Another Court Rules No Harm In Extra Digits
Tarr v. Burger King
Dismissed – Burger King allegedly printed the first six and last four digits of plaintiff’s credit card on an in store receipt. The court found that plaintiff failed to allege anyone besides him viewed his receipt, that he suffered identify theft, or any unauthorized purchases were made with his card. Although particularized, the alleged harms were not concrete, and the case must be dismissed for lack of subject matter jurisdiction.
[S.D. N.Y.; 1:17-cv-23776]
jbho: yet another interpretation of “no harm, no foul” under Spokeo.
As an aside, I recently read an article on common mistakes law students make. One was skipping over the “recitals” and jumping right to the analysis. Here the court prefaced the analysis by saying, “(t)o survive a motion to dismiss, plaintiffs must do more than merely state legal conclusions, (but) must allege some specific factual basis for those conclusions … (i)n short, the complaint must not merely allege misconduct, but must demonstrate that the pleader is entitled to relief” (citations omitted). Pretty much indicted plaintiff was doomed from the outset?
State Court Dismisses Receipt Case For Lack Of Concrete Injury
Miles v. The Company Store
Dismissed – The Company Store allegedly printed the first six and last four digits of plaintiff’s credit card on an in store receipt. The court found that plaintiff failed to allege the receipt was seen by anyone or that he suffered identify theft. As such, allegations of “exceeding federal statutory limits” alone were insufficient to confer standing under North Carolina law.
[Alamance Co. Sup. Ct.; 16-cvs-2346]
jbho: interesting to see a state court apply the Spokeo standard of no disclosure, no harm. Even though the opinion does not explicitly mention Spokeo.
Another Court Rules No Harm In Unredacted Zip Codes
Fullwood v. Wolfgang’s Steakhouse
Dismissed – Wolfgang’s allegedly printed the full expiration date of plaintiff’s credit card on a paper receipt. The court found that Plaintiff failed to allege she had been the victim of identity theft or credit card fraud, and did not allege damages incurred through defendants alleged FACTA violations.
[S.D. N.Y.; 1:13-cv-07174]
jbho: another win under Spokeo. Here the court found “Plaintiff’s amendments to her pleading are no match for the rising tide of binding precedent holding that a bare procedural violation of FACTA, without more, does not confer Article III standing.”
Still, a mess that could have been avoided if expiration dates had been redacted.
Another Court Rules No Harm In Unredacted Zip Codes
O’Shea v. P.C. Richard
Dismissed – P.C. Richard allegedly printed full expiration dates on a credit card receipts. The court found plaintiffs failed to allege their identities had been stolen, or they had been victims of credit card fraud. The allegations of increased risk were insufficient to constitute a concrete harm.
The court declined to consider the “other things” plaintiffs alleged were printed on the receipt, since the printing of the “other things” (brand of card, last four digits of card number, full name, physical address, telephone number, and email) were not proscribed by FACTA.
[S.D. N.Y.; 2:15-cv-09069]
jbho: the court heavily referenced Cruper-Weinmann v. Paris Baguette (2nd. Circ; 14-3709 [Orig: S.D. N.Y.; 1:13-cv-07013]) in its analysis, where the court found a printed expiration date did not raise a material risk of identity theft.
Another Receipt Case In South Florida
Gesten v. Burger King
Class complaint – Burger King allegedly printed the first six and last four digits of plaintiff’s credit card on an in store receipt. Plaintiff claimed the receipt also identified his card as a debit card. Plaintiff further alleged Burger King has been previously sued for FACTA violations, and should have known better than to print the extraneous information on its receipts.
UPDATE: 27Sep2017 – dismissed (Doc# 35) The court found that plaintiff did not allege anyone saw his receipt, nor did he dispute the first six digits only identified the issuing institution. The court declined to follow the reasoning in other 11th circuit cases, finding they relied on pre-Spokeo decisions. While the redaction requirements of the FACTA may constitute a substantive right, the facts here demonstrated there was no particularized tangible or intangible concrete harm. “This case presents a perfect example of a procedural violation that may result in no harm, in contrast to the examples of statutory violations that constitute concrete injuries in and of themselves.”
[S.D. FL; 1:17-cv-22541]
jbho: given the success rate of receipt printing cases in the 11th, anyone doing business there would be wise to update their registers to print at most the last five digits of a card number (and hide/mask expiration dates as well).
Printing Unredacted Expiration Date & Payment Card Type Leads To Class Claims
Romero v. Darden Restaurants
Class complaint – Darden allegedly printed the expiration date and type of payment card on a receipt at a Bahama Breeze restaurant. The receipt allegedly identified plaintiff paid with a debit card. Plaintiff further alleged the (prohibited) information was printed despite the fact Darden was contractually prohibited from doing so, and had previously been sued for similar violations (e.g., violations were willful).
UPDATE: 1Aug2017 – The case was jointly dismissed without explanation (Doc #24)
[S.D. FL; 0:17-cv-61098]
jbho: the complaint doesn’t appear to plead any harms. However, other plaintiffs have had success in the 11th on similar claims. Remember both FACTA and card brand rules only permit the last five digits of a card number to be displayed.
Statutory Damages Don’t Automatically Confer Standing
Katz v. Donna Karan
Dismissed – Donna Karan allegedly printed the first six and last four digits of plaintiff’s credit card on in-store receipts from at least two locations.
The court found plaintiff failed to allege any harm, imminent or otherwise (no loss, no protective measures taken, no allegation anyone saw the receipt). On plaintiff’s claim the statutory damages under FCRA/FACTA automatically conferred Article III standing, the court found that while a procedural violation may constitute a concrete harm (e.g., risk of identity theft – the congressionally proscribed harm), plaintiff failed to allege any imminent risk resulting from Donna Karan’s alleged procedural violation. Under Spokeo, the availability of statutory damages, without any injury, did not automatically confer standing.
UPDATE: 19Sep2017: the dismissal was affirmed by a three-judge panel, finding the disclosure in question was a bare procedural violation, insufficient to maintain Article III standing. It did remand to correct the dismissal, finding a dismissal based on lack of subject matter jurisdiction must be entered without prejudice. (2nd Circ.; 15-0464)
[S.D. N.Y; 1:14-cv-00740]
jbho: yet again, no disclosure, no harm
Interestingly, the court also noted that FACTA did not necessarily create a privacy right. The congressional intent was the security of consumer identities.
$0.86 Receipt Case Eighty-Sixed Under Spokeo
Hendrick v. Aramark
Dismissed – Plaintiff purchased a soda, and Aramark allegedly displayed 10 credit card digits on his printed receipt, rather than the statutorily permitted ‘last five.’ The court found plaintiff alleged only an increased risk of harm, but no injury. The receipt remained in his possession, and there was no allegation anyone else saw the receipt. Nor did he allege any attempt to use or access his credit information. Thus, the allegations of increased risk were insufficient to meet the concreteness standard.
[E.D. PA; 2:16-cv-04069]
jbho: another case of no disclosure, no harm.
No Harm In Unredacted Expiration Date
Weinstein v. Intermountain
Dismissed – Intermountain Park City Clinic allegedly printed a full expiration date on a credit card receipt. The court found plaintiff failed to allege (i) the receipt was seen by or in the possession of another party, (ii) that he was a victim of fraud or identity theft as a result of the disclosure, or (iii) that he had taken a steps to protect himself as a result. Thus the “bare procedural violation” did not provide plaintiff standing, and claims were dismissed with prejudice.
[D. UT; 2:16-cv-00280]
jbho: once again, no disclosure, no harm.
Beefed Up FACTA Complaint
Gennock v. Kirkland
Class complaint – Kirkland allegedly printed the first six and last four digits of plaintiffs’ credit cards on in-store receipts. Plaintiffs claim since not all receipts are in their possession, they are at increased risk of identity theft and credit card fraud.
Updated: 20Nov2017 – magistrate recommendation motion to dismiss be denied (Doc#25). The magistrate rejected opinions of other courts stating the exposure of first 6 digits of a card number do not increase risk, finding that line of reasoning ignored the fact Congress explicitly prohibited printing more than the last five digits of a card number. Plaintiff need not to prove he suffered or was at increased risk identity theft to demonstrate standing, and Kirkland’s motion to dismiss for lack of standing should be denied. Additionally, since agreements with credit card issuers, as well as periodic communications from those issuers, apprised Kirkland’s of its obligation to truncate credit and debit card account numbers, plaintiffs’ allegations of willfulness were sufficient at the current stage of litigation.
UPDATE: 31Jan2018 – stayed (Doc#36). The outcome of this case hinges on common issued being addressed in Kamal v. J. Crew (3rd. Circ.; 17-2345).
[W.D. PA; 2:17-cv-00454]
jbho: appears complaints are evolving to address the recent trend of no disclosure, no harm in FACTA cases.
Class Claims Extra Digits Printed In Two Ways
Fernandez v. University of California
Class complaint – UCLA allegedly printed more than the permitted last five digits of her credit card number on paper receipts. Plaintiff seeks to represent two classes:
• People with cafeteria receipts that displayed the first six and last four digits
• People with campus store receipts that displayed the first digit and last four digits
[L.A. Co. Super. Ct.; BC656256]
jbho: as these cases get dismissed in federal court, there seems to be an uptick in filings at the state level. A reminder that Spokeo doesn’t make cases go away, it just keeps them out of federal court.
Whopping $31 Million For Unmasked Credit Card Expiration Dates
Flaum v. Doctor’s Associates
Preliminary $31M settlement – Subway Franchises owned by Doctor’s Associates allegedly printed unmasked expiration dates on credit card receipts. Highlights include:
• $30,900,000 non-reversionary settlement fund
• ~ $130 for each class member (estimated)
• $20,000 for lead class representative, $10,000 for supporting class representative
• $10.3 million for class counsel (requested – 1/3 of settlement fund)
Final Approval Hearing is set for 11 October 2017
[S.D. FL; 0:16-cv-61198]
jbho: a follow up on a previously covered case. Same as below, remember both FACTA and card brand rules require expiration dates to be masked.
According to the motion, the $31 settlement would be “the largest all-cash FACTA settlements … a new record for FACTA class actions.” Certainly the largest I’ve seen (so far…)
$1.2 Million Credit Card Truncation Settlement
Guarisma v. Microsoft
$1.2M preliminary settlement – Microsoft allegedly printed the first six and last four digits of plaintiff’s credit card number on his in-store receipt. Highlights include:
• $1,194,696 non-reversionary settlement fund
• up to $100 for each class member (expected)
• $10,000 for class representative (requested)
• $398,232 for class counsel (requested – 1/3 of settlement fund)
[S.D. FL; 1:15-cv-24326]
jbho: reminder that both FACTA and card brand rules only permit the last five digits to be displayed.
No Disclosure, No Harm
Paci v. Costco
Dismissed – Costco allegedly printed the first six digits of plaintiff’s credit card on a copy of her in-store receipt, a copy produced by Costco’s customer service desk. The court found plaintiff failed to allege any risk of identity theft (the receipt never left her care), or that a change in her normal receipt-handling routine (having to store the receipt in a filing cabinet) caused her any expense or emotional distress.
[N.D Ill.; 1:16-cv-00094]
jbho: another case that seems to follow the emerging model of no disclosure, no concrete harm.
$2.5 Million For Unmasked Credit Card Expiration Dates
Wood v. J Choo
$2.5M preliminary settlement – Jimmy Choo allegedly printed unmasked expiration dates on in-store credit card receipts. Highlights include:
• $2,500,000 non-reversionary settlement fund
• $75 – $175 for each class member (expected)
• $5,000 for class representative (requested)
• $150,000 for class administration (expected)
• $833,333.33 for class counsel (requested – 1/3 of settlement fund)
Unclaimed funds will revert to a cy pres distribution.
[S.D. FL; 9:15-cv-81487]
jbho: an update on a previously covered case, and a reminder that both FACTA and card brand rules require expiration dates to be masked. Although here, an aggravating factor may have been the inclusion of home address and telephone number on the receipt as well.
$0.00 For Unmasked Credit Card Expiration Dates
Cruper-Weinmann v. Paris Baguette
Dismissed with prejudice – Paris Baguette allegedly printed unmasked expiration dates on credit card receipts. The action was dismissed with prejudice in 2014 (pre-Spokeo), where the court found plaintiff failed to sufficiently plead Paris Baguette knowingly or recklessly violated the FACTA. On appeal, the 2nd Circuit vacated the dismissal, and instructed the lower court to re-evaluate plaintiff’s standing under Spokeo.
On remand, the court ruled plaintiff did not allege anyone saw or accessed her receipt, or that she was at an increased risk of identity theft. Thus inclusion of an unmasked expiration date was merely a procedural violation and there was no threat of concrete harm under the circumstances.
Update – 26June2017 – the decision was affirmed by the appellate court, determining a printed expiration date did not raise a material risk of identity theft. (2nd. Circ; 14‐3709)
[S.D. N.Y.; 1:13-cv-07013]
jbho: interesting in comparison to the J Choo case above. A circuit split? Or is Spokeo still working its way through the system?
Also of note, since the court found plaintiff suffered no concrete harm, it declined to address Paris Baguette’s larger argument that a failure to redact a card expiration date categorically does not subject consumers to increased risk of identity theft.
Beware The Allure Of A Federal Forum
Mocek v. AllSaints
Attorney’s fees granted – AllSaints allegedly printed the first six and last four digits of plaintiff’s credit card number on her receipt. Plaintiff filed suit in Cook County court, and AllSaints moved to have the case removed to federal court. Upon removal, AllSaints filed a motion to dismiss for lack of subject matter jurisdiction (no concrete harm under Spokeo). Plaintiff countered with a motion to remand and a request for attorney’s fees.
The court found the case never belonged in federal court, and both parties’ motions agreed on this point. Therefore, as all were in agreement the federal court lacked subject matter jurisdiction, no Article III analysis was necessary, and a remand to state court was in order.
On plaintiff’s motion for attorney’s fees, the court found defendant’s strategy of asserting – then immediately disavowing – federal jurisdiction, unnecessarily prolonged the proceedings. With both sides arguing against federal jurisdiction, it should have been obvious to defendant the only possible outcome was a remand to state court. Therefore, defendant lacked an objectively reasonable basis for seeking removal, and plaintiff was entitled to recover the $58,112.50 in attorney’s fees incurred as a result of removal.
[N.D. Ill; 1:16-cv-08484]
jbho: Spokeo doesn’t make cases go away, it just keeps them out of federal court.
No Harm Under Spokeo in the 8th Circuit
Thompson v. Rally House
Dismissed – Rally House allegedly printed the first six digits of plaintiff’s credit card number on a receipt issued at one of its retail stores. The court found that although this was a clear violation of the FACTA, this ‘bare procedural violation’ – under recently established precedent in the 8th Circuit – was insufficient for Article III standing. Plaintiff did not (and could not) allege his credit card information had been exposed or that he faced an imminent risk of identity theft. Nor had plaintiff claimed to have taken any measures to protect himself from the supposed risks. Thus plaintiff filed to demonstrate any concrete harm, and claims were dismissed for lack of subject matter jurisdiction.
[W.D. MO; 4:15-cv-00886]
jbho: interesting result in that two similar cases in S.D. FL recently settled for a collective $13.8 million:
• $6.3 million in Muransky v. Godiva (S.D. FL; 0:15-cv-60716) for printing the first six and last four digits
• $7.5 million in Legg v. Spirit Airlines (S.D. FL; 0:14-cv-61978) for printing the first seven and last four digits (see below)
On the other hand, a nearly identical case in New Jersey was recently dismissed for failure to allege any concrete injuries from printing the first six digits (Kamal v. J. Crew; N.D. N. J.; 2:15-cv-00190).
Circuits remain split?
$6.3M Credit Card Settlement
Muransky v. Godiva
Preliminary settlement – Godiva allegedly printed the first six digits of plaintiff’s credit card number on a receipt issued at one of Godiva’s retail stores. Highlights include:
• $6,300,000 non-reversionary settlement fund
• $60 for each class member
• $10,000 for class representative
• $2,100,000 for class counsel (1/3 of settlement fund)
[S.D. FL; 0:15-cv-60716]
jbho: make sure PoS programmers know this law…
One Million For Each Extra Digit
Legg v. Spirit Airlines
$7.5 million settlement approved – Spirit allegedly displayed more than the statutorily permitted ‘last five’ digits of a credit card number on electronically printed receipts. Plaintiff paid a $45.00 dollar baggage fee at an automated kiosk at the Fort Lauderdale-Hollywood International Airport, and said the receipt printed the first seven and last four digits of his credit card number. Highlights include:
• non-reversionary $7,500,000 settlement fund
• ~ $265 for each class member
• $10,000 for class representatives
• $2.5 million for class counsel (35% of settlement fund)
• any unclaimed funds will be split equally between the Public Interest Research Group and The Sedona Conference.
[S.D. FL; 0:14-cv-61978]
jbho: make sure PoS programmers know this law…
Failure To Mask Expiration Dates Violates FACTA; Concrete Harm
Wood v. J Choo
Motion to dismiss denied – Jimmy Choo allegedly printed unmasked expiration dates on credit card receipts. The receipt also contained other sensitive information about Plaintiff, including her home address and telephone number. However, only the last four digits of her credit card number were displayed (as required by FACTA).
The court found the FACTA encompasses two separate truncation requirements: one for the credit card number, and one for the card expiration date (as codified in the Credit and Debit Card Receipt Clarification Act of 2007 [15 U.S.C. § 1681n(d)]).
The court also concluded that Congress created a substantive legal right for consumers, and Jimmy Choo’s willful failure* to protect their personal financial information through truncation constituted a concrete harm (under Spokeo), sufficient to confer standing.
* the record shows Jimmy Choo was previously sued for the FACTA violation in this case, and had been notified by major credit card companies of the same.
[S.D. FL; 15-cv-81487]
jbho: a reminder that both FACTA and card brand rules require expiration dates to be masked.
Failure To Mask Expiration Dates Concrete Harm
Flaum v. Doctor’s Associates
Motion to dismiss denied – Subway Franchises owned by Doctor’s Associates allegedly printed unmasked expiration dates on credit card receipts. The court found since FACTA created a substantive legal right to receive truncating receipts protecting consumers’ financial information, plaintiff personally suffered a concrete harm in receiving a receipt that violated the statute. Thus plaintiff sufficiently alleged an injury-in-fact, and the Court had subject-matter jurisdiction over this case.
[S.D. FL; 0:16-cv-61198]
jbho: a reminder that both FACTA and card brand rules require expiration dates to be masked. According to the Order, Doctor’s Associates had been sued four times previously for printing the full expiration dates of cards on its receipts.
A Correct Interpretation Of Spokeo?
Noble v. Nevada Checker Cab
Dismissed – Checker Cab allegedly printed the first number plus the last four numbers of Plaintiffs’ credit card numbers on receipts, rather than just the last five digits as permitted under the FACTA. Checker Cab argued the first number of a card is simply a code identifying the card company — information that it is lawful in word form — and was not the kind of private financial information FACTA was intended to protect. The court agreed and found the putative technical violation of the FACTA created no concrete harm. As plaintiff pled no actual injury resulting from the technical violation, plaintiff had no Article III standing to pursue claims under the FACTA.
[D. NV; 2:15-cv-02322]
jbho: reason prevails?