Bassett v. ABM Parking Servs., Inc.

• Decision Date: 21 February 2018
• Docket Number: No. 16-35933,16-35933
• Citation: 883 F.3d 776
• Parties: Steven BASSETT, Plaintiff–Appellant, v. ABM PARKING SERVICES, INC., DBA ABM Onsite Services—West, DBA AMPCO System Parking; ABM Onsite Services—West, Inc.; ABM Industries, Inc., Defendants–Appellees.
• Court: U.S. Court of Appeals — Ninth Circuit

883 F.3d 776

Steven BASSETT, Plaintiff–Appellant,
v.
ABM PARKING SERVICES, INC., DBA ABM Onsite Services—West, DBA AMPCO System Parking; ABM Onsite Services—West, Inc.; ABM Industries, Inc., Defendants–Appellees.

No. 16-35933

United States Court of Appeals, Ninth Circuit.

Submitted December 5, 2017^* Seattle, Washington
Filed February 21, 2018

Darrell L. Cochran and Christopher E. Love, Pfau Cochran Vertetis Amala PLLC, Tacoma, Washington, for Plaintiff–Appellant.

Ryan P. McBride, Abraham K. Lorber, and Randall P. Beighle, Lane Powell PC, Seattle, Washington, for Defendants–Appellees.

Before: Michael Daly Hawkins, M. Margaret McKeown, and Morgan Christen, Circuit Judges.

McKEOWN, Circuit Judge:

Today we answer a question that would certainly sound exotic to our nation's founders: Is receiving an overly revealing credit card receipt—unseen by others and unused by identity thieves—a sufficient injury to confer Article III standing?

In response to growing credit card fraud and identity theft, Congress enacted a series of protective laws. When Steven Bassett used his credit card at an ABM parking garage, he received a receipt displaying the card's full expiration date—a violation of the requirement that businesses redact certain credit card information on printed receipts. 15 U.S.C. § 1681c(g). Bassett sued but alleged only a statutory violation and a potential for exposure to actual injury. Like the district court, we conclude that Bassett failed to allege a concrete injury sufficient to give him standing. In doing so, we join the Second and Seventh Circuits in affirming dismissal under identical circumstances. See Crupar–Weinmann v. Paris BaguetteAm., Inc. , 861 F.3d 76 (2d Cir. 2017) ; Meyers v. Nicolet Rest. of De Pere, LLC , 843 F.3d 724 (7th Cir. 2016).

Background

The legislative backdrop for this case centers on FACTA and FCRA. The Fair and Accurate Credit Transactions Act of 2003 ("FACTA"), Pub. L. No. 108-159, 117 Stat. 1952, amended the Fair Credit Reporting Act ("FCRA") to limit the information printed on receipts: "[N]o person that accepts credit cards or debit cards for the

883 F.3d 778

transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction."¹ 15 U.S.C. § 1681c(g). The statute provides that "[a]ny person who willfully fails to comply with [that requirement] with respect to any consumer is liable to that consumer" for statutory damages of between $100 and $1,000 per violation or "any actual damages sustained by the consumer," costs and attorney's fees, and potential punitive damages. Id. § 1681n.

Following the passage of FACTA, consumers filed a spate of lawsuits against merchants who printed receipts showing credit card expiration dates. In response, Congress enacted the Credit and Debit Card Receipt Clarification Act (the "Clarification Act"), Pub. L. No. 110-241, 122 Stat. 1565 (2008). The Clarification Act reiterated that the FCRA prohibits the printing of receipts bearing a card's expiration date. Id. at 1566. But the congressional findings also noted that "hundreds of lawsuits were filed alleging that the failure to remove the expiration date was a willful violation of the [FCRA] even where the account number was properly truncated," and "[n]one of these lawsuits contained an allegation of harm to any consumer's identity." Id. at 1565. Congress went on to find that "[e]xperts in the field agree that proper truncation of the card number, by itself as required by the [FCRA], regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud." Id.

To "ensure that consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits," the Clarification Act granted a temporary reprieve for merchants: "[A]ny person who printed an expiration date on any receipt ... between December 4, 2004, and [June 3, 2008]," but otherwise complied with the card number truncation requirements, did not willfully violate the FCRA. Id. at 1566. The Act left the FCRA untouched for receipts printed after June 3, 2008. Id.

When Bassett paid for parking at an ABM garage in 2016, he was issued a receipt bearing his credit card expiration date. Bassett filed a putative class action lawsuit against ABM Services, Inc.; ABM Onsite Services – West; and ABM Industries, Inc. (collectively "ABM") alleging willful violations of the FCRA. Bassett's claimed injury was "exposure ... to identity theft and credit/debit fraud," because he was at "imminent risk" that his "property would be stolen and/or misused by identity thieves." He did not allege that a second receipt existed, that his receipt was lost or stolen, or that he was the victim of identity theft. Rather, he claimed that "the risk of harm created in printing the expiration date on the receipt" was a "sufficiently concrete" injury to confer Article III standing.

The district court granted ABM's motion to dismiss the complaint because Bassett failed to allege a sufficiently concrete injury. In dismissing the case with prejudice, the court concluded that Bassett alleged nothing more than a "possible risk of [identity] theft." Citing the Supreme Court's watershed decision on standing, Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016), the district court emphasized that "[s]omething more is necessary" to allege a concrete injury in fact, because "not every procedural violation gives rise to standing."

883 F.3d 779

Analysis

I. SPOKEO AND DECISIONS OF OUR SISTER CIRCUITS

At its core, standing is "an essential and unchanging part of the case-or-controversy requirement of Article III." Lujan v. Defenders of Wildlife , 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). Our analysis of this threshold issue begins with Spokeo . 136 S.Ct. 1540. To have standing, Bassett must allege that he "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of [ABM], and (3) that is likely to be redressed by a favorable judicial decision." Id. at 1547. An injury in fact is " ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’ " Id. at 1548 (quoting Lujan , 504 U.S. at 560, 112 S.Ct. 2130 ).

This appeal turns on whether Bassett alleged a concrete injury in fact. Spokeo , like this case, involved a putative consumer class action alleging willful violations of the FCRA. Robins claimed that Spokeo, a consumer reporting agency, published inaccurate credit report information about him, in violation of the FCRA. Id. at 1545–46. The district court dismissed the complaint for lack of standing, but we reversed. Id. at 1546. Because Robins alleged that "Spokeo violated his statutory rights, not just the statutory rights of other people," and Robins's "personal interests in the handling of his credit information are individualized rather than collective," we concluded that Robins's "alleged violations of [his] statutory rights [were] sufficient to satisfy the injury-in-fact requirement of Article III." Id. (quoting Robins v. Spokeo , Inc., 742 F.3d 409, 413–14 (9th Cir. 2014) ). Finding this analysis "incomplete," the Supreme Court vacated and remanded to consider whether Robins alleged a concrete injury in fact. Id. at 1545.

The Court emphasized that "Article III standing requires a concrete injury even in the context of a statutory violation." Id. at 1549. A plaintiff must show that a concrete injury "actually exist[s]"; in other words, it is "real, and not abstract." Id. at 1548 (internal quotation marks omitted). Intangible harms and a "risk of real harm" can be sufficiently concrete. Id. at 1549–50. But "a bare procedural violation, divorced from any concrete harm," cannot "satisfy the injury-in-fact requirement of Article III." Id. at 1549. Importantly, the Court noted that "[a] violation of one of the FCRA's procedural requirements may result in no harm"—for example, "[i]t is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm." Id. at 1550. The Court remanded to determine "whether the particular procedural violations alleged ... entail a degree of risk sufficient to meet the concreteness requirement." Id.

Following Spokeo , two of our sister circuits dismissed for lack of standing identical consumer class actions to the one presented in this appeal—alleged violations of the FCRA's credit card expiration date redaction requirement. In Meyers v. Nicolet Restaurant of De Pere , the Seventh Circuit held that " Spokeo compels the conclusion that Meyers'[s] allegations are insufficient to satisfy the injury-in-fact requirement for Article III standing":

The allegations demonstrate that Meyers did not suffer any harm because of Nicolet's printing of the expiration date on his receipt. Nor has the violation created any appreciable risk of harm. After all, Meyers discovered the violation immediately and nobody else ever saw the non-compliant receipt. In these circumstances, it is hard to imagine how the

...