Ahmed Kamal v. J. Crew Group, Inc.
918 F.3d 102
| 3rd Cir. | 2019Background
- FACTA (15 U.S.C. § 1681c(g)) forbids printing more than the last five digits of a card number on receipts; Congress enacted FACTA to reduce identity theft.
- Ahmed Kamal received three J. Crew receipts that showed the first six and last four digits of his credit card number; he did not allege anyone else saw the receipts or that any theft or misuse occurred.
- Kamal sued for willful FACTA violations seeking statutory and punitive damages; the district court initially found plausible willfulness but later—after Spokeo—dismissed for lack of Article III standing (no concrete injury).
- Kamal amended to allege two concrete harms: (1) the printing itself as a statutory injury and (2) an increased risk of identity theft; the district court again dismissed for lack of concreteness and later (improperly) entered dismissal with prejudice.
- The Third Circuit reviewed the facial standing challenge de novo, applied Spokeo’s two-part test (congressional judgment and historical analogues), and asked whether Kamal alleged either a de facto injury or a materialized/material risk of harm.
- The Third Circuit affirmed dismissal for lack of standing, holding the FACTA violation alleged was a bare procedural violation (no third‑party disclosure and only speculative risk), vacated the with‑prejudice dismissal, and remanded for dismissal without prejudice.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether a FACTA violation showing first six + last four digits on receipts alone gives Article III standing | Kamal: statutory violation itself (Congress identified harm) is a concrete injury | J. Crew: mere technical violation without disclosure or actual harm is not concrete | Held: No — statutory violation alone here is not a concrete injury under Spokeo |
| Whether the alleged increased risk of identity theft is a sufficiently concrete injury | Kamal: printing materially increases risk; congressional findings support that risk | J. Crew: risk is speculative; no third‑party access; first six digits only identify issuer and often appear elsewhere | Held: No — risk is too speculative and not a materialized/material risk of harm |
| Whether the FACTA violation is analogous to traditional privacy/confidentiality torts | Kamal: analogous to intrusion/publicity or breach of confidence | J. Crew: no third‑party disclosure; not closely related to traditional torts | Held: Not analogous — historical practice requires disclosure to third parties for those torts |
| Appropriate disposition given lack of standing | Kamal: sought to stand on operative complaint; requested appealability | J. Crew: dismissal proper | Held: Affirm dismissal for lack of standing; vacate judgment dismissing with prejudice; remand to dismiss without prejudice |
Key Cases Cited
- Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016) (Article III requires a concrete injury even for statutory violations; courts consider Congress’s judgment and historical analogues)
- In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625 (3d Cir. 2017) (unauthorized dissemination of personal information can be a de facto concrete injury)
- Susinno v. Work Out World Inc., 862 F.3d 346 (3d Cir. 2017) (TCPA statutory injury analogous to common‑law privacy harms suffices for standing)
- St. Pierre v. Retrieval‑Masters Creditors Bureau, 898 F.3d 351 (3d Cir. 2018) (unauthorized disclosure of account information implicates FDCPA privacy concerns and supports standing)
- Long v. Se. Pa. Transp. Auth., 903 F.3d 312 (3d Cir. 2018) (distinguishing substantive statutory harms from bare procedural violations under Spokeo)
- Clapper v. Amnesty Int’l USA, 568 U.S. 398 (2013) (threatened future harm must be certainly impending or present substantial risk)
- Katz v. Donna Karan Co., 872 F.3d 114 (2d Cir. 2017) (FACTA violation showing first six digits did not create material risk of identity theft)
- Bassett v. ABM Parking Servs., 883 F.3d 776 (9th Cir. 2018) (FACTA expiration‑date violation did not create concrete injury where information was not disclosed to others)
- Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724 (7th Cir. 2016) (failure to truncate expiration date did not create appreciable risk where plaintiff immediately saw the receipt and no one else did)
- Muransky v. Godiva Chocolatier, Inc., 905 F.3d 1200 (11th Cir. 2018) (contrasting view that certain FACTA violations may constitute concrete injury akin to breach of confidence)