENIED. See Aiellos, 2010 WL 421081, at *5 & n.8.
VII.

CONCLUSION

For the reasons set forth above, none of the additional allegations (nor those already
analyzed in Kamal II) are sufficient for the Court to conclude Plaintiff has standing to bring
this suit. Accordingly, Defendants’ motion to dismiss pursuant to FRCP 12(b)(1), ECF
No. 107, is GRANTED. An appropriate Order follows.

Date: September/fl 2019

WILL,21 J. MARTINI, U.S.D.J.

8