KAMAL v. J. CREW GROUP, INC. et al

Filing 63

OPINION. Signed by Judge William J. Martini on 10/20/16. (gh, )

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF NEW JERSEY

Civ. No. 2:15-0190 (WJM)

AHMED KAMAL,
Plaintiff,

OPINION
v.
J. CREW GROUP, INC., et al.,
Defendants.

WILLIAM J. MARTINI, U.S.D.J.:
Plaintiff Ahmed Kamal brings this putative class action suit for alleged
violations of the Fair and Accurate Credit Transactions Act (“FACTA”) amendment
to the Fair Credit Reporting Act, 15 U.S.C. § 1681, et seq. This matter comes before
the Court on Defendants’ motion to dismiss for lack of subject matter jurisdiction
under Federal Rule of Civil Procedure 12(b)(1). For the reasons set forth below, the
motion to dismiss is GRANTED. Plaintiff’s Amended Complaint is DISMISSED
without prejudice.
I.

BACKGROUND

In 2003, Congress passed the Fair and Accurate Credit Transaction Act
(“FACTA”) in part to curb credit card fraud and identity theft. 15 U.S.C. § 1681c. It
prohibits, among other things, printing more than the last five digits of a credit card
number on a sales receipt, a policy known as “truncation.”1 In theory, at least,
truncation reduces the risk that third parties use financial information on lost or stolen
receipts to perpetrate fraud or identity theft. FACTA creates a private cause of action
for “any actual damages . . . or damages of not less than $100 and not more than
$1,000.” 15 U.S.C. § 1681n(a).
Defendants are a conglomerate of several hundred clothing stores and
manufacturers known as J. Crew, along with parent company Chino’s Holdings, Inc.
1

The Court notes that credit card numbers are generally comprised of sixteen digits.
1

Plaintiff Ahmed Kamal brings this action “on behalf of all persons or entities to
whom Defendants provided an electronically printed receipt at the point of sale or
transaction . . . which receipt displayed more than the last five digits of the
customer’s credit card number.” Pl. Am. Compl., ¶ 13.
Plaintiff alleges that on December 18, 2014, he visited one of Defendants’
retail locations in Ocean City, Maryland. Upon making a purchase with his Discover
credit card, Plaintiff was given a receipt featuring the last four digits and the first six
digits of his credit card number, whereas the statute would permit printing no more
than the final five digits. Pl. Am. Compl., ¶ 69. Plaintiff reports that similar
violations occurred when he made purchases at Defendants’ Rehoboth Beach,
Delaware location on December 22, 2014, and at Defendants’ Wayne, New Jersey
location on January 4, 2015.
Procedural History before this Court
The Amended Complaint of March 25, 2015 states a single count action for
violating FACTA. Plaintiff seeks the statutory damages of $100 to $1000 per
violation along with attorneys’ fees and punitive damages. On August 6, 2015, the
Court denied Defendants’ motion to dismiss under Federal Rule of Civil Procedure
12(b)(6), finding that Plaintiff adequately stated a claim for willful violation of
FACTA’s credit card number truncation provision. See 15 U.S.C. § 1681, et seq.
The Court stayed the case in December of 2015 pending the Supreme Court’s
decision in Spokeo Inc. v. Robins, which asked the following: “Whether Congress
may confer Article III standing upon a plaintiff who suffers no concrete harm, and
who therefore could not otherwise invoke jurisdiction of a federal court, by
authorizing a private right of action based on a bare violation of a federal statute.”
Defs. Mot. Dismiss, at 1. That case was decided on May 16, 2016. Spokeo Inc. v.
Robins, 136 S. Ct. 1540 (2016).
On June 15, 2016, following supplemental briefing, Defendants moved to
dismiss under 12(b)(1), arguing that Plaintiff lacked standing under Article III of the
Constitution, and that the Court thus lacks subject matter jurisdiction over the action.
Defs. Mot. Dismiss, at 2.
II.

LEGAL STANDARD

Federal Rule of Civil Procedure 12(b)(1) is the proper vehicle for challenging a
plaintiff’s Article III standing. Fed. R. Civ. P. 12(b)(1); see Society Hill Towers
Owners’ Ass’n v. Rendell, 210 F.3d 168, 175 (3d Cir. 2000). The burden of
establishing subject matter jurisdiction rests with the plaintiff. Spokeo, Inc. v. Robins,
2

136 S. Ct. 1540 (2016). Animal Sci. Prod., Inc. v. China Minmetals Corp., 654 F.3d
462, 470 (3d Cir. 2011). “Although ‘general factual allegations of injury resulting
from the defendant’s conduct may suffice,’ the complaint must still ‘clearly and
specifically set forth facts sufficient to satisfy’ Article III.” Reilly v. Ceridian Corp.,
664 F.3d 38, 41 (3d Cir. 2011) (citations omitted).
III.

DISCUSSION

Article III of the Constitution limits the jurisdiction of federal courts to “Cases”
and “Controversies.” U.S. Art. III § 2. Plaintiffs must “clearly . . . allege facts
demonstrating” all three elements of constitutional standing: (1) an “injury in fact,”
(2) that is “fairly traceable” to a defendant’s conduct, and that (3) is likely to be
redressed by favorable judicial intervention. Lujan v. Defs. Of Wildlife, 504 U.S. 555,
561 (1992). To establish an “injury in fact,” Plaintiff must show “an invasion of a
legally protected interest which is (a) concrete and particularized . . . and (b) actual or
imminent, not conjectural or hypothetical.” Id. at 560 (citations omitted). Defendants
correctly argue that Plaintiff lacks standing because his injury is not sufficiently
“concrete.”
A. Governing Case Law
This action was stayed in December of 2015 pending the Supreme Court’s
decision in Spokeo v. Robbins. That decision confirmed that an “injury-in-fact” must
be “concrete” even where Congress has authorized a private cause of action. Spokeo,
136 S. Ct., at 1548 (citations omitted). Spokeo did not disturb this circuit’s standing
jurisprudence. See In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262,
273 (3d Cir. 2016). An “injury in fact” may be “intangible” or difficult to monetize,
but it must be “actual or imminent, not conjectural or hypothetical.” Spokeo, 136 S.
Ct., at 1548. Where the alleged injury is heightened risk of future harm, the
allegations must “entail a degree of risk sufficient to meet the concreteness
requirement.” Id. at 1550; Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138 (2013);
Bock v. Pressler & Pressler, LLP, 2016 WL 4011150, at *1 (3d Cir. July 27, 2016)
(“the question framed by [Spokeo] [is] whether the particular procedural violations
alleged in [a] case entail a degree of risk sufficient to meet the concreteness
requirement.”) (citation omitted).
As the Defendants argue, the alleged injury here entails an increased risk of
suffering fraud or identity theft sometime in the future, not a manifest violation of a
traditional privacy interest. Compare Reilly, 664 F.3d, at 41 (finding no standing for
allegations of an increased risk of identity theft resulting from the defendant’s
security breach) with Nickelodeon II, 827 F.3d, at 295 (finding plaintiff had standing
3

where defendant engaged in coordinated surveillance of web browsing and disclosed
private data to third parties).2 The purpose of credit card truncation is to limit
incremental risk of fraud or identity theft, not safeguard one’s freedom from
“injurious disclosure[] as to private matters” or “intrusion upon the domestic circle”
or some other traditional privacy interest. See Samuel D. Warren & Louis D.
Brandeis, The Right to Privacy, 4 Harv. L. Rev. 193 (1890); Nickelodeon II, 827
F.3d, at 295 (finding standing where plaintiffs adequately stated claim for invasion of
privacy). The essential question is whether, in light of Congress’ decision to authorize
private suits under FACTA, printing ten rather than five credit card digits on a sales
receipt elevates the risk of fraud enough to work a “concrete” injury for the purpose
of Article III standing. If the harm is not “concrete,” the Court lacks subject matter
jurisdiction and must dismiss the case.
B. Plaintiff’s Article III Standing
On its face, the Amended Complaint alleges that Plaintiff became more
susceptible to fraud because J. Crew prints the first six and last four digits of credit
card numbers on customer receipts, instead of just the last four digits. See Am.
Compl., ¶ 42 (“By failing to comply Defendants have deprived their customers of the
protections that the statute was designed to confer, and exposes cardholders to
increased risk of identity theft.”). Several district courts have examined whether an
individual in Plaintiff’s position has Article III standing in light of Spokeo’s
discussion of the “concreteness” requirement. They have reached inconsistent
outcomes. See Thompson v. Rally House of Kansas City et al., 15-cv-00886-GAF, at
*9 (W.D. Mo. Oct. 6, 2016) (printing first six and last four digits amounts to “purely
procedural violation” of FACTA and does not constitute an injury-in-fact); Wood v. J
Choo USA, 2016 WL 4249953, at *4 (S.D. Fla. Aug. 11, 2016) (denying motion to
dismiss claim for lack of standing where defendant violated FACTA by including
expiration date on receipt); Guarisma v. Microsoft, 2016 WL 4017196 (S.D. Fla. July
26, 2016); Altman v. White House Black Mkt., Inc., 2016 WL 3946780 (N.D. Ga. July
13, 2016).
The Court finds that Plaintiff’s allegations do not “entail a degree of risk
sufficient to meet the concreteness requirement.” Spokeo, 664 F.3d, at 1550. The
Amended Complaint does not provide any facts demonstrating a risk sufficiently
“actual or imminent” to constitute a concrete injury. Thompson, 15-cv-00886-GAF, at
*9 (W.D. Mo. Oct. 6, 2016). See also Reilly v. Ceridian Corp, 664 F.3d 38, 46 (3d
Cir. 2011); Crisafulli v. Ameritas Life Ins. Co., 2015 WL 1969176 (D.N.J. Apr. 30,
2015), at *3 (plaintiff failed to demonstrate “plausible, increased risk of future harm”
2

It is telling that, unlike Nickelodeon, this action does not allege any private tort or other count
besides its claim under FACTA.
4

and thus lacked standing); Noble v. Nevada Checker CAB Corp., 2016 WL 4432685,
at *3 (D. Nev. Aug. 19, 2016) (finding no standing for FACTA plaintiffs where
alleged injury was printing extra digit on customer receipts).
There is no evidence that anyone has accessed or attempted to access or will
access Plaintiff’s credit card information. See Thompson, 15-00886, at * 9 (“There is
no real risk of harm as the improper receipt has only been in Plaintiff’s possession
since receiving it from Defendants.”); Khan v. Children’s Nat’l Health System, 2016
WL 2946165, at *5 (D. Maryland May 19, 2016) (risk of future harm did not amount
to “injury in fact” where it was unclear whether hackers “actually viewed, accessed,
or copied” personal medical data). Nothing has been disclosed to third parties. See
Reilly, 664 F.3d, at 43-44; Braitberg v. Charter Commc'ns, Inc., No. 14-1737,
__F.3d__, 2016 WL 4698283, at *4 (8th Cir. Sept. 8, 2016) (procedural violation of
data retention statute was not sufficiently “concrete” to confer standing). Nor does the
record indicate that anyone will actually obtain one of Plaintiff’s discarded J. Crew
receipts, and—through means left entirely to the Court’s imagination—identify the
remaining six digits of the card number and then proceed undetected to ransack
Plaintiff’s Discover account.
Plaintiff vaguely refers to less sophisticated identity thieves called “carders” or
“dumpster divers,” who supposedly coble together credit card numbers from lost or
discarded receipts. Am. Compl., ¶ 20. Even considered in a most favorable light,
whatever causal chain Plaintiff alludes to is even more attenuated than the allegations
in Reilly and other risk-of-harm cases in which courts have found no standing. See,
e.g., In re Horizon Healthcare Services, Inc. Data Breach Litigation, 2015 WL
1472483, at *6 (March 31, 2015); In re Toys “R” Us – Delaware, Inc. – FACTA
Litigation, 2010 WL 5071073, at *11 (C.D. Cal. Aug. 17, 2010) (risk of printing the
first six and final four digits of credit card were statistically negligible). In Reilly, for
instance, the court found no standing where hackers “potentially gained access to
personal and financial information” after a security breach, because there was no
evidence that “the hacker read, copied, or understood” the data. Reilly, 664 F.3d, at
42; Khan, 2016 WL 2946165, at *5. By analogy, Plaintiff’s injury would be further
removed still: akin to an increased risk of a data breach sometime in the future. That
possibility is not sufficiently “concrete” to qualify as an “injury in fact.” See Clapper,
133 S. Ct. 1138, 1147 (2013) (“Allegations of future harm can establish Article III
standing if that harm is “certainly impending,” but “allegations of possible future
injury are not sufficient.”).
The Court recognizes that Congress may “define injuries and articulate chains
of causation that will give rise to a case or controversy where none existed before.”
136 S. Ct., at 1549. But “Congress’ role in identifying and elevating intangible harms
5

does not mean that a plaintiff automatically satisfies the injury-in-fact requirement
whenever a statute grants a person a statutory right . . .” Id. (internal quotations
omitted). Not all violations of FACTA “cause harm or present any material risk of
harm.” See id. at 1550; Smith v. Ohio State University, 2016 WL 3182675, at *4 (S.D.
Ohio June 8, 2016) (no standing under Spokeo for “bare procedural violation” of
FCRA). No facts in the Senate Report cited by Plaintiff validate the alleged injury.
See Senate Report No. 108-166 (Oct. 17, 2003). In fact, as Defendants note, the
Credit and Debit Card Receipt Clarification Act of 2007 instructs that “[t]he purpose
of [FACTA] is to ensure that consumers suffering from any actual harm to their
credit or identity are protected.” Pub. L. No. 110-241 (June 3, 2008) (emphasis
added). See Harris v. Wal-Mart Stores Inc., No. 07 C 02561, 2008 WL 5085132, at
*2 (N.D. Ill. Nov. 25, 2008) (“Congress made clear that its purpose in enacting the
Clarification Act and amending § 1681n was to allow claims as a result of actual
harm to one's credit or identity and to dispense with claims where no actual harm is
sustained.”).
While FACTA as a whole may implicate traditional privacy interests,
Plaintiff’s alleged injury does not. See Braitberg, 2016 WL 4698283, at *4 (no
standing for violation of data retention, because “[a]lthough there is a common law
traditional of lawsuits for invasion of privacy, the retention of information lawfully
obtained, without further disclosure, traditionally has not provided the basis for a
lawsuit in American courts.”). Without an “injury in fact,” Plaintiff lacks standing to
sue under Article III. Plaintiff is free to refile an amended complaint within 30 days
of this decision.
IV.

CONCLUSION

For the forgoing reasons, the Defendants’ motion to dismiss the Complaint is
GRANTED without prejudice to Plaintiff’s right to file an amended
complaint within thirty days of this decision.

/s/ William J. Martini
WILLIAM J. MARTINI, U.S.D.J.
October 20, 2016

6