Almost one year ago, we wrote about the impact of Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016) on Fair and Accurate Credit Transaction Act (FACTA) class actions and offered practical pointers for defendants confronting FACTA class claims. As we explained, because often the only “harm” from alleged FACTA violations is a theoretical increase in the risk of a potential future injury, such as identity theft, FACTA plaintiffs have difficulty meeting Article III’s injury-in-fact requirement. On March 8, 2019, the Third Circuit Court of Appeals issued its highly anticipated decision in another FACTA case, Kamal v. J. Crew Group, Inc., 2019 WL 1087350, which continues the post-Spokeo trend of requiring a plaintiff to allege more than some speculative, theoretical threat of future harm to establish Article III standing from a FACTA violation.
FACTA strictly—which is to say, draconically—forbids merchants from printing more than the last five digits of a credit or debit card number on any electronically printed receipt provided to the card holder at the point of sale, and provides potentially onerous penalties for violations. Ahmed Kamal, the putative class representative, alleged that J. Crew printed the first six and last four digits of his cards on three separate transactions in 2014 and 2015. After his original complaint was dismissed for failure to allege a concrete injury, Kamal asserted in an amended complaint that he was injured by J. Crew’s disclosure of his private information and by a resulting increased exposure to future identity theft or credit card fraud. The district court, relying on Spokeo, dismissed the case, ruling that Kamal failed to identify an injury-in-fact sufficient to confer Article III standing. Kamal’s privacy concerns, in the court’s eyes, fell short of recognized privacy interests and instead amounted to a “bare procedural violation divorced from any concrete harm,” and the court determined that J. Crew’s actions had not materially increased Kamal’s risk of identity theft or fraud. Kamal disagreed and appealed.
On appeal, the Third Circuit, following the Supreme Court’s instruction in Spokeo, analyzed whether Kamal’s alleged injuries of disclosure of private information and increased risk of identity theft or fraud enjoyed a “close relationship” to any harms that traditionally have provided a basis for common law privacy torts and breach of confidence. Kamal argued that he faced a real risk of identity theft because the first six digits identified his issuing bank and card type and that the receipts further identified his card issuer by name. The court declined to exalt this possibility of future events into a present injury. It noted that the information was not disclosed to a third party. Indeed, it appeared only on a printed receipt provided to Kamal. The Third Circuit recognized that receiving a printed copy of your own credit card number is not an injury that bears a “close relationship” with harms that traditionally provide a basis for analogous common law claims. Similarly, the court found Kamal’s argument that J. Crew created a risk of identity theft or card fraud unpersuasive. Notably, the risk could only be material if the receipts fell into a nefarious third party’s hands, and only if that third party would be able to obtain the remaining card digits and the expiration date, security code or other information needed to use the card—none of which had occurred in that case. The court declined to find a concrete injury from this “speculative chain of events.”
The lack of a “close relationship” between the alleged injuries and the harms associated with analogous common law claims led the Third Circuit to hold that Kamal lacked Article III standing to bring the FACTA class action. But there is a procedural wrinkle worth highlighting: The Third Circuit vacated the district court’s order dismissing the lawsuit with prejudice—even though Kamal had requested the order with prejudice as a final order for appeal—and remanded the case for the limited purpose of entering an order of dismissal without prejudice. The Third Circuit reasoned that because Kamal did not have standing, the district court lacked subject matter jurisdiction over decisions on the merits over the case and, therefore, it was improper to grant a dismissal for lack of standing with prejudice.
Kamal reinforces several of the main takeaways for defendants that we set forth in our previous post: (1) Class actions based on federal statutory violations may be vulnerable to concrete injury, Article III standing challenges, particularly where, as in Kamal and many other FACTA class actions, the alleged harm is a theoretical, conjectural increase in the risk of future injury; and (2) even if the court does not ultimately dismiss the case, contesting plaintiffs’ allegations of injury on Spokeo grounds may result in individualized allegations of harm ultimately helpful to oppose class certification. But Kamal also shows the limits of a successful jurisdictional challenge, as the Third Circuit’s decision to remand the case shows. Several conflicting strategic considerations inform how companies can best challenge federal statutory class actions, and there is no one-size-fits-all solution.