Katz v. Donna Karan Co.

• Decision Date: 19 September 2017
• Docket Number: Docket No. 15-464 August Term, 2015.
• Citation: 872 F.3d 114
• Parties: Yehuda KATZ, Plaintiff–Appellant, v. The DONNA KARAN COMPANY, L.L.C., The Donna Karan Company Store, L.L.C., Donna Karan International, Incorporated, Defendants–Appellees.
• Court: U.S. Court of Appeals — Second Circuit

872 F.3d 114

Yehuda KATZ, Plaintiff–Appellant,

v.The DONNA KARAN COMPANY, L.L.C., The Donna Karan Company Store, L.L.C., Donna Karan International, Incorporated, Defendants–Appellees.

Docket No. 15-464 August Term, 2015.

United States Court of Appeals, Second Circuit.

Argued: October 28, 2015

Final Submission: July 7, 2017

Decided: September 19, 2017

Shimshon Wexler , Law Offices of Shimshon Wexler, P.C., Atlanta, GA, and New York, NY (Keith J. Keogh, Keogh Law, Ltd., Chicago, IL, on the brief), for Plaintiff–Appellant.

Gregg M. Mashberg (David A. Munkittrick and Charles S. Sims, on the brief), Proskauer Rose, LLP, New York, NY, for Defendants–Appellees.

Before: Katzmann, Chief Judge, Pooler and Chin, Circuit Judges.

Katzmann, Chief Judge:

This is the second of two related cases concerning the impact of Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016), as revised (May 24, 2016), on the concrete injury requirement for establishing Article III standing when a claim alleges only a bare procedural violation of a statute, here the Fair and Accurate Credit Transactions Act of 2003 ("FACTA"), Pub. L. No. 108-159, 117 Stat. 1952 (codified as amended at 15 U.S.C. § 1681c(g) ). FACTA seeks to reduce the risk of identity theft by, among other things, prohibiting merchants from including more than the last five digits of a customer's credit card number on a printed receipt. See 15 U.S.C. § 1681c(g)(1). In the related case, Crupar–Weinmann v. Paris Baguette Am., Inc. , 861 F.3d 76 (2d Cir. 2017) (" Paris Baguette "), we held that the specific alleged bare procedural violation of FACTA—the printing of the plaintiff's credit card expiration date on her receipt—presented no material risk of harm to the underlying interest Congress sought to protect (identity theft), because Congress itself had clarified that printing the expiration date, without more, did not "increase[ ] the risk of material harm of identity theft." Id. at 81.

Here, the plaintiff alleges that he twice purchased items at the defendants' stores, and on both occasions received a printed receipt that identified not only the last four digits of his credit card number but also the first six digits. He alleges that such a violation of FACTA raises a material risk of harm of identity theft, and so he has suffered a concrete injury sufficient to establish Article III standing to sue defendants for the violation. At the motion-to-dismiss stage below, the defendants introduced extrinsic evidence that the first six digits of a credit card number simply identify the card issuer and provide no personally identifying information about the plaintiff. In part on this basis, the district court concluded that this alleged procedural violation, without some further harm, did not raise a material risk of identity theft sufficient to satisfy the concrete injury requirement as articulated in Spokeo , and dismissed with prejudice the plaintiff's complaint for lack of subject matter jurisdiction. See generally Katz v. Donna Karan Int'l, Inc. , No. 14 CIV. 740 (PAC), 2017 WL 2191605 (S.D.N.Y. May 17, 2017) (" Katz ").

On appeal, we hold that the parties' factual disagreement as to whether printing the first six digits constituted a material risk of harm is a question of fact even at the Rule 12(b)(1) motion-to-dismiss stage, and so we review the district court's finding for clear error. On the basis of the record below and the plaintiff's affirmative burden to establish subject matter jurisdiction by a preponderance of the evidence, and informed by the findings of other district courts as to this specific issue, we conclude that the district court's finding was not clearly erroneous. Accordingly, we AFFIRM the judgment of the district court dismissing the plaintiff's second amended complaint for lack of subject matter jurisdiction. However, because a complaint must be dismissed without prejudice where the dismissal is due to the court's lack of subject matter jurisdiction, we REMAND so that the district court may amend the judgment and enter the dismissal without prejudice.

BACKGROUND

I. Factual History

We draw the brief factual history of this case from plaintiff's second amended complaint, filed after our remand. Plaintiff Yehuda Katz alleges that, in January and February 2014, respectively, he visited the defendants' stores in Tipton Falls, New Jersey, and New York, New York, made a purchase, and at each "was given a customer copy of a computer-generated cash register receipt that published the first six digits of Plaintiff's credit card number." Sec. Am. Compl. ¶ 61. Katz alleges that printing the first six digits of his credit card number was in violation of FACTA. Id. ¶¶ 67; 72. Congress passed FACTA in part to reduce the risk of identity theft by, among other things, imposing a "truncation" requirement on venders who accept credit and debit cards, instructing them not to print "more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. § 1681c(g)(1).

Like the amended complaint in Paris Baguette , Katz's second amended complaint here is "devoid of specific factual allegations concerning ... any consequences that stemmed from display of" the first six digits of his credit card number on the receipts. 861 F.3d at 78. And as in Paris Baguette , Katz's second amended complaint instead largely focuses on the identity theft concerns that motivated Congress to pass FACTA, as well as the defendants' alleged prior knowledge of FACTA's requirements. Katz contends that the receipts issued by defendants including the first six digits of his credit card number are "exactly the reckless, i.e. willful, systematic dissemination of personal information which FACTA was enacted to protect from disclosure, i.e. concrete particularized harm which FACTA made redressable by providing a statutory damages remedy." Sec. Am. Compl. ¶ 68.

II. Procedural History

Katz filed his complaint in February 2014 and then amended his complaint in May 2014. Shortly thereafter, defendants moved to dismiss. The district court (Crotty, J .) ultimately granted the motion, primarily on the basis that his complaint did not contain "any well-pleaded facts which allow the plausible inference that Defendants willfully, knowingly, or recklessly violated FACTA." Katz v. Donna Karan Int'l, Inc. , No. 14 CIV. 740 PAC, 2015 WL 405506, at *2 (S.D.N.Y. Jan. 30, 2015). Katz appealed, and on October 28, 2015, we heard consolidated oral argument in both his case and Paris Baguette . Days later, the Supreme Court heard oral argument in Spokeo , which raised questions concerning the circumstances in which a risk of harm may be sufficiently concrete so as to satisfy the injury-in-fact requirement for Article III standing. 136 S.Ct. at 1549. After the Court clarified the requirements for standing in Spokeo, we vacated and remanded both cases "to allow plaintiffs an opportunity to replead their claims to comport with the pleading standards set forth in Spokeo , and to allow the district courts to address any standing questions in the first instance," and we retained appellate jurisdiction over the outcomes. Cruper–Weinmann v. Paris Baguette Am., Inc. , 653 Fed.Appx. 81, 82 (2d Cir. 2016). On remand, the district court again granted the defendants' motion to dismiss, this time because Katz did "not show that Defendants' FACTA violation presented a material risk of harm to [the] underlying interest of identity theft protection," and so Katz did not plead a concrete injury-in-fact sufficient to establish standing. Katz , 2017 WL 2191605, at *6 (alteration in original) (internal quotation marks omitted). The district court dismissed with prejudice Katz's claims for lack of subject matter jurisdiction, Katz appealed that dismissal, and the parties submitted letter briefing addressing this issue in light of Spokeo and our Circuit's subsequent doctrine concerning standing requirements when alleging bare procedural violations of law.

DISCUSSION

I. Standard of Review

We review de novo the district court's decision to dismiss a complaint for lack of standing pursuant to Federal Rule of Civil Procedure 12(b)(1), "construing the complaint in plaintiff's favor and accepting as true all material factual allegations contained therein." Donoghue v. Bulldog Inv'rs Gen. P'ship , 696 F.3d 170, 173 (2d Cir. 2012).

II. Concrete Harm from a Bare Procedural Violation of FACTA

In Paris Baguette , we described the contours of the concreteness requirement in light of Spokeo . See 861 F.3d at 79–81. After Spokeo , we explained, "the critical question for standing purposes is ‘whether the particular procedural violations alleged in this case entail a degree of risk sufficient to meet the concreteness requirement,’ " 861 F.3d at 80 (quoting Spokeo , 136 S.Ct. at 1550 ), which in turn depends on "whether the particular bare procedural violation may present a material risk of harm to the underlying concrete interest Congress sought to protect" in enacting the statutory requirement. Id. at 80–81.

Below, the district court concluded that although defendants violated FACTA's prohibition on printing the first six digits of Katz's credit card, "[t]he first six digits do not disclose any information about Plaintiff; but rather ‘identify the institution that issued the card to the card holder.’ " Katz , 2017 WL 2191605, at *1. The court drew this conclusion from information alleged in the defendants' motion to dismiss, and from a website cited in the defendants' brief. That site explains that "[t]he first 6 digits of a credit card number are known as the Issuer Identification Number (IIN), previously known as bank identification number (BIN). These identify the institution that issued the card to the card holder." See Bin List (Binlist) & Bin Ranges , https://www.bindb.com/bin-list.html (last visited Sept. 18, 2017). The court also made reference to...