KAMAL v. J. CREW GROUP, INC. et al

Filing 88

Amended Opinion. Signed by Judge William J. Martini on 6/13/17. (gh, )

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF NEW JERSEY

Civ. No. 2:15-0190 (WJM)

AHMED KAMAL,
Plaintiff,

OPINION
v.
J. CREW GROUP, INC., et al.,
Defendants.

WILLIAM J. MARTINI, U.S.D.J.:
Plaintiff Ahmed Kamal brings this putative class action suit for alleged violations of
the Fair and Accurate Credit Transactions Act amendment to the Fair Credit Reporting Act,
15 U.S.C. § 1681, et seq. This matter comes before the Court on Defendants’ motion to
dismiss Plaintiff’s Second Amended Complaint for lack of subject matter jurisdiction under
Federal Rule of Civil Procedure 12(b)(1). There was no oral argument. See Fed. R. Civ. P.
78(b). For the reasons set forth below, the motion to dismiss is GRANTED. Plaintiff’s Second
Amended Complaint is DISMISSED with prejudice.
I.

BACKGROUND

The Fair and Accurate Credit Transactions Act (“FACTA”) states that “no person that
accepts credit cards or debit cards for the transaction of business shall print more than the last
5 digits of the card number . . . upon any receipt provided to the cardholder at the point of the
sale or transaction.” 15 U.S.C.A. § 1681c. The statute creates a private cause of action for
“any actual damages . . . or damages of not less than $100 and not more than $1,000” for each
violation. 15 U.S.C. § 1681n(a).
Plaintiff Ahmed Kamal alleges that on three occasions Defendants, a conglomerate of
clothing stores and manufacturers comprising J. Crew (“J. Crew” or “Defendants”), printed
the first six and last four digits of Plaintiff’s credit card number on transaction receipts.
Second Amended Complaint (“SAC”) ¶ 2. Plaintiff purports to bring this action “on behalf of
all persons or entities to whom Defendants provided an electronically printed receipt at the
point of sale or transaction . . . which receipt displayed more than the last five digits of the
customer’s credit card number.” SAC ¶ 20.
1

Procedural History before this Court
Plaintiff filed his single-count FACTA Complaint on January 10, 2015, and his First
Amended Complaint (“FAC”) on March 25, 2015. He seeks statutory damages of $100 to
$1000 per violation along with attorneys’ fees and punitive damages. On August 6, 2015, the
Court denied Defendants’ motion to dismiss under Federal Rule of Civil Procedure 12(b)(6),
finding that Plaintiff adequately stated a claim for willful violation of FACTA’s credit-card
number truncation provision. ECF No. 33. See 15 U.S.C. § 1681, et seq. The Court granted J.
Crew’s motion to stay the case in December 2015 pending the Supreme Court’s decision
regarding constitutional standing in Spokeo Inc. v. Robins, 136 S. Ct. 1540 (2016). On May
16, 2016, the Supreme Court held that a plaintiff does not automatically “satisf[y] the injuryin-fact requirement whenever a statute grants a person a statutory right and purports to
authorize that person to sue to vindicate that right.” Spokeo, 136 S. Ct. at 1549. Applying
Spokeo, this Court determined that it lacked subject matter jurisdiction and dismissed Kamal’s
FAC without prejudice. Most federal courts faced with similar FACTA complaints have
agreed that a violation of the credit-card truncation provision does not automatically confer
Article III standing under Spokeo.1
Plaintiff filed the SAC on November 17, 2016. ECF No. 65. Defendants again moved
to dismiss for lack of standing. On January 20, 2017, as this motion was pending, the Third
Circuit decided In re Horizon Healthcare Servs. Data Breach Litig., 846 F.3d 625 (3d Cir.
2017) (hereinafter “Horizon”), which applied Spokeo in the context of an alleged data breach
that led to the disclosure of the plaintiff’s personal information. At the parties’ request, this
Court allowed for a short supplementary briefing schedule. Meanwhile, J. Crew moved
without opposition to consolidate this case with Parker v. J. Crew Group, Inc., et al.,
(“Parker”), a case originally filed in Illinois state court and then removed to the Northern
District of Illinois. On February 21, 2017, the Northern District of Illinois transferred the case
to the District of New Jersey pursuant to 28 U.S.C. § 1404(a) (providing transfer “for the
convenience of the parties and witnesses, in the interests of justice . . ..”); Order of Judge
Samuel Der-Yeghiayan, ECF No. 75, Ex. B. This case and Parker involve virtually identical
facts. Magistrate Judge Mark Falk granted the unopposed motion to consolidate on May 1,
2017. On May 5, 2017, after a telephone conference with the parties, Judge Falk temporarily

1

See Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 724, 727-28 (7th Cir. 2016); Katz v.
Donna Karan Int’l, Inc., 2017 WL 2191605 (S.D.N.Y. May 17, 2017); Llewellyn v. AZ
Compassionate Care Inc., No. 16-cv-04181, 2017 WL 1437632, at *6 (D. Ariz. Apr. 24, 2017);
Hendrick v. Aramark Corp., 2017 WL 1397241, at *4-5 (E.D. Penn. Apr. 18, 2017). See also
Cruper-Weinmann v. Paris Baguette Am., Inc., 13-cv-7013, 2017 WL 398657, at *3 (S.D.N.Y. Jan.
30, 2017); Stelmachers v. Verifone Systems, Inc., 14-04912, 2016 WL 6835084, at *4 (N. D. Cal.
Nov. 21, 2016); Thompson v. Rally House of Kansas City et al., 15-cv-00886, at *9 (W.D. Mo. Oct.
6, 2016); Noble v. Nevada Checker CAB Corp., No. 2:15-cv-02322, 2016 WL 4432685, at *3 (D.
Nev. Aug. 19, 2016).
2

stayed Parker pending this Court’s decision on J. Crew’s motion to dismiss Kamal’s SAC,
which the Court now decides.2
II.

LEGAL STANDARD

Federal Rule of Civil Procedure 12(b)(1) is the proper vehicle for challenging a
plaintiff’s Article III standing. Fed. R. Civ. P. 12(b)(1). See Society Hill Towers Owners’
Ass’n v. Rendell, 210 F.3d 168, 175 (3d Cir. 2000); Reilly v. Ceridian Corp., 664 F.3d 38, 41
(3d Cir. 2011) (citations omitted). Challenges to standing are either “facial” or “factual.”
Davis v. Wells Fargo, 824 F.3d 333, 346 (3d Cir. 2016). J. Crew’s challenge is facial, in that
it does not dispute what facts are, but rather whether the facts as plead create standing. In
such cases, a “presumptive truthfulness attaches to the plaintiff’s allegations,” as would be
the case in a 12(b)(6) setting. Horizon, 846 F.3d at 633, (citing Davis v. Wells Fargo, 824
F.3d 333, 346 (3d Cir. 2016)). Nonetheless, plaintiffs always bear the burden of establishing
subject matter jurisdiction. Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016). Animal Sci. Prod.,
Inc. v. China Minmetals Corp., 654 F.3d 462, 470 (3d Cir. 2011). “Although ‘general factual
allegations of injury resulting from the defendant’s conduct may suffice,’ the complaint must
still ‘clearly and specifically set forth facts sufficient to satisfy’ Article III.” Reilly v. Ceridian
Corp., 664 F.3d 38, 41 (3d Cir. 2011)(citations omitted).
III.

DISCUSSION

The Constitution limits the subject matter jurisdiction of federal courts to “cases” and
“controversies.” See U.S. Art. III § 2. To establish constitutional standing, plaintiffs must,
inter alia, “clearly . . . allege facts demonstrating” an “injury in fact.” Lujan v. Defs. Of
Wildlife, 504 U.S. 555, 561 (1992). An “injury in fact” is “an invasion of a legally protected
interest which is concrete and particularized.” Id. at 560 (citations omitted). The issue in this
case is whether Kamal alleges a sufficiently “concrete” harm to confer standing. The Court
will briefly summarize two recent, governing cases on the issue of concreteness, Spokeo and
Horizon. Applying this case law, the Court finds that Kamal fails to clearly allege facts
demonstrating that he has sustained a concrete injury in fact.
A. Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016)
The Supreme Court in Spokeo v. Robbins clarified that an “injury in fact” must be
“concrete,” which means “it must actually exist.” Spokeo Inc. v. Robins, 136 S. Ct. 1540, 1548
(2016) ((citing Black’s Law Dictionary 479 (9th ed. 2009)). “Concrete” injuries may be
“intangible” or non-economic, but, like other cognizable injuries, they must be “actual or
imminent, not conjectural or hypothetical.” Spokeo, 136 S. Ct. at 1548. Spokeo provided two
factors that determine whether an intangible harm is sufficiently concrete. Id. at 1549. The
first is “whether an alleged intangible harm has a close relationship to a harm that has
traditionally been regarded as providing a basis for a lawsuit in English or American courts.”
Id. If so, “it is likely to be sufficient to satisfy the injury-in-fact element of standing.” Horizon,
Judge Falk also administratively denied Kamal’s motion for appointment of interim lead counsel.
ECF No. 83.
2

3

846 F.3d at 637 (3d Cir. 2017). The second consideration is “whether Congress has expressed
an intent to make an injury redressable;” for, “even if an injury was previously inadequate in
law, Congress may elevate it to the status of [a] legally cognizable injur[y].” Id. (quoting
Spokeo, 846 F.3d at 637) (internal citations omitted). Still, a plaintiff does not “automatically
satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and
purports to authorize that person to sue to vindicate that right. Article III standing requires a
concrete injury even in the context of a statutory violation.” Spokeo, 136 S. Ct. at 1549.
B. In re Horizon Healthcare Serv. Data Breach Litig., 846 F.3d 625 (3d Cir. 2017)
The Third Circuit recently applied Spokeo in In re Horizon Healthcare Services Inc.
Data Breach Violation, 846 F.3d 625 (3d Cir. 2017). The plaintiff in Horizon alleged that two
laptop computers containing unencrypted personal information of over 800,000 health
insurance customers were stolen from Horizon’s headquarters. Id. at 630. Among the stolen
data were names, addresses, member identification numbers, dates of birth, “and in some
instances, a Social Security Number and/or limited clinical information.” Id. The breach led
to a fraudulent tax return filed in plaintiff’s name and to an attempted credit card fraud.
Plaintiff was also “denied retail credit because his social security number has been associated
with identity theft.” Id. The complaint alleged multiple violations of the FCRA, including the
unauthorized “furnishing” of certain personal information and failure to “adopt reasonable
procedures to keep sensitive information confidential,” along with several common law
privacy torts. Id. at n. 5, 631 (citing 15 U.S.C. § 1681(b); 1681a(d)(3)).
Applying Spokeo, the Third Circuit denied Horizon’s facial challenge, holding that the
alleged injuries were sufficiently “concrete” to confer constitutional standing. First, under
Anglo-American law, “unauthorized disclosures of information have long been seen as
injurious.” Id at 638. Indeed, “[t]he common law alone will sometimes protect a person’s right
to prevent the dissemination of private information . . . [and] improper dissemination of
information can itself constitute a cognizable injury.” Id. at 638-39. Second, by passing the
FCRA, Congress clearly intended to establish “that the unauthorized dissemination of
personal information by a credit reporting agency causes an injury in and of itself—whether
or not the disclosure of that information increased the risk of identity theft or some other
future harm.” Id. at 639. In sum, the alleged injury was “concrete” because it sufficiently
resembled a common law injury (invasion of privacy), such that Congress could “elevat[e]
[it] to the status of legally cognizable injur[y].” Id at 640. The Horizon majority declined to
consider “the full reach of congressional power to elevate a procedural violation to an injury
in fact,” because the case before it “[did] not strain that reach.” Horizon, 846 F.3d at 638.
C. Plaintiff’s Article III Standing
Plaintiff identifies two distinct “concrete” injuries: (1) disclosure of information
considered by law to be intrinsically private, and (2) the increased risk of identity theft or
credit-card fraud in the future.3 SAC ¶ 36. Neither theory adequately alleges a “concrete”
harm, so Plaintiff fails to satisfy the injury-in-fact element of constitutional standing.
3

The SAC differs from the FAC mainly in that it adds more legislative history in support of its
4

1. No de facto Injury to Plaintiff’s Privacy Rights
There is no meaningful relationship between J. Crew’s conduct and any privacy
interest historically recognized at common law. See Horizon, 846 F.3d at 637 (“The first test,
the one of history, asks whether ‘an alleged intangible harm’ is closely related ‘to a harm that
has traditionally been regarded as providing a basis for a lawsuit in English or American
Courts.’) (citing Spokeo, 136 S. Ct. at 1545). Unlike in Horizon, Plaintiff’s personal
information was not disclosed to third parties or used to perpetrate credit-card or tax fraud.
See Horizon, 846 F.3d at 637 (noting that in Spokeo, where the Supreme Court found no de
facto standing, “[t]he complaint did not include any allegation that the false information was
actually used to the plaintiff’s detriment.”). See id. at 641.
In contrast, Kamal alleges “a bare procedural violation, divorced from any concrete
harm,” under circumstances that do not implicate traditional common law privacy interests.
For one, J. Crew did not “disclose” Kamal’s personal information. Rather, Kamal gave his
credit-card number to J. Crew, which then printed a receipt containing part of that number
and handed it back to Kamal.4 See Stelmachers v. Verifone Systems, Inc., 2016 WL 6835084,
at *4 (Nov. 21, 2016). Regardless, printing a card’s first six and last four digits—rather than
only the last five digits—does not implicate the historic “right to be let alone,” particularly
when the first six digits do not pertain to the customer’s individual bank account. See infra p.
6. See also The Right to Privacy, Warren & Brandeis, 4 Harv. L. Rev. at 193. This case is
unlike In re Nickelodeon Consumer Privacy Litigation, in which the complaint alleged
“disclosure of information relating to [each plaintiff’s] online behavior.” 827 F.3d 262, 273
(3d Cir. 2016) (finding standing where defendant violated federal statute by surreptitious,
unauthorized tracking of plaintiffs’ internet activities). Nor does the SAC allege unauthorized
access to personal information. See In re Google Inc. Cookie Placement Consumer Privacy
Litig., 806 F.3d 125 (3d Cir. 2015) (defendants surreptitiously “implanted tracking cookies
on [plaintiffs’] personal computers] in order to track behavior ).
As for the second Spokeo factor, “the judgment of Congress,” the Court finds that the
legislative intent underlying FACTA’s private cause of action is more ambiguous than
Plaintiff suggests. Congress sought to “ensure that consumers suffering from any actual harm
to their credit or identity are protected.” Pub. L. No. 110-241 (emphasis in original). While
Congress undoubtedly hoped that FACTA would reduce identify theft, it does not follow that
Congress contemplated private actions by individuals who have not sustained any actual
harm. See id.; Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 724, 727-28 (7th Cir.
2016). In fact, the Clarification Act warned that “the continued appealing and filing of these
lawsuits represents a significant burden on the hundreds of companies that have been sued
contention that Congress intended to create a de facto injury for each violation of FACTA’s creditcard truncation provision. The FAC and SAC are otherwise virtually identical.
4
As an aside, the Court notes that Kamal continued to purchase from J. Crew even after sustaining
his first alleged “injury.” Despite receiving an insufficiently truncated receipt on December 18,
2014, Kamal made purchases on December 22, 2014, and January 4, 2015, albeit at different J.
Crew retailers.
5

and could well raise prices to consumers without corresponding consumer protection benefit.”
Id. at 728 (citing Pub. L. 110-241, § 2(a)(7)).
2. Material Risk of Future Harm
The second alleged basis for standing is that Plaintiff sustained an increased risk of
identity theft at some time in the future.5 Spokeo itself asked “whether the particular
procedural violations alleged in [a] case entail a degree of risk sufficient to meet the
concreteness requirement.” Bock v. Pressler & Pressler, LLP, 658 F. App'x 63, 65 (3d Cir.
2016) (quoting Spokeo, 136 S.Ct. at 1550).6 If Kamal adequately alleges that J. Crew’s
statutory violation creates a material risk of future harm, then Kamal likely has constitutional
standing. See Reilly v. Ceridian Corp., 664 F.3d 38 (3d. Cir. 2011). Even drawing all
reasonable inferences in Plaintiff’s favor, however, the risk-of-harm argument fails to
establish constitutional standing.
The Court takes notice that credit and debit card numbers are 16 digits long. The first
six relate to the bank or card-issuer and the last 10 refer to the card-holder’s specific account.
See Toys “R” Us – Delaware, Inc. FACTA Lit., MDL No. 08-01980, 2010 WL 5071073, at
*11 (C.D. Cal. Aug. 17, 2010). Given these facts, the Court cannot reasonably infer that
printing the first six and last four digits of Plaintiff’s credit card materially increased the risk
of future harm, because doing so “gives an identity thief no more personal information about
a person's account than Congress has permitted to be printed on receipts.” See, e.g., Noble v.
Nevada Checker CAB Corp., No. 2:15-cv-02322-RCJ-VCF, 2016 WL 4432685, at *3 (D.
Nev. Aug. 19, 2016).7

As the Third Circuit explained, it is not required that a plaintiff allege a “material risk of harm” in
order to establish standing where a statutory violation is related to an intangible right historically
recognized at common law. Horizon, 846 F3d. at 637. It does not follow, however, that a “material
risk of harm” may not be sufficient to create standing “where the mere technical violation of a
procedural requirement of a statute cannot, in and of itself, constitute an injury in fact.” See, e.g.,
Horizon, 846 F.3d at 641-42 (Shwartz, J., concurring). As such, the Court must examine Plaintiff’s
alternate position that printing the first six and last four digits of a credit card number on a customer
receipt “created a real risk of identity theft.” SAC ¶ 107.
6
While it emphasized the importance of congressional intent, the Horizon majority also stated that
“an increased risk of future injury . . . at least weighs in favor of standing.” Id. at n. 19, 639. The
plaintiffs made a “legitimate argument that they face increased risk of future injury,” as “the
information that was stolen was highly personal and could be used to steal one’s identity . . . The
theft appears to have been direct toward the acquisition of such personal information . . . [and] [t]he
stolen laptops were unencrypted, meaning that the personal information was easily accessible.” Id.
(citations omitted). See Horizon, 846 F.3d at 641 (Shwartz, J., concurring).
7
Since only the last 10 digits contain information personal to the Plaintiff’s account, printing the
first six and last four digits would seem to offer more protection than the statute’s prohibition of
printing more than the last five digits. The Court refers to the statute’s text only to the extent it
illuminates congressional intent. Whether Plaintiff states a cause of action under § 1681c is not at
issue.
5

6

Like the FAC, the SAC alternates its focus between “dumpster divers,” who gather lost
or discard receipts, and more “sophisticated criminals,” who use electronic means to
perpetrate fraud. SAC ¶¶ 28, 37. The threat posed by dumpster divers consists of a highly
“speculative chain of future events,” Reilly 664 F.3d at 42: Kamal loses or throws away one
of his J. Crew receipts, which is then discovered by a hypothetical third party, who then
obtains the six remaining truncated digits along with any additional information required to
use the card, such as the expiration date, security code or zip code, and proceeds to make
online purchases. Unsurprisingly, Plaintiff cites no specific examples of this actually
occurring. As the Court explained in its previous opinion, “there is no evidence that anyone
has accessed or attempted to access or will access Plaintiff’s credit card information.” See
Opinion Granting Motion to Dismiss FAC, at p. 5; ECF No. 63.
Alternatively, Plaintiff vaguely alleges that “sophisticated criminals” may deduce the
remaining truncated numbers electronically. See SAC ¶ 37. Plaintiff provides two articles in
support of this allegation, yet neither concerns credit-card truncation. The first article, in
Exhibit A of the SAC, analyzes the incremental risk of identity theft under conditions in which
the entire credit card number has already been obtained by prospective identity thieves.
Muhammed Aamir Ali, et al., Does Online Card Payment Landscape Unwittingly Facilitate
Fraud?, ECF No. 69-2. Plaintiff’s Exhibit B contains an article by the same author that merely
recapitulates the findings discussed in the first article.
The Court does not dispute that Congress “must have leeway to calibrate the burden of
consumer protection as it best sees fit.” Letter from Marvin L. Frank, at 3, ECF No. 70. But
Congress cannot empower individuals to manufacture a “case” or “controversy” where none
exists. As Spokeo explained and Horizon acknowledged, the “congressional power to elevate
intangible harms into concrete injuries is not without limits.” Horizon, 846 F.3d at 638 (citing
Spokeo, 136 S. Ct. at 1549). Those limits are established by Article III of the Constitution, as
interpreted by the Supreme Court. This Court finds that J. Crew’s technical violation of
FACTA lies beyond these limits. The Court lacks subject matter jurisdiction and the case must
be dismissed.
IV.

CONCLUSION
For the forgoing reasons, Defendants’ motion to dismiss Plaintiff’s Second Amended
Complaint pursuant to Rule 12(b)(1) is GRANTED. Plaintiff’s Second Amended
Complaint is DISMISSED with prejudice.

/s/ William J. Martini
WILLIAM J. MARTINI, U.S.D.J.
June 13, 2017

7