Every data breach class action in federal court must confront a threshold question: has the plaintiff alleged a sufficient “injury in fact” to establish Article III standing? The inquiry frequently focuses on whether a plaintiff has standing simply by pleading an increased risk of future injury from the theft of personal identifying information (PII). This is because many named plaintiffs do not––because they cannot––allege any present harm. The federal courts of appeals continue to weigh in on the issue of whether allegations of possible future harm suffice for Article III purposes. But far from providing clarity or consensus, recent appellate decisions have reached differing conclusions, which appear highly dependent on the nature of the facts alleged in each case.
Recently, the Ninth Circuit held in Bassett v. ABM Parking Services, Inc. that an allegation that a business violated the Fair and Accurate Credit Transactions Act (“FACTA”) by printing a credit card expiration date on a customer’s receipt is, by itself, insufficient to establish Article III standing under Spokeo, Inc. v. Robins. (For more information, read K&L Gates alerts on the Bassett decision and FACTA standing jurisprudence.) Now, in Noble v. Nevada Checker Cab Corp., No. 16-16573 (9th Cir. Mar. 9, 2018), the Ninth Circuit reached the same conclusion with respect to an alleged FACTA violation arising out of the printing of the first digit of the card number in addition to the last four digits. In doing so, the Ninth Circuit appears to be sending a strong signal to potential FACTA plaintiffs that something more than a technical violation is necessary to have standing to pursue statutory damages in federal court under FACTA.
The Sixth Circuit Court of Appeals recently ended a Fair Debt Collection Practices Act (“FDCPA”) lawsuit because the plaintiffs could not show that the allegedly offending letter had caused them actual harm. In Hagy v. Demers & Adams, the Sixth Circuit held that the plaintiffs lacked standing to sue a law firm for its technical FDCPA violation, namely failing to identify itself as a debt collector in a letter to the plaintiffs. Debt collectors will likely applaud the practical and sensible approach the Sixth Circuit applied in Hagy. The decision is remarkable, however, for its constitutional rebuke of Congress. Reminding the legislative branch that it lacks general police powers to create statutory remedies where no actual harm exists, the Sixth Circuit’s decision suggests — without specifically stating — that the statutory damage provision of the FDCPA may be unconstitutional. Read More