Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
On May 11, the U.S. Court of Appeals for the Sixth Circuit affirmed dismissal of a putative class action for lack of subject matter jurisdiction, holding that while a merchant technically violated the Fair and Accurate Credit Transactions Act (FACTA) by including 10 credit card digits on a customer’s receipt, the customer failed to allege any concrete harm sufficient to establish standing. According to the opinion, the named plaintiff filed a class action against the merchant alleging the first six and last four digits of her credit card number were printed on her receipt—a violation of FACTA’s truncation requirement, which only permits the last five digits to be printed on a receipt. The plaintiff argued that this presented “a significant risk of the exact harm that Congress intended to prevent—the display of card information that could be exploited by an identity thief,” and further claimed she did not need to allege any harm beyond the violation of the statute to establish standing. The district court disagreed, ruling that the plaintiff “lacked standing because she alleged merely a threat of future harm that was not certainly impending” and that the merchant’s technical violation demonstrated no material risk of identity theft.
In agreeing with the district court, the 6th Circuit concluded that a “violation of the statute does not automatically create a concrete injury of increased risk of real harm even if Congress designed it so.” Moreover, the appellate court reasoned that the “factual allegations in this complaint do not establish an increased risk of identity theft either because they do not show how, even if [p]laintiff’s receipt fell into the wrong hands, criminals would have a gateway to consumers’ personal and financial data.” The appellate court further concluded, “statutory-injury-for-injury’s sake does not satisfy Article III’s injury in fact requirement” and the court must exercise its constitutional duty to ensure a plaintiff has standing.
On March 11, the U.S. Court of Appeals for the Seventh Circuit held that a consumer’s alleged “stress and confusion” did not constitute a concrete and particularized injury under the FDCPA. The plaintiff alleged that the defendant debt collector violated the FDCPA when it directly communicated with her by sending a dunning letter related to unpaid debt even though she had previously notified the original lender that she was represented by counsel and requested that all debt communications cease. The district court granted the defendant’s summary judgment motion on the grounds that the debt collector could not have violated the FDCPA “without having actual knowledge of [the consumer’s] cease-communication request.”
On appeal, the 7th Circuit concluded that the complaint should be dismissed for lack of subject-matter jurisdiction because the plaintiff lacked standing. The 7th Circuit held that the consumer’s allegations—that the dunning letter caused her “stress and confusion” and “made her think that ‘her demand had been futile’”—did not amount to a concrete and particularized “injury in fact” necessary to establish Article III standing under the FDCPA. The court further noted that “the state of confusion is not itself an injury”—rather, for the alleged confusion to be concrete, “a plaintiff must have acted ‘to her detriment, on that confusion.’” Here, the consumer pointed only to a statutory violation and “failed to show that receiving [the debt collector’s] dunning letter led her to change her course of action or put her in harm’s way.” Additionally, the appellate court found the consumer’s argument that the dunning letter also “invaded her privacy,” raised for the first time on appeal, unpersuasive because she did not allege that injury in the complaint.
On February 4, the U.S. Court of Appeals for the Eleventh Circuit affirmed dismissal of a class action complaint, which raised several claims against a restaurant following a data breach that exposed customers’ financial information, for the named plaintiff’s lack of standing. According to the opinion, a restaurant chain suffered a data breach when hackers gained access to customers’ credit and debit card information through an outside vendor’s remote connection tool. The restaurant chain provided notice to customers that their information “‘may’ have been accessed.” A consumer, who made two purchases during the data breach period, cancelled the credit cards he used and filed a class action two weeks after the announcement of the breach, alleging the company was negligent in failing to safeguard the credit card data, and violated the Florida Unfair and Deceptive Trade Practices Act (FUDTPA), among others. The district court dismissed the action for lack of standing, concluding that the consumer failed to identify a “single specific, concrete injury in fact that he or anyone else  suffered as a result of any misuse of customer credit card information.”
On appeal, the 11th Circuit affirmed the district court’s holding. The appellate court rejected the consumer’s theories of standing, which were predicated on (i) a threatened “future injury” of identity theft, and (ii) the consumer’s alleged suffering of “mitigation injuries” (i.e., lost time, lost rewards points, and loss of access to accounts). The appellate court explained that in data breach cases like this, to have Article III standing the consumer must show a “substantial risk” of harm or that harm (e.g., identity theft) is “certainly impending.” The appellate court noted that despite the consumer still carrying “some risk of future harm involving identify theft,” that risk “is not substantial and is, at best, speculative” because the consumer “immediately cancelled his credit cards following disclosure [of the breach], effectively eliminating the risk of credit card fraud in the future.” Moreover, according to the appellate court, the consumer did not sufficiently allege an actual, present injury, through “inflicting injuries on himself to avoid an insubstantial, non-imminent risk of identity theft.” The appellate court reasoned that “[t]o hold otherwise would allow an enterprising plaintiff to secure a lower standard for Article III standing simply by making an expenditure based on a nonparanoid fear.”
On October 28, the U.S. Court of Appeals for the Eleventh Circuit, in a 7-3 en banc decision, vacated a $6.3 million Fair and Accurate Credit Transactions Act (FACTA) class action settlement, concluding the plaintiffs lacked standing because they did not allege any concrete harm. According to the opinion, the named plaintiff filed a FACTA class action against a chocolate retailer, alleging that the retailer printed too many credit card digits on receipts over several years. The complaint only pursued statutory damages and explicitly stated it did “not intend to request any recovery for personal injury.” The parties agreed to settle the litigation for $6.3 million prior to the U.S. Supreme Court decision in Spokeo, Inc. v. Robins (holding that a plaintiff must allege a concrete injury, not just a statutory violation, to establish standing). After Spokeo, the district court approved the class action, and class objectors appealed, with one objector arguing that the district court lacked jurisdiction to approve the settlement because the named plaintiff did not allege an injury in fact. On appeal, the 11th Circuit issued multiple opinions, with the first two affirming the settlement approval. The full panel ordered a rehearing en banc, vacating the last opinion.
The en banc panel vacated the district court order approving the settlement, concluding that the named plaintiff lacked standing under Spokeo. Specifically, the panel rejected the named plaintiff’s argument that “receipt of a noncompliant receipt itself is a concrete injury,” noting that “nothing in FACTA suggests some kind of intrinsic worth in a compliant receipt.” Moreover, the panel disagreed with the named plaintiff’s distinction that his claim was a “substantive” violation and not just a “procedural” one, reasoning that “no matter what label you hang on a statutory violation, it must be accompanied by a concrete injury.” Because the complaint did not allege a concrete injury, the panel vacated the order.
In dissent, one judge argued that the named plaintiff plausibly alleged concrete harm by establishing that the retailer’s FACTA violation elevated his risk of identity theft. In the second dissent, another judge asserted that both common law and congressional intent support the conclusion that the plaintiff’s complaint constitutes a concrete injury in fact. And lastly, the third dissent argued that the order should not be dismissed outright because the majority made “assumptions about the risks of identity theft without the benefit of a factual record, expert reports, or adversarial testing of the issue in the district court.”
On April 27, a majority panel for the U.S. Court of Appeals for the Eleventh Circuit denied the City of Miami Gardens’s petition for rehearing en banc after determining that the City “faced an uphill battle” to establish standing to bring a Fair Housing Act lawsuit against a national bank because it mainly relied on “an attenuated theory of injury.” As previously covered by InfoBytes, last July the 11th Circuit dismissed the City’s lawsuit against the bank for lack of standing after concluding, among other things, that the City’s evidence that certain loans may go into foreclosure at some point in the future “does not satisfy the requirement that a threatened injury be ‘imminent, not conjectural or hypothetical,’” and that the City failed to provide evidence that certain foreclosed loans had an effect on property-tax revenues or municipal spending or were issued on discriminatory terms. In explaining their decision to not rehear its 2019 ruling en banc, the majority stated that its decision—that the City failed to satisfy its burden of establishing standing—respects “the concerns and fairness and notice demanded by” both U.S. Supreme Court and 11th Circuit precedent. Two dissenting judges countered, however, that the rehearing should have been granted because, among other things, the 11th Circuit’s dismissal for lack of standing was done sua sponte “even though the City received neither proper notice that it failed to prove standing nor a legitimate opportunity to discover or produce the requisite evidence.”
On January 28, the U.S. Court of Appeals for the Seventh Circuit affirmed the dismissal of claims and counterclaims in a privacy lawsuit, holding that neither party had standing under the Fair Credit Reporting Act (FCRA). In 2016, the consumer filed a lawsuit against the credit reporting agency claiming privacy violations and emotional distress after the agency released his credit information without authorization. According to the consumer, his credit information appeared on a “prescreen list” given to a prospective lender that was no longer under contract with the agency to make loan offers to pre-screened consumers. The agency filed an FCRA counterclaim arguing that the plaintiff violated the FCRA when he obtained a copy of the prescreen list without authorization in order to file the lawsuit. The district court dismissed both claims, ruling that neither party had standing to sue because they had not suffered a concrete injury.
On appeal, the 7th Circuit agreed with the decision, concluding the plaintiff failed to meet the injury-in-fact requirements under Article III and that any harm he may have suffered when the prescreen list was shared was “exceedingly remote and speculative.” According to the appellate court, “[i]dentifying a violation of a statutory right does not automatically equate to showing injury-in-fact for standing purposes.” Moreover, the plaintiff “had to come forward with something showing that he did not receive a firm offer, that [the prospective lender] would not have honored a firm offer, that he was affected by the lack of a firm offer, or that he suffered any actual emotional damages,” the 7th Circuit wrote, which he failed to do. The 7th Circuit also agreed with the district court that the company’s alleged reputational harm was insufficient to confer standing. The appellate court further rejected the agency’s second argument that defending the suit counted as a concrete injury, holding that the agency was attempting to “shoehorn itself into another cause of action,” and that the FCRA does not create an independent cause of action for which the agency can recover its costs.
On January 3, the U.S. Court of Appeals for the Sixth Circuit affirmed the dismissal for lack of standing of an FDCPA suit brought by a consumer who claimed that because collection letters sent to him by a law firm caused him anxiety, the firm had violated the FDCPA. According to the opinion, the consumer had two delinquent accounts with a bank, which the law firm attempted to recover by sending collection letters to the consumer. The consumer asserted that the letters the law firm sent caused him “an undue sense of anxiety” that he would be sued by the firm, and he subsequently filed a lawsuit against the firm for violating the FDCPA. The court held that the consumer did not have standing to sue under Article III of the U.S. Constitution, for three main reasons: (i) the debtor’s anxiety about a potential lawsuit amounted to a fear of future harm that was not “certainly impending” because the consumer had not alleged that the law firm had threatened to sue him or that he refused to pay, and, therefore, his anxiety did not satisfy the injury-in-fact element for Article III standing; (ii) the consumer was “anxious about the consequences of his decision to not pay the debts that he does not dispute he owes,” and such a “self-inflicted injury” is not a basis for standing because it was not “fairly traceable” to the law firm’s conduct, but instead reflected the consumer’s own behavior; and (iii) “even assuming [the law firm” violated the statute by misrepresenting that an attorney had reviewed [the consumer’s] debts,” that violation did not cause any injury to the consumer because the consumer gave the court “no reason to believe he did not owe the debts,” and, therefore, he could not show that the law firm’s alleged procedural violation of the FDCPA, by itself, was an “injury in fact.” Because the court held that the consumer did not have standing, it affirmed the lower court’s dismissal of the action.
On October 31, the U.S. Court of Appeals for the Ninth Circuit, in a split panel decision, reversed the district court’s dismissal of a consumer’s FCRA action against a national bank alleging the bank obtained her credit report for an impermissible purpose. According to the opinion, the consumer filed the complaint against the bank after reviewing her credit report and noticing the bank had submitted “numerous credit report inquiries” in violation of the FCRA because she “did not have a credit relationship with [the bank]” as specified in the FCRA and, therefore, the inquiries were not for a permissible purpose. The bank moved to dismiss the action, arguing that the consumer did not suffer any injury from the credit inquiries. The district court agreed, and dismissed her claim with prejudice for lack of standing and failure to state a claim.
On appeal, the majority disagreed with the district court, concluding that (i) a consumer suffers a concrete injury in fact when a credit report is obtained for an impermissible purpose; and (ii) a consumer only needs to allege that her credit report was obtained for an impermissible purpose to survive a motion to dismiss. The appellate majority emphasized that the consumer does not have the burden of pleading the actual purpose behind the bank’s use of her credit report; the burden is on the defendant to prove the credit report was obtained for an authorized purpose. Moreover, the majority noted that the consumer alleges she only learned about the bank’s inquiry after reviewing her credit report and, therefore, it is implied “that she never received a firm offer of credit from [the bank],” and taken together with the fact that the bank actually obtained her credit report, she stated a plausible claim for relief.
One panel judge concurred in part and dissented in part, arguing that the consumer had standing but failed to state a plausible claim. Specifically, the judge argued that “the majority characterize[d] [the] plaintiff’s claim in terms of ‘possibility,’” but “mere possibility of liability does not plead a plausible claim.” Moreover, the judge disagreed with the majority’s conclusion that the defendant bears the burden of proof in these instances, stating “the Supreme Court has expressly placed the burden of pleading a plausible claim squarely on the plaintiff rather than on the defendant.”
District Court allows NCUA to substitute plaintiff, denies dismissal of breach of contract claim in RMBS action
On October 15, the U.S. District Court for the Southern District of New York held that the NCUA may substitute a new plaintiff to represent the agency’s claims in a residential mortgage-backed securities (RMBS) action against an international bank serving as an RMBS trustee. In the same order, the court dismissed certain tort claims, but allowed claims for breach of contract to move forward against the trustee.
According to the opinion, NCUA brought the action on behalf of 97 trusts for which the international bank served as the trustee, even though NCUA only had direct interest in eight of the trusts. NCUA argued it had derivative standing to pursue the claims on behalf of the other 89 trusts “on the theory that it had a latent interest in the [the 89 trusts] after they wound down and as ‘an express third-party beneficiary under the [89 trusts] Indenture Agreements.’” The trustee moved to dismiss the action and after hearing oral arguments on the motion, the court stayed the case pending the outcome of NCUA’s appeal regarding derivative standing in similar action before the U.S. Court of Appeals for the Second Circuit. In August 2018, the 2nd Circuit held that NCUA lacked standing to bring the derivative claims because the trusts had granted the right, title, and interest to their assets, including the RMBS trusts, to the Indenture Trustee. (Previously covered by InfoBytes here.) Based on the appellate court decision in the similar action, NCUA moved to file a second amended complaint and substitute a newly appointed trustee as plaintiff for the claims made on behalf of the 89 trusts for which it did not have direct standing.
Despite the trustee’s objections, the district court granted NCUA’s request, concluding that NCUA’s claims were timely and allowing the NCUA’s “Extender Statute”—which gives the agency the ability to bring contract claims at “the longer of” “the 6-year period beginning on the date the claim accrues” or “the period applicable under State law”—to apply to the new substitute plaintiff. Additionally, the court denied the bank’s motion to dismiss NCUA’s breach of contract claim alleging the trustee had notice of the defects in the mortgage files held in the various trusts. The court concluded that NCUA sufficiently plead that the trustee “did indeed receive notice [of the defective mortgages] and should have thus acted,” under the Pooling and Servicing Agreements.
District Court allows majority of privacy invasion class action claims to proceed against social media company
On September 9, the U.S. District Court for the Northern District of California granted in part and denied in part a social media company’s motion to dismiss a multidistrict class action alleging the company failed to prevent third parties from accessing and misusing private data of its users, in violation of the Stored Communications Act (SCA), the Video Privacy Protection Act (VPPA), and various state laws. In the consolidated action, the plaintiffs allege that the company (i) made sensitive user information—including basic facts such as gender, age, and address; and substantive content such as photos, videos, and religious and political views—available to third parties without user consent; and (ii) failed to prevent those same third parties from selling or otherwise misusing the information. The company moved to dismiss the action, arguing, among other things, that “people have no legitimate privacy interest in any information they make available to their friends on social media.”
The district court disagreed, concluding that most of the plaintiffs’ claims should survive, and that the company “could not be more wrong” in its argument that its users lose all privacy interest in the information they share with their friends on social media. The court asserted that when a user shares information with a limited audience, they “retain privacy rights and can sue someone for violating them.” The court also rejected the company’s argument that the plaintiffs did not have standing to sue in federal court because they could not show “tangible negative consequences from the dissemination of [the] information.” The court noted that privacy invasion is a redressable injury in itself and does not need a secondary economic injury to confer standing. Additionally, while the court recognized that the company’s argument that the users consented to this practice has “some legal force,” it cannot “defeat the lawsuit entirely, at least at the pleading stage.” Therefore, the court denied the motion as to the VPPA and narrowed certain claims under the SCA and California state laws, mostly with regard to claims on behalf of users who signed up for the service after 2009, who purportedly authorized the company to share information through their friends with app developers.
- Jonice Gray Tucker to discuss “How the new administration sets the tone for 2021” at the American Conference Institute Legal, Regulatory and Compliance Forum on Fintech & Emerging Payment Systems
- Sherry-Maria Safchuk to discuss UDAAP in consumer finance at an American Bar Association webinar
- Jeffrey P. Naimon to discuss "What to expect: The new administration and regulatory changes" at the Mortgage Bankers Association Legal Issues and Regulatory Compliance Conference
- Jonice Gray Tucker to discuss “The future of fair lending” at the Mortgage Bankers Association Legal Issues and Regulatory Compliance Conference
- Steven R. vonBerg to discuss "LO comp challenges" at the Mortgage Bankers Association Legal Issues and Regulatory Compliance Conference
- Michelle L. Rogers to discuss "Major litigation" at the Mortgage Bankers Association Legal Issues and Regulatory Compliance Conference
- Michelle L. Rogers to discuss “The False Claims Act today” at the Federal Bar Association Qui Tam Section Roundtable