Kamal v. J. Crew Group, Inc.

918 F.3d 102

Ahmed KAMAL, on Behalf of Himself and the Putative Class, Appellant in No. 17-2345

v.J. CREW GROUP, INC.; J Crew Inc.; J. Crew Intermediate LLC ; J Crew International, Inc.; J. Crew Operating Corp; J. Crew Services, Inc.; Chinos Acquisition Corp ; Chinos Holdings, Inc., Appellants in No. 17-2453

Nos. 17-2345

17-2453

United States Court of Appeals, Third Circuit.

Argued: February 8, 2018

Filed: March 8, 2019

Marvin L. Frank [ARGUED], Suite 1706, 370 Lexington Avenue, New York, NY 10017, Peter Y. Lee, Suite 1101, 60 East 42nd Street, New York, NY 10165, Counsel for Appellant/Cross-Appellee Ahmed Kamal

Andrew O. Bunn [ARGUED], Steven R. Marino, DLA Piper, 51 John F. Kennedy Parkway, Suite 120, Short Hills, NJ 07078, Keara M. Gordon, DLA Piper, 1251 Avenue of the Americas, New York, NY 10020, Counsel for Appellees/Cross-Appellants J. Crew Group, Inc., J Crew Inc., J. Crew

Intermediate LLC, J Crew International, Inc., J. Crew Operating Corp, J. Crew Services, Inc., Chinos Acquisition Corp; Chinos Holdings, Inc.

Before: CHAGARES, SCIRICA, and RENDELL, Circuit Judges.

OPINION OF THE COURT

SCIRICA, Circuit Judge

Enacted to combat credit card and identity theft, the Fair and Accurate Credit Transactions Act of 2003 (FACTA) prohibits anyone who accepts credit or debit cards as payment from printing more than the last five digits of a customer’s credit card number on the receipt. 15 U.S.C. § 1681c(g). Plaintiff-Appellant Ahmed Kamal brought this suit after receiving three receipts from Defendants-Appellees J. Crew Group, Inc. (and related entities) that included both the first six and last four digits of his credit card number. The District Court dismissed Kamal’s suit under Federal Rule of Civil Procedure 12(b)(1) for lack of Article III standing based on its determination that Kamal did not suffer a concrete injury from the alleged violation.

We agree, and we will affirm on that issue. We will vacate and remand, however, for the District Court to dismiss Kamal’s complaint without prejudice.

I.

We begin with a review of FACTA’s text and background before turning to the facts and procedural history.

A.

Congress enacted FACTA in 2003 as an amendment to the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681. FACTA was part of Congress’s effort to prevent identity theft. Pub. L. No. 108-159, 117 Stat. 1952. Consistent with that purpose, one of its provisions regulates the information that can be included on receipts given to customers:

Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.

15 U.S.C. § 1681c(g)(1). This provision was "included ... to limit the number of opportunities for identity thieves to ‘pick off’ key card account information." S. Rep. No. 108-166, at 13 (2003).

FACTA provides for actual damages and attorneys’ fees and costs to remedy negligent violations. 15 U.S.C. § 1681o(a). Willful violators are liable for "any actual damages ... or damages of not less than $ 100 and not more than $ 1,000," punitive damages, and attorneys’ fees and costs. Id. § 1681n(a).

In 2008, Congress passed the Credit and Debit Card Receipt Clarification Act (Clarification Act), which provided a temporary safe harbor to merchants that had violated FACTA by including card expiration dates on receipts. Pub. L. No. 110-241, 122 Stat. 1565. Although FACTA requires truncation of card numbers and removal of expiration dates, Congress found many merchants mistakenly believed it only required card number truncation, leading to "hundreds of lawsuits" alleging these merchants’ willful failure to remove the expiration date. Id. § 2(a)(3)–(4). According to Congress, these suits did not contain "allegation[s] of harm to any consumer’s identity," and "[e]xperts in the field agree that proper truncation of the card number ... regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft." Id. § 2(a)(5)–(6). To ensure "consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits that do not protect consumers," id. § 2(b), the Clarification Act amended FACTA so merchants who printed expiration dates but otherwise complied with FACTA would not be deemed in willful noncompliance, id. § 3; see also 15 U.S.C. § 1681n(d). This safe harbor covers receipts printed between 2004 and 2008. Clarification Act § 3; 15 U.S.C. § 1681n(d).

B.

On December 18, 2014, Kamal visited a J. Crew retail store in Ocean City, Maryland, and made a purchase with a credit card. Four days later, he went to another J. Crew store in Rehoboth Beach, Delaware, and again made a credit card purchase. Finally, about two weeks later, Kamal went to a J. Crew store in Wayne, New Jersey, and made a third purchase. Each time, Kamal "received an electronically printed receipt," which he retained, that "display[ed] the first six digits of [his] credit card number as well as the last four digits."¹ App. 97, Sec. Am. Compl. ¶ 8. As Kamal notes, the first six digits identify the issuing bank and card type. The receipts he received also identified his card issuer, Discover, by name. Kamal does not allege anyone (other than the cashier) saw his receipts. Neither does he allege his identity was stolen nor that his credit card number was misappropriated.

Six days after the last purchase, Kamal filed his first Class Action Complaint, alleging J. Crew willfully violated FACTA by including on his receipts the first six digits of his credit card number. Kamal sought statutory and punitive damages as well as attorneys’ fees. J. Crew filed a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), arguing its violations had not been willful. Kamal filed an Amended Complaint, and J. Crew again moved to dismiss on the same grounds. The District Court denied the motion, concluding Kamal plausibly alleged a willful violation. Following the Supreme Court’s decision in Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016), J. Crew moved to dismiss for lack of subject matter jurisdiction under Rule 12(b)(1), contending Kamal lacked standing because he did not suffer a "concrete" injury. The District Court agreed that Kamal had not alleged a sufficiently concrete injury and thus lacked standing under Article III. It granted J. Crew’s motion without prejudice and allowed Kamal to file another amended complaint.

Kamal filed his Second Amended Complaint—the operative complaint in this matter. In an effort to address the deficiencies leading to the dismissal of his Amended Complaint, Kamal alleges two "concrete" harms: "the printing of the prohibited information itself and the harm caused by such printing increasing the risk of identity theft." App. 104, Sec. Am. Compl. ¶ 36. To support these allegations, Kamal contends "[t]he extensive legislative findings by Congress, the Federal Trade Commission, the Department of Justice, and the industry" demonstrate that J. Crew’s conduct "created a real, non-speculative harm in the form of increased risk of identity theft." Id. The Complaint accordingly includes statements from Congress, industry experts, and government officials to show FACTA was intended to address identity theft. For example, Kamal notes that "[e]xperts ... told Congress that both non-redacted Card numbers and expiration dates are particularly dangerous in the hands of sophisticated criminals." App. 104, Sec. Am. Compl. ¶ 37. Similarly, Kamal says, "the Senate found that the specific provision at issue here protected consumers, like Plaintiff, from an intangible harm in the form of enhanced risk of identity theft." App. 106, Sec. Am. Compl. ¶ 41.

The Complaint also explains how FACTA’s truncation requirement responds to identity theft. Kamal alleges that "[o]ne common modus operandi of identity thieves is to obtain Card receipts that are lost or discarded, or through theft, and use the information on them to commit fraud and theft." App. 101, Sec. Am. Compl. ¶ 28. FACTA "makes it more difficult for identity thieves to obtain consumers’ Card information by reducing the amount of information identity thieves could retrieve from found or stolen Card receipts." App. 103, Sec. Am. Compl. ¶ 33. In other words, Congress was responding to "the possibility that identity thieves would be able to piece together credit card numbers and expiration dates to invade consumers’ privacy and exploit their financial resources." App. 106, Sec. Am. Compl. ¶ 42.

Notwithstanding these additional allegations, J. Crew again moved to dismiss on standing grounds. The District Court noted the two injuries alleged in the Second Amended Complaint—the printing of the prohibited information and the increased risk of identity theft—and rejected both in turn. See Kamal v. J. Crew Grp., Inc. , No. 15-0190, 2017 WL 2587617, at *3 (D.N.J. June 14, 2017).²

The court first held the printing of the information on the receipt was not itself a concrete injury. J. Crew’s conduct in giving Kamal a receipt that included his credit card’s first six digits did "not implicate traditional common law privacy interests" because "J. Crew did not ‘disclose’ Kamal’s personal information" and "the [card’s] first six digits do not pertain to the customer’s individual bank account." Id. As to "the judgment of Congress," Spokeo , 136 S.Ct. at 1549, the court—relying on quoted portions of the Clarification Act—determined that "Congress sought [through FACTA] to ‘ensure that consumers suffering from any actual harm to their credit or identity are protected,’ " Kamal , 2017 WL 2587617, at *4 (quoting Clarification Act § 2(b)) (emphasis added in District Court opinion). Because Kamal had not sustained any actual harm, the court held there was no injury in fact.

The District...