In a precedential opinion, the U.S. Court of Appeals for the Third Circuit concluded that a plaintiff in a class action complaint had Article III standing and was properly awarded summary judgment when a debt collector sent her a letter in an envelope that showed a quick response (QR) code that could potentially have revealed her account number in violation of the Fair Debt Collection Practices Act (FDCPA).

If scanned, the QR code on the outside of the envelope would have shown her internal account number with the debt collection agency. The Third Circuit held that the facts established that the plaintiff suffered a concrete injury providing Article III standing and were a basis to affirm the district court’s summary judgment award to the plaintiff on her FDCPA claim.

In DiNaples v. MRS BPO, LLC, the Third Circuit extended the rationale it applied in Douglass v. Convergent Outsourcing, where it held that displaying an account number on an envelope was a violation of the FDCPA sufficient to confer standing. Specifically, the Douglass opinion found that “displaying a consumer’s account number on an envelope was not ‘benign,’” and that such conduct “implicates a core concern animating the FDCPA—the invasion of privacy.” The issue presented in DiNaples, where the QR code necessitates an additional step of scanning to obtain the consumer account information, was specifically left unresolved in Douglass. In DiNaples, the Third Circuit confirmed that the additional step did not alter the analysis for standing purposes and that the QR code on the outside of an envelope also was an FDCPA violation.

Following the U.S. Supreme Court’s guidance in Spokeo, the Third Circuit examined “both history and the judgment of Congress.” Reasoning that the harm of a QR-coded account involved “the invasion of privacy . . . ‘closely related to harm that has traditionally’” been recognized by American courts and that Congress specifically included language in § 1692f(8) of the FDCPA which prohibits use of “any language or symbol other than the debt collector’s address on any envelope when communicating with a consumer,” the Third Circuit held that DiNaples suffered a concrete injury. The appeals court rejected the defendant’s argument that Douglass was distinguishable, both because the QR code required an additional step to access account number information and because the plaintiff failed to show that anyone actually intercepted her mail. In doing so, the Third Circuit noted the ubiquity of smart phones and that the ease of application download meant that anyone could have accessed the embedded account number: “the harm here is still the same [as in Douglass]—the unauthorized disclosure of confidential information.” 

The Third Circuit declined to join sister Circuits in recognizing a “benign language” exception to § 1692f(8) of the FDCPA. While recognizing that the provision, when read literally, would seem to prohibit including the debtor’s address or common markings indicating the type of postage and method of delivery, the Third Circuit held that the QR code was not benign and therefore stated that it did not need to decide if a benign language exception exists. 

The Third Circuit also rejected defendant’s bona fide error defense based on its argument that the use of QR codes is an industry standard. The appeals court cited the language in Jerman v. Carlisle, McNellie, Rini Kramer & Ulrich L.P.A. and held that such defense is only available where there is a clerical or factual mistake, not a misinterpretation of the requirements of the statute.