Doris Jeffries v. Volume Services America, Inc. , 928 F.3d 1059 ( 2019 )

United States Court of Appeals
FOR THE DISTRICT OF COLUMBIA CIRCUIT
Argued February 21, 2019 Decided July 2, 2019
No. 18-7139
DORIS JEFFRIES, ON BEHALF OF HERSELF
AND ALL OTHERS SIMILARLY SITUATED,
APPELLANT
v.
VOLUME SERVICES AMERICA, INC.,
DOING BUSINESS AS CENTERPLATE AND
CENTERPLATE/NBSE AND DOES 1 THROUGH 10, INCLUSIVE,
APPELLEES
Appeal from the United States District Court
for the District of Columbia
(No. 1:17-cv-01788)
Brian K. Herrington argued the cause for the appellant.
Chant Yedalian was with him on brief.
Mark W. Bayer argued the cause for the appellee Volume
Services America, Inc. Scott N. Godes was with him on brief.
Before: HENDERSON and ROGERS, Circuit Judges, and
EDWARDS, Senior Circuit Judge.
Opinion for the Court filed by Circuit Judge HENDERSON.
2
Opinion concurring in part and concurring in the judgment
filed by Circuit Judge ROGERS.
KAREN LECRAFT HENDERSON, Circuit Judge: Doris
Jeffries made a credit card purchase at a Centerplate 1 location
and received a receipt that displayed her sixteen-digit credit
card number and credit card expiration date. Jeffries sued
Centerplate for violating the Fair and Accurate Credit
Transactions Act of 2003 (FACTA), Pub. L. No. 108-159,
§ 113, 117 Stat. 1952, 1959–60 (codified at 15 U.S.C.
§ 1681c(g)), which prohibits printing “more than the last 5
digits of the card number or the expiration date upon any
receipt provided to the cardholder at the point of the sale or
transaction.” 15 U.S.C. § 1681c(g)(1). The district court
granted Centerplate’s motion to dismiss, concluding that
Jeffries lacked standing. Jeffries v. Volume Servs. Am., Inc.,
319 F. Supp. 3d 525, 527 (D.D.C. 2018). Jeffries timely
appealed and we now reverse and remand.
I. BACKGROUND
“The crime of identity theft—in which a perpetrator
assumes the identity of a victim in order to obtain financial
products and services or other benefits in the victim’s name—
ha[d] reached almost epidemic proportions” in the early 2000s.
H.R. Rep. No. 108-263, at 25 (2003). “A hotline established
by the Federal Trade Commission to field consumer complaints
and questions about identity theft logged over 160,000 calls in
2002 alone.” Id. “[E]lectronically printed receipts” provided
criminals with “easy access to” credit and debit card
information. S. Rep. No. 108-166, at 3 (2003). In response
to the increasing identity theft threat, the Congress enacted
1
The named defendant is Volume Services America, LLC,
which does business as Centerplate. The parties refer to the
defendant as Centerplate and we follow suit.
3
FACTA, which mandates (inter alia): “no person that accepts
credit cards or debit cards for the transaction of business shall
print more than the last 5 digits of the card number or the
expiration date upon any receipt provided to the cardholder at
the point of the sale or transaction.” 15 U.S.C. § 1681c(g)(1).
Any person who willfully violates this truncation
requirement—that is, anyone who willfully prints more than
five digits or the expiration date on a receipt—is liable for “any
actual damages sustained by the consumer . . . or damages of
not less than $100 and not more than $1,000” and for “such
amount of punitive damages as the court may allow.” Id.
§ 1681n(a)(1)(A), (a)(2).
Doris Jeffries made a purchase at a Centerplate location.
Centerplate provided Jeffries with a receipt containing all
sixteen digits of her credit card number, her credit card
expiration date and her credit card provider. She immediately
recognized that the receipt contained her personal information
and held on to it for safekeeping. Jeffries then filed this class
action lawsuit against Centerplate, alleging willful violations
of FACTA’s truncation requirement. According to the
complaint, Centerplate’s conduct violated Jeffries’ statutory
right and, as a result, exposed her to an increased risk of
identity theft. Because of Centerplate’s conduct, Jeffries was
also forced to take steps to safeguard the non-compliant receipt.
Centerplate moved to dismiss the case for lack of standing.
Jeffries, 319 F. Supp. 3d at 528. The district court determined
that Jeffries did not suffer an increased risk of identity theft
because Jeffries—and only Jeffries—viewed the receipt
containing her credit card information. Id. at 533–34. The
district court also concluded that the burden of safeguarding the
non-compliant receipt—the second form of harm identified in
the complaint—was insufficiently concrete to support
standing. Id. at 530. Finding both harms alleged in the
4
complaint inadequate, the district court held that Jeffries lacked
standing and dismissed her case for lack of subject-matter
jurisdiction. Id. at 534. Jeffries appeals the dismissal. “Our
review is de novo.” Nat’l Ass’n of Home Builders v. U.S. Fish
& Wildlife Serv., 786 F.3d 1050, 1052 (D.C. Cir. 2015).
II. ANALYSIS
Article III of the United States Constitution limits the
federal “judicial Power” to “Cases” and “Controversies.”
U.S. Const. art. III, § 2, cl. 1. A case or controversy does not
exist “unless the plaintiff has standing.” West v. Lynch, 845
F.3d 1228, 1230 (D.C. Cir. 2017). Standing has three
elements. “The plaintiff must have (1) suffered an injury in
fact, (2) that is fairly traceable to the challenged conduct of the
defendant, and (3) that is likely to be redressed by a favorable
judicial decision.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540,
1547 (2016). An injury in fact is “an invasion of a legally
protected interest which is (a) concrete and particularized and
(b) actual or imminent, not conjectural or hypothetical.”
Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992) (quotation
marks and internal citations omitted). The district court
dismissed this action at the pleading stage, when a plaintiff is
required only to state plausibly that each standing element
exists. Attias v. Carefirst, Inc., 865 F.3d 620, 625 (D.C. Cir.
2017). Causation and redressability are not in dispute. The
issue is whether Jeffries alleged an adequate injury in fact.
Jeffries contends that the violation of her statutory right
under FACTA constitutes an injury in fact without any
additional showing of harm. “[T]he violation of a procedural
right granted by statute can be sufficient in some circumstances
to constitute injury in fact.” Spokeo, Inc., 136 S. Ct. at 1549.
The United States Supreme Court has long recognized that the
“Congress may create a statutory right or entitlement the
5
alleged deprivation of which can confer standing to sue even
where the plaintiff would have suffered no judicially
cognizable injury in the absence of statute.” Warth v. Seldin,
422 U.S. 490, 514 (1975).
The concreteness component of injury in fact sharply
limits when a plaintiff can establish standing based solely on a
violation of his statutory rights. An injury in fact must always
be “concrete”—that is, “real” and “de facto,” not “abstract.”
Spokeo, Inc., 136 S. Ct. at 1548; Hancock v. Urban Outfitters,
Inc., 830 F.3d 511, 514 (D.C. Cir. 2016) (“[T]he legislature
cannot dispense with the constitutional baseline of a concrete
injury in fact.”). This means the Congress cannot authorize a
lawsuit based on a “bare procedural violation” of a statute
divorced from any “real” or “de facto” harm. Spokeo, Inc.,
136 S. Ct. at 1549. After all, a “procedural right in vacuo” is
nothing more than an abstract “interest in the proper
administration of the law.” Summers v. Earth Island Inst., 555
U.S. 488, 496–97 (2009). For a statutory violation to
constitute an injury in fact, then, the statute must protect the
plaintiff’s concrete interest—i.e., afford the putative plaintiff a
right to be free of a harm capable of satisfying Article III.
Accord Strubel v. Comenity Bank, 842 F.3d 181, 190 (2d Cir.
2016) (“[A]n alleged procedural violation can by itself
manifest concrete injury where Congress conferred the
procedural right to protect a plaintiff’s concrete interests.”);
Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017)
(same).
Jeffries believes FACTA is such a statute and vests
consumers with a concrete interest in using their credit and
debit cards without incurring an increased risk of identity theft.
We agree. FACTA’s truncation requirement imposes on the
merchant the duty not to print “more than the last 5 digits of
the card number or the expiration date.” 15 U.S.C.
6
§ 1681c(g)(1). The duty applies at the “point of the sale or
transaction” and a violation occurs regardless whether a
plaintiff ever becomes the victim of any crime. Id.; see also
id. § 1681n (making available statutory damages). In other
words, FACTA itself does not prohibit the crimes of identity
theft or fraud; its truncation requirement is a “‘procedure[]
designed to decrease th[e] risk’ that a consumer would have his
identity stolen.” Muransky v. Godiva Chocolatier, Inc., 922
F.3d 1175, 1188 (11th Cir. 2019) (first alteration in original)
(quoting Spokeo, Inc., 136 S. Ct. at 1550). The requirement
thus vests consumers with an interest in using their credit and
debit cards without facing an increased risk of identity theft. 2
The question now becomes whether the interest protected
by FACTA—avoiding an increased risk of identity theft—is
concrete. “In determining whether an intangible harm” like
risk is concrete, “both history and the judgment of Congress
play important roles.” Spokeo, Inc., 136 S. Ct. at 1549. The
historical analysis focuses on “whether an alleged intangible
harm has a close relationship to a harm that has traditionally
been regarded as providing a basis for a lawsuit in English or
American courts.” Id. “In addition, because Congress is well
positioned to identify intangible harms that meet minimum
Article III requirements, its judgment is also instructive and
important.” Id.
History tilts toward concreteness. “A common law
breach of confidence lies where a person offers private
2
There are other indirect harms attendant on a violation of
FACTA’s truncation requirement. The requirement relieves
consumers of having to worry about the content of printed receipts
and of having to safeguard or destroy receipts containing too much
information. These additional harms, although not the focus of our
inquiry, bolster Jeffries’ assertion that FACTA protects a concrete
interest.
7
information to a third party in confidence and the third party
reveals that information” to another. Muransky, 922 F.3d at
1190–91. This tort “is rooted in the concept that the law
should recognize some relationships as confidential to
encourage uninhibited discussions between the parties
involved.” Young v. U.S. Dep’t of Justice, 882 F.2d 633, 640
(2d Cir. 1989). The harm in a breach-of-confidence case
“occurs when the plaintiff’s trust in the breaching party is
violated, whether or not the breach has other consequences.”
Muransky, 922 F.3d at 1190. FACTA’s truncation
requirement establishes a similar relationship of trust between
consumer and merchant, requiring the merchant to safeguard
the consumer’s credit or debit card information and thus
preventing an increased risk of identity theft. See 15 U.S.C.
§ 1681c(g)(1). That is not to say a FACTA violation and a
breach of confidence are identical. Part of the harm involved
in a breach of confidence is actual disclosure to a third party.
See Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 114 (3d Cir.
2019) (“[A] breach of confidence involves ‘the unconsented,
unprivileged disclosure to a third party of nonpublic
information that the defendant has learned within a confidential
relationship.’” (quoting Alan B. Vickery, Note, Breach of
Confidence: An Emerging Tort, 82 Colum. L. Rev. 1426, 1455
(1982)). FACTA punishes conduct that increases the risk of
third-party disclosure, not the actual disclosure itself.
Muransky, 922 F.3d at 1191. Even so, “risk” is nothing more
than a “possibility of loss, injury, disadvantage, or destruction.”
Webster’s Third New International Dictionary 1961 (1976).
And FACTA protects against the risk of the very harm the
breach of confidence tort makes actionable—an unauthorized
disclosure of privileged information to a third party. This is
the type of “close relationship” with “a harm that has
traditionally been regarded as providing a basis for a lawsuit in
English or American courts” that weighs in favor of
concreteness. Spokeo, Inc., 136 S. Ct. at 1549 (emphasis
8
added). Compare Muransky, 922 F.3d at 1191 (FACTA “has
a sufficiently close relationship to breach of confidence to
satisfy Spokeo”), with Kamal, 918 F.3d at 114 (finding
relationship too remote because FACTA does not require
actual disclosure to third party).
We also give weight to the Congress’s determination that
printing too much credit card information on a receipt creates
a “real” or “de facto” harm. It found that printing excess credit
card information gives “criminals . . . easy access to such key
information” and thus contributes to identity theft. S. Rep.
No. 108-166, at 3. “After hearing from experts on the matter,
Congress decided to set the tolerable level of risk at printing
the last five digits of a card number.” Muransky, 922 F.3d at
1188. The line between a concrete and an abstract risk is,
understandably, hard to draw. For that reason, the Congress’s
judgment about when increased risk becomes intolerable is
entitled to respect. See Spokeo, Inc., 136 S. Ct. at 1549.
Our analysis does not stop with the conclusion that
FACTA protects a concrete interest. See id. at 1550 (some
statutory violations “may result in no harm” and thus do not
constitute injury in fact); Owner-Operator Indep. Drivers
Ass’n, Inc. v. U.S. Dep’t of Transp., 879 F.3d 339, 343 (D.C.
Cir. 2018) (even if statute protects concrete interest, “the
putative plaintiff” must have “suffered a de facto injury
resulting from the procedural violation”). We must also
determine whether the challenged violation of Jeffries’
statutory right harmed or created a “risk of real harm” to the
concrete interests protected by FACTA. Spokeo, Inc., 136 S.
Ct. at 1549. Jeffries views the inquiry as open and shut,
arguing that every FACTA violation creates a risk of identity
theft. Her view finds support in a recent Eleventh Circuit
decision, which determined that “Congress decided to set the
tolerable level of risk at printing the last five digits of a card
9
number.” Muransky, 922 F.3d at 1188. The Eleventh Circuit
therefore “decline[d] to substitute [its] judgment for
Congress’s by saying that, as a matter of law, the risk of
identity theft is not concrete until a merchant prints the first
eight or ten digits instead of the first six.” Id.
But not every violation of FACTA’s truncation
requirement creates a risk of identity theft. Several years after
enacting FACTA, the Congress found that “hundreds of
lawsuits were filed alleging that the failure to remove the
expiration date was a willful violation of” FACTA “even where
the account number was properly truncated” and that “[n]one
of these lawsuits contained an allegation of harm to any
consumer’s identity.” Credit and Debit Card Receipt
Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(4)–(5)
122 Stat. 1565, 1565. According to the Congress, “proper
truncation of the card number, by itself as required by”
FACTA, “regardless of the inclusion of the expiration date,
prevents a potential fraudster from perpetrating identity theft or
credit card fraud.” Id. § 2(a)(6), 122 Stat. at 1565. Thus,
printing an expiration date on a receipt without more—
although a technical violation of FACTA—does not create a
risk of identity theft; accordingly, a plaintiff who has suffered
this type of FACTA violation has been able to use his credit
card without incurring an increased risk of identity theft—i.e.,
has not suffered a concrete injury in fact. That is why our
sister circuits, applying Spokeo, have unanimously concluded
that a FACTA violation based solely on a failure to truncate an
expiration date does not qualify as a concrete injury in fact.
Accord Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 783
(9th Cir. 2018) (no standing where plaintiff alleged FACTA
violation by printing only expiration date on receipt); Crupar-
Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 81 (2d Cir.
2017) (same); Meyers v. Nicolet Rest. of De Pere, LLC, 843
F.3d 724, 727 (7th Cir. 2016) (same). As explained infra,
10
however, none of these courts encountered a FACTA violation
as egregious as the one committed by Centerplate.
Although not every FACTA violation creates a concrete
injury in fact, we conclude that the alleged violation of Jeffries’
right does so. The Act requires the truncation of two
categories of information at the point of sale: credit card digits
and expiration date. 15 U.S.C. § 1681c(g)(1) (“[N]o person
that accepts credit cards or debit cards for the transaction of
business shall print more than the last 5 digits of the card
number or the expiration date upon any receipt.”). Centerplate
printed all of the information in both categories, creating the
nightmare scenario FACTA was enacted to prevent, see
Remarks on Signing the Fair and Accurate Credit Transactions
Act of 2003, 39 Weekly Comp. Pres. Doc. 1746, 1748 (Dec. 4,
2003) (“Slips of paper that most people throw away should not
hold the key to their savings and financial secrets.”). Unlike a
receipt containing only an expiration date, Jeffries’ receipt bore
sufficient information for a criminal to defraud her. At the
point of sale—the time at which FACTA measures liability—
there was no way to know whether Jeffries would recognize
Centerplate’s mistake and mitigate any harm or whether the
receipt would end up in the trash for anyone to find or
otherwise be accessed by a malevolent third party (e.g., an
employee or fellow customer). Accordingly, Jeffries was not
able to use her credit card without incurring an increased risk
of identity theft and, as a result, suffered a concrete injury in
fact. She has pleaded enough facts to establish standing.
Centerplate focuses much of its defense on the fact that
Jeffries has not become a victim of identity theft because,
through her own efforts, she has mitigated any risk of a third
party accessing her credit card information. These facts,
although true, are irrelevant. As noted earlier, FACTA itself
does not prohibit the crime of identity theft; instead, it
11
establishes a procedural requirement to ensure that consumers
can use their credit and debit cards without incurring an
increased risk of identity theft. Moreover, there was no
guarantee at the point of sale that Jeffries would recognize and
safeguard the non-compliant receipt. Just as someone who
replaces the pin in a grenade remains, nonetheless, previously
at risk of getting blown up, Jeffries’ effort to safeguard her
receipt does not change the fact that she was prevented from
using her credit card without at the same time facing exposure
to increased identity theft risk. Because the receipt contained
enough information to defraud Jeffries, she suffered an injury
in fact at the point of sale.
Centerplate also contends that a decision in Jeffries’ favor
will create tension with the Third Circuit’s opinion in Kamal v.
J. Crew Group, which held that a plaintiff failed to establish
standing when a merchant printed the first six digits of his
credit card number on a receipt, 918 F.3d at 116–17. Yet the
Third Circuit determined that a FACTA violation can support
standing if the plaintiff faces a real or material risk of identity
theft. Id. at 116. The court found no standing in that case
because the plaintiff failed to allege that “the receipt included
enough information to likely enable identity theft.” Id. It
expressly stated its “analysis would be different if, for example,
[the plaintiff] had alleged that the receipt included all sixteen
digits of his credit card number, making the potential for fraud
significantly less conjectural.” Id. In other words, the Third
Circuit recognized its analysis would be different if it were
presented with the facts Jeffries presents to us. 3 See id.
3
We are not necessarily in full agreement with the Third
Circuit, which takes the position that FACTA protects an interest in
avoiding actual identity theft, rather than increased risk of identity
theft. See Kamal, 918 F.3d at 115 (“[T]he FACTA provision at
issue was part of Congress’s effort to prevent the concrete harm of
12
Finally, and on a separate score, Centerplate argues
Jeffries’ injury fails the imminence requirement of injury in
fact because the risk of her suffering future identity theft is
speculative. An injury in fact must be “actual or imminent” as
opposed to “‘conjectural’ or ‘hypothetical.’” Lujan, 504 U.S.
at 560 (quoting Whitmore v. Arkansas, 495 U.S. 149, 155
(1990)). Centerplate makes a fair point. We have repeatedly
expressed skepticism of increased-risk-of-harm injuries
because any future injury—no matter how speculative—can be
recast as a present risk of future harm, thus purportedly meeting
the imminence requirement of Article III. E.g., Ctr. for Law
& Educ. v. Dep’t of Educ., 396 F.3d 1152, 1161 (D.C. Cir.
2005); Pub. Citizen, Inc. v. Nat’l Highway Traffic Safety
Admin., 489 F.3d 1279, 1294 (D.C. Cir. 2007). But Jeffries
does not rely on increased risk of future identity theft as her
injury in fact; she relies on an invasion of her concrete interest
as protected by FACTA’s truncation requirement. The
alleged violation of her statutory right has already occurred:
there is nothing “conjectural” or “hypothetical” about it.
Accord Robins, 867 F.3d at 1117–18; Macy v. GC Servs. Ltd.
P’ship, 897 F.3d 747, 759–60 (6th Cir. 2018).
identity theft.”). As noted earlier, we disagree with that
determination because FACTA (1) does not prohibit identity theft,
(2) imposes a truncation duty at the point of sale when identity theft
cannot yet have occurred and (3) does not make liability contingent
on a showing of actual harm. See supra at 6. The distinction
between risk of identity theft and actual identity theft as the relevant
interest makes a difference in the concreteness inquiry. Where we
have looked to see whether the alleged statutory violation increased
Jeffries’ risk of identity theft, the Third Circuit analyzed how close
the plaintiff came to suffering actual identity theft, a more onerous
burden.
13
For the foregoing reasons, we reverse the judgment of the
district court and remand for further proceedings consistent
with this opinion.
So ordered.
ROGERS, Circuit Judge, concurring in part and concurring
in the judgment: The question before the court is whether
appellant Doris Jeffries has plausibly alleged an Article III
injury by pleading a violation of the Fair and Accurate Credit
Transactions Act of 2003 (“FACTA”), Pub. L. No. 108-159,
§ 113, 117 Stat. 1952, 1959–60 (codified at 15 U.S.C.
§ 1681c(g)). See Op. 4; Lujan v. Defs. of Wildlife, 504 U.S.
555, 560–61 (1992). The Supreme Court has clarified that to
satisfy Article III, an injury-in-fact must be not only
particularized but also concrete. Spokeo v. Robins, 136 S. Ct.
1540, 1548 (2016). In the context of a statutory violation, our
sister circuits have responded to Spokeo by examining
(1) whether the statutory provision at issue “protect[s] a
plaintiff’s concrete interests,” and (2) whether the specific
statutory violation alleged in a given case “actually harm[ed],
or present[ed] a material risk of harm to, such interests.”
Robins v. Spokeo, 867 F.3d 1108, 1113 (9th Cir. 2017) (citing
Strubel v. Comenity Bank, 842 F.3d 181, 190 (2d Cir. 2016));
see Muransky v. Godiva Chocolatier, Inc., 922 F.3d 1175, 1186
(11th Cir. 2019); Kamal v. J. Crew Grp., Inc., 918 F.3d 102,
112–13 (3d Cir. 2019). Jeffries’ allegations meet this two-part
test and I join the court in reversing the dismissal of her
complaint for lack of standing. See Op. 2, 5, 8. I write
separately because in my view Jeffries has shown FACTA
protects her concrete interests (part one of the test) by pointing
to “Congress’s determination that printing too much credit card
information on a receipt creates a ‘real’ or ‘de facto’ harm,” id.
at 8 (quoting Spokeo, 136 S. Ct. at 1548), regardless of whether
she can also show that her injury is analogous to the harm
associated with a common law breach of confidence, see id. at
6–7.
In 2003, Congress found that identify theft had reached
“almost epidemic proportions,” H.R. REP. NO. 108-263, at 25
(2003), and that “electronically printed receipts” provided
criminals with “easy access to” credit and debit card
information, S. REP. NO. 108-166, at 3 (2003). To lower the
2
risk of identity theft, Congress enacted FACTA, which imposes
a duty on persons accepting credit or debit cards for the
transaction of business not to “print more than the last 5 digits
of the card number or the expiration date upon any receipt
provided to the cardholder at the point of sale or transaction.”
15 U.S.C. § 1681c(g)(1). A private party who receives a non-
conforming receipt may sue for actual damages in a case of
negligent noncompliance, id. § 1681o(a), and for statutory
damages (up to $1,000) and punitive damages in a case of
willful noncompliance, id. § 1681n(a). Thus, “Congress
decided to set the tolerable level of risk at printing the last five
digits of a card number,” Op. 8–9 (quoting Muransky, 922 F.3d
at 1188), and chose private lawsuits as its enforcement
mechanism. Further, when Congress amended FACTA in 2008
to “limit[] abusive lawsuits that do not protect consumers,” it
left the truncation requirement and enforcement mechanism
untouched. See Credit and Debit Card Receipt Clarification
Act, Pub. L. No. 110-241, §§ 2(b), 3(a), 122 Stat. 1565, 1566
(2008).
The Supreme Court has long held that Congress has the
power to “define injuries” and articulate “new rights of action
that do not have clear analogs in our common law tradition.”
Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 126 n.22
(O’Connor, J., concurring) (1998) (quoting Lujan, 504 U.S. at
580 (Kennedy, J., concurring)); see Zivotofsky ex rel. Ari Z. v.
Sec’y of State, 444 F.3d 614, 617–19 (D.C. Cir. 2006); see also
William Baude, Standing in the Shadow of Congress, 2016
SUP. CT. REV. 197, 199–203 (2016). For example, the Court
has recognized Congress’s authority to create new rights that
allow individuals to be free from competitive injury, Hardin v.
Ky. Utils. Co., 390 U.S. 1, 6 (1968); receive “truthful
information considering the availability of housing,” Havens
Realty Corp. v. Coleman, 455 U.S. 363, 373 (1982); and access
a wide range of government documents, see, e.g., Pub. Citizen
3
v. U.S. Dep’t of Justice, 491 U.S. 440, 449 (1989). None of
these cases involved an analogy to a common law harm.
Instead, the Court has indicated that the violation of a private
statutory right constitutes an injury-in-fact so long as the
plaintiff alleges the type of harm against which the statute is
meant to guard. See Havens, 455 U.S. at 373–74; Hardin, 390
U.S. at 5–7; see also FEC v. Akins, 524 U.S. 11, 20–22 (1998);
Owner-Operator Indep. Drivers Ass’n, Inc. v. U.S. Dep’t of
Transp., 879 F.3d 339, 344–45 (D.C. Cir. 2018); Friends of
Animals v. Jewell, 828 F.3d 989, 992 (D.C. Cir. 2016).
Spokeo did not overrule this line of precedent. See 136
S. Ct. at 1549–50 (citing Akins and Public Citizen with
approval). On the one hand, the Court observed that in
assessing concreteness it can be “instructive to consider
whether an alleged intangible harm has a close relationship to
a harm that has traditionally been regarded as providing a basis
for a lawsuit in English or American courts” because such an
historical inquiry may shed light on the case-or-controversy
requirement of Article III. Id. at 1549 (citing Vermont Agency
of Nat. Res. v. United States ex rel. Stevens, 529 U.S. 765, 775–
77 (2000)). At the same time, the Court reaffirmed Congress’s
“power to define injuries and articulate chains of causation that
will give rise to a case or controversy where none existed
before.” Id. (quoting Lujan, 504 U.S. at 580 (Kennedy, J.,
concurring)). Thus, while the Court indicated that “historical
practice” can be evidence of what constitutes a concrete injury-
in-fact, it did not suggest that every plaintiff who alleges her
statutory rights have been violated must analogize her injury to
a harm recognized at common law. See id.
Here, it is unclear whether the proffered analogy between
a FACTA violation and a breach of confidence supports
Jeffries’ claim of standing. In Spokeo, 136 S. Ct. at 1549, the
Court cited Vermont Agency, 529 U.S. at 775–77, to illustrate
4
how history can be “instructive.” Vermont Agency involved a
qui tam action; a private individual brought a False Claims Act
suit against a state agency on behalf of the United States. Id. at
768–70. The Court held that the individual had Article III
standing, explaining that qui tam actions are “Cases” or
“Controversies” within the meaning of Article III because they
were “prevalent” in England and America “in the period
immediately before and after the framing of the Constitution.”
Id. at 776–77. That historical relationship was much more
straightforward — and compelling — than Jeffries’ view,
accepted by this court, that the harm suffered by a FACTA
plaintiff is analogous to the harm associated with a breach of
confidence. See Pet’r’s Br. 25–26; Op. 7. The Third Circuit
has concluded that the two harms differ in character because a
breach of confidence requires disclosure to a third party but a
FACTA violation does not. Kamal, 918 F.3d at 114. The
Eleventh Circuit disagrees, concluding that the harms have a
“sufficiently close relationship” because each occurs when a
defendant’s mishandling of confidential information creates a
heightened risk of future harm. Muransky, 922 F.3d at 1190–
92. The vagueness of the “close relationship” test leaves ample
room for a court to reach either conclusion and therefore does
little to advance the standing analysis here. Further, even if the
breach-of-confidence analogy were persuasive, it would be
unnecessary; Jeffries has “independently” shown that FACTA
protects her concrete interests “based on Congress’s judgment”
that printing a full credit card number on a receipt creates a
“heightened risk of identity theft.” Id. at 1190; see id. at 1187.
It also bears mentioning that FACTA lawsuits do not
implicate traditional separation-of-powers concerns. The
Supreme Court has long held that “[t]he law of Article III
standing . . . serves to prevent the judicial process from being
used to usurp the powers of the political branches.” Town of
Chester v. Laroe Estates, Inc., 137 S. Ct. 1645, 1650 (2017)
5
(quoting Clapper v. Amnesty Int’l USA, 568 U.S. 398, 408
(2013)); see, e.g., Lujan, 504 U.S. at 573–78. Standing doctrine
preserves the separation of powers by limiting the
circumstances in which “a private individual [may] invoke the
judicial power to determine the validity of executive or
legislative action.” Id. at 575 (quoting Ex parte Lévitt, 302 U.S.
633, 634 (1937)); see Zivotofsky, 444 F.3d at 618. Separation-
of-powers concerns are “generally absent,” however, “when a
private party seeks to enforce only his personal rights against
another private party.” Spokeo, 136 S. Ct. at 1551, 1553
(Thomas, J., concurring) (citing F. Andrew Hessick, Standing,
Injury in Fact, and Private Rights, 93 CORNELL L. REV. 275,
317–321 (2008)). Here, “Congress has created a private duty
owed personally to [Jeffries] to protect [her] information,” so
Jeffries’ allegation that Centerplate breached that duty
“suffices for Article III injury in fact.” Id. at 1554. Far from
preserving the separation of powers, Centerplate’s contrary
position invites the court to “substitute [its] judgment for
Congress’s” by holding that printing a receipt displaying a full
credit card number and expiration date is harmless. See
Muransky, 922 F.3d at 1188.
Finally, because the parties have not raised the issue and it
is unnecessary to the resolution of this appeal, I would leave for
another day the question whether “printing an expiration date
on a receipt without more,” in violation of FACTA, causes an
Article III injury. Op. 9; see Muransky, 922 F.3d at 1189 n.5.