Skip to main content
Menu Icon Menu Icon
Close

InfoBytes Blog

Financial Services Law Insights and Observations

Filter

Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.

  • Split en banc 11th Circuit vacates $6.3 million FACTA settlement

    Courts

    On October 28, the U.S. Court of Appeals for the Eleventh Circuit, in a 7-3 en banc decision, vacated a $6.3 million Fair and Accurate Credit Transactions Act (FACTA) class action settlement, concluding the plaintiffs lacked standing because they did not allege any concrete harm. According to the opinion, the named plaintiff filed a FACTA class action against a chocolate retailer, alleging that the retailer printed too many credit card digits on receipts over several years. The complaint only pursued statutory damages and explicitly stated it did “not intend[] to request any recovery for personal injury.” The parties agreed to settle the litigation for $6.3 million prior to the U.S. Supreme Court decision in Spokeo, Inc. v. Robins (holding that a plaintiff must allege a concrete injury, not just a statutory violation, to establish standing). After Spokeo, the district court approved the class action, and class objectors appealed, with one objector arguing that the district court lacked jurisdiction to approve the settlement because the named plaintiff did not allege an injury in fact. On appeal, the 11th Circuit issued multiple opinions, with the first two affirming the settlement approval. The full panel ordered a rehearing en banc, vacating the last opinion.

    The en banc panel vacated the district court order approving the settlement, concluding that the named plaintiff lacked standing under Spokeo. Specifically, the panel rejected the named plaintiff’s argument that “receipt of a noncompliant receipt itself is a concrete injury,” noting that “nothing in FACTA suggests some kind of intrinsic worth in a compliant receipt.”  Moreover, the panel disagreed with the named plaintiff’s distinction that his claim was a “substantive” violation and not just a “procedural” one, reasoning that “no matter what label you hang on a statutory violation, it must be accompanied by a concrete injury.” Because the complaint did not allege a concrete injury, the panel vacated the order.

    In dissent, one judge argued that the named plaintiff plausibly alleged concrete harm by establishing that the retailer’s FACTA violation elevated his risk of identity theft. In the second dissent, another judge asserted that both common law and congressional intent support the conclusion that the plaintiff’s complaint constitutes a concrete injury in fact. And lastly, the third dissent argued that the order should not be dismissed outright because the majority made “assumptions about the risks of identity theft without the benefit of a factual record, expert reports, or adversarial testing of the issue in the district court.” 

    Courts Eleventh Circuit FACTA Settlement Class Action Spokeo Standing Appellate

    Share page with AddThis
  • D.C. Circuit says consumer failed to show injury in FDCPA action

    Courts

    On June 9, the U.S. Court of Appeals for the D.C. Circuit vacated the district court’s judgment in favor of a consumer, concluding that the consumer failed to demonstrate a concrete injury-in-fact traceable to the FDCPA violations she alleged. According to the opinion, the consumer brought the putative class action against the debt collector after the collector sued the consumer to collect an outstanding auto loan debt. The collector allegedly used affidavits in its lawsuit against the consumer that were signed by an agent of the collector, not by an employee as attested. As requested by the debt collector, the action was then dismissed with prejudice. Subsequently, the consumer filed the putative class action against the debt collector and its agent alleging various violations of the FDCPA. The defendants moved to dismiss the action, which the district court denied. Subsequently, the district court granted their motion for summary judgment, concluding that any “any falsehoods in the [] affidavits were immaterial—and thus not actionable—because they ‘had no effect on [the consumer]’s ability to respond or to dispute the debt.’”

    On appeal, the D.C. Circuit disagreed with the district court, concluding that the consumer lacked standing to sue the defendants altogether. Specifically, the appellate court held that the consumer failed to identify a traceable injury to the “false representations” made in the affidavits, citing to the fact that the consumer “testified unequivocally that she neither took nor failed to take any action because of these statements.” Moreover, citing to the U.S. Supreme Court decision in Spokeo, Inc. v. Robins, the appellate court emphasized that “[n]othing in the FDCPA suggests that every violation of the provisions implicated here…create[] a cognizable injury.” The appellate court vacated the district court’s judgment and remanded the case with instructions to dismiss the complaint.

    Courts Appellate FDCPA D.C. Circuit Debt Collection Spokeo

    Share page with AddThis
  • District court: Plaintiffs whose search terms were disclosed to third parties have standing under Spokeo

    Courts

    On June 5, the U.S. District Court for the Northern District of California issued an order denying a global search engine’s (defendant) motion to dismiss class action claims, ruling that the plaintiffs’ claims met the standing requirement under Spokeo, Inc. v. Robins. The court determined that the plaintiffs pled a concrete injury by claiming that the defendant violated the Electronic Stored Communications Act (ESCA) and their contractual privacy rights by disclosing their search terms to third party servers without their authorization. The court rejected the defendant’s arguments that (i) the “plaintiffs cannot show the search terms can or will be linked to a searcher’s identity,” and (ii) “anonymized search terms could ‘rarely if ever result in harm or certainly impending harm.’” According to the court, this argument assumes that harm must take the form of “‘individuals’ discovered identities’ being ‘exploit[ed]. . .to their detriment,” which is “[n]ot so.” The court stressed that the ESCA “protects users’ privacy rights against the mere disclosure of their communications,” and that “the statute makes such disclosure actionable regardless whether those communications reveal the user’s identity.” Among other things, the court also noted that Congress has “identified a concrete privacy interest in communications stored with electronic communication service providers—even if those communications cannot be linked to the user.” “Because plaintiffs ‘need not allege any additional harm beyond the one Congress has identified,’ their standing in no way depends on whether the search terms may be used to discover their identities,” the court wrote.

    Courts Privacy/Cyber Risk & Data Security Spokeo

    Share page with AddThis
  • 11th Circuit: Unsolicited text message doesn't establish standing under TCPA

    Courts

    On August 28, the U.S. Court of Appeals for the 11th Circuit held that receiving one unsolicited text message is not enough of a concrete injury to establish standing under the TCPA. According to the opinion, a former client of an attorney received an unsolicited “multimedia text message” from the attorney offering a ten percent discount on services. The client filed a putative class action, alleging the attorney violated the TCPA arguing the text message caused him “‘to waste his time answering or otherwise addressing the message’” leaving his cell phone “‘unavailable for otherwise legitimate pursuits’” and resulted in “‘an invasion of [] privacy and right to enjoy the full utility’” of his cell phone. The attorney moved to dismiss the complaint for lack of standing and the district court denied the motion. However, the court allowed the attorney to pursue an interlocutory appeal.

    On appeal, the 11th Circuit looked to the Supreme Court decision in Spokeo, Inc. v. Robins— which held that a plaintiff must allege a concrete injury, not just a statutory violation, to establish standing—as well as the legislative history of the TCPA and determined there was “little support” for treating the client’s allegations as a concrete injury. Specifically, the panel noted that the allegations of “a brief, inconsequential annoyance are categorically distinct from those kinds of real but intangible harms” Congress set out to protect. Moreover, the “chirp, buzz, or blink of a cell phone” is annoying, but not a basis for invoking federal court jurisdiction. The panel also acknowledged that Congress, not a federal court, is “well positioned” to assess the new harms of technology. Because the client failed to allege a concrete harm by receiving the unsolicited text message, the panel reversed the district court decision.

    Courts Appellate Eleventh Circuit Spokeo Standing Class Action TCPA

    Share page with AddThis
  • 9th Circuit: Plaintiffs’ face-scanning claims can proceed

    Courts

    On August 8, the U.S. Court of Appeals for the 9th Circuit affirmed a district court order certifying a class action suit that alleged a social media company’s face-scanning practices violated the Illinois Biometric Information Privacy Act (BIPA). The court found that the plaintiffs alleged a sufficiently concrete injury necessary to establish Article III standing as defined in the U.S. Supreme court’s decision in Spokeo, Inc. v. Robins. The plaintiffs contended that the defendant’s use of the facial-recognition technology did not comply with Illinois law designed to regulate “the collection, use, safeguarding and storage of biometrics”—which, under BIPA, includes the scanning of face geometry. The district court denied the defendant’s motion to dismiss for lack of standing and certified the class. The defendant appealed, arguing, among other things, that even if the plaintiffs have standing to sue, (i) BIPA is not intended to be applied extraterritorially; (ii) the collection of biometric data occurred on servers located outside of Illinois; and (iii) it is unclear that the alleged privacy violations “occurred ‘primarily and substantially within’” within the state. Additionally, the defendant argued that the district court abused its discretion by certifying the class because the state’s “extraterritoriality doctrine precludes the district court from finding predominance,” and that a class action was not superior to individual actions due to the potential for a large statutory damages award.

    On appeal, the 9th Circuit held that the plaintiffs’ claims met the standing requirement of Spokeo because the defendant’s alleged development of a face template that uses facial-recognition technology without users’ consent constituted an invasion of an individual’s private affairs and concrete interests. “Because we conclude that BIPA protects the plaintiffs’ concrete privacy interests and violations of the procedures in BIPA actually harm or pose a material risk of harm to those privacy interests, the plaintiffs have alleged a concrete and particularized harm, sufficient to confer Article III standing,” the appellate court stated. The 9th Circuit also dismissed the defendant’s extraterritoriality argument, stating that predominance is not defeated because the threshold questions of exactly which consumers BIPA applies to can be decided on a classwide basis.

    Courts Ninth Circuit Appellate Privacy/Cyber Risk & Data Security Class Action Spokeo

    Share page with AddThis
  • D.C. Circuit: Receipt containing complete credit card information constitutes concrete injury

    Courts

    On July 2, the U.S. Court of Appeals for the D.C. Circuit reversed a district court’s ruling that a consumer lacked Article III standing to allege a violation of the Fair and Accurate Credit Transaction Act (FACTA) when a merchant included all 16 digits of her credit card account number, her full name, and the expiration date on a receipt, because the receipt was not thrown away. Under FACTA, merchants are prohibited from including on a receipt (i) more than the last five digits of a consumer’s credit card number; and (ii) a credit card’s expiration date. The consumer alleged that the merchant violated the restriction, but the district court ruled that the consumer lacked standing to sue because she failed to describe a concrete risk of “actual or imminent” injury to a protected interest as defined in the U.S. Supreme Court’s decision in Spokeo, Inc. v. Robins. According to the district court, because the consumer did not dispose of the receipt, and was the only person who ever saw the receipt, her risk of identity theft had not increased. Moreover, the district court stated that the burden of protecting the non-compliant receipt did not constitute a concrete injury.

    On appeal, the D.C. Circuit reversed, holding that printing a receipt containing all 16 digits of a consumer’s credit card number is an “egregious” enough violation of FACTA to confer standing. According to the panel, the harm inflicted on the consumer by the merchant’s mishandling of her receipt had a “close relationship” to the type of harm that gives rise to a “breach of confidence” claim. Moreover, the panel stated that it was irrelevant that the consumer had been able to protect herself by safeguarding the receipt because: (i) FACTA protects an interest in avoiding an increased risk of identity theft, which the panel considered to be sufficiently concrete; and (ii) under the facts presented, the violation of the truncation requirement created a “risk of real harm” to such concrete interest. The D.C. Circuit remanded the case for further proceedings consistent with its findings. Notwithstanding, the panel was clear that not every violation of FACTA’s truncation requirement creates a risk of identity theft.

    Notably, while the D.C. Circuit’s decision is in agreement with an 11th Circuit opinion issued in April (prior InfoBytes coverage here), it conflicts with other appellate decisions, including an opinion issued by the 3rd Circuit in March (covered by InfoBytes here), wherein the 3rd Circuit held that, without concrete evidence of harm, a consumer lacks standing under FACTA to sue a merchant for including too many digits of a credit card account number on a receipt. The D.C. Circuit noted, however, that the 3rd Circuit “recognized its analysis would be different if it were presented with the facts [the consumer] presents to us.”

    Courts D.C. Circuit Appellate Privacy/Cyber Risk & Data Security FACTA Spokeo

    Share page with AddThis
  • 9th Circuit: Class decertification appropriate when representative lacks standing

    Courts

    On June 5, the U.S. Court of Appeals for the 9th Circuit affirmed a lower court’s decision to decertify a class of callers claiming their cellphone calls were unlawfully recorded, holding that the class representative lacked standing as to its individual claim. According to the opinion, customers of a concrete supplier alleged that calls placed to a phone system that the company began using in 2009 failed to inform callers that their cellphone calls were being recorded. In 2013, the company changed the recording to state that the calls maybe be “monitored or recorded.” The class representative sought to certify a class of all persons whose calls were recorded between the time that the company started using the call recording system in 2009 to when it updated the recording. The district court initially denied certification under the Federal Rule of Civil Procedure Rule 23’s predominance requirement, and later—after certifying the class based on evidence presented concerning the timing of certain recorded calls—decertified the class for failing to satisfy the “commonality” and “predominance” requirements once the concrete supplier identified nine customers who claimed they had actual knowledge of the recording practice during the class period. In addition, the court concluded that the class representative lacked standing to seek damages on its individual claim or injunctive relief because it lacked standing under the 2016 Supreme Court opinion Spokeo, Inc. v. Robins, which required that it show a concrete or particularized injury as a result of the concrete supplier's alleged violation. 

    On appeal, the 9th Circuit rejected the class’s argument that it “has standing to appeal the decertification order notwithstanding the adverse judgment against it on the merits” due to the following two exceptions to the mootness doctrine that may permit a class representative to appeal decertification even if its individual claims have been mooted: (i) the class representative “retains a ‘personal stake’ in class certification”; or (ii) “the claim on the merits is ‘capable of repetition, yet evading review,’” even though the class representative has lost “his personal stake in the outcome of the litigation.” The appellate court concluded that “neither of these mootness principles can remedy or excuse a lack of standing as to the representative's individual claims.”

    Courts Ninth Circuit Appellate Spokeo Standing Class Action State Issues

    Share page with AddThis
  • Splitting from the 6th Circuit, 7th Circuit holds mere procedural violation of FDCPA not sufficient harm for standing

    Courts

    On June 4, the U.S. Court of Appeals for the 7th Circuit held that the receipt of an incomplete debt collection letter is not a sufficient harm to satisfy Article III standing requirements to bring a FDCPA claim against a debt collector. According to the opinion, a consumer received a collection letter which described the process for verifying a debt but did not specify that she had to communicate with the collector in writing to trigger the protections under the FDCPA. The consumer filed a class action against the debt collector alleging the omission “‘constitute[d] a material/concrete breach of her rights’” under the FDCPA. In the complaint, the consumer did “not allege that she tried—or even planned to try—to dispute the debt or verify that [the stated creditor] was actually her creditor.” The district court dismissed the action, concluding that the consumer had not alleged that the FDCPA violation “caused her harm or put her at an appreciable risk of harm” and therefore, the consumer lacked standing to sue.

    On appeal, the 7th Circuit affirmed the district court’s decision, concluding that because the consumer did not allege that she tried to dispute or verify the debt orally, leaving her statutory protections at risk, she suffered no harm to her statutory rights under the FDCPA. The appellate court emphasized that “procedural injuries under consumer‐protection statutes are insufficiently concrete to confer standing.” The court acknowledged that its opinion creates a conflict with a July 2018 decision by the U.S. Court of Appeals for the 6th Circuit, which held that consumers had standing to sue a debt collector whose letters allegedly failed to instruct them that the FDCPA makes certain debt verification information available only if the debt is disputed “in writing.” (Covered by InfoBytes here.) The appellate court also agreed with the district court’s decision to deny the consumer’s request for leave to file an amended complaint, noting that she did not indicate what facts she would allege to cure the jurisdictional defect.

    Courts Spokeo Seventh Circuit Sixth Circuit Appellate FDCPA

    Share page with AddThis
  • 2nd Circuit: Unsolicited text messages are sufficient injury under TCPA

    Courts

    On April 30, the U.S. Court of Appeals for the 2nd Circuit held that the receipt of unsolicited text messages, absent any additional injury, is sufficient to demonstrate injury-in-fact in a TCPA class action. According to the opinion, consumers filed a class action lawsuit against a retail store for sending unsolicited text messages in violation of the TCPA. The district court approved a settlement between the parties and certified the class despite various objections, including one from a third-party defendant who argued the consumers lacked standing under the 2016 Supreme Court opinion Spokeo, Inc. v. Robins, because “they alleged only a bare statutory violation and statutory damages cannot substitute for concrete harm.”

    On appeal, the appellate court first rejected the third-party defendant’s standing to appeal the district court’s decision because it had not been “‘formally strip[ped]’ of any claim or defense, it lacks standing to pursue its appeal” in the underlying class action. Notwithstanding the lack of standing by the third-party defendant, the appellate court then went on to address the jurisdictional standing issues raised against the consumers. The court reasoned that, even though the third party that raised the jurisdictional question had been dismissed, the court had an “independent obligation to satisfy [itself] of the jurisdiction” of the appellate and district court. The appellate court concluded that the consumers sufficiently alleged “nuisance and privacy invasion” by the unsolicited text messages, which “are the very harms with which Congress was concerned when enacting the TCPA.” Because the harms identified are “of the same character as harms remediable by traditional causes of action,” the appellate court held the consumers sufficiently demonstrated injury-in-fact as required by Article III.

    Courts TCPA Appellate Second Circuit Spokeo Privacy/Cyber Risk & Data Security Class Action

    Share page with AddThis
  • 11th Circuit: Increased risk of identity theft is sufficient to bring FACTA claims

    Courts

    On April 22, the U.S. Court of Appeals for the 11th Circuit affirmed a district court’s ruling that including too many digits of a consumer’s credit card account number on a receipt was sufficient to constitute a concrete injury even if the consumer’s identity was not stolen. Under the Fair and Accurate Credit Transactions Act (FACTA), merchants are prohibited from including more than the final five digits of a consumer’s credit card number on a receipt. According to the opinion, the consumer filed a class action suit against a chocolate company, alleging that one of its stores printed the first six and last four digits of his account number on a receipt, which exposed the class members “to an elevated risk of identity theft.” When the parties sought approval of a proposed settlement, two unnamed class members contested the settlement on the grounds that, among other things, the consumer/class representative lacked standing to sue because he had not suffered a concrete injury as defined in the U.S. Supreme Court’s decision in Spokeo, Inc. v. Robins. The district court, however, approved the settlement.

    On appeal, the 11th Circuit held that an increased risk of identity theft is sufficient to bring claims under FACTA, and that the class representative’s “alleged injury is ‘particularized’ because the heightened risk of identity theft affected him ‘in a personal and individual way’—it was his credit card number that appeared on the receipt.” Moreover, the appellate court noted, “In our view, if Congress adopts procedures designed to minimize the risk of harm to a concrete interest, then a violation of that procedure that causes even a marginal increase in the risk of harm to the interest is sufficient to constitute a concrete injury.”

    Courts Appellate FACTA Privacy/Cyber Risk & Data Security Eleventh Circuit Class Action Settlement Spokeo

    Share page with AddThis

Pages