In a precedential opinion, the U.S. Court of Appeals for the Third Circuit concluded that because the named plaintiff in a class action complaint failed to allege a concrete injury, he lacked standing under Article III of the U.S. Constitution to bring an action against a retailer for a violation of the Fair and Accurate Credit Transactions Act (FACTA). The plaintiff alleged that the retailer violated the FACTA provision that limits the digits of a credit card number that can be printed on a receipt to no more than the last five. He claimed that the receipts he received from the retailer included the first six digits of his credit card number.

The decision in Kamal v. J. Crew Group, Inc. is the first in which the Third Circuit has found a lack of standing under the framework established by the U.S. Supreme Court in Spokeo, Inc. v. Robbins. Four times previously, the Third Circuit applied Spokeo and found the plaintiff had established standing based on an alleged technical statutory violation.

The decision is welcomed by the consumer finance industry, but is by no means a cure-all—plaintiffs like the one in J Crew Group may be able to sue in state court, where Spokeo doesn't bind standing determinations.

The Spokeo framework, as explained by the Third Circuit, allows a court to find a concrete injury based on a technical violation "if the violation actually harms or presents a material risk of harm to the underlying concrete interest" identified by Congress. A technical statutory violation can constitute concrete injury under Spokeo where the violation has a "close relationship" to a harm that traditionally has been regarded as providing a basis for an action under common law.

Kamal, the named plaintiff in J Crew Group, pleaded two alleged concrete injuries: the failure to truncate sufficient digits in violation of FACTA's plain text, and the resulting increased risk of identity theft. The Third Circuit rejected Kamal's contention that his injury resulting from the FACTA violation was analogous to common law privacy torts and an action for breach of confidence. According to the Third Circuit, the harm underlying both such actions occurs when a third party gains unauthorized access to a plaintiff's personal information. It concluded that Kamal's injury did not have the requisite "close relationship" with such actions because he pled only that he received FACTA non-compliant receipts but did not allege disclosure of his credit card information to a third party.

The Third Circuit then turned to whether the alleged FACTA violation presented a "material risk of harm," having previously noted that it had "not yet had occasion to review standing where a procedural violation allegedly presents a 'material risk of harm,' because, in past cases, the underlying harm had already materialized or failed to materialize." (In its opinion, the Third Circuit reviews its four prior decisions in which, applying Spokeo, it found the plaintiff had established standing based on an alleged technical statutory violation.)

The Third Circuit found Kamal's "conclusory allegations" that the FACTA violation created a real risk of identity theft to be insufficient because he did not "plausibly aver how printing of the six digits presents a material risk of concrete, particularized harm." More specifically, he did not allege "third-party access of his information, nor that the receipt included enough information to likely enable identity theft." The Third Circuit, agreeing with the district court, found that Kamal's description of a potential scenario in which a receipt that he had lost or thrown away was discovered by a third party who then obtained the remaining digits along with additional information needed to use the card, such as the expiration date, was too speculative to constitute a material risk of harm. (The Third Circuit noted that its analysis would be different if Kamal had alleged that the receipts included his full credit card number.)

The district court had dismissed Kamal's second amended complaint with prejudice. While affirming the district court's judgment that Kamal lacked standing, the Third Circuit vacated the district court's order dismissing the case with prejudice and remanded to the district court to dismiss without prejudice. According to the Third Circuit, the district court's lack of jurisdiction required the case to be dismissed without prejudice.

The Third Circuit's application of Spokeo to find a lack of standing is clearly a result welcomed by industry and defense attorneys. At the same time, as we have previously observed, Spokeo standing arguments may not be a silver bullet for defeating class claims where the plaintiff's injury was caused by a "bare procedural violation," such as those under FACTA, the Telephone Consumer Protection Act, or the Fair Credit Reporting Act. A dismissal without prejudice creates the potential for such class claims to be refiled in state court, where judges are not bound by Spokeo in making standing determinations.