997 F.3d 629
6th Cir.2021Background
- FACTA (15 U.S.C. §1681c(g)) forbids printing more than the last five digits of a credit/debit card on point-of-sale receipts; willful violations permit statutory damages.
- On June 26, 2017, Thomas received an electronically printed receipt from a TOMS King restaurant showing the first six and last four card digits.
- Thomas sued TOMS King as a class action alleging the noncompliant receipt increased her and class members’ risk of identity theft and forced them to take protective steps; she sought statutory and punitive damages.
- The district court granted Defendants’ Rule 12(b)(1) motion and dismissed for lack of Article III standing, concluding the alleged violation was technical and did not allege a concrete or certainly impending harm.
- The Sixth Circuit reviewed de novo, examined circuit authority and the statutory history (including the 2008 Clarification Act), and framed the question whether a FACTA truncation violation that prints the first six and last four digits alone suffices as a concrete injury.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether a FACTA truncation violation (printing first 6 + last 4 digits) alone establishes Article III injury in fact | Thomas: Congress created the right and damages; printing extra digits increases risk of identity theft and imposes a burden to safeguard receipts | TOMS King: The violation is technical; first six digits identify only the issuer; no allegation receipt was lost, seen by a third party, or otherwise caused concrete risk | Held: No standing. The complaint failed to allege a concrete or imminent injury or a materialized increased risk from these digits alone |
| Whether congressional judgment alone makes a bare statutory violation a concrete injury | Thomas: Congress’s findings and damages scheme demonstrate Congress intended the procedure to protect against real risk | Defendants: Congress cannot, by statute alone, convert a bare procedural violation into an Article III injury; the Clarification Act indicates not all FACTA violations cause harm | Held: Court rejected automatic deference; Congress cannot erase Article III limits and the Clarification Act undercuts a per se rule that any violation is concrete |
| Whether historical common-law analogues (breach of confidence, invasion of privacy) support concreteness | Thomas: FACTA is analogous to breach-of-confidence/invasion-of-privacy harms protecting confidential information | Defendants: No confidential relationship and no disclosure to a third party here; analogies are weak | Held: Court rejected the analogies as inapplicable—no disclosure and no traditional close confidential relationship were alleged |
Key Cases Cited
- Spokeo v. Robins, 136 S. Ct. 1540 (2016) (Article III requires a concrete injury even for statutory violations)
- Thole v. U.S. Bank N.A., 140 S. Ct. 1615 (2020) (reaffirming the concreteness requirement for Article III standing)
- Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059 (D.C. Cir. 2019) (FACTA violation can confer standing when receipt contains enough information to enable fraud)
- Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917 (11th Cir. 2020) (en banc) (not every FACTA truncation violation creates standing; majority rejects per se injury rule)
- Kamal v. J. Crew Grp., Inc., 918 F.3d 102 (3d Cir. 2019) (no standing where receipt showed only first six and last four digits and no allegation of disclosure)
- Katz v. Donna Karan Co., LLC, 872 F.3d 114 (2d Cir. 2017) (printing issuer information/first six digits did not establish concrete injury)
- Huff v. TeleCheck Servs., Inc., 923 F.3d 458 (6th Cir. 2019) (procedural statutory violations do not automatically establish concrete injury)
- Buchholz v. Meyer Njus Tanick, 946 F.3d 855 (6th Cir. 2020) (standing analysis and limits on speculative future harms)
- Galaria v. Nationwide Mut. Ins. Co., [citation="663 F. App'x 385"] (6th Cir. 2016) (data breach produced concrete risk and mitigation costs demonstrating standing)