Banking and Finance Law Daily Failure to truncate credit card number did not cause concrete injury
Thursday, October 29, 2020

Failure to truncate credit card number did not cause concrete injury

By Nicole D. Prysby, J.D.

A consumer who alleged that a merchant printed too many digits of his credit card number on his receipt did not suffer sufficient concrete injury for standing to sue.

A consumer who alleged a procedural violation of the Fair and Accurate Credit Transactions Act (FACTA) lacked standing to bring the claim, held the Eleventh Circuit Court of Appeals. The consumer alleged that a cashier handed him a receipt containing the first six and last four digits of his account number credit card information printed on it, in violation of FACTA’s requirement that a receipt can include no more than the last five digits of the account number. Although the receipt violated the law because it contained too many digits, the consumer alleged no concrete harm or material risk of harm stemming from the violation. Because this amounts to nothing more than a bare procedural violation, divorced from any concrete harm, the consumer failed to allege that he has standing to bring this lawsuit. Because he lacked standing to bring the claims, the federal court may not approve the proposed $6.3 million class settlement he reached with the merchant. The court joined the Second, Third, and Ninth Circuits, which have each considered FACTA violations involving partially truncated credit-card numbers and concluded that the violation created neither a harm nor a material risk of harm (Muransky v. Godiva Chocolatier, Inc., Oct. 28, 2020, Grant, B.).

Background. The Fair and Accurate Credit Transactions Act limits what a merchant can include on a credit card transaction receipt printed at the point of sale. The merchant cannot include the card expiration date, and it can include no more than the last five digits of the account number. In this case, a consumer filed a class action against Godiva Chocolatier, Inc., complaining that one of its stores had printed the first six and last four digits of his account number on a receipt. In April 2019, the Eleventh Circuit held that the increased risk of identity theft arising from the merchant’s inclusion of too much of the consumer’s account number on a credit card receipt was enough to constitute a concrete injury that gave him standing to sue. In October 2019, the Eleventh Circuit agreed to reconsider its decision and ordered rehearing en banc (see Banking and Finance Law Daily, Oct. 7, 2020).

Consumer lacked standing. The court held that, based on Spokeo, Inc. v. Robbins, the bare procedural violation was not enough to support standing. The consumer previously argued that the wrongs were statutory, but now argues that the extra digits on his receipt can be counted as a concrete injury in several different ways. His first argument is that he had a "substantive right" to a properly truncated receipt, and that the violation of that right, by itself, is a concrete injury because the violation of a substantive right, unlike a procedural right, automatically inflicts an injury in fact. But his assertion that he does not need to show anything more than a noncompliant receipt because his statutory right was "substantive" cannot be squared with the central holding of Spokeo. To avoid "alleging a bare procedural violation," the plaintiff must show either some harm caused by the violation or a material risk of harm. The consumer next argued that the time he spent to safeguard his receipt qualifies as an injury in fact. But because the receipt did not actually pose a risk, he was not injured because of any efforts he took to secure it. Finally, the consumer argued that the mishandling of his account information is actionable because it bears a close resemblance to a common-law breach of confidence. That argument failed there was no disclosure to a third party and the consumer had no confidential relationship with the Godiva store.

The consumer also argued that the extra digits on the receipt caused him to suffer a material risk of harm, taking the position that, by requiring the truncation of all but the last five digits of a credit card, Congress has decided that printing additional digits creates a real risk of identity theft. But the court held that even if Congress had explicitly stated in the text of the statute that every FACTA violation poses a material risk of harm, Congress cannot erase Article III’s standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing. The consumer’s complaint offered nothing beyond the naked assertion that he and members of the class continue to be exposed to an elevated risk of identity theft.

Dissents. Judge Wilson dissented and would have held that the consumer had standing based on the consumer’s heightened risk of identity theft due to the untruncated receipt. Judge Martin dissented and would have held that the consumer suffered injury based on Congress’s judgment that more than five digits being displayed on a receipt is the point of intolerable risk. Judge Jordan joined those two dissents and also would have granted the consumer leave to amend his complaint to alleged standing under the majority’s standard.

The case is Nos. 16-16486 & 16-16783.

Attorneys: Patrick Christopher Crotty, Office of the Attorney General, for David S. Muransky. Wallace Allen McDonald (Lacy Price & Wagner, PC) for James H. Price. David S. Almeida (Benesch Friedlander Coplan & Aronoff, LLP) for Godiva Chocolatier, Inc.

Companies: Godiva Chocolatier, Inc.

MainStory: TopStory AlabamaNews CreditDebitGiftCards CyberPrivacyFeed DataPrivacy DataSecurity FederalLegislation FloridaNews GCNNews GeorgiaNews IdentityTheft Privacy

Back to Top

Interested in submitting an article?

Submit your information to us today!

Learn More

Banking and Finance Law Daily: Breaking legal news at your fingertips

Sign up today for your free trial to this daily reporting service created by attorneys, for attorneys. Stay up to date on banking and finance legal matters with same-day coverage of breaking news, court decisions, legislation, and regulatory activity with easy access through email or mobile app.