Every data breach class action in federal court must confront a threshold question: has the plaintiff alleged a sufficient “injury in fact” to establish Article III standing? The inquiry frequently focuses on whether a plaintiff has standing simply by pleading an increased risk of future injury from the theft of personal identifying information (PII). This is because many named plaintiffs do not––because they cannot––allege any present harm. The federal courts of appeals continue to weigh in on the issue of whether allegations of possible future harm suffice for Article III purposes. But far from providing clarity or consensus, recent appellate decisions have reached differing conclusions, which appear highly dependent on the nature of the facts alleged in each case.
Recently, the Ninth Circuit held in Bassett v. ABM Parking Services, Inc. that an allegation that a business violated the Fair and Accurate Credit Transactions Act (“FACTA”) by printing a credit card expiration date on a customer’s receipt is, by itself, insufficient to establish Article III standing under Spokeo, Inc. v. Robins. (For more information, read K&L Gates alerts on the Bassett decision and FACTA standing jurisprudence.) Now, in Noble v. Nevada Checker Cab Corp., No. 16-16573 (9th Cir. Mar. 9, 2018), the Ninth Circuit reached the same conclusion with respect to an alleged FACTA violation arising out of the printing of the first digit of the card number in addition to the last four digits. In doing so, the Ninth Circuit appears to be sending a strong signal to potential FACTA plaintiffs that something more than a technical violation is necessary to have standing to pursue statutory damages in federal court under FACTA.
The Ninth Circuit recently held in Bassett v. ABM Parking Services, Inc. that a plaintiff cannot establish Article III standing to maintain a Fair and Accurate Credit Transactions Act (“FACTA”) claim merely by pleading that a business printed a credit card expiration date on the plaintiff’s receipt. In so ruling, the Ninth Circuit followed similar rulings by the Second and Seventh Circuits, avoiding a potential circuit split. As explained below, the Bassett decision is the latest in a growing majority of cases in the wake of Spokeo, Inc. v. Robins that demand a plaintiff allege actual harm to maintain a FACTA damages claim—even one for statutory damages based on an alleged willful violation.
After paying for groceries with a credit card or debit card, the clerk hands the receipt to the customer. In addition to the last four digits of the card number, it contains the first digit. Or perhaps it contains the first six digits. Or maybe the expiration date. Is this a concrete injury that provides the customer standing to sue the grocery store?
That is the question federal courts have grappled with since the Supreme Court decided Spokeo, Inc. v. Robins in May 2016. The Fair and Accurate Credit Transactions Act (“FACTA”) regulates retailers’ conduct in printing card number information on customers’ receipts and provides a private right of action for alleged violations. But, as discussed below, a customer may not have standing to sue in federal court or even in certain state courts just because a violation may have occurred.
The Ninth Circuit has opined, again, on whether a statutory violation of the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. §§ 1681, et seq.—by itself—constitutes a concrete injury for Article III standing purposes. Last year, in Spokeo, Inc. v. Robins, the United States Supreme Court vacated and remanded the Ninth Circuit’s original opinion on the issue. Although the Ninth Circuit had reviewed the plaintiff’s allegations for existence of a particularized injury, it had not separately analyzed whether they described a sufficiently concrete injury. In Spokeo, the Supreme Court ruled that “a bare procedural violation [of a federal statute], divorced from any concrete harm,” does not suffice to “satisfy the injury-in-fact requirement of Article III.” But the Court declined to define a “bare procedural violation” in favor of allowing the Ninth Circuit to first consider the question. Now that the Ninth Circuit has done so, the Supreme Court may take up the question once more.
To read the full alert, click here.
From the January 27, 2017 issue of the Washington Legal Foundation’s LEGAL BACKGROUNDER, Vol. 32 No. 3, with permission from the Washington Legal Foundation (WLF).
Last term, in Spokeo, Inc. v. Robins, the United States Supreme Court issued a much-anticipated opinion on Article III standing. The Court reiterated that to establish standing at the pleading stage, a plaintiff must allege an injury-in-fact that is both particularized and concrete. In other words, a plaintiff bringing suit upon an alleged statutory violation may not establish standing by merely alleging “a bare procedural violation, divorced from any concrete harm.”
Much has been written about Spokeo in the intervening months. Some members of the plaintiffs’ bar have lauded the decision as purportedly protecting consumer rights; some members of the defense bar have suggested Spokeo may signal the end of statutory class actions. Yet, to date, courts have not taken a uniform, bright-line approach in applying Spokeo to civil litigation asserting statutory causes of action, including those styled as putative class actions. Even still, courts have begun to develop two apparent schools of thought on how to analyze standing under Spokeo, resulting in increasingly divided case law across the country.
This article analyzes a few notable decisions applying each of these two approaches and considers the possibility that courts may begin to apply a third, “hybrid” approach.
To read the full article, click here.
The Eighth Circuit recently became the one of the first federal Courts of Appeals to apply the U.S. Supreme Court’s Article III standing decision in Spokeo Inc. v. Robins to a data privacy case. The Eighth Circuit affirmed the dismissal of a putative class action complaint on the basis that the plaintiff failed to allege a concrete injury that “actually exist[s],” is “real,” and is not “abstract.” The lawsuit alleged that Charter Communications, Inc. (“Charter”), a company providing cable services, retained the personally identifiable information (“PII”) of its former customers well after the customers’ cancellation of their services. Because the plaintiff asserted only a technical violation of the statute, without alleging how that violation had actually injured him, the Eighth Circuit found that, under Spokeo, the plaintiff failed to plead a concrete and particularized injury sufficient to establish standing to file suit in federal court.
To read the full alert, click here.
With the ever-increasing amount of personal information stored online, it is unsurprising that data breach litigation has become increasingly common. A critical issue in nearly all data breach litigation is whether a plaintiff has standing to pursue claims—especially where there is no evidence of actual fraud or identity theft resulting from the purported data breach. The plaintiffs’ bar has pursued a litany of legal theories in the attempt to clear the standing hurdle, including the recent theory of “overpayment” (a/k/a “benefit of the bargain” theory). Under this theory, the plaintiff alleges that the price for the purchased product or service—whether sneakers, restaurant meals, or health insurance—included some indeterminate amount allocated to data security. Depending on how the theory is framed, the purported “injury” is either that the plaintiff “overpaid” for the product or service, or that the plaintiff did not receive the “benefit of the bargain,” because the defendant did not appropriately use the indeterminate amount to provide adequate data security. Despite plaintiffs’ attempts to establish standing through this novel theory, courts have limited its applicability in a variety of ways discussed in this alert.
To read the full alert, click here.
On Monday, the United States Supreme Court issued its long-awaited decision in Spokeo, Inc. v. Robins, — U.S. — (No. 13-1339). In rendering its decision, the Court reiterated that to establish Article III standing, a plaintiff must plead an injury-in-fact that is both particular to the plaintiff and concrete. The Court explained that whether a plaintiff has pleaded sufficient facts to allege a concrete injury requires more than just examining whether the plaintiff has pleaded that the defendant violated a federal statute. In particular, the Court held that “a bare procedural violation, divorced from any concrete harm,” does not suffice to “satisfy the injury-in-fact requirement of Article III.” Slip op. at 9-10. As such, the Spokeo plaintiff’s allegation that the defendant’s actions had violated the Fair Credit Reporting Act, 15 U.S.C. §§ 1681, et seq., would not, by itself, demonstrate a plausible injury-in-fact. Rather, “Article III standing requires a concrete injury even in the context of a statutory violation.” Slip op. at 9.