In a decision issued on June 6, 2017, the United States District Court for the District of New Jersey dismissed, for the second time, a proposed class action alleging that J. Crew violated the Fair and Accurate Credit Transactions Act (FACTA), based on the plaintiff’s failure to allege a concrete injury. Kamal v. J. Crew Grp., Inc., No. 15-0190, 2017 WL 2443062 (D.N.J. June 6, 2016) (Martini, J.). Following its dismissal of the original complaint on October 20, 2016, the court had given the plaintiff latitude to amend his complaint to address this deficiency—which he failed to effectively do.

In his amended complaint, the plaintiff alleged that J. Crew violated § 1681c—which makes it unlawful for a business to print “more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.” 15 U.S.C. § 1681c(g)(1). Specifically, the plaintiff alleged that J. Crew had printed the first six and the last four digits of customer credit and debit cards on sales receipts on three occasions between December 18, 2014 and January 4, 2015.

Judge Martini, without reaching the issue of whether the plaintiff had stated a claim under § 1681c(g), dismissed the Amended Complaint in its entirety on the grounds that the plaintiff’s purported “injuries” of “disclosure of information considered by law to be intrinsically private” and “increased risk of identity theft or credit-card fraud in the future” did not constitute “concrete harm.” Kamal, 2017 WL 2443062, at *3. The court found that the plaintiff failed to establish the requisite injury-in-fact for constitutional standing under Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).

In Spokeo, the Supreme Court clarified that an “injury in fact” must be “concrete,” which means “it must actually exist.” 136 S. Ct. at 1548 (citing Black’s Law Dictionary 479 (9th ed. 2009)). It requires a plaintiff to demonstrate a “concrete injury even in the context of a statutory violation” in order to establish Article III standing. Id. at 1549. Accordingly, a statute containing a statutory right and authorizing suit to vindicate that right does not “automatically satisf[y] the injury-in-fact requirement [of standing].” Id.

Applying Spokeo in conjunction with the recent Third Circuit decision, In re Horizon Healthcare Services Inc. Data Breach Litigation, 846 F.3d 625 (3d Cir. 2017), the court held that the plaintiff did not suffer an injury to his privacy rights because he alleged a “bare procedural violation divorced from any concrete harm” in circumstances “that [did] not implicate traditional common law privacy interest.” Kamal, 2017 WL 2443062, at *3. J. Crew did not disclose or grant unauthorized access to his personal information: the plaintiff simply “gave his credit-card number to J. Crew, which then printed a receipt containing part of that number and handed it back to [Plaintiff].” Id.

The court further held that the plaintiff did not suffer concrete injury as a result of an alleged increased risk of identity theft or credit card fraud. Relying on the fact that credit and debit card numbers are 16 digits long with the first six relating to the bank or card issuer and the last 10 referring to the card holder’s specific account, the court could not reasonably infer that printing the first six and last four digits of a credit card “materially increased the risk of future harm [in the form of potential identity theft or credit-card fraud].” Id. at *4.

Judge Martini’s decision is a promising development for those at risk of “gotcha” litigation. FACTA, like many other consumer protection statutes, creates a private right of action and provides for statutory damages “of not less than $100 and not more than $1,000” for each willful violation even if there has been no harm. 15 U.S.C. § 1681n(a)(1)(A). Pursuit of aggregated statutory damages for innocent transgressions, without a requirement of harm, through the class action device creates powerful leverage for plaintiffs and potentially catastrophic risk for businesses.

The court’s decision, and its application of Spokeo, can serve as a powerful tool for companies embroiled in putative class action lawsuits under FACTA and similar consumer protection statutes.