Daniel v. Nat'l Park Serv., 16-35689

• Decision Date: 30 May 2018
• Docket Number: No. 16-35689,16-35689
• Citation: 891 F.3d 762
• Court: U.S. Court of Appeals — Ninth Circuit
• Parties: Stephanie DANIEL, on behalf of herself and all others similarly situated, Plaintiff-Appellant, v. NATIONAL PARK SERVICE; Does, 1–10, Defendants-Appellees.

891 F.3d 762

Stephanie DANIEL, on behalf of herself and all others similarly situated, Plaintiff-Appellant,

v.NATIONAL PARK SERVICE; Does, 1–10, Defendants-Appellees.

No. 16-35689

United States Court of Appeals, Ninth Circuit.

Argued and Submitted December 5, 2017—Seattle, Washington

Filed May 30, 2018

Timothy M. Bechtold (argued), Bechtold Law Firm PLLC, Missoula, Montana, for Plaintiff-Appellant.

Mark B. Stern (argued) and Henry C. Whitaker, Appellate Staff; Michael W. Cotter, United States Attorney; Chad A. Readler, Acting Assistant Attorney General; Civil Division, United States Department of Justice, Washington, D.C.; for Defendant-Appellee.

Before: Michael Daly Hawkins, M. Margaret McKeown, and Morgan Christen, Circuit Judges.

OPINION

McKEOWN, Circuit Judge:

This appeal is one of many in which plaintiffs seek redress for violation of a federal law that requires redaction of certain credit and debit card information on printed receipts. Stephanie Daniel alleges that identity thieves made fraudulent charges on her debit card at some unspecified time after she visited Yellowstone National Park. Daniel sued the National Park Service for issuing a receipt showing her debit card’s expiration date, a violation of the Fair Credit Reporting Act ("FCRA"). 15 U.S.C. § 1681c(g).

We affirm the district court’s dismissal of Daniel’s suit. As an initial matter, Daniel lacks standing because her complaint makes only conclusory allegations that her stolen identity was traceable to the Park Service’s alleged FCRA violation. Nonetheless, giving Daniel leave to amend the complaint would be futile because the FCRA does not waive the federal government’s sovereign immunity from Daniel’s suit.

Background

When Daniel purchased an entrance pass to Yellowstone National Park, the National Park Service (the "Park Service") printed a receipt bearing her full debit card expiration date. According to Daniel, the Park Service violated the FCRA’s prohibition that "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. § 1681c(g) (emphases added). The receipt otherwise complied with the FCRA’s card-number redaction requirements—it did not print more than the last five digits of the debit card number.

Daniel sued the Park Service, on behalf of herself and a putative class, under one of the FCRA’s enforcement provisions: "Any person who willfully fails to comply with [the FCRA] with respect to any consumer is liable to that consumer" for statutory damages of between $100 and $1,000 per violation or "any actual damages sustained by the consumer," costs and attorneys’ fees, and potential punitive damages. Id. § 1681n. Daniel claimed that after the Yellowstone transaction, her debit card was used fraudulently and she suffered damages from her stolen identity. She also alleged that the fraudulent use of her debit card was caused in part by the inclusion of the card’s expiration date on her Yellowstone receipt.

The district court granted the Park Service’s motion to dismiss on the grounds that the FCRA does not waive the U.S. government’s sovereign immunity. The court concluded that "including the United States as a ‘person’ every time the term is used in the FCRA would lead to inconsistent usage and potentially absurd results." Accordingly, Congress did not "speak unequivocally" as is required to waive sovereign immunity.¹

Analysis

Both Article III standing and sovereign immunity are threshold jurisdictional issues that we review de novo. See Raines v. Byrd , 521 U.S. 811, 818, 117 S.Ct. 2312, 138 L.Ed.2d 849 (1997) ; FDIC v. Meyer , 510 U.S. 471, 475, 114 S.Ct. 996, 127 L.Ed.2d 308 (1994). In this instance, we analyze both issues because dismissal of the case on standing grounds leaves open whether Daniel could amend her complaint to satisfy standing requirements. That route is foreclosed, however, because a suit dismissed on sovereign immunity grounds cannot be salvaged. See United States v. Mitchell , 463 U.S. 206, 212, 103 S.Ct. 2961, 77 L.Ed.2d 580 (1983) ("It is axiomatic that the United States may not be sued without its consent and that the existence of consent is a prerequisite for jurisdiction."). Daniel’s complaint fails on both fronts.

I. STANDING

To meet the constitutional threshold of Article III standing, Daniel must allege that she "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of [the Park Service], and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016). Although Daniel alleged a sufficient injury of identity theft, she failed to allege that her injury was "fairly traceable" to the Park Service’s issuance of the receipt. Without this link, Daniel’s suit must be dismissed.

A. DANIEL ALLEGED A CONCRETE INJURY OF IDENTITY THEFT

We recently considered whether "receiving an overly revealing credit card receipt—unseen by others and unused by identity thieves—[is] a sufficient injury to confer Article III standing." See Bassett v. ABM Parking Servs., Inc. , 883 F.3d 776, 777 (9th Cir. 2018). Bassett’s theory of injury—an "exposure" to identity theft "caused by [the issuer’s] printing of his credit card expiration date on a receipt that he alone viewed"—did not "have ‘a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.’ " Id. (quoting Spokeo , 136 S.Ct. at 1549 ). Nor did Congress "elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law." Id. at 781–82 (quoting Lujan v. Defenders of Wildlife , 504 U.S. 555, 578, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). It was no stretch to conclude that a receipt showing the credit card expiration date, by itself, was not a concrete injury. Id. at 780.

In contrast to Bassett, Daniel alleged a concrete, particularized injury by claiming that after the Yellowstone transaction, her debit card was used fraudulently and she suffered damages from her stolen identity. Identity theft and fraudulent charges are concrete harms particularized to Daniel and establish a sufficient injury at the pleading stage. See generally Spokeo , 136 S.Ct. at 1548–50 ; In re Zappos.com, Inc. , 888 F.3d 1020, 1028 (9th Cir. 2018) (holding that specific allegations of hackers accessing a plaintiff’s personal information that "could be used to help commit identity fraud or identity theft" are a sufficient injury).

B. DANIEL’S IDENTITY THEFT IS NOT FAIRLY TRACEABLE TO THE PARK SERVICE’S RECEIPT

The trickier question is whether the fraudulent charges on Daniel’s debit card and her stolen identity are "fairly traceable" to the Park Service’s printing of a receipt showing the expiration date of that debit card. At the pleading stage, Daniel does not need to prove proximate causation. See Lexmark Int’l, Inc. v. Static Control Components, Inc. , 572 U.S. 118, 134 S.Ct. 1377, 1391 n.6, 188 L.Ed.2d 392 (2014). But she still bears the burden of "demonstrating that her injury-in-fact is ... fairly traceable to the challenged action"—here, the Park Service’s issuance of the receipt. Davidson v. Kimberly-Clark Corp. , 889 F.3d 956, 967 (9th Cir. 2018) (citing Monsanto Co. v. Geertson Seed Farms , 561 U.S. 139, 149, 130 S.Ct. 2743, 177 L.Ed.2d 461 (2010) ). Daniel’s threadbare allegations fall short of demonstrating that link.

Daniel’s complaint contains only two generic statements that attempt to draw a connection between the receipt and her later identity theft. She alleged: "After this debit card transaction, Plaintiff Daniel’s personal debit card was used fraudulently and she suffered damages from the stolen identity." She went on to claim: "Based on information and belief, the fraudulent use of Plaintiff Daniel’s debit card was caused in part by the inclusion of the expiration date of her debit card on the receipt of her purchase from Defendant National Park Service."

The latter statement is a legal conclusion, and is therefore not entitled to an assumption of truth at the pleading stage. See Ashcroft v. Iqbal , 556 U.S. 662, 678–80, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). The former statement presents no specific factual allegations plausibly tying the Park Service receipt to her identity theft. These naked assertions fail our edict that a plaintiff may not "rely on a bare legal conclusion to assert injury-in-fact, or engage in an ingenious academic exercise in the conceivable to explain how defendants’ actions caused his injury." Maya v. Centex Corp. , 658 F.3d 1060, 1068 (9th Cir. 2011) (internal quotation marks and footnotes omitted).

Like Bassett, Daniel "did not allege that another copy of the receipt existed, that h[er] receipt was lost or stolen, ... or even that another person apart from h[er] lawyers viewed the receipt." Bassett , 883 F.3d at 783.² Merely asserting that a theft occurred at an unspecified time "after" the debit card transaction—absent any other details—does not connect the dots. Even crediting that temporal allegation as true, as we must at this stage, Daniel alleged no link between the receipt and the identity theft. See Syed v. M-I, LLC , 853 F.3d 492, 499 n.4 (9th Cir. 2017) ; Maya , 658 F.3d at 1068–73.

We are left with an allegation of a "bare procedural violation" of the FCRA and a generic allegation of later harm that is "divorced from" that violation. See Spokeo , 136 S.Ct. at 1549 ; Bassett , 883 F.3d at 781, 783. Because the "fairly traceable" leg of standing is no less essential to the "irreducible constitutional minimum" of standing than the injury leg, Daniel failed to adequately allege standing. Spokeo , 136 S.Ct. at 1547 (quoting Lujan , 504 U.S. at 560, 112 S.Ct. 2130 ).

Our conclusion does not alter the...