Ninth Circuit says receipt containing credit card’s full expiration date violates FCRA but is not, in itself, a sufficient injury to establish standing

In Bassett v. ABM Parking Services, Inc., 883 F.3d 776 (Feb. 21, 2018), the United States Court of Appeals for the Ninth Circuit held that a consumer who received a credit card receipt that improperly contained the full expiration date in violation the Fair Credit Reporting Act (“FCRA”) failed to allege a concrete injury in fact sufficient to establish standing.

The plaintiff- consumer used his credit card at defendant’s parking garage. When exiting the garage, he received a receipt displaying the credit card’s full expiration date in violation of 15 U.S.C. §1681c(g). He sued, alleging a statutory violation of FCRA, exposure to identity theft and credit/debit fraud, and imminent risk that his property would be stolen and/or misused by identity thieves. He did not allege a duplicate receipt existed, that his receipt was lost or stolen, or that he was the victim of identity theft. Instead, he claimed the risk of harm created by the printing of the full expiration date on the receipt was in itself a sufficiently concrete injury to confer standing. The defendant unsuccessfully moved the district court to dismiss the complaint on the grounds that it failed to allege a concrete injury.

In upholding dismissal, the Ninth Circuit followed Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 194 L.Ed.2d 635 (2016) which held that not every procedural violation gives rise to standing. To establish standing under Spokeo, the plaintiff must allege he or she (1) suffered an injury in fact, (2) that is fairly traceable to the conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision. And the injury in fact must invade a legally protected interest that is concrete and particularized and is actual and imminent, not conjectural and hypothetical.

The consumer argued FCRA created a substantive right to privacy, the invasion of which confers standing. Alternatively, the law establishes a procedural right, the violation of which creates a material risk of harm sufficient to confer standing.

The court rejected the substantive right claim because it depends entirely on the framing of the right – which is arbitrary and bears minimally on whether the consumer suffered a concrete injury in fact. Further, the consumer’s private information was not disclosed to anyone but himself – and thus no substantive privacy right had been invaded. The court also rejected the procedural right claim, finding that the consumer did not allege actual harm or a material risk of harm. The court found it difficult to see how issuing a receipt to only the card holder and with only the expiration date (the credit card number was redacted), without more, could work any concrete harm. Therefore, the theory of “exposure” to identity theft is too speculative to confer jurisdiction under Article III of the Constitution.

Download Related Document