Dr. David S. Muransky v. Godiva Chocolatier, Inc.
979 F.3d 917
11th Cir.
2020
Check Treatment
Docket

DR. DAVID S. MURANSKY, individually and on behalf of all others similarly situated v. GODIVA CHOCOLATIER, INC., a New Jersey corporation

No. 16-16486 & 16-16783

IN THE UNITED STATES COURT OF APPEALS FOR THE ELEVENTH CIRCUIT

(October 28, 2020)

D.C. Docket No. 0:15-cv-60716-WPD; [PUBLISH]

DR. DAVID S. MURANSKY, individually and on behalf of all others similarly situated, Plaintiff - Appellee,

JAMES H. PRICE, ERIC ALAN ISAACSON, Interested Parties - Appellants,

versus

GODIVA CHOCOLATIER, INC., a New Jersey corporation, Defendant - Appellee.

Appeals from the United States District Court for the Southern District of Florida

Before WILLIAM PRYOR, Chief Judge, WILSON, MARTIN, JORDAN, NEWSOM, BRANCH, GRANT, LUCK, LAGOA, ED CARNES,* Circuit Judges.**

GRANT, Circuit Judge, delivered the opinion of the Court, in which WILLIAM PRYOR, Chief Judge, NEWSOM, BRANCH, LUCK, LAGOA, and ED CARNES, Circuit Judges, joined.

GRANT, Circuit Judge:

In , the Supreme Court took on a standing question that had bedeviled litigants, scholars, and lower courts—whether pleading that a statutory requirement was violated is enough to establish standing, even if the plaintiff suffered no injury from the alleged violation. The answer was a resounding no: a party does not have standing to sue when it pleads only the bare violation of a statute.

That holding left the class action litigants here in an awkward spot. Years ago, the named plaintiff pleaded this case as a pure statutory violation. He alleged that Godiva chocolate stores had printed too many credit card digits on hundreds of thousands of receipts over the course of several years, and pointed out that those extra numbers were prohibited under a federal law aimed at preventing identity theft. His complaint disclaimed any recovery for actual damages, and why not—with per-violation statutory damages of up to $1,000, the potential class recovery was staggering even if no one actually suffered any harm. Godiva, it seems, also found the potential damages staggering, and the parties agreed on a class settlement not too long after the lawsuit was filed.

So why are the litigants in an awkward spot? As they admitted in the district court, Spokeo was on the horizon during settlement talks, but had not yet been decided; it formed an ominous backdrop for their negotiations. Both parties had an interest in settling before that case was decided, because the Supreme Court‘s decision was likely to shift the bargaining calculus dramatically. So they settled. And having reached a deal in the shadow of Spokeo, neither side was ready to start all over after it was decided. Together, they pushed through the class fairness hearing, and landed here for a fairness review after a few class members objected to the settlement.

But even if the parties wish to bargain around Spokeo, we cannot indulge them. Federal courts retain our constitutional duty to evaluate whether a plaintiff has pleaded a concrete injury—even where Congress has said that a party may sue over a statutory violation. Having shut his eyes and closed his ears to the requirements of Spokeo while his claims were still at the district court, the named plaintiff now tries to say that those claims surely show concrete injury under Spokeo in any event. He has done his best to argue that the statutory violation he alleged carries with it both harm and risk of harm—and does so every time. But the emperor still has no clothes; the bare procedural violation the plaintiff alleges is just as bare as it ever was. Because the plaintiff alleged only a statutory violation, and not a concrete injury, he has no standing. That means we cannot evaluate the fairness of the parties’ settlement, and we vacate the district court‘s order approving it.

I.

A.

Before turning to why alleging the violation of a statute is not enough to establish standing, we should say a few words about the statute at issue here. The Fair and Accurate Credit Transactions Act sets out a wide range of protections and procedures. Pub. L. No. 108-159, 117 Stat. 1952 (2003). One of the (many) stated goals of the legislation is “to prevent identity theft.” Id. In support of that goal, FACTA forbids merchants from printing more than the last five digits of the card number (or the card‘s expiration date) on receipts offered to customers. Id. sec. 113, § 605(g), 117 Stat. at 1959 (codified at 15 U.S.C. § 1681c(g)(1)). A willful violation exposes a company to liability for actual damages—if any were sustained—or statutory damages ranging from $100 to $1,000 per violation. 15 U.S.C. § 1681n(a)(1)(A). Punitive damages and attorney‘s fees are also available. Id. § 1681n(a)(2)-(3).

Several years after the passage of FACTA, in response to “hundreds” of lawsuits seeking damages because credit card expiration dates had been printed on receipts—lawsuits that otherwise contained no “allegation of harm to any consumer‘s identity“—Congress enacted what‘s known as the Clarification Act. Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241 § 2(a)(4)-(5), 122 Stat. 1565, 1565 (2008). That law retroactively eliminated liability for merchants who had printed credit card expiration dates on receipts but complied with the other receipt-printing limitations. Id. sec. 3, § 616(d), 122 Stat. at 1566 (codified at 15 U.S.C. § 1681n(d)). The Clarification Act offered a subsequent Congress‘s view that some technical FACTA violations caused consumers no harm: the statute‘s stated “purpose” was to protect “consumers suffering from any actual harm” while also “limiting abusive lawsuits” that would drive up costs to consumers without offering them any actual protection. Id. § 2(b), 122 Stat. at 1566.

B.

With that background, we return to the allegations in front of us. Dr. David Muransky used his credit card to spend $19.26 at a Godiva retail store in Florida. He was handed a receipt containing the first six and last four digits of his sixteen-digit credit card number—too many digits under FACTA.

Muransky got busy, filing a class action complaint against Godiva less than a week later. He alleged that Godiva had willfully printed more digits than the law allowed and that the excess digits were a national problem for the company. Muransky‘s complaint made clear that the alleged FACTA violations were “statutory in nature” and that the suit was expressly “not intended to request any recovery for personal injury.” He alleged the class‘s harm, and risk of harm, from those statutory violations in broad terms: “Plaintiff and the members of the class have all suffered irreparable harm as a result of the Defendant‘s unlawful and wrongful conduct,” and “Plaintiff and members of the class continue to be exposed to an elevated risk of identity theft.” No additional details were offered.

The class of injured persons that Muransky proposed consisted of anyone in the United States who, in the two preceding years, received a point-of-sale receipt from Godiva that displayed more than the last five digits of their credit or debit card number. He sought statutory damages, punitive damages, and costs—as well as attorney‘s fees. Because of the size of the putative class, Godiva faced a startling liability of more than $342 million.

After a few motions to dismiss were rejected, Godiva‘s answer to the complaint included a standing argument: “Neither Dr. Muransky nor any member of the proposed class has suffered any injury in fact. They therefore lack standing to prosecute their alleged claims.”

Given the dramatic size of the potential damages, it is no surprise that the parties soon began settlement negotiations. They tried to move quickly—both Muransky and Godiva admit that one of the driving forces in those negotiations was the Supreme Court‘s impending decision in . As Muransky later told the trial court, “the class faced considerable uncertainty with regard to the Supreme Court‘s anticipated decision in Spokeo, Inc. v. Robins which, depending on the outcome, could have resulted in the case‘s dismissal for failure to present an injury in fact.” Godiva‘s briefing acknowledged the same—the potential outcome of Spokeo factored heavily into the settlement negotiations.

The flush of negotiations led to an agreement in principle to settle the case: Godiva would pay $6.3 million instead of the $342 million initially sought. Almost a third of the pot, $2.1 million, would go to the class attorneys, with an additional $10,000 going to Muransky “for his service as Class Representative.” The average class member, according to Muransky, would net about $60 when all was said and done.

With Spokeo still outstanding, the district court certified the class, granted preliminary approval of the settlement, and directed notice to the class members. Four class members filed various objections after they heard about the suit—including Appellants James Price and Eric Isaacson—though none of the objectors initially argued that Muransky lacked standing.

But by the time the district court held a fairness hearing on the proposed settlement, things had changed: the Supreme Court had issued its decision in Spokeo. Objector Isaacson took notice, and argued to the district court that it had an obligation to examine whether Muransky‘s claim satisfied the requirements of Article III standing as described in Spokeo. Muransky, he said, bore the burden of establishing the elements of standing as the party invoking federal jurisdiction—and in the absence of standing, the district court “would have no choice” but to dismiss the case. Neither Godiva nor Muransky offered anything in response.

Roughly a week later, the district court—without addressing Spokeo or Article III standing—approved the class settlement. The court instead offered a general conclusion that it had “jurisdiction over the subject matter of this litigation,” before going on to approve the settlement. Isaacson and Price appealed.

Objector Price raised the same issues he raised below—the contents of the class notice, the attorney‘s fee award, and the incentive award to Muransky.

Objector Isaacson, in addition to several other objections, offered the one we face here today: that the court lacked Article III jurisdiction to approve the settlement because Muransky had not suffered an injury in fact.

A panel of our Court disagreed, affirming the settlement‘s approval after concluding that Muransky had satisfied the requirements of Article III—even considering Spokeo. A few months later, the panel vacated its first opinion and issued a new one in its place. Although the superseding opinion contained a revised standing analysis, it reached the same conclusions as the first: Muransky had Article III standing, the objections failed on the merits, and the class settlement was properly approved.

The panel‘s new standing analysis resulted in a categorical rule: “if Congress adopts procedures designed to minimize the risk of harm to a concrete interest, then a violation of that procedure that causes even a marginal increase in the risk of harm to the interest is sufficient to constitute a concrete injury.” , reh‘g en banc granted, opinion vacated, . The level of risk required was alternatively described as “no more than an identifiable trifle.” (quotation marks and citation omitted). So in the panel‘s view, by setting out a statutory requirement for the number of digits on a receipt, Congress had judged that any violation of that requirement would increase the consumer‘s risk of identity theft—and this Court was bound to accept that congressional assessment of injury. .

In response, the full Court ordered rehearing en banc and vacated the panel opinion. In a testament to the complications of this case, the four parties offer different perspectives on Muransky‘s Article III standing. Objector Isaacson maintains that Muransky lacks standing because he was not injured and says this case should be dismissed. Muransky and Objector Price both argue that Muransky has standing (though they disagree about the merits of the settlement approval). For its part, Godiva declines to offer the Court any perspective at all, claiming that it is “prevented from answering this question” by the settlement agreement.

II.

Whether the plaintiffs have standing to sue is a threshold jurisdictional question that we review de novo. .

III.

At the heart of this case is one question: whether the judiciary must assume that whenever Congress creates a legal entitlement, any violation of that entitlement causes a concrete injury. Although courts “sometimes make standing law more complicated than it needs to be,” a well-trod path leads us to the answer here. . The Supreme Court “has rejected the argument that ‘a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.‘” (quoting ). And that rejection is derived from the now-familiar admonition that alleging a “bare procedural violation, divorced from any concrete harm” is not enough to support standing. . So, even considering the welter of standing doctrines that can clutter our analysis, we know one thing to be true—alleging a statutory violation is not enough to show injury in fact.

Why not? Article III of the Constitution limits federal courts to deciding “Cases” or “Controversies.” U.S. Const. art. III, § 2. The existence of a case or controversy is a “bedrock requirement” of our jurisdiction; we cannot exercise judicial power without it. (quoting ). So in order to find out if we can hear a party‘s claim, we need to consider whether that party has a case or controversy rather than, say, a strong and abiding interest in an issue, or a desire to obtain attorney‘s fees.

Standing, ripeness, and mootness are three traditional doctrines governing whether a case or controversy exists. Standing—“perhaps the most important of the jurisdictional doctrines“—is the only one at issue here. (quoting ) (alterations adopted). For a party to have standing to bring a lawsuit, it must have “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” (citing ). In plainer language, the plaintiff needs to show that the defendant harmed him, and that a court decision can either eliminate the harm or compensate for it. That standard applies equally in the class action setting; a district court is “powerless to approve a proposed class settlement” if “no named plaintiff has standing.” .

Our inquiry becomes narrower as we move down the standing decision tree; injury is the only element we need to consider here. At the pleading stage of a case, “general factual allegations of injury” can suffice. . But that is not a free pass—these general factual allegations must “plausibly and clearly allege a concrete injury.” ; see also ; ; . “[M]ere conclusory statements do not suffice.” (punctuation omitted). Although Iqbal and Twombly have put a finer point on it, this standard is not new—it‘s long been known that even at the pleading stage, the “litigant must clearly and specifically set forth facts” to satisfy the requirements of Article III. . We will not “imagine or piece together an injury sufficient to give [a] plaintiff standing when it has demonstrated none,” and we are powerless to “create jurisdiction by embellishing a deficient allegation of injury.” (citing ).

What is required, then? A plaintiff needs to plead (and later support) an injury that is concrete, particularized, and actual or imminent, rather than conjectural or hypothetical.1 See (quoting ). Our inquiry narrows again; we only consider concreteness here. A lot of ink has been spilled to explain what concrete means, but the best word may also be the simplest—“real.” And statutory violations do not—cannot—give us permission to offer plaintiffs a wink and a nod on concreteness. Plaintiffs must show, and the courts must ensure, that an alleged injury is concrete, or else we have no jurisdiction to consider it. .

As the parties recognized—or, less charitably, feared—during their settlement negotiations, the Supreme Court‘s Spokeo, Inc. v. Robins decision is central to our concreteness analysis. That‘s because Spokeo was not only about concreteness; it was also about Congress. Spokeo cautioned that “Congress’ role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” . So although a congressional judgment may be “instructive and important” to this Court‘s analysis, we need to come to our own conclusion that the alleged harm is concrete before we can find that a plaintiff has standing.

Echoing , the Spokeo decision also acknowledged that Congress may “elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law” and that “Congress has the power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before.” (citation omitted and alterations adopted). Congress can certainly create new legal entitlements, the denial of which will constitute a concrete injury. See, e.g., (inability to obtain information is an injury in fact); (same). It can also recognize and provide legal remedies for concrete injuries that already exist, but for which there is no cause of action. But this is a limited authority to provide legal process relating to actual harms, not a blanket power to authorize suit in the absence of harm: Congress “cannot erase Article III‘s standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.” (quoting ).2

A.

Now to the mechanics of pleading. Plaintiffs can show a concrete, or “real,” harm in two ways. The first is to show that the statutory violation itself caused a harm. It‘s safe to say that pointing to a direct harm is the most straightforward way to show a concrete injury—in fact, it‘s probably what most people think of naturally. Such harms can be tangible or intangible. Tangible harms are the most obvious and easiest to understand; physical injury or financial loss come to mind as examples.

Claims of intangible harm, on the other hand, can be tricky: some are concrete, some are not. Violations of the rights to free speech or free exercise, for instance, are intangible harms that are also both direct and concrete. (collecting cases). “[C]onscientious objection” to a law or “fears of hypothetical future harm“? Not so much. See ; . And questions of whether alleged intangible harms are concrete have an extra wrinkle when the plaintiff‘s claim stems from the violation of a statute.

Shedding some light on how to draw that difficult line, Spokeo instructs that we may consider “both history and the judgment of Congress.” . History first—by looking to history, we can discern a concrete injury where the “intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” The fit between a new statute and a pedigreed common-law cause of action need not be perfect, but we are called to consider at a minimum whether the harms match up between the two. Likewise, congressional judgment may illuminate a concrete injury because, as a body, Congress “is well positioned to identify intangible harms that meet minimum Article III requirements.” But as we have already explained, congressional judgment only goes so far, and does not relieve the judiciary of our constitutional duty to independently determine whether the plaintiff has suffered a concrete injury.

Our own post-Spokeo precedent illustrates how both history and congressional judgment can fit into the concreteness analysis. In several cases, we have concluded that a plaintiff had standing because the statutory violation at issue led to a type of harm that has historically been recognized as actionable. For example, we held that CNN‘s dissemination of a plaintiff‘s news-viewing history to a third-party, in violation of the Video Privacy Protection Act, could constitute a concrete injury because it was analogous to torts that were well-established in American courts—namely, invasion of privacy and intrusion upon seclusion. . We reached a similar conclusion when we held that an agency‘s violation of the Fair Credit Reporting Act—offering an allegedly inaccurate statement in a plaintiff‘s credit report—was analogous to the longstanding tort for publication of defamatory material. .

We have also relied on the judgment of Congress to discern concrete injuries. In , for instance, we considered the plaintiffs’ claim that they were sold an adulterated dietary supplement as defined by the Food, Drug, and Cosmetic Act because the manufacturer failed to provide notice to the Food and Drug Administration that a new dietary ingredient was safe. . Although the plaintiffs suffered no physical harm from the supplement, we concluded that they were sold a worthless product “that Congress judged insufficiently safe for human ingestion.” . That deprived the plaintiffs of the benefit of their bargain and amounted to a direct economic loss that supported standing. . In short, a variety of approaches can demonstrate direct harm to a plaintiff.

Even without any direct harm, a plaintiff can establish an injury in fact by showing that a statutory violation created a “risk of real harm.” (citing ). But while very nearly any level of direct injury is sufficient to show a concrete harm, the risk-of-harm analysis entails a more demanding standard—courts are charged with considering the magnitude of the risk. That means we evaluate whether the claimed “procedural violations . . . entail a degree of risk sufficient to meet the concreteness requirement.” .

If some degrees of risk are called sufficient, that means others must be insufficient. Although Spokeo did not trace a numerical line between the two, it did explain that the risk must be “material.” That‘s a familiar word that, in this context, means “important; essential; relevant.” New Oxford American Dictionary (3d ed. 2010); see also The American Heritage Dictionary of the English Language (5th ed. 2018) (“Being both relevant and consequential; crucial.“). We recognize that “material risk of harm” is a somewhat indefinite term. ; . One thing is definite, however. Whatever “material” may mean, conceivable and trifling are not on the list.

And for all the things that Spokeo broke new ground on, the high standard for risk of harm was not one of them. The Supreme Court has long indicated that standing predicated on a risk of harm must be based on something more than a minor or theoretical risk—“a ‘substantial risk’ that the harm will occur,” for example. (citation omitted). Other cases use slightly different formulations to describe a significant or substantial risk, but they are consistent in recognizing a high standard for the risk-of-harm analysis, and a robust judicial role in assessing that risk. See, e.g., (“substantially increased risk“); (“a substantial risk that the harm will occur” (quoting )); (“substantial risk” or “significant risk“); (“realistic danger of sustaining a direct injury” (citation omitted)); (a “sufficiently substantial” threat). We do not see, we should add, a “material” or “substantial” difference among these terms, and the Supreme Court has not suggested one.

Our Court has already put this standard to work. In , we concluded that a plaintiff had suffered neither direct harm nor a “material risk of harm” when his mortgage company recorded the discharge of his debt later than it should have. . The plaintiff, after all, had brought his lawsuit two years after the lender had finally (albeit tardily) fulfilled its duty, and there was no allegation that the lender‘s earlier failure had already injured him or would pose any risk in the future. . With neither a direct harm nor a material risk of harm, the plaintiff had suffered no concrete injury. See id.

We add that the lack of a numerical standard governing the quantum of risk that is sufficient to support standing does not mean that the standard is zero, that the standard is minimal, or that we simply defer to Congress. And the limits on congressional authority do not disappear when the statutory right at issue protects against a risk of future harm; it would be backwards to say that Congress gets less than complete deference when it seeks to identify actual harm, but is due blind, unreviewable deference if it seeks to protect against a risk of actual harm. The same is true for pleading requirements. A conclusory statement that a statutory violation caused an injury is not enough, so neither is a conclusory statement that a statutory violation caused a risk of injury.

B.

To boil down the lessons above, we consider two things when we evaluate whether concrete harm flows from an alleged statutory violation—and thus whether the plaintiff has standing. First, we ask if the violation itself caused harm, whether tangible or intangible, to the plaintiff. If so, that‘s enough. If not, we ask whether the violation posed a material risk of harm to the plaintiff. If the answer to both questions is no, the plaintiff has failed to meet his burden of establishing standing.3

The heart of Muransky‘s claim is that “he was provided with an electronically printed receipt” that “displayed the last four digits of his credit card as well as the first six digits of his account number” and that, because of this type of violation, he and other class members “have all suffered irreparable harm” and “continue to be exposed to an elevated risk of identity theft.” And, as we have explained, the complaint emphasizes that the wrongs committed by Godiva are “statutory in nature” and expressly disclaims any recovery for “personal injury” arising from the violations.

Relying on these allegations, all of which are grounded in the statute, Muransky now argues that the extra digits on his receipt can be counted as a concrete injury in four different ways. Three of his arguments suggest that the statutory violation itself—his receipt of the receipt—caused him a direct harm. His alternative argument is that the violation exposed him to an increased risk of identity theft. But Muransky‘s efforts to recharacterize the statutory violation he pleaded to fit within Spokeo‘s limits demonstrate, if anything, a commitment to the idea that the violation alone must somehow be enough.

1.

His first argument is that he had a “substantive right” to a properly truncated receipt, and that the violation of that right, “by itself, is a concrete injury.” This argument gets at the core of his complaint‘s allegations—statutory-violation-qua-injury was the predominant theory of harm throughout the litigation. Muransky also presses a new argument that the (unpleaded) efforts he took to safeguard his receipt qualify as an injury in fact. Finally, he pivots to historical analogue, asserting that the mishandling of his account information is actionable because it bears a close resemblance to a common-law breach of confidence. None of these direct-injury claims holds up.

i.

We have already explained the key holding from Spokeo: a “bare procedural violation, divorced from any concrete harm” is not enough to establish an Article III injury. . But we restate the point here to explicitly reject any argument that the complaint‘s conclusory statement that “Plaintiff and the members of the class have all suffered irreparable harm as a result of the Defendant‘s unlawful and wrongful conduct” is enough to show concrete injury; that claim would be so flimsy after Spokeo (not to mention Iqbal) that Muransky himself does not raise it. Nothing in FACTA suggests some kind of intrinsic worth in a compliant receipt, nor can we see any. So it makes little sense to suggest that receipt of a noncompliant receipt itself is a concrete injury.

To resist the force of that intuition, Muransky attempts to reframe the nature of his injury by relying on a fuzzy distinction between “substantive” and “procedural” rights. He argues that Godiva‘s statutory violation deprived him of a substantive right to receive “a properly truncated receipt,” and that the violation of a substantive right, unlike a procedural right, automatically inflicts an injury in fact.

fact—even if it causes no harm. This, it turns out, is a dressed up version of the same argument that the Eighth Circuit accepted before Spokeo, but had to walk back after it: “Our prior statement that ‘[i]njury in fact may thus be shown solely by the invasion of a legal right that Congress created,’ is no longer good law in light of the Supreme Court‘s subsequent holding in [that] ‘Article III standing requires a concrete injury even in the context of a statutory violation.‘” (quotation marks and citations omitted).

In an attempt to resuscitate that argument, Muransky contends that the holding in Spokeo applies only to what he calls “procedural” statutory violations, and not to what he calls “substantive” ones. He argues that Spokeo confirms his view when it says that even a procedural violation “can be sufficient in some circumstances to constitute injury in fact.” . Muransky is absolutely right that Spokeo makes this point, but he‘s absolutely wrong that it saves his claim.

‘s statement stands for the unremarkable proposition that, in some cases, the violation of a procedural right set out in a statute will necessarily result in the harm that Congress was trying to prevent. A prime example is the illegal deprivation of information: “a plaintiff suffers an ‘injury in fact’ when the plaintiff fails to obtain information which must be publicly disclosed pursuant to a statute.” (citation omitted); see also (denial of “legal right to truthful information about available housing” is an Article III injury). That, the Supreme Court has alreadymade clear, is not a “bare” procedural violation, or one that is “divorced from any concrete harm“; if a statute protects against a lack of information, the denial of access to information is a concrete injury. For FACTA, on the other hand, a violation of the statute does not directly result in the harm Congress was trying to prevent. That is, no one‘s identity is stolen at the moment a receipt is printed with too many digits. See Pub. L. No. 108-159, 117 Stat. at 1952 (a goal of FACTA is “to prevent identity theft“).

So while some statutory violations, by their very nature, will be coextensive with the harm that Congress was trying to prevent, labels do not control our analysis. We are not the first court to recognize that arguments grounded in a distinction between substantive and procedural rights miss the point and are “unconvincing” because they depend “entirely on the framing of the right.” ; see also . The question, always, is whether an injury in fact accompanies a statutory violation.

Confronting this argument again also feels a little like Groundhog Day, because we already rejected it in . There, the plaintiff claimed that, because “the New York legislature intended to create a substantive right to have the certificate of discharge timely recorded,” the plaintiff automatically suffered a concrete injury when the discharge was untimely filed. (emphasis added). There too, we held that the “relevant question” was “whether Nicklaw was harmed when this statutory right was violated.” The point is thatfor standing purposes, no matter what label you hang on a statutory violation, it must be accompanied by a concrete injury.

We thus continue to adhere to our decision in . Muransky‘s assertion that he does not need to show anything more than a noncompliant receipt because his statutory right was “substantive” cannot be squared with our precedent—or with the central holding of Spokeo. To avoid “alleging a bare procedural violation,” the plaintiff must show either some harm caused by the violation or a material risk of harm. . What Muransky has missed is that the word “bare” is just as important as the word “procedural.”

ii.

Perhaps suspecting that a statutory violation alone would no longer be sufficient after we considered , Muransky claims on appeal that the time he spent safeguarding his receipt also constitutes a direct injury in fact.

Although we have held that “allegations of wasted time can state a concrete harm for standing purposes,” we have also declined to find standing when no such allegations were pleaded. . In , we rejected the plaintiff‘s assertion at oral argument that receiving unwanted text messages caused him to waste time. . We did so for a simple reason: his complaint lacked any “specific time allegation.” So too here. Muransky never alleged that he treated his Godiva receipt differently than any other, or that he spent any additional time safeguarding it.

But even if Muransky had alleged that he spent additional time destroying or safeguarding his receipt, he would not succeed on this theory. Where a“hypothetical future harm” is not “certainly impending,” plaintiffs “cannot manufacture standing merely by inflicting harm on themselves.” . Muransky is no different than the Clapper plaintiffs in this respect—his management-of-risk claim is bound up with his arguments about actual risk. If his Godiva receipt would not offer any advantage to identity thieves, we could hardly say that he was injured because of the efforts he took to keep it out of their hands. To be fair, we have not yet addressed Muransky‘s risk-of-harm claims, but any assertion of wasted time and effort necessarily rises or falls along with this Court‘s determination of whether the risk posed by Godiva‘s FACTA violation, as pleaded by Muransky, is itself a concrete harm.

iii.

In his final attempt to show a direct harm, Muransky argues—for the first time—that Godiva‘s FACTA violation is analogous to a common-law breach of confidence tort. To succeed on this theory, he needs to show that the violation bears “a ‘close relationship’ to a traditionally redressable harm.” (quoting ). His argument proceeds along the following lines: FACTA requires merchants to keep credit card information secret. By handing him a receipt with too many digits of his credit card number exposed, Godiva “disclosed” information that he provided in confidence and gave criminals “easy access” to it. Because that disclosure (to him) bears a close relationship to the common-law breach of confidence tort, he says, it qualifies as a concrete harm.

Not so fast. As an initial matter, the parties dispute whether a breach of confidence tort can fairly be said to have “traditionally been regarded as providing a basis for a lawsuit in English or American courts.” . There is arguable support for both views in academic literature and caselaw. As a 1982 note cited by both Muransky and Isaacson explains, following its recognition in 1849, “the breach of confidence tort has become the basis of an extensive body of law” in England. Alan B. Vickery, Note, Breach of Confidence: An Emerging Tort, 82 Colum. L. Rev. 1426, 1452–54 (1982). But that same source goes on to state that the “law of breach of confidence in the United States, at least with respect to personal information, has not enjoyed a similar development,” and that the tort was “emerging” in a “rudimentary” form after initially dying “out in its infancy.” Id. at 1451–52, 1454. The observation that the tort was “emerging” in the 1980s is consistent with the Second Circuit‘s 1989 description of a breach of confidence as “a relative newcomer to the tort family.” .

One of the unexpected consequences of the common-law-analogy approach to identifying harms is the growing insistence on hammering square causes of action into round torts. Litigants and courts alike can be drawn into overthinking what was really a simple instruction: see if a new harm is similar to an old harm. Another risk is that courts will be unnecessarily drawn into an arcane evaluation of a tort‘s origins. Fortunately, we are not put to that test today. We need not resolve whether breach of confidence is sufficiently ancient, because even if we assumethat a breach of confidence was traditionally redressable in English and American common-law courts, we are unpersuaded by its analogy to the facts of this case.

A breach of confidence, at least as defined by the article cited by the parties, involves “the unconsented, unprivileged disclosure to a third party of nonpublic information that the defendant has learned within a confidential relationship.” Vickery, supra, at 1455; see also ; . Godiva‘s FACTA violation shares very little with this definition. Two key elements of a breach of confidence are completely absent from the violation he complains of. To begin, there was no “disclosure to a third party.” Muransky was handed a receipt that bore his own information, and he does not allege that anyone else ever saw it. To describe this act as a “disclosure” would distort the meaning of the term.

Nor can we see how Muransky could have had a confidential relationship with the Godiva retail store. A breach of confidence “is rooted in the concept that the law should recognize some relationships as confidential to encourage uninhibited discussions between the parties involved.” ; see also David A. Elder, Privacy Torts § 5:3 (2019). Given this understanding, it is unsurprising that breach of confidence claims traditionally arise in the context of close professional relationships—those involving physicians, therapists, financial institutions, and the like. See, e.g., (bank); (psychiatrist); (medicaldoctor). Handing a common form of payment to a cashier at a retail store is simply not equivalent to these kinds of vulnerable, confidential relationships.

Because no information was disclosed, and no confidential relationship existed, the relationship between Godiva‘s conduct and a breach of confidence is anything but “close“: a Godiva clerk handed Muransky a receipt containing a portion of his own credit card information. The fit between a traditionally understood harm and a more recent statutory cause of action need not be perfect, but the association here is too strained. Accordingly, we cannot say—at least based on a breach-of-confidence theory—that Muransky has pleaded the kind of injury that “has traditionally been regarded as providing a basis for a lawsuit.” .

2.

Because Muransky failed to allege that the FACTA violation caused him a direct harm, we move on to consider whether he pleaded that the extra digits caused him to suffer a material risk of harm. In arguing that he did, Muransky returns, really, to the same point we dismissed earlier: that the inquiry begins and ends with deference to congressional judgment. As he sees it, by requiring the truncation of all but the last five digits of a credit card, Congress has decided that printing additional digits creates a real risk of identity theft. End of story; there is no role for the courts.

What Muransky asks is for us to abandon our judicial role by merging the ordinary steps in the analysis—concluding that because the statute protects a concrete interest, any violation automatically threatens that interest and thussupports standing. Although that approach would simplify our job, it is inconsistent with and with what the Constitution demands of us. But first, as a practical matter, there is good reason to doubt that Congress has deemed every violation of FACTA to pose a material risk of identity theft. FACTA did not specifically address the kind of partial truncation that occurred in this case—an observation made by the Third Circuit when it noted (with respect to an identical FACTA violation) that the “congressional findings of risk are not tailored to the FACTA violation . . . pleaded.” . Moreover, Congress expressly recognized in the Clarification Act that not all violations of the truncation requirement pose a serious threat to consumers. See Pub. L. No. 110-241 § 2(b), 122 Stat. at 1566. So Congress itself has made clear that not every FACTA violation carries with it a risk of harm.

Still, even if Congress had explicitly stated in the text of the statute that every FACTA violation poses a material risk of harm, that alone would not carry the day. Although the judgment of Congress is an “instructive and important” tool to identify Article III injuries, we cannot accept Muransky‘s argument that once Congress has spoken, the courts have no further role. . “Congress cannot erase Article III‘s standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.” (citation omitted). And as emphasized, deciding whether a given risk of harm meets the materiality threshold is an independent responsibility of federal courts. See (“But the lesson of Spokeo is that we must confirm a concrete injury or material risk exists even when Congress confers aright of action.“). Indeed, the majority‘s ultimate instruction to the Ninth Circuit on remand was to determine “whether the particular procedural violations alleged in this case entail a degree of risk sufficient to meet the concreteness requirement.” . That instruction applies equally here.

It thus falls to us to consider Muransky‘s claim. The question is whether Muransky has alleged a material risk of harm, one that is “sufficient to meet the concreteness requirement.” Factual allegations that establish a risk that is substantial, significant, or poses a realistic danger will clear this bar—but Muransky gives us very little to go on. In his complaint, he offers the naked assertion that he “and members of the class continue to be exposed to an elevated risk of identity theft.” Nothing indicates how much risk this might be, however, and no facts alleged in the complaint provide insight into what degree of “elevated risk” Muransky faced, or why.

That kind of conclusory allegation is simply not enough. Muransky did not plead facts that, taken as true, plausibly allege a material risk, or significant risk, or substantial risk, or anything approaching a realistic danger. See . The thing is, contrary to our dissenting colleague‘s assertion, Muransky did not offer “a general factual contention subject to proof or disproof with evidence at later stages of litigation.” Jordan Dissent at 101. In fact, he was not trying to do so, and his own brief headings tell us why. Muransky‘s argument to this Court—still—is that Congress determined that he was put at risk and that Congress‘s judgment of risk is sufficient. And he later adds that he is relieved of any duty to plead facts supporting a risk of harm because “Congress already foundthe risk substantial.” So instead of actually pleading a material risk of harm, he has provided us with a threadbare allegation that he was exposed to an increased risk of identity theft. But an allegation of risk is not excused from the ordinary bar on conclusory allegations—it would not be (indeed is not here) enough to plead that “the defendant broke the law and injured me in doing so.” That is, again, merely a reiteration of the statutory violation. If this pleading is enough to show standing, then there is no violation of FACTA that would not be.

Late-breaking allegations in unsworn briefs before this Court do not change that. According to Isaacson (and various amici), the extra numbers on Muransky‘s receipt merely contain information that is already allowed to be printed on it elsewhere—the card issuer, for example. This observation was credited by the Second Circuit, which has said that printing “the first six digits of a credit card . . . is the equivalent of printing the name of the issuing institution.” . For his part, Muransky argues that the six digits do contain information that can be exploited by identity thieves, such as the card level or industry program, and that access to it enables identity thieves to conduct “phishing” inquiries.4 But all of that is really beside the point. Maybe these facts are true; perhaps they are not. Neither scenario would change our ruling, which is based on Muransky‘s pleading of a statutory violation. He pleaded nothing about any specific risks from the sequence of numbers included on his receipt, and did not address the issue before the district court at any time. It

was his burden to satisfy the court that standing exists, and thus to plead something more than a conclusory allegation of harm. If anything about Godiva‘s violation subjected him to an increased risk of identity theft, it was Muransky‘s burden to tell the court about it.

Perhaps before there was an argument that Muransky‘s claim could have survived as pleaded, but now his allegation—consisting of nothing more than a “bare procedural violation, divorced from any concrete harm“—is too thin to survive. .

3.

The conclusion we reach here—that Muransky has alleged neither a harm nor a material risk of harm—is in accord with the majority of other circuits to consider this same question. The Second, Third, and Ninth Circuits have each considered FACTA violations involving partially truncated credit-card numbers. All three concluded that the violation created neither a harm nor a material risk of harm. See ; (unpublished); . Two out of the three, we should add, were dismissed on the pleadings without considering extrinsic evidence—just like this case will be. Similarly, after , every circuit to have considered a FACTA violation involving an undeleted expiration date has held that, without more, it does not confer standing. See ;; .5

The only circuit to conclude that a bare violation of FACTA‘s receipt requirements could support standing reached that conclusion on significantly different facts. Last year, the D.C. Circuit considered a case where a merchant printed the entire credit card number, as well as the expiration date, on a customer‘s receipt. . Because the merchant “printed all of the information in both categories” it created “the nightmare scenario FACTA was enacted to prevent” and provided “sufficient information for a criminal to defraud her.” That factual scenario is different than the violation Muransky complains about, and we do not consider it here.

4.

Because Muransky has failed to allege either a harm or a material risk of harm stemming from the FACTA violation, he lacks standing to bring this lawsuit. And because federal courts are “powerless to approve a proposed class settlement” if “no named plaintiff has standing,” we necessarily conclude that the district court acted without jurisdiction. . Accordingly, “we have jurisdiction on appeal, not of the merits but merely for the purpose of correcting the error of the lower court in entertaining the suit.” (citation omitted). The proper remedy is for

us to remand to the district court for a dismissal without prejudice. .

Muransky complains that at “no time in the district court proceedings was standing challenged” and suggests that standing was only “mentioned . . . at the final approval hearing.” Those statements are not completely right. But even if they were, our decision would not change. As we have said before, it “is not unfair to require every plaintiff to file a complaint which contains sufficient allegations of standing.” .

That lack of unfairness is particularly acute here, where the plaintiff was aware from the very beginning that his standing was in question and was critical to the success of his claim. In its answer to the complaint, one of Godiva‘s defenses was that “[n]either Dr. Muransky nor any member of the proposed class has suffered any injury in fact” and that they “lack standing to prosecute their alleged claims.” With this defense in the backdrop, both Muransky and Godiva admitted that Spokeo was a driving force in their settlement negotiations. Muransky himself admitted that the impending decision in , “depending on the outcome, could have resulted in the case‘s dismissal for failure to present an injury in fact.” And of course, Isaacson raised the Spokeo decision at the fairness hearing and urged the district court to exercise its obligation to assure itself of standing. Indeed, though it is rare, from time to time plaintiffs have even filed affidavits in this Court to firmup standing allegations. See . No such attempt was made here.

At any point in this series of events, Muransky could have confronted the standing issue head on, or requested leave to amend his complaint. We do not think it is too much to ask that litigants who are aware that their allegations may not satisfy constitutional standing requirements take the time to firm up those allegations —if it is possible to do so—before an en banc circuit court confirms their suspicions of inadequacy. This is not a case where a surprise standing issue was thrust upon an unaware plaintiff.

Because no court has had the opportunity to consider any facts supporting Muransky‘s conclusory allegation of harm, we cannot say that no one could ever show standing for a similar procedural violation. In fact, Muransky himself could try to do so, because we are dismissing his claim without prejudice. But for now, Muransky has not alleged any facts to support his claim beyond that of a bare procedural violation. That is not enough.

We close with this. One of our dissenting colleagues suggests that Muransky and his counsel should have yet another opportunity on remand to plead or demonstrate harm—one last bite at the apple. See Jordan Dissent at 97, 100. The problem with that solution—even setting aside that the parties have been aware of the potential standing infirmities from the start—is that Muransky has never asked for it. Not before the panel, and not before our full Court. Instead, he and his counsel have pressed for their preferred theory of standing: “the violation of Dr. Muransky‘s substantive FACTA rights, by itself, is a concrete injury.”

Muransky, for whatever reason, has never sought to replead or prove standing under a different theory. We defer to the parties on how to litigate their claims, and decline to offer them a solution they have not sought. Because, under , the bare statutory violation pleaded by Muransky on behalf of the class is not sufficient, we dismiss his claims.

* * *

Muransky has alleged that a cashier handed him a receipt containing some of his own credit card information printed on it. Although the receipt violated the law because it contained too many digits, Muransky has alleged no concrete harm or material risk of harm stemming from the violation. Because this amounts to nothing more than a “bare procedural violation, divorced from any concrete harm,” Muransky has failed to allege that he has standing to bring this lawsuit. . And in the absence of a named plaintiff with standing, neither this Court nor the district court has jurisdiction over this case. We therefore VACATE the order of the district court and REMAND with instructions to dismiss without prejudice.

WILSON, Circuit Judge, dissenting:

The Fair and Accurate Credit Transactions Act is a bipartisan marvel. Built in the shadow of the credit-card boom, the Act—known as FACTA—passed in Congress with staggering support. Days later, President George W. Bush lauded the bill in the Roosevelt Room for “protecting our citizens by taking the offensive against identity theft.” Credit Transactions Act Signing, C-SPAN (Dec. 4, 2003), https://www.c-span.org/video/?179442-1/credit-transactions-act-signing. The bill‘s “offensive” includes the truncation requirement, which made it the law that no business may print more than the last five digits of their customers’ credit or debit card number on store receipts. President Bush extolled that the truncation requirement “will help prevent identity theft before it occurs.” Id. (emphasis added). To enforce the new rule, FACTA imposed steep statutory penalties for businesses that play fast and loose with this sensitive information.

Today this court misreads FACTA and dilutes core protections provided by Congress. FACTA‘s truncation requirement protects against both actual identity theft and a consumer‘s interest in using a credit or debit card without incurring any heightened risk of identity theft. By assuming that the truncation requirement redresses only actual identity theft and nothing more, the majority overlooks that FACTA protects against a point-of-sale harm—the consumer suffers a heightened risk of identity theft the moment the business prints an untruncated receipt. The

court‘s mistake all but ensures that consumers in the Eleventh Circuit must now allege, support, and prove that they suffered actual identity theft (or at least soon will) because of a defendant‘s FACTA violation in order to avail themselves of the law‘s protections. It is tough, though—and sometimes impossible—to trace an identity thief. As a result, the majority‘s decision essentially eviscerates this statute in our circuit, stripping thousands of consumers who receive untruncated receipts of a universally championed remedy.

Neither Article III nor compel this result. Because Muransky plausibly alleged that Godiva‘s FACTA violation elevated his risk of identity theft the moment the receipt was printed, he has shown that the violation harmed a concrete interest that FACTA protects. That is enough to satisfy standing at this phase of the case, so I dissent.

I.

Article III standing has three well-worn requirements: injury in fact, causation, and redressability. See . This case turns on injury in fact. To satisfy that prong, the plaintiff must show, among other things, that he has suffered an injury that is “concrete.” . A concrete injury is a real one; it is not “hypothetical or speculative,” but in fact exists. . The standard for establishing concrete injury climbs higher as the case inches forward. ,. But when we analyze the plaintiff‘s injury using only the allegations in the plaintiff‘s complaint, we take those allegations as true. . The allegations need not be specific; when we rely on the complaint, “general factual allegations . . . will suffice.” .1 The question is whether, taking his allegations as true, the plaintiff has plausibly alleged a concrete injury. .

For a while, many debated whether the violation of a statute inherently creates a concrete injury under Article III. Compare (holding that a statutory violation alone is enough), with (holding that a statutory violation alone is not enough). put that debate to bed. . As the majority explains, held that the violation of a statute does not always cause a concrete injury; “bare

procedural violation[s],” without more, are not enough. . Rather, a statutory violation must cause concrete harm. .

When does that happen? At first blush, it seems simple: a statutory violation causes a concrete harm when it causes a real harm or a material risk of real harm. See . But that simple statement begs a trickier question: What is a “real harm“?

states that there are two types of real harm: tangible and intangible. See . A tangible harm is a palpable one, something that most would know hurts without much thought. It is a harm painfully obvious—often physically obvious—to the common observer (like losing money, a benefit, or a job). See, e.g., (holding that a lost rent payment was a concrete injury for standing purposes). These harms are almost always concrete. See .

An intangible harm, in contrast, is harder to define yet still offensive; it is one that infringes on a person‘s interests or rights (like infringement of your freedom of speech or exercise of religion). See . Due to their conceptual nature, not all intangible harms are “real” enough to be concrete.

In the statutory context, explains how we should decide whether an alleged intangible harm is concrete. See . First, we ask whether thestatute protects “concrete interests (as opposed to purely procedural rights).” See, e.g., (Spokeo II) (applying Spokeo), cert. denied, (mem.); see also (same). Second, we ask if the violation “actually harm[ed]” or “present[ed] a material risk of harm” to a concrete interest that the statute protects. ; see also . If the answer to both questions is yes, the statutory violation causes a concrete injury. ; .2

Muransky has established concrete injury under this test. FACTA protects his concrete interest in using his credit or debit card without incurring a heightened risk of identity theft. And Muransky plausibly alleged that Godiva‘s violation in fact heightened his risk of identity theft, harming an interest that FACTA protects.

Because the violation actually harmed Muransky‘s concrete interest, we need not analyze whether the violation presented a material risk of harm.

II.

First up is the concrete interest. To decide whether a statute protects a concrete interest, we look to “history and the judgment of Congress.” . An interest is more likely to be concrete if it has a “close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” So too is an interest that Congress has identified and judged as important and worth protecting. But the interest need not pass both litmus tests: a substantial showing in either category can suffice to establish a concrete interest. See (noting that the lack of a common-law analog is “not fatal” to a plaintiff‘s standing if Congress has judged the interest as concrete); (Rogers, J., concurring in part and concurring in judgment) (agreeing that the defendant‘s alleged FACTA violation harmed a concrete interest because Congress identified the interest as concrete, no matter if a common-law analog exists).

But even if Muransky had to clear both hurdles, he does so with space to spare. Both Congress and history have established that a consumer has a concrete interest in using a credit or debit card without incurring a heightened risk of identity theft. See (majority opinion).

A.

Let‘s start in Congress. Statutory text, legislative history, and public policy make clear that Congress, in passing FACTA, recognized that consumers have a concrete interest in using their cards without fear that each swipe will raise their risk of identity theft.

Statutory Text. The surest mark of what Congress meant is what Congress wrote. Three aspects of FACTA make clear that Congress thought that consumers have an interest in avoiding the heightened risk of identity theft in addition to avoiding actual identity theft.

The first is FACTA‘s damages structure. The statute allows a consumer to recover statutory damages whenever a business willfully prints more than the last five digits of the consumer‘s card number. 15 U.S.C. § 1681n(a)(1)(A). These damages have no tie to actual identity theft; the consumer can recover them no matter if he “ever becomes the victim of any crime.” .

That damages scheme clashes with the majority‘s take on FACTA‘s purpose. The majority assumes that FACTA guards against only the harm of identity theft. See Majority Op. at 22 (claiming that the “harm Congress was trying to prevent” through FACTA was stolen identity). But why would the statute allow damages divorced from identity theft if its sole purpose were to combat identity theft? It wouldn‘t; it would instead bind FACTA‘s damages scheme to the harm of identity theft. So there must be a more nuanced method to Congress‘s madness—we interpret statutes “to avoid constitutional difficulties,” not create them. . That method becomes clear once we accept that Congress enacted the statutory-damages remedy to address a broader aim: to “decrease the risk that a consumer would have his identity stolen.” (alteration accepted) (emphasis added). Its presence tells us that actual identity theft is not the only concern driving FACTA. Rather, this statutory scheme also protects another interest, one prone to harm even without identity theft: the consumer‘s interest “in using [a] credit [or] debit card[] without incurring an increased risk of identity theft.” (emphasis added).

The second statutory clue is FACTA‘s point-of-sale trigger. The statute “imposes a truncation duty at the point of sale when identity theft cannot yet have occurred.” . The cause of action that Congress created does not become complete when the consumer suffers identity theft; it is complete well before that, the moment the business prints out too many card digits. See 15 U.S.C. § 1681c(g)(1). If FACTA were concerned with just identity theft, though, its penalty would not accrue at the point of sale (before identity theft can occur); it would accrue at the point of identity harm (when one suffers harm from identity theft). The point-of-sale trigger thus reveals that Congress sought to protect an immediately harmed interest—the interest in avoiding the heightened risk of identity theft. See .

The last indication—perhaps the most telling—is FACTA‘s statute of limitations. The statute of limitations turns on the untruncated receipt alone. The limitations period for a FACTA violation is two years from the discovery of the untruncated receipt but not later than five years from the printing of the untruncated receipt. 15 U.S.C. § 1681p. Identity theft plays no role in this sequence—the statute is indifferent to when or whether identity theft occurs. We must ask, then: If the statute aims to redress only the harm of identity theft, why is its limitations period apathetic to the harm of identity theft? Wouldn‘t the limitations period run sometime after the theft occurs?

Indeed, an example reveals the catch-22 that awaits a FACTA claimant under the majority‘s one-track view of FACTA‘s protected interest. Suppose you purchase a box of chocolates from a Godiva Chocolatier. After paying for the box with your credit card, you notice that the cashier handed you a receipt showing more than the last five digits of your card number. Although this act violated the statute, the majority says you cannot sue yet; FACTA protects against only the harm of identity theft, and you have not yet felt the hurt. But assume that the cashier remembers your number, jots it down, and lays in wait. Two years and a day later, you learn that the cashier, using the information on your receipt, has stolen your identity, racking up thousands in credit card debt. Now that you have suffered actual identity theft, the majority would say that you still cannot sue. The statute of limitations began when you discovered the printed receipt, and now it has run.

If FACTA‘s sole aim were to redress the harm of identity theft, that limitations scheme would make no sense—it operates without regard for when (or even if) identity theft occurs. But the limitations scheme makes perfect sense once we accept that FACTA also seeks to protect a consumer‘s interest in using a credit or debit card without incurring the heightened risk of identity theft. See . In Congress‘s eyes, that harm can occur at the point of sale, the moment Godiva prints an untruncated receipt. Accordingly, Congress reasonably chose to start the clock the moment the consumer discovers this point-of-sale injury.

Legislative History. The legislative history also confirms that FACTA sought to do more than just redress actual identity theft. When Congress passed FACTA, the crime of identity theft had “reached almost epidemic proportions.” H.R. Rep. No. 108-263, 25 (2003). Consumers were “increasingly concerned about the risk of their personal financial information falling into the wrong hands.” Id. (emphasis added). In fact, a “hotline established by the Federal Trade Commission to field consumer complaints and questions about identity theft logged over 160,000 calls in 2002 alone.” Id.

To ease these concerns, Congress found it “vitally important to address measures which will help prevent identity theft” before it occurs. S. Rep. No. 108-166, 8 (2003). The result was FACTA: a law designed to lessen consumer worries by “limit[ing] the number of opportunities for identity thieves to ‘pick off’ key card account information.” Id. at 13; see also (“Congress has treated credit card numbers as sufficiently sensitive to warrant legislation prohibiting merchants from printing such numbers on receipts—specifically to reduce the risk of identity theft.“). President Bush confirmed this purpose at the bill‘s signing, noting that FACTA would “help prevent identity theft before it occurs.” Credit Transactions Act Signing, C-SPAN (Dec. 4, 2003), https://www.c-span.org/video/?179442-1/credit-transactions-act-signing.

Not a shred of legislative history suggests that Congress wrote FACTA to remedy only actual or inevitably impending identity theft. The history says just the opposite. Congress‘s focus on preventing identity theft before it occurs shows that, in passing FACTA, Congress was concerned with more than just the actual harm of identity theft. It believed that consumers have an interest in participating in the market without increasing their chances of suffering identity theft. See (respecting Congress‘s judgment that consumers have “an interest in using their credit and debit cards without facing an increased risk of identity theft“). We must defer to this legislative prerogative. See .

The majority takes a different view. It says that a later Clarification Act makes clear that Congress‘s “‘purpose’ was to protect ‘consumers suffering from any actual harm‘” from identity theft. Majority Op. at 5. But all Congress recognized in the Clarification Act is that the failure to truncate an expiration date does not pose “actual harm” to any interest. See Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(4)-(6), (b) (2008). In contrast, Congress reiterated that “proper truncation of the card number, by itself . . . prevents a potential fraudster from perpetrating identity theft or credit card fraud.” Id. § 2(a)(6) (emphasis added). As a result, Congress “left the truncation requirement and enforcement mechanism untouched,” affirming that the failure to hide customers’ credit or debit card numbers can still put them in harm‘s way: it can heighten their risk of identity theft, a harm FACTA sought to prevent. See (Rogers, J., concurring in part and concurring in judgment).

Public Policy. Good policy often flows from good sense, and it makes sense why Congress identified the heightened risk of identity theft as a concrete interest. For one, a higher risk of identity theft can lead to another concrete harm: actual identity theft. See (“[T]he less information the receipt contains the less likely is an identity thief who happens to come upon the receipt to be able to figure out the cardholder‘s full account information and thus be able to make purchases . . . .“). For another, consumers are less likely to use credit cards if their transactions are unprotected, hamstringing economic efficiency and consumer spending. And a higher risk of identity theft can divert consumer resources toward theft-prevention measures, rather than typical economic goods and services. So Congress had good reason to recognize that freedom from the heightened risk of identity theft is itself a concrete interest.

*

It is worth reporting the violence that the majority‘s logic does to this statute. The holding hiding behind its reasoning is that a plaintiff can enforce a FACTA violation only if it causes (or will soon cause) harm from identity theft. That view decimates the class that this statute sought to protect. FACTA of course provides a remedy for those who suffer identity theft. But it also provides a remedy for those who do not—it lets consumers recover damages at the point of sale well before identity theft could occur. 15 U.S.C. §§ 1681c(g)(1), 1681n(a)(1)(A). We are supposed to construe FACTA so that this feature is not “inoperative or superfluous, void or insignificant.” . But by shrinking FACTA to cover just those that suffer or will soon suffer identity theft, the majority ignores this directive, rewrites the statute, and blinks FACTA as Congress knew it out of existence.

I would take a different route. Congress passed FACTA to fight identity theft, but it did not elevate this interest to the exclusion of all others. Another interest—one just as important—was encouraging consumers to use their credit or debit cards without fear that their usage would raise their risk of identity theft. Because Congress identified this interest as important and worth protecting, we should defer to its determination and dub the interest concrete. See .

B.

Congress‘s thoughts on the matter are enough to cement Muransky‘s interest in avoiding the heightened risk of identity theft. But if there were any doubt, history also “tilts toward concreteness.” (majority opinion). Again, an interest is more likely to be concrete if it has a “close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit.” . A consumer‘s interest in engaging in commerce without heightening his risk of identity theft fits that bill: it bears a close relationship to an interest harmed in a common-law breach-of-confidence claim.3

The tort of breach of confidence historically allowed a plaintiff to recover against a party who failed to adequately protect a plaintiff‘s confidential information. See Alan B. Vickery, Breach of Confidence: An Emerging Tort, 82 Colum. L. Rev. 1426, 1427-28 (1982). It “is rooted in the concept that the law should recognize some relationships as confidential to encourage uninhibited discussions between the parties involved.” . The plaintiff in a breach-of-confidence claim relies on an “assurance of secrecy . . . . in forming the relationship, and thereafter in revealing what [he] would otherwise hold back.” Vickery, supra, at 1428. For that reason, an interest harmed in a breach-of-confidence case is the plaintiff‘s “general interest in the security of the confidential relationship and his corresponding expectation of secrecy.” Id. at 1434. An interest harmed in a FACTA case is the same: the consumer expects the business to comply with FACTA and keep his card number confidential. The failure to do so undermines the “security of the confidential relationship” and the consumer‘s “expectation” that his card number will stay hidden. See Vickery, supra, at 1434; see also . And because of the breach, the consumer is more “likely to remain silent in circumstances that would otherwise call for frankness,” see Vickery, supra, at 1434, precisely the type of economic inefficiency Congress sought to avoid through FACTA. See, e.g., H.R. Rep. No. 108-263, 23 (noting that “[o]ne of the hallmarks of the modern U.S. economy is quick and convenient access to consumer credit“).

The majority fires two shots at this historical connection, but neither lands. It first argues that a FACTA violation does not track the typical elements of a breach-of-confidence claim, as a FACTA claim does not require disclosure to a third party. See Majority Op. at 26. This argument fails on two levels.

To start, a statutory harm need not “exactly track[ a] common law” analog to be concrete. See . Nor must the violation “give rise to a cause of action under common law.” . Rather, the harm need only bear a “close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit,” so that it is similar “in kind and in degree.” (emphasis added). If a plaintiff had “to satisfy every element of a common law cause of action before qualifying for statutory relief, Congress‘s power to ‘elevate intangible harms’ by defining injuries and chains of causation” that create a ‘case or controversy where none existed before’ would be illusory.” (Martin, J., concurring in part and dissenting in part) (alteration accepted) (quoting ); see also ; (holding that judicial power extends to “cases and controversies of the sort traditionally amenable to, and resolved by, the judicial process” (emphasis added)). So even if “there are differences between [FACTA‘s] cause of action and those recognized at common law, the relevant point is that Congress has chosen to protect against a harm that is at least closely similar in kind to others that have traditionally served as the basis for lawsuit.” See . Assurance that a plaintiff‘s confidential disclosure will remain hidden and will not spike his risk of injury lies at the heart of both a FACTA claim and a breach-of-confidence claim. So FACTA‘s underlying interest has a historical partner. See (holding that the Fair Credit Reporting Act protected against a harm bearing a close relationship to the harm suffered in a defamation suit, even though the elements of the claims did not match).

Another reason: the element of third-party disclosure is not inextricably tied to the harms underlying a breach-of-confidence claim. To the contrary, a “seemingly innocuous or limited disclosure may nevertheless injure the wronged party directly because of the special significance that the party attaches to the information.” Vickery, supra, at 1434 n.29. And “even if the disclosure is innocuous, the wronged party may well fear future disclosures of more damaging information.” Id. In other words, the “harm in a breach-of-confidence case occurs when the plaintiff‘s trust in the breaching party is violated, whether or not the breach has other consequences.” (internal quotation mark omitted). In the FACTA context, the business breaches that trust when it prints more than five card digits, harming the consumer‘s expectation that his disclosure will not increase his chances that a thief will uncover his card number. That harm occurs at the point of sale, no matter if a third party ever sees the receipt. See .

Next up, the majority says that the harms do not match because Muransky does not have a confidential relationship with Godiva. Majority Op. at 27. In the majority‘s eyes, breach of confidence involves “close professional relationships,” like that between a doctor and a patient. Id. The majority claims that a customer-merchant relationship does not create similar secrecy duties. Id.

That oversimplifies the situation. The exchange of card information between a customer and merchant no doubt triggers a confidential relationship. The “essential ingredients of what can be termed a ‘confidential relationship‘” are “the assurance of secrecy and the reliance it evokes.” Vickery, supra, at 1428. A consumer paying with a credit or debit card would naturally believe that the merchant will keep his card number secret—a belief that FACTA codified. And that belief spurs consumer spending, as it lets the consumer breathe easy knowing that his card information will stay safe throughout the transaction. So a typical card transaction has both assurance and reliance—the key triggers of confidentiality.

Legal elements aside, that relationship stands on common sense. Few would say that confidential financial information is less sensitive than confidential medical or legal information. For this reason, scholars have noted that “given their relationship to consumers, the holders of consumer data in commercial transactions should be labeled with a distinct term: data confidants.” Alicia Solow-Niederman, Beyond the Privacy Torts: Reinvigorating A Common Law Approach for Data Breaches, 127 Yale L.J.F. 614, 625 (2018). So just as governing ethical standards recognize a “relationship of trust” between a doctor and her patient or a lawyer and her client, FACTA‘s truncation requirement recognizes “a similar relationship of trust between consumer and merchant, requiring the merchant to safeguard the consumer‘s credit or debit card information.” . Bottom line: customer and merchant do share a confidential relationship.

All things said, a FACTA violation and a breach-of-confidence tort each concretely harm the plaintiff‘s expectation that his confidential disclosure will be protected. For FACTA specifically, the harmed interest is the consumer‘s expectation that his credit card purchase will not heighten his risk of identity theft. See Because this interest is “similar in kind” and bears a “close relationship” to the interest harmed in a breach-of-confidence case, see , history settles that this interest is concrete. See .

III.

Since FACTA protects Muransky‘s concrete interest in using his credit or debit card without incurring the heightened risk of identity theft, all that‘s left is whether Muransky plausibly alleged that Godiva‘s FACTA violation “actually harm[ed]” or “present[ed] a material risk of harm” to this interest. See ; see also . He did—he alleged that Godiva‘s violation in fact heightened his risk of identity theft. So he has pled “actual[] harm” to an interest that FACTA protects. See .

Muransky alleged two core facts in his complaint: (1) Godiva violated FACTA when it printed 10 digits of his card number, and (2) this violation “elevated his risk of identity theft.” Both statements are facts, not legal conclusions. So we must accept them as true when analyzing standing at this stage, because “[w]ithout the benefit of discovery, we are not in a position to second guess the harm [he] allege[s].” See (Sutton, J., concurring).4

Accepting these facts as true, Muransky has alleged that Godiva‘s FACTA violation harmed his interest in avoiding a heightened risk of identity theft the moment the violation occurred. His harm is not one that might happen in the future (so that we would need to analyze whether he alleged a material risk of real harm); it is a real harm to a concrete interest, one that Muransky adequately alleges happened the moment Godiva printed the untruncated receipt. See (explaining that the material-risk-of-harm standard plays no role when the complaint alleges that “the challenged conduct and the attendant injury have already occurred“). Whether Muransky can prove down the road that Godiva‘s FACTA violation heightened his risk of identity theft is another matter. See (noting that the plaintiff‘s burden of proof increases as the case advances). For now, it is enough that he alleged that the violation harmed his interest in using his card without suffering a heightened risk of identity theft. See .5

To sidestep this conclusion, the majority calls Muransky‘s complaint conclusory. It says that it need not accept Muransky‘s allegation that Godiva‘s violation increased his risk of identity theft because he has not given specific facts to explain how the violation did so. But we have said time and again that a plaintiff‘s allegation of injury need not be specific at the pleading stage—“general factual allegations . . . will suffice.” . At this stage, tells us to presume that Muransky‘s “general allegations embrace those specific facts that are necessary to support the claim.” ; see also (applying this rule), cert. denied, (mem.).

Article III does not command Muransky to provide these facts at the pleading phase; says that is what discovery is for. See ; see also (Sutton, J., concurring). Based on this principle, we routinely accept general factual allegations on the promise that specific support will come later. See, e.g., (majority opinion) (accepting “at the motion to dismiss stage” the general allegation that a “dietary supplement that is deemed adulterated and cannot lawfully be sold has no value“). It is inconsistent that the majority demands those specifics from Muransky right now.

IV.

To close, I note that the majority‘s cases are not persuasive for a mix of reasons. Some cases dealt with a different truncation failure: the failure to truncate the expiration date—a violation that Congress judged as not creating concrete harm. See, e.g., ; ; . Another came with an evidentiary record (not on an analysis of the complaint), in which the district court found that the violation there did not harm or raise a material risk of harm to a concrete interest. . And both and incorrectly determined that FACTA redresses only actual identity theft; the Ninth Circuit also chose not to publish , so the opinion is not precedential. See ; ; see also (rejecting the Third Circuit‘s position that “FACTA protects an interest in avoiding actual identity theft, rather than increased risk of identity theft“).

Far more persuasive is the D.C. Circuit‘s published opinion in . There, the D.C. Circuit considered most of the cases cited above and rejected their reasoning. It held that FACTA protects a consumer‘s interest in using a credit or debit card without incurring an increased risk of identity theft. . And then the court held that the FACTA violation alleged there harmed that interest at the point of sale. . To be sure, the FACTA violation there was worse than the one levied here: the defendant printed all 16 digits of the plaintiff‘s card number. But did not turn on that fact; its reasoning extends to this case just the same. As in , the interest at issue is the consumer‘s interest in avoiding the increased risk of identity theft. And as in , the plaintiff has alleged that the FACTA violation in fact increased his risk of identity theft, harming an interest that the statute protects. Like the court in , we should take the plaintiff at his word for now and hold that he has established standing at this phase of the case.

* * *

The majority claims that Muransky “shut his eyes and closed his ears to the requirements of Spokeo.” Majority Op. at 3. Yet the majority shuts its eyes and closes its ears to the interest that FACTA protects. The statute protects Muransky‘s concrete interest in avoiding a heightened risk of identity theft. And Muransky plausibly alleged that the moment Godiva printed the untruncated receipt, he sustained an injury sufficient to confer standing to maintain a claim under FACTA. The mistake the majority makes is to require anything more.

MARTIN, Circuit Judge, dissenting:

Not all statutory violations result in a concrete injury. The Supreme Court told us so in . . Today, the majority extends this principle from to conclude that courts may ignore the judgment of Congress when assessing whether a party has met the concreteness requirement of Article III. The majority opinion holds that a receipt displaying ten digits of a customer‘s credit card number does not pose a material risk of identity theft, and therefore is not a concrete injury. The majority says this means plaintiffs have no standing here, even though Congress established the point of intolerable risk at more than the last five digits being displayed on a receipt. Because Congress‘s judgment is deserving of deference under these circumstances, and because congressional judgment supports a finding of concreteness, I respectfully dissent from the majority‘s opinion.

also tells us we may find concrete injury where a statutory violation bears a close relationship to a type of harm that has traditionally been actionable at common law. . In contrast to the majority, I view Dr. Muransky‘s FACTA violation as bearing a close relationship to a common law breach of confidence tort. I therefore respectfully dissent on this ground as well.

I.

In April 2015, Dr. David Muransky filed a class action lawsuit against Godiva Chocolatier (“Godiva“), alleging that Godiva violated the Fair and Accurate Transactions Act (“FACTA” or the “Act“), 15 U.S.C. § 1681c(g), when it issued him a receipt containing the first six and last four digits of his card number. His central claim is that by issuing him this receipt, Godiva willfully violated FACTA, which, among other things, prohibits merchants from printing “more than the last 5 digits of the credit card number . . . upon any receipt provided to the cardholder at the point of the sale or transaction.” Id. § 1681c(g). He alleged in his complaint that Godiva‘s violation of FACTA‘s truncation requirement exposed him and the class members “to an elevated risk of identity theft.”

The majority opinion recounts the dense and winding path this case has taken since filed. Maj. Op. at 5-9. I will briefly review this history as well. After Dr. Muransky filed his complaint, the parties engaged in mediation, and reached an agreement to settle the case for $6.3 million. Notice of the settlement was sent to class members, and James H. Price and Alan Isaacson filed objections. At the District Court‘s fairness hearing, Mr. Isaacson, but not Mr. Price, challenged Dr. Muransky‘s standing. The District Court approved the settlement reached by the class members and Godiva. Then, both Mr. Price and Mr. Isaacson challenged that approval on appeal. Throughout this appeal, Mr. Isaacson has maintained his argument that Dr. Muransky lacks standing, while Mr. Price has joined Dr. Muransky in arguing that Dr. Muransky has standing.

For all its procedural complexity, this appeal presents only a simple question. Did Dr. Muransky establish Article III standing by alleging a violation of FACTA‘s truncation requirement, based on a receipt showing 10 of the 16 digits of his credit card? I believe he did.

II.

I begin, as I must, with the standard announced by the Supreme Court in . To satisfy the injury-in-fact requirement of Article III, a plaintiff must allege an injury that is both “concrete and particularized,” as well as “actual and imminent.” . The discussion here is about the first of these requirements: whether Dr. Muransky‘s complaint alleges an injury that is sufficiently concrete. The majority accurately recounts that an injury need not be “tangible” to be concrete. . And even intangible injuries, such as the “risk of real harm,” can satisfy Article III‘s concreteness requirement. When we are tasked with deciding whether an intangible injury is sufficiently concrete, tells us that “both history and the judgment of Congress” inform our analysis. On this much, the majority and I agree.

Absent from the majority opinion, however, is the mention of another command from . It tells us that when a statutory right itself protects a concrete interest, a plaintiff need not allege “any additional harm beyond the one Congress has identified.” In practical terms, a complaint alleging a statutory violation, and nothing more, can be sufficient to establish standing at the pleading stage, so long as the statutory violation itself protects a concrete interest. . And in determining whether a statutory provision protects a concrete interest, we are guided by congressional judgment and common law principles. See (holding that a plaintiff alleging a violation of the Video Privacy Protection Act need not allege “any additional harm beyond the statutory violation” because both congressional judgment and common law support a finding of concreteness).

Focusing, for now, on discussion of the role of Congress, the Court recognized that congressional judgment is “instructive and important because Congress is well positioned to identify intangible harms that meet minimum Article III requirements.” (quotation marks omitted); see also Daniel Townsend, Who Should Define Injuries for Article III Standing?, 68 Stan. L. Rev. Online 76, 81-83 (2015) (explaining that Congress is better positioned to gather facts and make empirical judgments about whether a practice is injurious). And as the majority recognizes, Congress may thus “elevat[e] intangible harms” by defining injuries and chains of causation that will “give rise to a case or controversy where none existed before.” (quotation marks omitted).

Where the intangible injury identified by Congress is a risk of harm, tells us that the risk must be “material.” . The majority “recognize[s] that ‘material risk of harm’ is a somewhat indefinite term,” and says that in this context, “material” means “important; essential; relevant.” Maj. Op. at 16 (citing New Oxford American Dictionary (3d ed. 2010)). I agree. In , the Court gave us the example of including the wrong zip code on a credit report as one insufficiently “material” risk of harm. . In the context of the Fair Credit Reporting Act, which creates a statutory cause of action for inaccuracies on credit reports, the Court puzzled about “how the dissemination of an incorrect zip code, without more, could work any concrete harm.” Since the concrete interest intended to be protected by the FCRA is avoiding the harms that come from false credit reporting, it was not obvious to the Court how a mistaken zip code was “essential” or “relevant” to that interest.

The majority suggests here that did not “br[eak] new ground” on the amount or type of risk required to establish standing. Maj. Op. at 16. I think it did. Although several earlier Supreme Court decisions described the required level of risk as “substantial” or “certainly impending,” (listing cases), did not include this description. See . This was no accident. The cases in which the Court described the necessary risk as “substantial” or “certainly impending” did not address a statutory cause of action itself designed to prevent future harm. See, e.g., (holding that certain attorneys and organizations did not have standing to challenge the constitutionality of a provision of the Foreign Intelligence Surveillance Act of 1978). With this in mind, the Third Circuit recognized that the Supreme Court decided in to require a lesser magnitude of risk for statutory injuries in order to “strike[] a balance between Congress‘s power to define injuries . . . and the requirement that—absent a statutory right of action—a threatened harm be certainly impending or based on a substantial risk of harm to amount to injury in fact.” (citation and quotation marks omitted).

I also part ways with the majority in its explanation of how courts decide whether the risk of harm identified by Congress is sufficiently material for Article III purposes. While the majority acknowledges that congressional judgment plays a role in identifying intangible injuries of the “direct” variety (for example, interference with free speech or free exercise rights), it effectively concludes that congressional judgment plays no role when identifying whether a prohibited practice presents a risk of real harm. Maj. Op. at 27-29. The implication of this holding is that when courts are confronted with prophylactic legislation designed to reduce a risk of harm from occurring—like the statute at issue here—we operate with a blank canvas in deciding whether the risk of harm is sufficiently material. . I don‘t think this approach can be reconciled with command that the “judgment of Congress” plays an important role in determining whether an injury satisfies Article III‘s concreteness requirement. . And while it is surely the courts, and not Congress, that are ultimately responsible for deciding whether an injury is sufficiently concrete under Article III, our role does not require or allow us to ignore the judgment of Congress entirely.

It is these principles that frame the concreteness inquiry here. Dr. Muransky‘s complaint alleges that Godiva violated FACTA‘s truncation requirement when it issued him a receipt that displayed the first six and the last four digits of his credit card number. He says he suffered irreparable harm from Godiva‘s violation of the truncation requirement because it “exposed [him] to an elevated risk of identity theft.” This Court must therefore decide whether the risk of identity theft that Dr. Muransky suffered on account of Godiva‘s FACTA violation constitutes a concrete injury. And in making this determination, this Court must consider whether congressional judgment and the common law support a finding of concreteness under these circumstances.

II.

A.

First, the judgment of Congress. When it enacted FACTA, Congress prohibited merchants from printing “more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder.” 15 U.S.C. § 1681c(g)(1). FACTA provides that any merchant willfully violating this requirement is liable for “any actual damages sustained by the consumer . . . or damages of not less than $100 and not more than $1,000.” Id. § 1681n(a)(1)(A). While Congress‘s creation of a statutory cause of action certainly evinces a judgment that violations of the truncation requirement cause harm, tells us that this fact alone is not sufficient to satisfy Article III‘s standing requirements. See . Congress‘s decision to sanction lawsuits for violations of the truncation requirement is therefore only the starting point of the inquiry into Congress‘s judgment.

We go next, then, to the history of FACTA. That history confirms that Congress considered the violation at issue here—a receipt displaying the first six and last four digits of the customer‘s credit card—to pose a material risk of identity theft. When it enacted FACTA, Congress sought to “protect[] consumers from identity theft.” ; see also S. Rep. 108-166 at *6 (Oct. 16, 2003) (observing that FACTA was enacted to address “the emergence and impact of identity theft on the credit granting and reporting systems“). FACTA was necessary, Congress found, in light of the increased use of credit in the late 1990s and early 2000s, which “create[d] a target-rich environment for . . . sophisticated criminals, many of whom are organized and operate across international borders.” S. Rep. 108-166 at *8; see also Credit and Debit Card Receipt Clarification Act of 2007 (“Clarification Act“), Pub. L. No. 110-241, § 2(a)(1), 122 Stat. 1565, 1565 (finding that “the purpose[]” of FACTA is to “reduce identity theft and credit card fraud“). When he signed FACTA into law, President George W. Bush echoed Congress‘s findings. He stated that “this law will help prevent identity theft before it occurs, by requiring merchants to delete all but the last five digits of a credit card number on store receipts.” Remarks on Signing the Fair and Accurate Credit Transactions Act of 2003, 39 Weekly Comp. Pres. Doc. 1746, 1748 (Dec. 4, 2003); see also S. Rep. 108-166 at 6 (concluding that the truncation requirement “limit[s] the number of opportunities for identity thieves to ‘pick off’ key card account information“).

The history of FACTA following its initial enactment confirms that Congress considered the type of violation at issue here to pose a material risk of harm. After FACTA‘s truncation requirement went into effect, “hundreds of lawsuits were filed” alleging that merchants violated FACTA by “fail[ing] to remove the expiration date” as required by 15 U.S.C. § 1681c(g)(1). Clarification Act § 2(a)(4). In June 2008, the Clarification Act became law, and gave amnesty to merchants who printed a card‘s expiration date in the years since FACTA was enacted. Id. § 3(a). Congress gave this amnesty because a complaint alleging a mere violation of the expiration date requirement did not “contain[] an allegation of harm to any consumer‘s identity.” Id. § 2(a)(5). Notably, while Congress was at it, it gave no amnesty to merchants who printed more than the allowed number of digits. See id. § 3(a). Rather, Congress observed that “[e]xperts in the field agree that proper truncation of the card number, by itself as required by [FACTA], . . . regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud.” Id. § 2(a)(6). By granting amnesty only as to the expiration date, the Clarification Act sought to curtail “abusive lawsuits” concerning a requirement that “do[es] not protect consumers.” Id. at § 2(b).1

This demonstrates that, while Congress did not consider all violations of the truncation requirement to pose a serious threat to consumers, it maintained its concern about the violation pled here—a receipt showing more than the last five digits of a card number—to entail material risk of identity theft. Congress‘s view was based on a finding that “[e]xperts in the field agree that proper truncation of the card number, by itself” minimizes the risk of identity theft. Clarification Act § 2(a)(6). Congress‘s judgment thus supports a finding of concreteness here. See (noting that, while “every FACTA violation [does not] create[] a concrete injury in fact,” a receipt displaying a card‘s entire number and expiration date caused concrete injury because it was the “nightmare scenario” Congress sought to prevent).

As I said at the start, when a statutory violation itself protects a concrete interest, a plaintiff need not allege anything more than a violation of the statute itself. See . Because the judgment of Congress supports a finding of concreteness here, Dr. Muransky was not required to allege any additional harm beyond the statutory violation alleged in his complaint. On this basis alone, I would hold that Dr. Muransky established Article III standing.

B.

The majority opinion takes a dramatically different path. It starts by eschewing any deference to congressional judgment in determining whether Dr. Muransky‘s FACTA violation entailed a sufficiently high risk of identity theft. See Maj. Op. at 27-28. We cannot defer to Congress, the majority reasons, so we must instead look to Dr. Muransky‘s complaint to see if he has alleged facts establishing that a receipt showing ten digits of a credit card number poses a risk of identity theft. . Although Dr. Muransky alleged that he suffered an elevated risk of identity theft as a result of the FACTA violation at issue here, the majority says that allegation “is simply not enough.” In so holding, the majority assumes, without offering any explanation, that Dr. Muransky did not face a “material risk, or significant risk, or substantial risk, or anything approaching a realistic danger” due to the receipt at issue. . This analysis errs at every step.

To begin, the majority starts on incorrect footing by effectively concluding that congressional judgment is owed no deference in deciding whether a risk of harm clears the concreteness bar.2 Maj. Op. at 27-28. The majority says it is required to do so because (1) tells us that the creation of a statutory cause of action does not automatically confer standing, and (2) courts have an independent responsibility to decide whether a risk of harm meets the materiality threshold. Both of these premises are true, but neither lead to the conclusion that courts may ignore the judgment of Congress.

First, it is true that told us “Congress cannot erase Article III‘s standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.” . This premise does not, however, erase Congressional judgment from the equation entirely. Indeed, says quite the opposite. It notes that Congressional judgment is “instructive and important” in determining whether an injury is concrete because Congress “is well positioned to identify intangible harms that meet minimum Article III requirements.” . I have already walked through the application of these principles here. A violation of the truncation requirement is not a concrete harm merely because Congress gave litigants the right to sue. It is a concrete harm, however, because congressional factfinding in the FACTA context lends significant support to the idea that a failure to adhere to the digit truncation requirement results in a material risk of harm.

Relatedly, the majority repeats throughout its opinion that deference to the judgment of Congress would mean, in practical terms, that “there is no violation of FACTA that would not be” “enough to show standing.” Maj. Op. at 30. This is not so, and we need not travel far for an example of why this is wrong. As set out above, when Congress passed the Clarification Act, it expressed a judgment that the expiration date requirement “do[es] not protect consumers” and does not result in “consumers suffering from any actual harm.” Id. at § 2(b). So even though FACTA continues to provide a statutory cause of action for violating the expiration date requirement, see 15 U.S.C. § 1681c(g)(1), the judgment of Congress would not lend itself to a finding of concreteness. Every one of our sister circuits to consider the question of expiration dates has reached the same conclusion. See ; ; .

The next reason the majority gives for rejecting congressional judgment in its evaluation of the risk of harm, is that federal courts have an “independent responsibility” to “decid[e] whether a given risk . . . meets the materiality threshold.” Maj. Op. at 28. Again, this principle is accurate. After all, federal courts must satisfy themselves of Article III standing even where a plaintiff alleges a statutory violation. See, e.g., (observing that the “requirement of injury in fact is a hard floor of Article III jurisdiction that cannot be removed by statute“). But as set out above, there is nothing incompatible with the court satisfying itself of an injury‘s concreteness, and considering the judgment of Congress at the same time. Deference to congressional judgment does not mean “no role for the courts.” Maj. Op. at 27. To the contrary, I see at least a couple ways in which federal courts might complement, rather than erase Congress‘s judgment.

First, as discussed here, courts can and should determine whether the judgment of Congress in fact supports the conclusion that a risk of harm was sufficiently material. In that regard, the history of FACTA supports a finding of materiality as to Dr. Muransky‘s allegations. I recognize there are circumstances in which congressional judgment would not support a finding of concreteness, as with violations of FACTA‘s expiration date requirement. And I agree with the view of the majority that it is the responsibility of courts to make that evaluation, even in the face of a statutory cause of action. See, e.g., (concluding that a FACTA violation presented a sufficiently material risk of harm in part because it was the “nightmare scenario” Congress sought to prevent in enacting the statute).

Second, I acknowledge there are instances in which courts must themselves determine whether a risk of harm is sufficiently material. In , for instance, the Supreme Court noted that not all FCRA violations result in a material risk of harm to the concrete interests the protected by that statute. . The example I have already given comes from the Court‘s observation that “[i]t is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.” Whether a credit report containing inaccurate personal information creates a risk of concrete harm is precisely the type of standing question that is susceptible to this sort of commonsense analysis by federal courts. See (in the context of an FCRA violation, concluding that inaccuracies concerning “age, marital status, educational background, and employment history” present a material risk of harm because this is “the type [of information] that may be important to employers or others making use of a consumer report“).

After rejecting consideration of or giving weight to Congress‘s judgment, the majority concludes that the FACTA violation alleged in Dr. Muransky‘s complaint does not entail a material risk of harm, and so is not a concrete injury. It assumes, without explanation, that Dr. Muransky‘s allegation that he suffered an elevated risk of harm from Godiva‘s FACTA violation is not enough to meet the materiality threshold because a receipt showing 10 of a card‘s 16 digits does not pose “anything approaching a realistic danger” of identity theft. Maj. Op. at 29. I think this weighing of the facts goes too far. Some questions of materiality, like whether an incorrect zip code on a credit report can cause harm, lend themselves to such commonsense judgments. However, questions about the number of digits of a credit or debit card an identity thief needs in order to steal one‘s identity is not one of them. And aside from the majority‘s intuition about what card information is (or is not) useful to identity thieves, there is nothing in the record of this case to suggest that Congress was wrong when it decided that a FACTA violation of this sort creates a material risk of identity theft.3 In circumstances such as these—where neither commonly held understandings nor the record undermine congressional factfinding— suggests that courts should be guided in their risk analysis by the judgment of Congress. (observing that “Congress is well positioned to identify intangible harms that meet minimum Article III requirements“). On the issue of the number of digits that create risk, Congress‘s judgment, after hearing from experts on the matter, was that printing anything more than the last five digits of a credit card number poses an intolerable risk of harm to consumers. This judgment supports the conclusion that Dr. Muransky faced a material risk of harm, and thus a concrete injury, when Godiva printed a receipt showing the first six and last four digits of his credit card number.

I accept that Congress‘s judgment as to the materiality of a risk is not infallible. An example of this is the Second Circuit‘s decision in , , which also involved a FACTA claim based on a receipt showing the first six and last four digits of a credit card number. . There, the defendant raised a factual challenge to standing in a Federal Rule of Civil Procedure 12(b)(1) motion to dismiss. . As part of that motion, the defendant presented extrinsic evidence supporting its argument that the first six digits of a credit card number revealed only the cardholder‘s issuing institution, and thus presented no material risk of identity theft. The district court found in favor of the defendant, and the Second Circuit concluded that the district court‘s factual ruling—that the first six digits identify only the card‘s issuer—was not clearly erroneous. . thus demonstrates how the introduction of extrinsic evidence in the District Court may, in some circumstances, work to undermine Congress‘s judgment. Here, however, neither Mr. Isaacson nor Godiva raised any factual challenge to Dr. Muransky‘s standing in the District Court. For that reason, no record was developed in this case like that available to the Second Circuit in . In the absence of record evidence suggesting that Congress misjudged the number of card digits necessary to cause a material risk identity theft, we are left to conclude that the FACTA violation at issue constitutes a concrete injury.

At the final step of its analysis, the majority says Dr. Muransky failed to establish standing in his complaint because he pled only that he suffered a FACTA violation. Maj. Op. at 29-30. Thus, the majority reasons, Dr. Muransky violated the requirement that pleadings must contain more than conclusory allegations of harm. (citing ). But again, when a statute itself protects a concrete interest, an allegation that the defendant violated that statutory requirement is anything but conclusory. See (concluding that where the statutory right at issue itself protects a concrete interest, a plaintiff need not allege “additional harm” beyond the statutory violation). Because the FACTA violation alleged by Dr. Muransky itself constitutes a concrete harm, he was not required to plead additional facts showing how a receipt revealing the first six and last four digits of a credit card creates a risk of identity theft.4

III.

I return now to the lesson from that courts deciding whether an injury is sufficiently concrete should be guided by “history and the judgment of Congress.” . I have set out how the judgment of Congress alone supports a finding of concreteness in this case. I now address how history also strongly suggests that Dr. Muransky‘s alleged injury is concrete.

says courts may find an injury to be sufficiently concrete if the “alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” . In this circumstance, it is sufficient for a plaintiff, at the pleading stage, to allege only a violation of the statutory right bearing a close relationship to the common law harm. See (finding a close relationship between violations of the Video Privacy Protection Act and the tort of intrusion upon seclusion). The match between the statutory violation and the tort traditionally recognized at common law need not be perfect. See (“An alleged harm need not actually have been actionable at common law to satisfy this inquiry, rather it must have a ‘close relationship’ to the type of harm that has traditionally been recognized as actionable.“); (recognizing a close relationship between a statutory violation and

common law tort where the statute “codifies a context-specific extension of the substantive right to privacy” (emphasis omitted)).

I agree with Dr. Muransky that the injury asserted here bears a close relationship to a common law breach of confidence tort. A breach of confidence lies where a person offers private information to a third party in confidence, and the third party discloses that information. Alan B. Vickery, Breach of Confidence: An Emerging Tort, 82 Colum. L. Rev. 1426, 1427-28 (1982). The basic elements of this tort are: “(1) the plaintiff conveyed confidential and novel information to the defendant; (2) the defendant had knowledge that the information was being disclosed in confidence; (3) there was an understanding between the defendant and the plaintiff that the confidence be maintained; and (4) there was a disclosure or use in violation of the understanding.” (quotation marks omitted). The tort of breach of confidence “is rooted in the concept that the law should recognize some relationships as confidential to encourage uninhibited discussions between the parties involved.” (quoting ).

A breach of confidence tort is not a perfect analogue to the FACTA violation at issue here. As the majority notes, the two ways in which a breach of confidence tort is distinguishable from the violation alleged by Dr. Muransky are (1) that a breach of confidence requires a disclosure, and Dr. Muransky has not alleged his credit card information was disclosed to anyone; and (2) the relationship between Dr. Muransky and Godiva is not the prototypical confidential relationship giving rise to breach of confidence torts. Maj. Op. at 26-27. The majority seems to think this these differences make a breach of confidence tort ill-suited to the FACTA violation at issue here. I think not.

To begin, history may support a finding of concreteness even if a plaintiff cannot satisfy all the elements of a closely related tort. That is because, under , congressionally proscribed “conduct [need not] give rise to a cause of action under common law.” (quotation marks omitted). “If a plaintiff were required to satisfy every element of a common law cause of action before qualifying for statutory relief, Congress‘s power to ‘elevate intangible harms’ by defining injuries and chains of causation which will ‘give rise to a case or controversy where none existed before’ would be illusory.” (Martin, J., concurring in part and dissenting in part) (alterations adopted) (quoting )).

As to Dr. Muransky‘s failure to allege that Godiva disclosed his credit card information to a third party, also recognized that a material risk of intangible harm is sufficient to establish a concrete injury in fact. 136 S. Ct. at 1549. Here, the FACTA violation alleged by Dr. Muransky posed a material risk that his identity would be stolen, which is “the very harm the breach of confidence tort makes actionable—an unauthorized disclosure of privileged information to a third party.” . Thus, the fact that Dr. Muransky did not actually fall victim to identity theft does not preclude our court from finding that the violation he alleged here bears a close relationship to a breach of confidence tort.

And with respect to the relationship between Dr. Muransky and Godiva, I recognize that the breach of confidence tort has historically applied to traditional confidential relationships, like that between a customer and his bank. See, e.g., . But I see no reason why a relationship between a consumer and a point-of-sale merchant should not be viewed as confidential. When a consumer makes a purchase using a credit or debit card, he provides confidential identifying information to a merchant. In doing so, the consumer places trust in the merchant to safeguard that information from potential identity thieves. 39 Weekly Comp. Pres. Doc. 1746, 1748 (noting that receipts printed by merchants “should not hold the key to [a consumer‘s] savings and financial secrets“). I therefore view the confidential relationship been a consumer and a merchant as an appropriate “context-specific extension” of a traditional breach of confidence tort. See .

For these reasons, I believe Dr. Muransky has alleged a concrete injury that is closely related to a harm traditionally protected at common law. Therefore, he was not required to allege any further harm beyond the FACTA violation asserted in his complaint.5

IV.

Congress enacted FACTA in an effort to reduce the risk of identity theft by requiring merchants to truncate credit card numbers on printed receipts, and in doing so, set the tolerable level of risk at no more than the last five digits of a card number. Dr. Muransky alleges he suffered a concrete injury when Godiva printed the first six and last four digits of his card number. Both the common law and the judgment of Congress support a conclusion that the FACTA violation alleged in Dr. Muransky‘s complaint constitutes a concrete injury in fact. I believe commands us to find that Dr. Muransky has satisfied the injury in fact requirement of Article III. I therefore respectfully dissent.

JORDAN, Circuit Judge, dissenting:

I join the dissents of Judges Wilson and Martin. They each demonstrate, for different reasons, that Dr. Muransky has Article III standing based on the allegations of his complaint. I write to make two additional points, one procedural and one substantive.

The procedural point is that, regardless of what one thinks about the disagreement between the majority and the dissents on Article III standing, this case should not be dismissed outright, and at most should be remanded for further proceedings. Assuming for the sake of argument that the majority‘s view of standing is correct, Mr. Isaacson did not raise his standing argument until the fairness hearing, and even then, he did so only obliquely. Supreme Court precedent and procedural fairness dictate that Dr. Muransky have an opportunity to amend his complaint or present facts in support of standing.

Not only is dismissal unfair to Dr. Muransky, but it requires the majority to make assumptions about the risks of identity theft without the benefit of a factual record, expert reports, or adversarial testing of the issue in the district court. The majority essentially relies on its common sense to conclude that when a vendor prints a receipt displaying the first six and last four digits of a credit card number, the risk of identity theft is “remote.” But that is a fact-based and value-laden judgment, which appellate courts are ill-equipped to make in the abstract. The result of dismissing in this procedural context is problematic for another reason. The majority does not and cannot explain what analysis or assumptions lead to its conclusion of remoteness, and it fails to describe the standard it applies or delineate the boundaries of Article III jurisdiction. The majority‘s “I know it when I see it” approach to standing, cf. (Stewart, J., concurring), is a problem for future litigants and courts, especially in data privacy cases, where the harm is perhaps difficult to quantify and describe, but which Congress has nonetheless identified and attempted to prevent by legislation.

The second point, the substantive one, concerns the doctrine of Article III standing. That we need to resolve what is essentially a policy question to determine the boundaries of our subject-matter jurisdiction reminds us how far standing doctrine has drifted from its beginnings and from constitutional first principles. Standing, as we know it today, was a twentieth-century innovation. But to the extent that the current doctrine can be reconciled with the Constitution, it is designed to safeguard the separation of powers between the branches of government and ensure that courts hear—in the words of James Madison—cases only “of a Judiciary Nature.” Cases like this one, involving the alleged invasion of a congressionally-created private right by a private party against another private party, do not implicate structural or institutional concerns. They are exactly the type of cases suited for initial congressional judgment and ensuing judicial resolution. There has been a long tradition—before the Founding and after—of English and American courts hearing cases involving the invasions or violations of private legal rights, including new private rights created by statute, regardless of whether the plaintiff could allege some injury beyond the invasion of the right itself. The Supreme Court‘s standing cases, from the early twentieth century to the present, have not upset that tradition.

The better way to understand standing here is not through the lens of injury-in-fact, but under the rights-based model that Justice Thomas and others have outlined. That framework is grounded in the traditional distinction between public and private rights, which early American jurists understood well, and which perseveres in other areas of law. Properly rooted in history and tradition, this rights-based framework harmonizes modern standing doctrine with Article III. It also offers a straightforward and consistent method for resolving difficult standing questions, such as the one presented here, which have been unnecessarily complicated by a narrow focus on the injury-in-fact requirement.

Under this rights-based framework, Dr. Muransky easily alleged the invasion of a private legal right—the right to receive a receipt truncating all but the last five digits of his credit card number. That right was supposed to inure to his benefit under a law that Congress enacted, and the violation itself was something that a vendor did directly to him. The violation, in other words, was personal to him. By requiring Dr. Muransky to demonstrate a separate injury in this context, we turn Article III on its head.

I

To justify dismissal, the majority argues that “[t]his is not a case where a surprise standing issue was thrust upon an unaware plaintiff.” I strongly disagree. Dr. Muransky never had any reason to doubt that he met his burden to establish standing, and he was led to believe that subject-matter jurisdiction was not an issue, even after the Supreme Court decided . To see why, we must review the district court proceedings in detail and without the benefit of hindsight.

A

Dr. Muransky filed his complaint in June of 2015. He alleged that Godiva printed a receipt displaying the last four and first six digits of his credit card number. He claimed, correctly, that Godiva violated the FACTA, 15 U.S.C. § 1681c(g)(1). And he asserted that the violation burdened him and putative class members with an “elevated risk of identity theft“—the very risk that Congress sought to mitigate when it enacted the FACTA.

When Dr. Muransky made these allegations, he was justified in believing they were sufficient to establish Article III standing. The majority appears to concede this point, acknowledging that “[p]erhaps before there was an argument that [Dr.] Muransky‘s claim could have survived as pleaded[.]” But this acknowledgment is an understatement, for it was clear that standing existed. Our own cases reiterated that “Congress may enact statutes creating legal rights, the invasion of which creates standing, even though no injury would exist without the statute.” (internal quotation marks omitted). This was not surprising given cases like , which held that a “tester” plaintiff who received false information in violation of the Fair Housing Act had standing to sue, even though he did not intend to rent or purchase a home or apartment and did not suffer an actual injury.

With respect to the FACTA, the Eighth Circuit had relied on to hold that a violation of §1681c(g) was, by itself, sufficient for an Article III injury. See (“[T]he actual-injury requirement may be satisfied solely by the invasion of a legal right that Congress created. This is not a novel principle within the law of standing.“). Lower courts, including one in in this circuit, had reached the same conclusion. See ; ; . The majority is mistaken in suggesting that the law in 2015 was in a state of flux.1

Understandably, then, Godiva did not make any real attempt to challenge Dr. Muransky‘s standing. The majority points to the fact that Godiva raised standing as an affirmative defense in its answer to the complaint, but that defense was a mere placeholder—a single, conclusory statement that “[n]either Dr. Muransky nor any member of the proposed class has suffered any injury in fact.” Godiva did not say anything more, and it is not clear whether this argument was even a facial attack on the complaint or a factual attack. The defense therefore could have been stricken as conclusory under Rule 12(f). See, e.g., (“Where an affirmative defense is ‘no more than bare bones conclusory allegations, it must be stricken.‘“) (quoting ). In any event, Godiva never pursued the standing argument. It did not move to dismiss under Rule 12(b)(1) for lack of jurisdiction, and instead sought to dismiss on the merits under Rule 12(b)(6).

Likewise, the district court—which had an independent duty to ensure that it had subject-matter jurisdiction—declined to take up standing on its own. Had the district court considered standing to be an issue, it would have been required to give Dr. Muransky an opportunity to present facts supporting standing and, if necessary, to hold an evidentiary hearing. See (explaining that a district court may “hear conflicting evidence and decide for itself the factual issues that determine jurisdiction,” but “a plaintiff must have ample opportunity to present evidence bearing on the existence of jurisdiction“); (faulting the district court for making findings regarding disputed facts related to standing without holding an evidentiary hearing).

Dr. Muransky and Godiva negotiated toward a settlement after the close of the pleadings. As the majority points out, they negotiated in the shadow of , which was pending before the Supreme Court at the time. The parties recognized that the pending case could upend standing law in the consumer privacy area, and they sought to mitigate risk and uncertainty, which cut both ways. But at no point was there any guarantee about what the Supreme Court would say or hold in . Indeed, the Ninth Circuit in had initially ruled that Article III standing existed. See . So, even though standing may have been a background issue for the parties, it was not a contested matter in the case nor a jurisdictional problem under existing law. Any suggestion that Dr. Muransky—and only Dr. Muransky—was trying to resolve the case before the Supreme Court decided is misleading. Just as class action plaintiffs try to assess risk, so too do class action defendants like Godiva. See generally Brian T. Fitzpatrick, The Conservative Case for Class Actions 107-08 (2019).

The parties eventually came to terms. In January of 2016, the district court granted preliminary approval of their joint motion for class certification and class settlement. But the court still did not ask Dr. Muransky to proffer facts supporting standing, this time as part of its review of the settlement agreement. The court provided topics to be addressed at a fairness hearing without mentioning any jurisdictional concerns.

In May of 2016, four months after the preliminary approval of the class settlement, the Supreme Court issued its decision in . And here is the key point: the parties—including Mr. Isaacson—and the district court still remained silent. In the four months between and the fairness hearing in September of 2016, no one thought to address Article III standing. Godiva did not seek to withdraw from the settlement, move to dismiss under Rule 12(b)(1), or request summary judgment. The court did not ask for supplemental briefing on or amend its preliminary approval order to include standing as a topic to be discussed at the fairness hearing.

Significantly, Mr. Isaacson—the objector-appellant now challenging Dr. Muransky‘s standing on appeal—did not raise standing in his written objections to the settlement, or in any of his other papers, all of which he filed months after was decided. So, by the time of the fairness hearing, standing was still entirely uncontested, as though had no effect on the case. Dr. Muransky had no reason to amend his complaint or proffer additional facts to move the settlement forward to completion.

Then, at the fairness hearing in September of 2016, Mr. Isaacson mentioned standing for the first time. But he did not say much on the topic and certainly did not present a fully formed argument that precluded settlement. He pondered whether further factual inquiry was necessary before the district court approved the settlement, but he essentially conceded that did not warrant dismissal on the pleadings. When the court suggested that dismissal might harm the class members, Mr. Isaacson responded: “Potentially. And I‘m not saying necessarily that that‘s what should happen.” After this exchange, Mr. Isaacson quickly moved to the merits of the settlement under Rule 23. The court did not subsequently ask the parties to respond to Mr. Isaacson‘s musings on standing, so Dr. Muransky still had no reason to amend his complaint or proffer additional facts.

Within the broader legal landscape, it made sense not to take up standing. After came down, but before the district court approved the settlement in September of 2016, two other district courts in this circuit concluded that the same allegations that Dr. Muransky made against Godiva were sufficient to establish standing under . See ; . Two district courts in that same time period also concluded that plaintiffs had standing based on FACTA violations in which the vendor printed receipts displaying credit card expiration dates. See ; .

We addressed only once in the four-month period leading up to the final approval of the settlement. In , an unpublished decision, we held that a plaintiff had established a concrete injury based solely on an allegation that a debt collector sent her a letter omitting required information under the Fair Debt Collection Practices Act. The plaintiff “alleged an injury to her statutorily-created right to information,” which was itself sufficient for Article III standing, without regard to whether she alleged any additional injury. See This was not the type of “bare procedural violation” discussed in , but the invasion of a substantive right, which by itself provided standing. See .

Some district courts in our circuit eventually came to the opposite conclusion regarding Article III standing and violations of the FACTA. But those cases were decided after the settlement at issue here had been approved. See ; . The same is true of the cases from our sister circuits that the majority now cites as persuasive authority, three involving credit card numbers and three involving expiration dates. All six decisions were handed down after September of 2016. See (credit card number); (credit card number); (credit card number); (expiration date); (expiration date); (expiration date / decided December 13, 2016). We also had not yet issued (decided October 6, 2016), a standing decision on which the majority also relies. The district court approved the settlement shortly after the fairness hearing, believing it had jurisdiction—correctly, given the existing legal landscape. Mr. Isaacson appealed, and only then did he launch his full-throated attack against Dr. Muransky‘s standing (even though he had several months to make his arguments in his written objections to the settlement). His initial brief was the first time that any party briefed standing in this case or offered any meaningful argument as to why required dismissal of Dr. Muransky‘s class complaint.2

B

Aware of this procedural history, the majority directs the dismissal of the complaint, arguing that it was Dr. Muransky‘s burden to prove standing and that he should have known to “firm up” his jurisdictional allegations. That, I think, amounts to Monday-morning quarterbacking. The majority‘s decision to dismiss, in this procedural context, is mistaken.

For one, it is not fair to expect parties to anticipate changes in the law and then dismiss their case if they fail to do so. The proper resolution in that scenario is to remand. See (“When law changes in unanticipated ways during an appeal . . . this court will generally remand for a new trial to give parties the benefit of the new law and the opportunity to present evidence relevant to that new standard. The motivation of this rule is fairness: to prevent injustice to a party who had no reason to expect a changed rule at the time of trial.“). Although our law on the FACTA did not change during the pendency of this appeal, it has now changed at the end of the appeal. That is, the majority‘s decision is itself an expansion of , which Dr. Muransky (and Godiva, the district court, and other district courts in this circuit) had no reason to expect or predict. did not involve § 1681c(g)(1), the provision of the FACTA at issue here, and the Supreme Court did not even decide the standing issue before it. The Supreme Court reversed the Ninth Circuit because it failed to address “concreteness” as a distinct requirement of an Article III injury. See . But it remanded without deciding the issue of whether the plaintiff adequately alleged an injury in fact. See 3

We have reiterated that “a plaintiff must have ample opportunity to present evidence bearing on the existence of jurisdiction.” . The Supreme Court followed the same path in . In that case, a three-judge district court sua sponte held that an organizational plaintiff lacked standing to sue Alabama for racial gerrymandering because it did not proffer evidence that its members resided in the relevant voting districts. See . Alabama had only challenged the individual co-plaintiffs’ standing, arguing that none claimed to live in those districts. See . Based on this challenge to its co-plaintiffs’ standing, the organization probably should have been aware of potential problems with its own standing. But it did not take the opportunity to obviate the issue with evidence of where its own members resided.

Rather than dismiss, the Supreme Court reversed and remanded so that the organization could establish its standing. See . It noted that certain deposition testimony supported an “inference” that the organization had members in the relevant districts, and that the inference was “strong enough to lead the [organization] reasonably to believe that, in the absence of a state challenge or a court request for more detailed information, it need not provide additional information such as a specific membership list.” . Had its standing been directly challenged, i.e., “had it been asked,” then the organization could have provided more evidence, such as a member residency list. See . But “elementary principles of procedural fairness” mandated that the organization have “an opportunity to provide evidence of” standing. See . I don‘t understand why those principles don‘t warrant the same result here.

In two similar FACTA cases—, and —the Second Circuit had remanded to give the plaintiffs an opportunity to replead or proffer additional facts after came down. See (remanding the consolidated cases “to allow the district courts to address any standing questions in the first instance“). The plaintiffs “did not seek the opportunity to supplement the record with additional evidence,” however, and failed to carry their burden on remand, which is why the majority now cites to these cases as persuasive authority. But the key point is that the Second Circuit first gave the plaintiffs an opportunity to adapt to the shifting law of standing. Indeed, the Second Circuit recognized that there was confusion after and cautioned courts to put plaintiffs on “renewed notice of both the right to introduce such evidence and the

plaintiff‘s burden of proof to do so even at the motion-to-dismiss stage.” .

Dr. Muransky was not given adequate notice at any stage of the proceedings that undermined his standing. To the contrary, he was led to believe, by the contemporaneous legal authority and the parties’ silence after , that standing was not an issue. Mr. Isaacson‘s muted observations about standing at the fairness hearing did not alter this reality. In sum, Dr. Muransky had no reason to amend his complaint or proffer additional facts. Outright dismissal at this stage is wrong, and the majority offers no persuasive reasons why remand is inappropriate.

C

In addition to ensuring procedural fairness, there are important institutional and precedential reasons for us to remand rather than dismiss.

I focus here on Dr. Muransky‘s allegation that he and class members face an increased risk of identity theft, even though I do not believe that this is the only basis for standing. As Judges Wilson and Martin correctly explain, and as I describe further below, Dr. Muransky suffered a violation of a substantive legal right (that is, a private, congressionally-created right), which is sufficient to establish standing. But even assuming that Godiva‘s FACTA violation was merely “procedural,” as the majority contends, Dr. Muransky would still have standing because he faced a “risk of real harm.” (citing ).

The majority acknowledges this point, but still dismisses at the pleading stage in the face of a plausible allegation of an increased risk of a real harm—identity theft. Dr. Muransky‘s allegation was not conclusory, as the majority states, but was a general factual contention subject to proof or disproof with evidence at later stages of litigation. The Supreme Court has made this point repeatedly, but the majority acts as if the Court‘s decisions were written in vanishing ink. See (explaining that “general factual allegations of injury” suffice at the pleading stage and that the plaintiff must substantiate general claims with “specific facts” at later stages of litigation); (”, since it involved the establishment of injury in fact at the summary judgment stage, required specific facts to be adduced by sworn testimony; had the same challenge to a generalized allegation of injury in fact been made at the pleading stage, it would have been unsuccessful.“); (explaining that courts “must presume that the general allegations in the complaint encompass the specific facts necessary to support those allegations” of jurisdiction). See also (explaining that the burden for establishing jurisdiction at the pleading stage is “relatively modest“).4

Dr. Muransky‘s claim to an elevated risk of identity theft is plausible on its face and bolstered by his allegations that identity theft is pervasive in his area and that Godiva had already been the target of hackers. When we properly construe all reasonable inferences in his favor, see, e.g., , it is fair to conclude that a receipt displaying the ten digits of a credit card number made it more likely that identity thieves (concentrated in his area) could obtain that information and use it to steal his identity. The majority may doubt that Dr. Muransky will be able to prove that the risks are truly substantial, but that is not a reason to dismiss the complaint. See (“[A] well-pleaded complaint may proceed even if it strikes a savvy judge that actual proof of those facts is improbable[.]“).

The majority, in other words, fails to appreciate the distinction between a substantive standing requirement—that the plaintiff must demonstrate a substantial risk of a future injury—with the procedural principle that an allegation need only be plausible at the pleading stage. Indeed, not one of the cases that majority cites for the proposition that a risk of harm must be “substantial” requires that a plaintiff prove or describe substantiality at the pleading stage, or even allege the precise degree of risk of harm. To the contrary, the cases either accept the general allegations of an elevated risk at the pleading stage, or they accept or reject standing at the summary judgment stage based on the record evidence. See (relying on the district court‘s findings of fact at a bench trial to conclude that the plaintiffs had standing); (accepting standing at the pleading stage based on the plaintiffs’ allegations that they intended to engage in conduct proscribed by the challenged statute); (holding that the plaintiffs lacked standing because they “set forth no specific facts [at summary judgment] demonstrating that the communications of their foreign contacts will be targeted“); (accepting standing based only on the allegation that the plaintiffs were “subject to the terms” of the challenged ordinance); (dismissing certain claims and explaining that “[n]othing in the record” shows that the plaintiffs had been “threatened” with the alleged harm). Cf. (rejecting an increased-risk-of-harm theory of standing offered by amici, as the plaintiffs did not assert that theory and did not allege a substantially increased risk of harm in their complaint).

To dismiss at the pleading stage, the majority must fall back on its common sense and intuition to conclude that Dr. Muransky‘s risk of identity theft is “remote.” But that conclusion is factual in nature and cannot be based on common sense. All that common sense can really tell us at this point is that the more private information is displayed, the more likely it is to be obtained and used to steal one‘s identity. Cf. (“[T]he less information the receipt contains the less likely is an identity thief who happens to come upon the receipt to be able to figure out the cardholder‘s full account information and thus be able to make purchases[.]“). Common sense, no matter how acute, cannot pinpoint the degree of elevated risk caused by a FACTA violation, nor can it assist us in determining whether an elevated risk of identity theft is “substantial.” When the majority concludes that Dr. Muransky‘s risk is “remote,” that conclusion must be based on some unknown underlying premise or assumed facts.5

The majority appears to recognize that its conclusion is fundamentally factual. It points out, for example, that “[a]ccording to [Mr.] Isaacson . . . the extra numbers on [Dr.] Muransky‘s receipt merely contain information that is already allowed to be printed on it elsewhere—the card issuer, for example.” The majority also acknowledges Dr. Muransky‘s counterargument, noting that, “[f]or his part, [Dr.] Muransky argues that the six digits do contain information that can be exploited by identity thieves, such as the card level or industry program, and that access to it enables identity thieves to conduct ‘phishing inquiries.‘” But the majority does not resolve these competing factual claims because it cannot sit as a trier of fact on a barren evidentiary record.

The majority also cites to , quoting it for the proposition that the printing of “the first six digits of a credit card . . . is the equivalent of printing the name of the issuing institution.” As Judge Martin explained in the second panel majority opinion, however, we cannot impose factfinding from another district court on Dr. Muransky: “Judicial notice of another court‘s opinion takes notice of the existence of the opinion, which is not subject to reasonable dispute over its authenticity, but not of the facts summarized in the opinion.” (quoting ). It has been the law of this circuit for at least 25 years that the factual findings contained in a court order or opinion (1) cannot be judicially noticed by another court, and (2) constitute inadmissible hearsay if they are offered for the truth of the matter asserted. See (“If it were permissible for a court to take judicial notice of a fact merely because it has been found to be true in some other action, the doctrine of collateral estoppel would be superfluous. . . . [T]he plain language of Rule 803(8)(C) [of the Federal Rules of Evidence] does not apply to judicial findings of fact.“).

The majority‘s fact-borrowing from is especially problematic because the Second Circuit “admitted[ ] [that] the fact-finding procedure below was more abbreviated than might be conventionally expected,” and that “the plaintiff did not seek the opportunity to supplement the record with additional evidence.” . And, as Judge Martin explained in the first panel majority opinion, this factual proposition originally came from one expert‘s declarations submitted in two district court cases more than a decade ago, which have not since been challenged “in light of technological changes related to brute-force cryptological attack on credit card numbers.” (citing , rev‘d and remanded, , and ).

It is not clear—at least to me—how these factual assertions influence the majority‘s assessment of the risks. For the majority quickly pulls back and says that the factual dispute is “beside the point” because Dr. Muransky failed to plead the “specific risks from the sequence of numbers included on his receipt, and did not address the issue before the district court at any time.” But, again, Dr. Muransky did not amend his pleadings or address the issue in the district court because he had no opportunity or any reason to do so, either before or after . And, in any event, his general allegations suffice at the pleading stage.6

This brings me to the institutional and precedential concerns with the majority‘s failure to remand. As an appellate court we are not suited to resolve factual disputes bearing on jurisdiction in the first instance. See (“[W]henever possible . . . the evaluation of such factual contentions bearing upon Article III jurisdiction should not be made by this Court in the first instance.“); (noting that the causation prong of Article III standing “is an issue best left to the rigors of evidentiary proof at a future stage of the proceedings, rather than dispensed with as a threshold question of constitutional standing“), rev‘d on other grounds, . Yet this case clearly turns on factual questions, as the majority seems to recognize. Whether the extra numbers on a receipt reflect the credit card brand, or whether the digits can be exploited for “phishing inquiries,” for example, are precisely the types of questions that must be resolved prior to determining whether a risk of identity theft is substantial. These questions should be addressed in an adversarial posture in the district court, with evidence and experts, and an evidentiary hearing if necessary, but not on appeal in the first instance.

The Second Circuit recognized as much in , explaining that jurisdictional discovery and evidentiary production would be necessary to resolve fact-based standing challenges to FACTA claims. See . With respect to information privacy statutes more generally, it noted that a “fact-finding hearing with expert witness testimony may very well be appropriate, depending on the novelty of the issue, the extent of the material dispute of facts, and the statutory prohibition in question.”

The majority ignores this lesson from , as it confronts a complex and novel question about credit card numbers and the risk of identity theft. The majority tries to take the question head on, but without a factual record it can only venture a guess in the abstract and therefore cannot explain the logic underlying its decision. The result is that it cannot meaningfully describe the applicable standard or offer any guidance for litigants or courts.

The majority tries to offer some suggestions, but they are vague and not of any help to Dr. Muransky—should he decide to refile—or other litigants who may sue for FACTA violations. For example, the majority asks for more “insight” into the elevated risks of harm at the pleading stage. But how does one more precisely describe a “risk” of something like identity theft, which is perpetrated by criminals, and what level of detail is needed? Percentages? Anecdotal information? Empirical data? Law-enforcement reports? Affidavits of IT consultants or reformed hackers? The majority cannot say. By demanding more facts beyond the allegation of a risk of harm, the majority comes close to returning us to the fact-pleading regime of a bygone era. See (Wood, J., dissenting from denial of rehearing en banc) (“In demanding proof of injury, we need to guard against pushing a merits judgment into the Article III injury-in-fact inquiry [and] to be sure that we are not returning to a fact pleading regime[.]“). Yet the Supreme Court has told us that and its progeny do not require hyper-detailed allegations. See (“Having informed the city of the factual basis for their complaint, [the plaintiffs] were required to do no more to stave off threshold dismissal for want of an adequate statement of their claim.“).

As this all demonstrates, Dr. Muransky cannot possibly make his allegations anymore “clearly and specifically,” as the majority requires. Detailed allegations about who, what, when, or how his identity could be stolen in the future would be speculation, as Dr. Muransky is alleging an injury, in part, based on a risk of a future event. But Congress has already explained that “[e]xperts in the field agree that proper truncation of the card number . . . prevents a potential fraudster from perpetrating identity theft or credit card fraud,” Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(6), 122 Stat. 1565, and that is exactly what Dr. Muransky is trying to prevent. See (explaining that Congress can “articulate chains of causation that will give rise to a case or controversy where none existed before“). It is befuddling why the majority treats Congress’ findings about the risk of identity theft in the FACTA with such skepticism.7

The majority also suggests that Dr. Muransky should have “indicate[d] how much risk” of identity theft the FACTA violation caused. But it does not and cannot specify what probability standard would meet its threshold (nor does it incorporate the magnitude of the injury into the mathematical loss, as noted above). Future litigants will have to guess a number, and then hope that it matches the next panel‘s definition of “substantial.” So much for guidance.

And what is the precedential effect of this case? Assume that Dr. Muransky estimates that his risks of identity theft increased by 25% due to the FACTA violation, and he refiles making that exact allegation. Would the district court still be required to dismiss based on today‘s holding that a receipt displaying the first six and last four digits creates only a “remote” risk? And what if a future litigant alleges that a vendor printed 12 out of 16 digits (or 14 out of 16 digits) of his credit card number; would that allegation suffice? Apparently 16 out of 16 digits is enough at the pleading stage, see , but then why not 15? And if not 15, then why not 14, 13, etc.? At what point would the majority draw the line between —where the identity thief apparently had “sufficient information” to defraud the plaintiff—and a case where the identity thief would not have sufficient information?

From my perspective, these are inevitable consequences of the standing framework that the majority derives from , a problem which I explain in more detail below. But in a post- world, if we are going to take on “a robust judicial role” in assessing risks of harm to plaintiffs and push legislative findings to the side, then we should endeavor to conduct a careful analysis with as much information as possible. That is particularly necessary in complex areas like consumer and informational privacy, where problems are not easily resolved by so-called common sense. See .

There is no shame in admitting our institutional limitations and taking up these issues at a later stage on a complete record. The Supreme Court frequently remands when faced with these types of questions, recognizing that Article III standing is a malleable and evolving area of law. In , for example, the Supreme Court granted certiorari to review whether a cy pres class settlement was “fair, reasonable, and adequate” under Rule 23. But the Court determined that there were “substantial questions about whether any of the named plaintiffs ha[d] standing to sue” in light of . See . The Court requested supplemental briefing on the issue, but it concluded that the briefs raised a “wide variety of legal and factual issues.” . Rather than pass on these novel standing issues itself, the Supreme Court remanded for further proceedings. See The procedure that was good for the Supreme Court in should be good enough for us.

Similarly, in , the Supreme Court concluded that the plaintiffs in a voting rights case had not established an Article III injury. But rather than direct dismissal, it remanded “so that the plaintiffs may have an opportunity to prove concrete and particularized injuries using evidence . . . that would tend to demonstrate a burden on their individual votes.” . Even though those plaintiffs had been given an opportunity to develop the record (unlike Dr. Muransky), the Court was still wary of dismissal because the case involved an “unsettled kind of claim [it] ha[d] not agreed upon, the contours and justiciability of which are unresolved.” Why the approach is inappropriate here remains a mystery.

Whether the Supreme Court remands out of fairness or caution, or some combination of both, we ought to proceed accordingly. If we do not affirm, we should instead treat this case as having properly survived the pleading stage and give Dr. Muransky an opportunity to support his Article III standing with additional allegations or evidence. He may or may not be able to carry that burden, but he is owed the chance. If we take up the standing issue at a later time, moreover, we can do so on a developed factual record and with the benefit of adversarial framing of the factual issues. This will lead to a more precise and detailed opinion on our part, which will inure to the benefit of future litigants and courts, who may be wondering what exactly we have decided.

II

Although remanding this case would mitigate some of the problems of the majority‘s decision, a better outcome would be to affirm based on the public-private rights framework that Justice Thomas outlined in his concurrence in and others have echoed. “Private rights” are those “belonging to individuals, considered as individuals.” (Thomas, J., concurring) (quoting 3 William Blackstone, Commentaries *2 (1768)). Public rights are those “owed to the whole community, considered as a community, in its social aggregate capacity.” (quoting 4 William Blackstone, Commentaries *5 (1769)).

Dr. Muransky alleged that Godiva violated his congressionally-created private right—the right of individual “cardholders” to receive receipts truncating all but the last five digits of their credit card number. See 15 U.S.C. § 1681c(g)(1). Cf. (Thomas, J., concurring) (concluding that § 1681e(b) of the Fair Credit Reporting Act arguably confers private rights because it requires reporting agencies to “follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates“); (Thomas, J., dissenting) (concluding that the Stored Communications Act confers a private right insofar as it prohibits electronic service providers from “knowingly divulg[ing] . . . the contents of a communication” sent by a “user,” “subscriber,” or “customer” of the service“). For that reason alone, Dr. Muransky has Article III standing to proceed with this lawsuit.

A

The Constitution provides that “[t]he judicial Power shall extend to all Cases, in Law and Equity, arising under . . . the Laws of the United States[.]” U.S. Const. Art. III, § 2. Because there was little discussion about this provision at the Constitutional Convention, and because the text does not lead to any “linguistically inevitable conclusion,” Antonin Scalia, The Doctrine of Standing as an Essential Element of the Separation of Powers, 17 Suffolk U. L. Rev. 881, 882 (1983), the Supreme Court has looked instead to the common law to define the scope of Article III jurisdiction. See (separate opinion of Frankfurter, J.) (“Judicial power could come into play only in matters that were the traditional concern of the courts at Westminster and only if they arose in ways that to the expert feel of lawyers constituted ‘Cases’ or ‘Controversies.‘“). Indeed, in modern cases where the common law in the eighteenth century recognized a cause of action, the Supreme Court has held that Article III standing exists. See (holding that a qui tam relator has Article III standing in part because qui tam actions were “cases and controversies of the sort traditionally amenable to, and resolved by, the judicial process,” as evidenced by “the long tradition of qui tam actions in England and the American Colonies“) (internal quotation marks omitted).

The common law provides a clear answer for this case. English courts at common law heard suits involving private rights, regardless of whether the plaintiff suffered actual damage, as was true, for example, in cases of trespass, assault, and battery. See, e.g., (“[W]hen one man placed his foot on another‘s property, the property owner needed to show nothing more to establish a traditional case or controversy.“); 3 Blackstone, Commentaries *124 (explaining that with respect to assault, “no actual suffering is proved, yet the party injured may have redress,” and as to battery, every unlawful touching is actionable, whether “accompanied with pain . . . [or] attended with none“).

That tradition continued in early America. Jurists understood that a plaintiff alleging the violation of a private right had a justiciable case, regardless of whether he could demonstrate actual damage. See (Story, J.) (explaining that “whenever there is a clear violation of a right, it is not necessary in an action of this sort to show actual damage” because “every violation imports damage; and if no other be proved, the plaintiff is entitled to a verdict for nominal damages.“). The principle was repeated in state courts and treatises throughout the nineteenth century. See, e.g., (explaining that where there has been a violation of a right, a person is entitled at least to nominal damages “to vindicate the right which has been invaded,” and for that reason, he may sustain an action of trespass “although he shows no actual specific damage to have thereby accrued to him“); (“[O]ne commoner might maintain an action against another, for an injury to his right, without proof of actual damage.“); 1 Theodore Sedgwick, Measure of Damages 43-44 (5th ed. 1869) (explaining that wherever “the invasion of a right is established, the English law infers some damage to the plaintiff; and if no evidence is given of any particular amount of loss, it declares the right by awarding what it terms nominal“).

It was also understood that Congress could create private rights by statute and that a plaintiff could sue based on a violation of that statutory right without regard to actual damages. See Thomas M. Cooley, The Law of Torts 271 (2d ed. 1888) (explaining that where “statutes fix a minimum of recovery . . . there would seem to be no doubt of the right of one who establishes a technical ground of action to recover this minimum sum without any specific showing of loss“). As Theodore Sedgwick explained in his influential treatise on damages, the question was whether the statute “obviously prohibited [an act] for the protection of a particular party“; if it did, “then it [was] not necessary [for the protected party] to allege special damage.” 1 Sedgwick, Measure of Damages, at 661 (quoting ).

In the Copyright Act of 1790, for example, the First Congress imposed statutory damages on those infringing on an individual‘s patent, even if the patent-holder could not show monetary loss. See Act of May 31, 1790, ch. 15, § 2, 1 Stat. 124, 124-25. Justice Story, riding circuit, presided over a case in which the defendant infringed on a patent by building a similar machine. See (Story, J.). The defendant argued that “the making of a machine cannot be an offence, because no action lies, except for actual damage, and there can be no actual damages, or even a rule for damages, for an infringement by making a machine.” . Justice Story rejected this argument: “[W]here the law gives an action for a particular act, the doing of that act imports of itself a damage to the party. Every violation of a right imports some damage, and if none other be proved, the law allows a nominal damage.”

The Framers did not demonstrate any intent to depart from this common-law understanding, which fit well within the broader idea that the judiciary was tasked with protecting the rights of individuals. In , Chief Justice Marshall stated that “the province of the court is, solely, to decide on the rights of individuals[.]” And in , he described the judicial power as “capable of acting only when the subject is submitted to it by a party who asserts his rights in the form prescribed by law.” Justice Story echoed Justice Marshall, and described an Article III “case” as one “touching the Constitution, laws, or treaties of the United States” and “submitted to the court by a party, who asserts his rights in the form prescribed by law.” 3 Joseph Story, Commentaries on the Constitution of the United States § 1640 (1833). The law professor and former antifederalist St. George Tucker described the judiciary as “that department of the government to whom the protection of the rights of the individual is by the constitution especially confided.” 1 St. George Tucker, Blackstone‘s Commentaries 140 (1803). And as

one state supreme court explained, “the very object of all suits, both at law and in equity,” is “[t]o preserve and enforce the rights of persons, as individuals, and not as members of the community at large.” .

In short, the Framers and contemporary jurists would have considered Dr. Muransky‘s lawsuit to be the quintessential “case or controversy” involving the adjudication of private rights created by statute. The FACTA “obviously prohibit[s]” acts for the protection of “particular parties“—i.e., cardholders—and so had English or early American courts heard this case, I think they would not have demanded damages beyond the statutory violation. I have not found any cases or authorities around the time of the Founding that would have required a court to evaluate Dr. Muransky‘s separate “injury” in order to determine whether it had subject-matter jurisdiction.

B

We are, of course, bound by Supreme Court precedent. But a review of standing doctrine, from its infancy in the twentieth century to the present, leads me to the same conclusion.

The Supreme Court has never cabined the redress of private wrongs through its Article III jurisprudence. Standing grew out of public law litigation in the early twentieth century, not out of private disputes. As Justice Douglas put it in 1942, reflecting on the developments of the prior decades, “[r]epeated attempts of private litigants to obtain a special stake in public rights have been consistently denied.” (Douglas, J., dissenting) (emphasis added) (collecting cases).

The same is true for the injury-in-fact requirement. It expressly emerged in the 1970s and 1980s amidst a fast-growing administrative state and questions about the extent to which citizens could challenge agency action as representatives of the public. In that context, the Supreme Court began referring to injury in fact as part of an “irreducible minimum” of Article III. See . See also (Brennan, J., concurring); . The phrase was cemented in , and has been treated as gospel ever since. Yet the Supreme Court could not have meant exactly what it said, as it has always allowed individuals to sue upon the invasions of private rights, even without showing actual damages.

The Court‘s “one-size-fits-all standing doctrine” for both public and private rights cases, see F. Andrew Hessick, Standing, Injury in Fact, and Private Rights, 93 Cornell L. Rev. 275, 277 (2008), is therefore a conceptual mistake that needs fixing. Either injury in fact is not a constitutional prerequisite, except when a plaintiff purports to assert rights of the public at large, or, injury is a constitutional requirement, but the concept encompasses invasions of private legal rights. See, e.g., (“An injury, legally speaking, consists of a wrong done to a person, or, in other words, a violation of his right.“); (“[W]henever there has been an illegal invasion of the rights of another, it is an injury, for which he is entitled to a remedy by an action.“).

1

Modern standing doctrine began to take shape in the early twentieth century. Some commentators argue that it was the brainchild of Justices Brandeis and Frankfurter, who sought to “insulate progressive and New Deal legislation from frequent judicial attack” and thwart “efforts by citizens at large to invoke the Constitution to invalidate democratic outcomes.” Cass R. Sunstein, What‘s Standing After Lujan? Of Citizen Suits, “Injuries,” and Article III, 91 Mich. L. Rev. 163, 179 (1992). See also Maxwell L. Stearns, Standing and Social Choice: Historical Evidence, 144 U. Pa. L. Rev. 309, 370 (1995); Steven L. Winter, The Metaphor of Standing and the Problem of Self-Governance, 40 Stan. L. Rev. 1371, 1374 (1988). In any event, the main issues in the early standing cases concerned public rights, not the vindication of private rights. The seminal cases in the 1920s involved individuals suing for proper administration of the law and basing “standing“—a word that had not yet entered the legal lexicon—on their citizen or taxpayer status alone. See (dismissing a challenge to the ratification process of the Nineteenth Amendment because the plaintiff “ha[d] only the right, possessed by every citizen, to require that the government be administered according to law and the public moneys not be wasted“); (dismissing a challenge to social welfare legislation, brought by a plaintiff who claimed the scheme would increase her tax burden, because the suit would not involve “a judicial controversy,” but would require the Court “to assume a position of authority over the governmental acts of another and coequal department, an authority which plainly we do not possess“).

As the Court imposed limitations on the ability of citizens or taxpayers to sue in the public interest, however, it did not deviate from the common-law rule that one individual could sue another based on the violation of a private right. That remained uncontroversial. See (“[T]he judicial function may be appropriately exercised although the adjudication of the rights of the litigants may not require the award of process or the payment of damages.“). A private legal right was still the sine qua non of justiciability. See (denying standing where there was no invasion of a “legal right,” including “one founded on a statute which confers a privilege“); (holding that an electric company had no standing to challenge the legality of federal loans to competitors because it had not suffered the deprivation of a private legal right).

In 1940s, the Court entered a relatively brief era of broad statutory standing. In a landmark case, , the Supreme Court permitted a radio station to sue to enjoin a Federal Communications Commission order granting a license to a market competitor, even though the station did not have a legal right to the grant or denial of the license, or a common-law right to be free from market competition. See (“[T]he damage consequent on competition . . . will not support a cause of action or a right to sue.“). But Congress had included a provision in the Communications Act permitting judicial review for any person “aggrieved” by an FCC order. See 47 U.S.C. § 402(b). And the Court reasoned that Congress “may have been of opinion that one likely to be financially injured by the issue of a license would be the only person having a sufficient interest to bring to the attention of the appellate court errors of law in the action of the Commission in granting the license.” . In , the Court read as permitting private litigants to stand in court, “only as representatives of the public interest.” See also (describing as holding that the Constitution allows Congress to “empower[ ] any person, official or not, to institute a proceeding involving such a controversy, even if the sole purpose is to vindicate the public interest,” and coining the phrase “private Attorney Generals“), vacated, .

The Court‘s expansion of statutory standing to so-called private attorneys general in the / era of course did not prevent individuals from suing on private rights alone. To the contrary, the Court‘s substantial deference to Congress and its ability to create standing by statute would have supported standing in the case before us. The FACTA, in addition to creating a private right for cardholders to receive truncated receipts, includes a cause-of-action provision. See 15 U.S.C. § 1681n(a) (“Any person who willfully fails to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer.“).8

2

As Justice Thomas observed in his concurrence in , the Court‘s recent decisions have “not required a plaintiff to assert an actual injury beyond the violation of his personal legal rights to satisfy the ‘injury-in-fact’ requirement.” (Thomas, J., concurring). That is, even while the Court has assumed that injury in fact is a universal requirement, it has not, in practice, denied standing to plaintiffs who allege invasions of private rights.

Injury in fact traces back to , a case in which the Court first shifted from a rights-based to an injury-based standing framework. In 1946, Congress had enacted the Administrative Procedure Act, which created statutory review for any person “adversely affected or aggrieved by agency action.” 5 U.S.C. § 702. The Court in held that whether a plaintiff possessed any legal right regarding the agency action went to the merits of his claim, and that the plaintiff only needed to allege an “injury in fact, economic or otherwise” in order to sue under the APA. See . This was a novel interpretation of the APA at the time, and the Court‘s first use of the term “injury in fact” in the standing context. See Scalia, The Doctrine of Standing, 17 Suffolk U. L. Rev. at 888; Magill, Standing for the Public, 95 Va. L. Rev. at 1160-63.

We now think of the injury-in-fact requirement as an obstacle for plaintiffs. But the Court at the time intended to “broaden[ ] access to federal courts” for plaintiffs to sue the government. See . See also (explaining that the Court intended to “expand[ ] the types of ‘personal stake(s)’ which are capable of conferring standing on a potential plaintiff“). Therefore, even if Congress had not created a personal legal right in an agency decision or action, a plaintiff could still obtain judicial review by demonstrating some harm, which the Court defined broadly as including economic, aesthetic, conservational, recreational, and spiritual interests. See . This was perhaps the culmination of the Warren Court‘s loosening of standing restrictions, a trend that had begun in the 1940s with . See, e.g., (granting standing to a taxpayer seeking to enjoin government expenditures allegedly in violation of the Establishment Clause).

Throughout the 1970s and 1980s, however, the Burger Court pulled back on the previously liberalized standing doctrine. Justice Powell had expressed concern particularly with taxpayer lawsuits, which he thought corresponded to “the expansion of judicial power” and “a remarkably illogical system of judicial supervision of the coordinate branches of the Federal Government.” (Powell, J., concurring). And his separation-of-powers theory of standing eventually carried the day. But instead of returning to a rights-based model, the Court stuck with injury in fact. At the same time, it narrowed the universe of cognizable injuries and imposed causation and redressability requirements, thereby making the threshold obstacle of much more difficult to surpass. See Hessick, Standing, Injury in Fact, and Private Rights, 93 Cornell L. Rev. at 297 (arguing that had created a “quasi-public model of standing,” but that the Court implicitly returned to a private rights model by narrowing the category of acceptable injuries to those that were “actual,” “distinct,” “palpable,” and “concrete,” rather than merely “abstract“) (quoting ).

But again, the important cases in this era arose in the public law context. They involved plaintiffs asserting (often generalized) grievances about alleged government misconduct. See, e.g., (denying standing in a lawsuit to prevent another prisoner‘s execution based on “the public interest protections of the Eighth Amendment“); (denying standing to taxpayers seeking to enjoin the transfer of federal property to a religious organization); (dismissing a taxpayer suit challenging the government‘s failure to disclose CIA expenditures); (dismissing a taxpayer lawsuit seeking to prevent members of Congress from serving in the Armed Forces Reserve).

In the private rights context, the Court continued to maintain that “Congress may enact statutes creating legal rights, the invasion of which creates standing, even though no injury would exist without the statute.” . See also (“The Illinois Legislature has the power to create new interests, the invasion of which may confer standing.“); (recognizing “Congress’ power to create new interests the invasion of which will confer standing“).

In , for example, the Supreme Court held that “tester” plaintiffs had standing to sue under the Fair Housing Act, even though they did not intend to purchase homes and therefore did not experience any injury in fact from the FHA violation. The FHA created private rights, imposing duties upon private parties to act a certain way toward others. It made it unlawful for any individual or firm covered by the statute “[t]o represent to any person because of race, color, religion, sex, or national origin that any dwelling is not available for inspection, sale, or rental when such dwelling is in fact so available,” or “[t]o discriminate against any person in the terms, conditions, or privileges of sale or rental of a dwelling, or in the provision of services or facilities in connection therewith, because of race, color, religion, sex, or national origin.” 42 U.S.C. § 3604(b), (d) (emphases added). Individuals therefore had private rights corresponding to the duties imposed upon realtors, and the plaintiffs were able to sue without showing damage. See . Accord .9

3

One of the most important cases in the modern era is , in which the Court denied standing to environmental plaintiffs challenging an Interior Department rule allegedly promulgated in violation of the Endangered Species Act. See . The Court reiterated and cemented the tripartite Article III test of injury in fact, causation, and redressability that had developed since . It held that the plaintiffs did not assert a sufficiently imminent injury, or one that was redressable by a favorable decision against the government. See .

More significant was the Court‘s holding the plaintiffs’ alleged “procedural injury” under a citizen-suit provision of the Endangered Species Act was insufficient under Article III. See . The question for our purposes is whether this holding rejected the rule—which dated back to the common law and early American cases like —that Congress could fashion private legal rights, the invasion of which created standing.

did not repudiate this rule, simply because the ESA provision at issue did not create private legal rights, unlike, for example, the FHA. The citizen-suit provision in the ESA created a cause of action for “any person” to sue for violations of “this chapter.” See (quoting 16 U.S.C. § 1540(g)). But the actual provision at issue—the one that the Secretary of the Interior allegedly violated—required agencies to consult with one another on certain decisions. See (quoting 16 U.S.C. § 1536(a)(2)). It did not direct the agency, for example, to provide information, funds, or benefits to designated individuals. Nor did it “obviously prohibit[ ]” certain government conduct “for the protection of a particular party.” 1 Sedgwick, Measure of Damages, at 661. The duty of consultation, in other words, did not create a corollary private right “belonging to individuals, considered as individuals.” (Thomas, J., concurring) (quoting 3 Blackstone, Commentaries *2). The government‘s compliance with the consultation provision was a public duty “owed ‘to the whole community, considered as a community, in its social aggregate capacity.‘” (quoting 4 Blackstone, Commentaries *5). As the majority in pointed out, “[t]his is not a case where plaintiffs are seeking to enforce a procedural requirement the disregard of which could impair a separate concrete interest of theirs“; the plaintiffs sought to enforce the right of “all persons . . . to have the Executive observe the procedures required by law.” . In this way, the Court was channeling the observations of in the 1920s.

can therefore be seen as limited to the public rights context. And it can be read as holding that, while Congress can create private rights (as it always has), it cannot convert a public interest into a private right merely by including a citizen-suit provision. To do so would allow Congress to “transfer from the President to the courts the Chief Executive‘s most important constitutional duty, to ‘take Care that the Laws be faithfully executed.‘” (quoting U.S. Const. Art. II, § 3). “It would enable the courts, with the permission of Congress, to assume a position of authority over the governmental acts of another and co-equal department, and to become virtually continuing monitors of the wisdom and soundness of Executive action.” (internal quotation marks and citations omitted). But nothing in the opinion suggests that these separation-of-powers concerns would arise when Congress created a private right that a plaintiff sought to vindicate against a private defendant.

Notably, the major cases since that have denied standing based on insufficient injury in fact have also done so in the public rights context. See, e.g., (denying standing to plaintiffs seeking a declaration that § 702 of the Foreign Intelligence Surveillance Act of 1978 is unconstitutional); (dismissing a taxpayer suit under the Establishment Clause); (denying standing to an environmental group that sought to enjoin enforcement of regulations that “exempt[ed] small fire-rehabilitation and timber-salvage projects from the notice, comment, and appeal process used by the Forest Service“); (dismissing a taxpayer suit under the Establishment Clause). I have not found a contemporary Supreme Court case in which a plaintiff had a private statutory right but was denied standing.10

4

At this point, I pause to examine and explain why it does not conflict with the public-private rights framework. For starters, the Court in did not issue a direct holding as to whether the plaintiff there had standing; it reversed the Ninth Circuit for failing to consider separately the “concreteness” requirement under the Court‘s test for an Article III injury, and remanded for a new determination of standing. See .

Moreover, nothing that the Court said was inconsistent with the public-private rights model. The Court advised the Ninth Circuit that the plaintiff could not obtain standing based on a “bare procedural violation” divorced from factual injury. See . But it also acknowledged Congress could still “elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.” (quoting ). Not surprisingly, courts have struggled to reconcile these two apparently conflicting statements. See, e.g., (“It‘s difficult, we recognize, to identify the line between what Congress may, and may not, do in creating an ‘injury in fact.‘“). But the two statements make more cohesive sense when considered through a rights-based lens.

Recall that the Court in had suggested that a procedural requirement in a statute could protect individuals (i.e., create private rights), rather than protect the public at large. See . But the plaintiffs in had not argued that the “consultation” provision protected them individually. They argued that the citizen-suit provisions, which applied to “all persons,” vested in them a procedural right. See . In other words, they attempted to read the cause of action into the substantive provision in order to manufacture a “procedural” right that belonged to them individually. The Court rejected that theory. Because the substantive provision imposed a public duty upon the agency to consult with other agencies, Congress could not turn that public duty into a private right through a citizen-suit provision. A “bare” procedural violation, in other words, was the violation of a public duty, without any additional, particularized harm to the individual. A bare procedural violation was not the same thing as an invasion of a private right.

In that way, —although not entirely clear on its face—may be in line with . Just as Congress cannot confer blanket standing on “all persons” to oversee the Department of the Interior‘s duty to comply with the consultation provision, it cannot delegate to the public what would otherwise be executive authority to enforce general regulatory obligations of covered, third-party entities. The decision to bring enforcement actions has traditionally been “committed to agency discretion by law.” 5 U.S.C. § 701(a)(2). See also . A plaintiff therefore has standing only if the procedural duty was “obviously intended” to protect the particular plaintiff (i.e., created a private right that he may vindicate), or if the procedural violation created a public duty but also harmed the plaintiff in some concrete and particularized manner as distinct from the general public (i.e., caused an “injury-in-fact“).11

The difficulty in was that the statute at issue, the FCRA, creates a web of regulatory obligations which arguably confer both private and public rights. For example, § 1681e(b) requires reporting agencies to “follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.” This provision, Justice Thomas pointed out, seems to create private rights for the individual qua individual. See (Thomas, J., concurring). But the plaintiff in alleged violations of other FCRA provisions, such as one requiring reporting agencies to post toll-free numbers on their website. See (majority opinion) (citing § 1681j(c)(i)). See also First Amended Complaint, (alleging that the defendant “failed to post a toll-free telephone number on its website through which consumers can request free annual file disclosures“). At oral argument, Justice Scalia expressed concern that citizens could have roving standing to sue for violations of the defendant‘s regulatory obligations. See Oral Argument Tr., Spokeo, Inc., v. Robins, No. 13-1339, at 26-27, 43 (Nov. 2, 2015). This makes sense under : a plaintiff should not be able to pursue violations of an entity‘s procedural duties (notwithstanding the FCRA cause of action provision), unless (1) the procedural duty protected particular individuals like the plaintiff, or (2) the violation was not “bare” and caused some additional and unique harm to the plaintiff. It is otherwise the executive branch‘s role and duty to investigate and enforce violations of general regulatory obligations. See .

The Court in did not, in the end, untangle the statutory web of the FCRA, and it remanded for further proceedings in the circuit court. But we are faced with a much easier case here. The FACTA imposes a duty upon Godiva to truncate the credit card numbers in its receipts, a duty clearly intended to protect individual cardholders, like Dr. Muransky, who purchase goods from its stores. Dr. Muransky alleged that Godiva did not provide him with a truncated receipt and therefore violated his private statutory right. That allegation alone suffices for standing.12

C

If the common-law tradition and contemporary Supreme Court cases are not sufficiently convincing, then consider the characteristics of an Article III “Case or Controversy” that justiciability doctrines aim to ensure.

First, there is adverseness—that the parties “face each other in an adversary proceeding” and that their dispute “relates to legal rights and obligations[.]” . There must be an “honest and actual antagonistic assertion of rights” by one individual against another, which is neither “feigned” nor “collusive.” See (quoting ). See also . “Concrete adverseness . . . sharpens the presentation of issues upon which the court so largely depends[.]” (internal quotation marks omitted).

Second, a court must not issue an “advisory opinion“—it must issue a “decree of a conclusive character, as distinguished from an opinion advising what the law would be upon a hypothetical state of facts.” . See also 2 The Records of the Federal Convention of 1787, at 341 (M. Farrand ed. 1966) (hereinafter “Farrand“) (describing the failed proposal at the Convention that would have given Congress and the Executive the “authority to require the opinions of the supreme Judicial Court upon important questions of law, and upon solemn occasions“); 3 Correspondence and Public Papers of John Jay 486-89 (H. Johnston ed. 1891) (relating that the Justices of the Supreme Court refused to offer an opinion requested by the President and Secretary of State regarding foreign treaties, as such advice would be “extra-judicial[ ]“). The final judgment should not be subject to review or revision by another branch of government. See . See also (opinion of Wilson and Blair, JJ., and Peters, D.J.) (“[R]evision and control” of an Article III judgment by the legislature or executive officer is “radically inconsistent with the independence of that judicial power which is vested in the courts“).

Third, federal courts have traditionally avoided difficult political questions. These include the validity of a foreign treaty or the lawful authority of a state government. See (Iredell, J., concurring) (explaining that to declare a foreign treaty void would turn on “considerations of policy, considerations of extreme magnitude, [which are] certainly entirely incompetent to the examination and decision of a Court of Justice“); (“Congress must necessarily decide what government is established in the State before it can determine whether it is republican or not. . . . And its decision is binding on every other department of the government, and could not be questioned in a judicial tribunal.“). See also (explaining that there are “peculiarly irksome” and “delicate” “[q]uestions, in their nature political” that should not be resolved by federal courts).13

Not even one of these concerns is present here. Dr. Muransky faces Godiva as an adversary, hoping to vindicate the invasion of his private legal rights. The use of “judicial power” to find the existence of a statutory right and violation, and then to provide a remedy by awarding statutory damages, would not require the court to issue an advisory opinion or tackle a political question.14

For example, compare Dr. Muransky‘s claim to that of the plaintiff in , who, as I mentioned above, alleged that a vendor printed a receipt with all 16 digits of her credit card number and the expiration date. See . The D.C. Circuit found standing based on the allegations in the plaintiff‘s complaint because that was the “nightmare scenario” the FACTA was intended to prevent. See . The majority here appears to accept as correctly decided but distinguishes it as having a different “factual scenario.” Although the plaintiff in perhaps faced a higher risk of identity theft, how could that difference be of constitutional magnitude? The defendants in both cases violated the express terms of a statute, which were intended to protect the plaintiffs in the same way. In terms of adverseness, style of proceedings, type of judicial decision-making, and remedy, the two cases are entirely indistinguishable.

The attempt to distinguish these two cases is in a way an “extra-judicial” act, insofar as a court must draw lines beyond those already drawn by Congress. See (explaining that the threshold standing requirement “ensures that we act as judges, and do not engage in policymaking properly left to elected representatives“). The majority here in effect amends the FACTA by denying its protections to a subgroup of plaintiffs—those who received receipts displaying ten digits of a credit card number. Presumably the FACTA still works for plaintiffs like the one in , whose receipts included all 16 digits, and maybe even for other subgroups of plaintiffs whose receipts display 11 or more digits. But at the end of the day, there is no constitutional principle—whether based on text, structure, or history—that can provide a manageable rule of decision for distinguishing between any two cases involving explicit FACTA violations. Cf. William Baude, Standing in the Shadow of Congress, 2016 Sup. Ct. Rev. 197, 224 (arguing that the Supreme Court‘s “so far unsuccessful quest to define the limits of statutory standing is reminiscent of the path of another doctrine—that of substantive due process“).

Consider how much damage the majority‘s decision does to the actual text of Article III, which limits the “judicial Power” to “Cases or Controversies.” If anything, those terms import a qualitative notion about justiciability. See 2 Farrand, at 430-32 (noting James Madison‘s concern that the judicial power should extend only “to cases of a Judiciary Nature“); (Marshall, C.J.) (describing cases and controversies as taking on a certain “form that the judicial power is capable of acting on“). The words do not and cannot have any inherent quantitative parameters. One would not think of a lawsuit alleging battery as being any more or less of a “case” than another lawsuit alleging battery, simply based on the extent of the plaintiff‘s injuries or the amount of damages awarded.

The same is true for threatened injuries caused by violations of private rights. In my view, there is no textual basis in Article III to distinguish between two plaintiffs who experience a violation of the same statutory private right, even though one might face a more imminent factual injury than the other as a result of the violation. One, both, or neither of the two plaintiffs could eventually suffer the harm that Congress sought to prevent; but the plaintiffs’ use of the courts to vindicate their legal rights would be identical in character. There would be an assessment of the legal right, a finding that it had been violated, and an imposition of a corresponding remedy. This would be a typical case—the “regular course of judicial procedure.” . It is not only unnecessary to superimpose an injury-in-fact inquiry at the threshold of such a private rights dispute, but, as we have seen, it turns Article III upside down.

I leave for another day the scope and role of injury in fact in public rights litigation, which is part of an ongoing and important debate. But suffice it to say that an injury in fact is not required for a private rights dispute, and Dr. Muransky should have standing here.

D

There has been profound confusion about current standing doctrine. See, e.g., Robert J. Pushaw, Jr., Justiciability and Separation of Powers: A Neo-Federalist Approach, 81 Cornell L. Rev. 393, 480 (1996) (describing the doctrine as “theoretically incoherent“); Cass R. Sunstein, Standing and the Privatization of Public Law, 88 Colum. L. Rev. 1432, 1458 (1988) (calling standing “manipulable” and permeated with “doctrinal confusion“). This has only gotten worse since , as courts have been asked to address standing under complex data and consumer privacy statutes. See, e.g. (summarizing a circuit split with respect to threatened injuries in data privacy and security breach cases); Note, Cyberlaw—Data Breach Litigation, 133 Harv. L. Rev. 1095, 1095, 1101 (2020) (describing a “pattern of lower courts struggling to reconcile Supreme Court guidance with a theory of future injury” and a “pattern of lower court confusion over how Clapper and Spokeo apply to data breaches“). Time will tell whether the Supreme Court will step in to sort out the doctrinal incoherence. See Bradford C. Mank, Data Breaches, Identity Theft, and Article III Standing: Will the Supreme Court Resolve the Split in the Circuits?, 92 Notre Dame L. Rev. 1323, 1324 (2017).

In the meantime, Justice Thomas’ concurrence in provides some much-needed clarity in this area. His “framework,” to be sure, is not a new concept, but merely an explanation of something that has been true since the common law and which has persisted in contemporary standing jurisprudence: public rights and private rights are treated differently for purposes of Article III justiciability.15

Because “the requirements of standing turn on whether the plaintiff seeks to vindicate a private or public right, the first step in any standing case is to classify the asserted right.” (Thapar, J., concurring) (emphasis added). The majority here fails to take that initial step, however, and blindly applies the injury-in-fact requirement where it is not needed. That is not all the majority‘s fault. As I have explained, the Supreme Court has frequently, but incautiously, identified factual injury as part of an “irreducible constitutional minimum,” and so naturally the majority would think to apply it in any case where standing is at issue. But a closer look at the Court‘s decisions shows that this is not quite right. At most, an injury in fact is only necessary when the plaintiff purports to stand on and vindicate public rights.

The rights-based framework may not immediately resolve all of the difficult questions in the public litigation context. See (noting that “a lawsuit seeking to vindicate a public right presents a harder question” with respect to standing). But at least it gives us a starting point, and reminds us that an injury is not a requirement for its own sake, but is instead a way for a plaintiff to distinguish himself from the public at large and to demonstrate that he seeks to vindicate his own particularized rights or injuries. Where a statute creates a private right, on the other hand, the injury-in-fact inquiry serves little or no purpose. It does not preserve any of the traditional characteristics of a “Case or Controversy,” which are already present simply because the plaintiff is seeking to vindicate personal legal rights that the defendant violated. With that basic understanding in mind, we should have a much easier time navigating complex data and consumer privacy statutes, many of which, like the FACTA, create straightforward private rights.

I close by acknowledging that I am not the first to express interest in refocusing standing doctrine based on Justice Thomas’ concurrence in . Justice Gorsuch recently signed onto an opinion applying the rights-based rubric. See (Thomas, J., concurring). And several other judges and commentators have cited to, applied, or endorsed it. See (applying Justice Thomas’ “rubric” in the alternative for claims under the Biometric Information Privacy Act, and having “no trouble concluding that [the plaintiff] was asserting a violation of her own rights [which was] enough to show injury-in-fact without further tangible consequences“); (“The theory deserves further consideration at some point. It seems to respect history and cuts a path in otherwise forbidding terrain.“); (Thapar, J., concurring) (“Since the founding, a lawsuit seeking to vindicate an individual‘s private rights has counted as a case or controversy for purposes of Article III.“); (citing Justice Thomas’ concurrence and noting that the plaintiff‘s claim “clearly implicates, at least in some way, [his] concrete interests in truthful credit reporting“); (“Justice Thomas‘s concurring opinion in Spokeo offers a reasonable (to me, at least) resolution to the confusion of modern standing doctrine.“); Baude, Standing in the Shadow of Congress, 2016 Sup. Ct. Rev. at 229 (explaining that the public-private rights framework “may need to be articulated more fully in the future,” but concluding that it is more realistic and workable than other post- attempts to define a “platonic class of real injuries“). Hopefully, I also won‘t be the last.

III

Dr. Muransky has standing to assert Godiva‘s violation of the FACTA. But even if I am mistaken on this point, we should remand to give him an opportunity to satisfy the majority‘s newly articulated Article III standard. With respect, I dissent.

Notes

1
We note that the burden of establishing these elements of standing continues—and, in fact, increases—all the way through the litigation. . The elements need to be supported “with the manner and degree of evidence required at the successive stages of the litigation“—though what that means at the class settlement stage has been the subject of some debate. Because Muransky has not offered any allegations beyond those in his complaint, and because we can resolve the case on the basis of his deficient pleadings, we do not need to wrestle with that question here. The majority says that Muransky must “clearly and specifically” allege facts to survive a standing analysis at the pleading stage. Majority Op. at 11. But that view neglects ‘s statement that, “[a]t the pleading stage, general factual allegations of injury” can suffice, “for on a motion to dismiss we presume that general allegations embrace those specific facts that are necessary to support the claim.” (alteration accepted) (internal quotation mark omitted). True, Muransky must provide specific facts when pressed at summary judgment. But when we scan his standing based on just his complaint, we presume that his general factual allegations contain the specific facts he needs. The majority reads the Clarification Act to imply that the FACTA violation alleged here was not concrete, because of its acknowledgment that some FACTA claims do not cause “actual harm.” Maj. Op. at 28. To the contrary, the fact that the Clarification Act left the digit truncation requirement in place while granting amnesty for violations of the expiration date requirement indicates that Congress continued to view the former as a category of FACTA violations that cause “actual harm.” Clarification Act § 2(b). In 2016, the Eighth Circuit, in a case involving the Cable Communications Policy Act, concluded that had abrogated its decision in . See . In light of the public-private rights framework that I discuss below, I do not believe that is correct. In any event, was decided more than a year after Dr. Muransky filed his complaint.
2
Our dissenting colleague‘s long discussion of the public-private rights theory is interesting to consider as a matter of first principles. See Jordan Dissent at 115–47. But it is also irrelevant to the work that we have to do as an inferior court in this appeal. That work is to apply the binding caselaw of the Supreme Court, which does not currently endorse the theory pressed by our colleague. I agree with the majority that the distinction between “substantive” and “procedural” rights is semantical. The question is simply whether the violation harmed (or created a material risk of harm to) a concrete interest. See (“[W]hether the right is characterized as ‘substantive’ or ‘procedural,’ its violation must be accompanied by an injury-in-fact. . . . That is one of the lessons of Spokeo.“). Sometimes that happens innately—the violation always harms an underlying concrete interest. See (holding that when “every” statutory violation “offends the interests that the statute protects,” plaintiffs need not allege more harm to establish standing); see also (holding that a violation of a statute establishing “an enforceable right to truthful information [about] the availability of housing” was such a statute, since the violation always harmed the concrete interest in truthful information). But that is not always the case, and thus we must decide for ourselves whether a violation harmed a concrete interest. The majority notes, in passing, that there is “good reason to doubt” that Congress‘s judgment supports a finding of materiality because Congress did not “specifically address the kind of partial truncation that occurred in this case.” Maj. Op. at 28 (citing ). What Congress said was that proper truncation—i.e., revealing no more than the last five digits of a card—prevents the risk of identity theft, and Dr. Muransky‘s receipt revealed more than the last five digits. See Clarification Act § 2(a)(6). That Congress did not separately address every possible fact scenario that could constitute a violation of the truncation requirement does not dilute its judgment supporting a finding of concreteness here. For the reasons I explained in my panel concurrence, see (Jordan, J., concurring), I continue to doubt that Mr. Isaacson has standing on appeal to litigate for an outright dismissal of the case based on lack of subject-matter jurisdiction. Although we have an independent duty to ensure our jurisdiction and that of the district court, Mr. Isaacson decided not to opt out of the class and, rather than use the appeal to fine-tune the settlement in his favor, he is now attempting to wipe out the settlement entirely, even though it benefits him.

The fact that Mr. Isaacson omitted any mention of Article III standing in his written objections to the settlement or in his other papers, all of which he filed several months after , makes me further question the propriety of his litigation strategy. Mr. Isaacson makes 52-pages-worth of very specific arguments about Article III, , and the FACTA in his initial brief, but he did not make a single one of these points in his objections to the class settlement and waited until the fairness hearing to raise only abstract concerns about standing. So either Mr. Isaacson is attempting to sandbag Dr. Muransky by waiting until appeal to articulate his arguments—in which case we should remand, if only to discourage such tactics—or he genuinely did not believe that his arguments were winners at the time given the legal landscape—in which case we should also remand because, just as Mr. Isaacson would have had no reason to raise the arguments, Dr. Muransky would have had no reason to anticipate them.

3
We will confess that we find ourselves somewhat perplexed by our dissenting colleague‘s repeated assertions that we believe only identity theft can cause injury under FACTA. See Wilson Dissent at 36, 42–43, 47. Both identity theft and a material risk of identity theft plainly qualify as injuries under that statute and under this opinion. Nor do we see how interpreting the interest protected by FACTA as avoidance of “risk of identity theft” moves the ball. To begin, this opinion makes clear that anyone who properly pleads a material risk of identity theft would have standing. Second, if the harm the statute protects against is “risk of identity theft” rather than “identity theft,” that would mean that we would need to consider whether a statutory violation led to a material risk of a risk of identity theft. We fail to see how that word-soup analysis would help plaintiffs in any event—either they suffer a material risk of harm or they do not. The majority assumes that the breach-of-confidence tort is old enough to serve as a historical analog. I do the same and note that there is good cause for that assumption. See (discussing the breach-of-confidence tort). Perhaps cognizant that this record is bereft of any factfinding on whether the risk posed by Godiva‘s FACTA violation is sufficiently material, Mr. Isaacson sought to fill this gap in two ways. First, he argues on appeal that the first six digits of a card number equates to printing the name of the card‘s issuing institution. But just as a plaintiff cannot raise “[l]ate-breaking allegations in unsworn briefs” to shore up standing, Maj. Op. at 30, neither can a defendant raise factual contentions in an unsworn brief to disprove standing. And Mr. Isaacson‘s brief presents the only factual offering in this record about what these digits stand for. Second, Mr. Isaacson asks us to rely on opinions by our sister circuits recognizing that the first six digits of a card number identifies the issuing institution. Br. of Appellant Isaacson at 3 (citing (observing that the district court found on a factual challenge to standing that printing the first six digits of a credit card number poses no risk of identity theft)). Mr. Isaacson effectively asks us to take judicial notice of facts found in another court‘s opinion. This we may not do. See (“Judicial notice of another court‘s opinion takes notice of the existence of the opinion, which is not subject to reasonable dispute over its authenticity, but not of the facts summarized in the opinion.” (quotation marks omitted)). The Ninth Circuit on remand concluded that the plaintiff alleged a concrete injury. See .
4
Muransky, we note, does not offer this factual assertion to show that he has or can plead an elevated risk of identity theft, but as support for his argument that we should defer to Congress‘s judgment of risk. The majority is thus wrong to say that Muransky alleged a “pure statutory violation.” Majority Op. at 2. If that were so, he would not have alleged another fact—that Godiva‘s FACTA violation raised his risk of identity theft. He would have instead said that Godiva printed the receipt, violating FACTA—period. Because he alleged additional facts, we must take him at his word that he suffered additional harm. Dr. Muransky argues for the first time on appeal that he suffered an injury because, as a result of Godiva‘s FACTA violation, he was forced to safeguard his receipt to keep it from falling into the hands of identity thieves. Br. of Appellee Muransky at 39-42. I agree with the majority that Dr. Muransky cannot raise this new theory of standing at this late stage. Maj. Op. at 23 (citing ). I also agree with the majority that the viability of Dr. Muransky‘s safeguarding theory is in any event bound up in whether he faced a material risk of harm. However, because I would hold that Dr. Muransky did face a material risk of identity theft stemming from Godiva‘s FACTA violation, I would also hold that Dr. Muransky could have proceeded on his safeguarding theory had he raised it in his complaint. Several of our own cases—including some decided after —make the same point. See (explaining that general factual allegations of an Article III injury suffice at the pleading stage because we presume that the general allegations “embrace those specific facts that are necessary to support the claim“) (internal quotation marks omitted). Accord ; ; . But they too appear to mean little to the majority.
5
Contrary to our dissenting colleague‘s assertion, neither we nor our sister circuits have “misread[] FACTA” any more than the Supreme Court misread FCRA when it required the plaintiff in Spokeo to plead something beyond the violation of that statute. Wilson Dissent at 36. We seek only to ensure that the plaintiff has, as he must under the Constitution, an actual controversy rather than a theoretical one. Because Muransky alleges a direct harm, the majority‘s focus on whether Muransky alleged a material risk of identity theft is irrelevant (and for the same reason, I diverge from my dissenting colleague‘s discussion of materiality). See infra at 75-78. Our job when analyzing a direct-harm theory is not to decide whether the violation “materially” harmed the statutory interest; our job is to decide whether the violation “actually harm[ed]” the statutory interest. See . FACTA protects Muransky‘s concrete interest in using his card “without incurring an increased risk of identity theft,” see , and Muransky claimed that he suffered an increased risk at the point of sale. That is an alleged actual harm, not an alleged material risk of actual harm, so materiality plays no role. The only question is whether he has alleged enough facts to plausibly establish direct harm at the pleading stage. As the majority points out, Maj. Op. at 25, the parties dispute whether a breach of confidence tort was “traditionally . . . regarded as providing a basis for a lawsuit in English or American courts.” . Dr. Muransky notes that English courts recognized the tort as early as 1849, see , while American courts recognized the tort as early as 1894, see . Mr. Isaacson, meanwhile, cites an article that (a) described the tort as “emerging” as of 1982; and (b) described the tort as “dy[ing] out in its infancy” in the United States, while forming the “basis of an extensive body of law” in England. Vickery, 82 Colum. L. Rev. at 1452-54. I believe Dr. Muransky has the better of this argument. The fact that a tort did not gain prominence in the United States until the 1980s does not mean it was not traditionally regarded as providing a basis for suit. And Mr. Isaacson has failed to cite a single court decision refusing to recognize a breach of confidence tort as actionable. The Supreme Court may have thought that it was helping courts apply by allowing them to use their common sense at the pleading stage. See . But this case demonstrates that judicial common sense has its own problems. See, e.g., David L. Noll, The Indeterminacy of Iqbal, 99 Geo. L.J. 117, 138 (2010) (“If judicial experience and common sense constitutes a license to rely on broad new categories of extrinsic information at a motion to dismiss, the critics’ fears that motion to dismiss practice will be unduly influenced by individual judges’ differing views of life, the universe, and everything may be warranted.“) (internal quotation marks and citation omitted); Ion Meyn, The Haves of Procedure, 60 Wm. & Mary L. Rev. 1765, 1806 (2019) (” instructs a judge to rely on her experience and common sense in determining plausibility, inviting judicial bias to inform whether a case remains on the docket.“); Access to Justice Denied: Ashcroft v. Iqbal: Hearing Before the Subcomm. on the Constitution, Civil Rights, and Civil Liberties of the H. Comm. on the Judiciary, 111th Cong. 17 (2009) (statement of Arthur Miller, Professor, New York University School of Law) (“The subjectivity at the heart of - raises the concern that rulings on motions to dismiss may turn on individual ideology regarding the underlying substantive law, attitudes toward private enforcement of federal statutes, and resort to extra-pleading matters hitherto far beyond the scope of a Rule 12(b)(6) motion to dismiss.“).
6
Assuming that it is correct in saying that the risk of identity theft is remote, the majority fails to consider how damaging and costly identity theft can be to a victim. It is not unreasonable to imagine losses in the hundreds or thousands of dollars, factoring in the value of lost time, attorneys’ fees, and actual monetary loss. Even a 1 in 100 chance of that event occurring—i.e., a remote risk—is still “substantial” because it could lead to a significant mathematical loss. See Jonathan Remy Nash, Standing‘s Expected Value, 111 Mich. L. Rev. 1283, 1297–98 (2013). See also (concluding that a plaintiff organization had standing to challenge an EPA rule: “The lifetime risk that an individual will develop nonfatal skin cancer as a result of EPA‘s rule is about 1 in 200,000 . . . Even if a quantitative approach is appropriate—an issue on which we express no opinion—this risk is sufficient to support standing.“). This is why people spend money, lots of it, to protect against identity theft.

Of course, Dr. Muransky does not need to allege a hypothetical loss amount, as there is no way for him to predict how much he would or could lose or spend due to identity theft. But if the majority is going to rely on its non-empirical intuition to determine the materiality of threatened injuries, it ought to incorporate other reasonable assumptions about the financial and psychological magnitude of those threatened injuries.

7
In a number of cases, the Supreme Court has relied on and deferred to congressional findings with respect to the harms caused by certain conduct. See (“We owe Congress’ findings an additional measure of deference out of respect for its authority to exercise the legislative power. Even in the realm of First Amendment questions where Congress must base its conclusions upon substantial evidence, deference must be accorded to its findings as to the harm to be avoided and to the remedial measures adopted for that end, lest we infringe on traditional legislative authority to make predictive judgments when enacting nationwide regulatory policy.“); (deferring to congressional findings about the harms to society and the medical profession caused by partial-birth abortion); (deferring to congressional findings regarding discrimination against persons with disabilities in the provision of public services in support of its exercise of power under § 5 of the Fourteenth Amendment). The Court has been especially deferential to congressional fact-finding with regard to complex problems and empirical questions. See (“[W]hen we face a complex problem with many hard questions and few easy answers we do well to pay careful attention to how the other branches of Government have addressed the same problem.“). That cautious deference ought to apply in the standing context as well, particularly when standing is based on empirical questions about data privacy. See (“[W]e must give great weight to this congressional finding in our standing inquiry.“).
8
The Supreme Court eventually interpreted these cases not as giving Congress carte blanche to enlist private attorneys general, but as permitting plaintiffs to make merits arguments in the public interest only after they had established standing based on economic injury. See (“Taken together, Sanders and Scripps-Howard thus established a dual proposition: the fact of economic injury is what gives a person standing to seek judicial review under the statute, but once review is properly invoked, that person may argue the public interest in support of his claim that the agency has failed to comply with its statutory mandate.“). That reading of and effectively ended the era of individual standing as a representative of the public, and presaged the limitation on citizen-suit provisions in cases like . For an interesting study about this era, see Elizabeth Magill, Standing for the Public: A Lost History, 95 Va. L. Rev. 1131 (2009).
9
The Supreme Court has also recognized that Congress can create enforceable private rights vis-à-vis the government. For example, the Freedom of Information Act requires government agencies to provide “any person” with unexempted records if that person requests them. See 5 U.S.C.A. § 552(3)(A). The requester—qua individual—obtains the private right to the information he requested from the government. Fittingly, the Supreme Court‘s “decisions interpreting the Freedom of Information Act have never suggested that those requesting information under it need show more than that they sought and were denied specific agency records.” (collecting cases). See also (citing Public Citizen as the type of case in which a plaintiff “need not allege any additional harm beyond the one Congress has identified“). The same has been true for violations of constitutional rights, which do not require actual damage for vindication. See ; . To be sure, this is a much easier case than the FOIA or § 1983 cases because it does not involve the government as a defendant, but is merely a private dispute between private parties. Cf. (“The distinction between ‘public rights’ against the Government and ‘private rights’ between private parties is well established.“).
10
The majority quotes , for the proposition that a plaintiff does not automatically have standing “whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” But as Justice Thomas pointed out in his concurrence, the provision at issue in that case, a part of the Employee Retirement Income Security Act of 1974, did not create private rights belonging to the plaintiffs; the plaintiffs sought to enforce fiduciary duties under ERISA that were “owed to the plan, not [the plaintiffs].” (Thomas, J., concurring).
11
For this reason, , may be wrongly decided, at least under the public-private rights framework. There, the Court held that voters had standing to challenge the FEC‘s determination that an organization was not a “political committee” as defined by the Federal Election Campaign Act. See . The FECA imposed disclosure requirements upon political committees, and the plaintiffs asked the FEC, first, to find that the organization had violated the FECA and, second, to order the organization to disclose the requisite information. See . The Court rejected the government‘s “prudential standing” argument, as the FECA provided a cause of action for “[a]ny person who believes a violation of the [FECA] . . . has occurred,” and has been “aggrieved” by the violation. See (quoting 2 U.S.C. § 437g(a)(1)). It held that the voters suffered an Article III injury, insofar as they could not obtain information that they needed to evaluate candidates for public office. See .
Viewing this case through the public-private rights lens, the FECA imposed a duty upon the executive branch (1) to determine whether entities were “political committees,” and (2) to enforce the disclosure of information. Under , Congress would not be able to convert that public interest in administration of laws into a private right, lest any citizen be able to compel the executive to enforce the law. Only if the plaintiffs had suffered an injury distinct from that of the general public could they have standing to sue. But , had dismissed for lack of standing a suit in which the plaintiff claimed to have been aggrieved by the government‘s refusal to disclose information to the public.
As a result, may raise separation-of-powers problems. See (Scalia, J., dissenting) (“A system in which the citizenry at large could sue to compel Executive compliance with the law would be a system in which the courts, rather than the President, are given the primary responsibility to ‘take Care that the Laws be faithfully executed.‘“). The case is in that way reminiscent of the bygone era. But, again, the fact that the Court may have improperly expanded standing in does not mean that Dr. Muransky lacks standing here.
12
Viewing through the rights-based lens also leads to the conclusion that Dr. Muransky‘s injury was both “concrete” and “particularized.” The invasion of the private right was concrete—i.e., real, and not abstract—insofar as Godiva engaged in affirmative conduct that explicitly violated Dr. Muransky‘s private right to a truncated receipt. The injury was also particularized because Godiva printed a receipt specifically for Dr. Muransky and that receipt displayed only his unique credit card number.
13
I recognize that the Supreme Court‘s political question checklist, see, e.g., (listing six factors), has been subject to criticism, but that does not eliminate the reality that some matters are inappropriate for judicial resolution.
14
If the majority has some unstated concern that Dr. Muransky is not a sufficiently motivated adversary to represent absent class members due to the unlikelihood of his experiencing identity theft, then that should be dealt with under Rule 23, not Article III. In certifying the class here, the district court found that Dr. Muransky was an adequate class representative. And for Article III purposes, he is undoubtedly an adversary of Godiva‘s. Godiva allegedly invaded his private right, he seeks to vindicate that right, and the two parties do not have aligned interests. There is no suggestion that this is a feigned or collusive suit.
15
The public-private rights distinction is also not unique to standing doctrine. See, e.g., (discussing a category of “public rights,” dating back to , which could be adjudicated outside of the Article III judicial branch).
*
We heard this case en banc while Judge Ed Carnes was an active judge, and he elected to continue to participate in the decision of this case after becoming a senior circuit judge. See Eleventh Circuit Rule 35-9 (“Senior circuit judges of the Eleventh Circuit . . . may continue to participate in the decision of a case that was heard or reheard by the court en banc at a time when such judge was in regular active service.“); see also Gogel v. Kia Motors Mfg. of Ga., Inc., 967 F.3d 1121, 1125 n.** (11th Cir. 2020) (en banc).
**
Judge Rosenbaum and Judge Jill Pryor are recused. Judge Andrew Brasher joined the Court on June 30, 2020, and did not participate in this decision.