James X. Bormes v. United States

In the United States Court of Appeals For the Seventh Circuit ____________________   No.  13-­‐‑1602   JAMES  X.  BORMES,   Plaintiff-­‐‑Appellant,   v.   UNITED  STATES  OF  AMERICA,   Defendant-­‐‑Appellee.   ____________________   Appeal  from  the  United  States  District  Court  for  the   Northern  District  of  Illinois,  Eastern  Division.   No.  08  C  7409  —  Charles  R.  Norgle,  Judge.   ____________________   ARGUED  SEPTEMBER  27,  2013  —  DECIDED  JULY  22,  2014   ____________________   Before  WOOD,  Chief  Judge,  and  BAUER  and  EASTERBROOK,   Circuit  Judges.   EASTERBROOK,  Circuit  Judge.  In  an  earlier  stage  of  this  liti-­‐‑ gation,  the  Supreme  Court  held  that  the  Little  Tucker  Act,  28   U.S.C.   §1346(a)(2),   does   not   waive   the   sovereign   immunity   of  the  United  States  in  a  suit  seeking  to  collect  damages  for   an   asserted   violation   of   the   Fair   Credit   Reporting   Act   (FCRA),  15  U.S.C.  §§  1681–1681x.  United  States  v.  Bormes,  133   S.   Ct.   12   (2012).   Although   the   case   reached   the   Supreme   2   No.  13-­‐‑1602   Court  from  the  Federal  Circuit,  the  Supreme  Court  remand-­‐‑ ed  it  to  us,  because  the  suit  originated  in  the  Northern  Dis-­‐‑ trict   of   Illinois.   (The   original   appeal   had   been   routed   to   the   Federal   Circuit   only   because   of   the   Tucker   Act.)   The   Su-­‐‑ preme  Court  told  us  to  decide  “whether  FCRA  itself  waives   the   Federal   Government’s   immunity   to   damages   under   §1681n.”  Id.  at  20.   James  Bormes,  an  attorney,  tendered  the  filing  fee  for  one   of  his  suits  via  pay.gov,  which  the  federal  courts  use  to  facili-­‐‑ tate  electronic  payments.  The  web  site  sent  him  an  email  re-­‐‑ ceipt   that   included   the   last   four   digits   of   his   credit   card’s   number,   plus   the   card’s   expiration   date.   Bormes,   who   be-­‐‑ lieves  that  §1681c(g)(1)  allows  a  receipt  to  contain  one  or  the   other  of  these  things,  but  not  both,  then  filed  this  suit  against   the  United  States  seeking  damages.   Any   “person”   who   willfully   or   negligently   fails   to   com-­‐‑ ply  with  the  Fair  Credit  Reporting  Act  is  liable  for  damages.   15   U.S.C.   §§  1681n(a),   1681o(a).   “Person”   is   a   defined   term:   “any   individual,   partnership,   corporation,   trust,   estate,   co-­‐‑ operative,  association,  government  or  governmental  subdivision   or   agency,   or   other   entity.”   15   U.S.C.   §1681a(b)   (emphasis   added).  The  United  States  is  a  government.  One  would  sup-­‐‑ pose   that   the   end   of   the   inquiry.   By   authorizing   monetary   relief  against  every  kind  of  government,  the  United  States  has   waived  its  sovereign  immunity.  And  so  we  conclude.  (As  far   as  we  can  tell,  this  is  the  first  appellate  decision  on  the  issue.)   The   United   States   maintains   that   the   definition   should   not   be   given   its   natural   meaning.   As   originally   enacted   in   1970,  §1681n  authorized  damages  against  only  consumer  re-­‐‑ porting  agencies  and  users  of  information.  In  1996  Congress   amended  §1681n  to  authorize  damages  against  all  “persons.”   No.  13-­‐‑1602   3   According  to  the  United  States,  none  of  the  legislative  histo-­‐‑ ry   analyzing   or   explaining   this   amendment   discusses   the   fact   that   this   change,   applied   according   to   the   terms   of   §1681a(b),   exposes   the   Treasury   to   monetary   awards.   Be-­‐‑ cause  Congress  in  1996  did  not  evince  knowledge  of  how  the   revised   version   of   §1681n   interacts   with   §1681a(b),   the   ar-­‐‑ gument  concludes,  the  FCRA  does  not  waive  sovereign  im-­‐‑ munity  for  damages  even  though  the  definition  of  “person”   includes  the  United  States.   The   United   States   concedes   that   it   is   a   “person”   for   the   purpose  of  the  Act’s  substantive  requirements.  It  denies  only   that  §1681n  authorizes  damages.  But  if  the  United  States  is  a   “person”  under  §1681a(b)  for  the  purpose  of  duties,  how  can   it   not   be   one   for   the   purpose   of   remedies?   Nothing   in   the   FCRA  allows  the  slightest  basis  for  a  distinction.   The   absence   of   legislative   history   discussing   sovereign   immunity   in   1996   is   hardly   surprising.   Immunity   had   been   waived  in  1970.  Why  bring  the  subject  up  again?  Apparently   no  one  in  the  Executive  Branch  asked  Congress  to  revise  the   definition   in   §1681a(b)   when   changing   the   category   of   enti-­‐‑ ties  for  which  §1681n  authorizes  awards  of  damages.   The   argument   that   a   silent   legislative   history   prevents   giving   the   enacted   text   its   natural   meaning   has   been   made   before—and  it  has  not  fared  well.  Why  should  Congress  have   to   reenact   §1681a(b),   or   repeat   it   in   the   committee   reports,   every  time  it  amends  some  other  portion  of  the  statute?  Sec-­‐‑ tion   1681a(b)   does   what   it   has   done   since   1970,   no   matter   what  happens  to  other  sections,  and  what  §1681a(b)  does  is   waive   sovereign   immunity   for   all   requirements   and   reme-­‐‑ dies  that  another  section  authorizes  against  any  “person.”   4   No.  13-­‐‑1602   Congress   need   not   add   “we   really   mean   it!”   to   make   statutes  effectual.  See,  e.g.,  Swain  v.  Pressley,  430  U.S.  372,  378   &   n.11   (1977);   Harrison   v.   PPG   Industries,   Inc.,   446   U.S.   578,   592   (1980)   (“it   would   be   a   strange   canon   of   statutory   con-­‐‑ struction  that  would  require  Congress  to  state  in  committee   reports   or   elsewhere   in   its   deliberations   that   which   is   obvi-­‐‑ ous  on  the  face  of  a  statute”).  It  takes  unequivocal  language   to   waive   the   national   government’s   sovereign   immunity,   Department  of  Energy  v.  Ohio,  503  U.S.  607,  615  (1992),  but  this   means  unequivocal  language  in  a  statute,  not  in  a  committee   report.   The  FCRA  says  that  courts  may  award  punitive  damages   for   willful   violations.   15   U.S.C.   §1681n(a)(2).   According   to   the  government,  this  shows  that  §1681n  can’t  apply  to  it,  no   matter   what   §1681a(b)   says,   for   there   is   a   tradition   that   the   United  States  is  not  subject  to  punitive  damages.  (The  Feder-­‐‑ al   Tort   Claims   Act,   for   example,   forbids   them.   28   U.S.C.   §2674   ¶1.)   A   tradition   differs   from   a   rule   of   law,   however.   Congress   can   authorize   punitive   awards   against   the   United   States.  If  the  interaction  of  §1681a(b)  and  §1681n(a)(2)  creates   excessive  liability—which  it  won’t  if  federal  officers  obey  the   statute—then  the  solution  is  an  amendment,  not  judicial  re-­‐‑ writing  of  a  pellucid  definitional  clause.  See,  e.g.,  Michigan  v.   Bay  Mills  Indian  Community,  134  S.  Ct.  2024,  2033–34  (2014).   The   government   also   observes   that   three   provisions   of   the   FCRA   expose   “persons”   to   criminal   penalties,   which   in   principle   could   include   state   prosecutions.   15   U.S.C.   §§  1681n,  1681p,  1681s.  The  United  States  expresses  incredu-­‐‑ lity   that   Congress   could   have   authorized   state   prosecutions   of  federal  employees.  But  why  not?  The  idea  that  a  criminal   prosecution  of  a  federal  employee  alleged  to  have  deliberate-­‐‑ No.  13-­‐‑1602   5   ly  violated  a  federal  statute  might  begin  in  state  court  is  not   so  outlandish  that  we  should  read  §1681a(b)  to  mean  some-­‐‑ thing  other  than  what  it  says.  Federal  employees’  protection   is   the   right   to   remove   and   have   the   adjudication   in   federal   court,   see   28   U.S.C.   §1442(a)(1),   not   a   rule   of   construction   that  eliminates  the  possibility  of  prosecution  altogether.   The  United  States  has  one  final  argument  about  the  scope   of  §1681a(b).  It  observes  that  the  definition  treats  states  and   the  national  government  identically.  Its  brief  maintains  that   Congress   lacks   the   authority   to   subject   states   to   damages   through   statutes   enacted   under   the   Commerce   Clause,   see   Seminole  Tribe  v.  Florida,  517  U.S.  44  (1996),  and  asks  us  to  in-­‐‑ fer   that,   since   states   need   not   pay   damages,   the   national   government  need  not  do  so  either.   The   premise   of   this   argument   is   not   entirely   correct.   States  may  not  be  at  risk  of  damages  in  private  litigation,  but   the   United   States   may   enforce   the   FCRA   against   the   states   and  collect  damages.  See  Monaco  v.  Mississippi,  292  U.S.  313,   328–29   (1934)   (collecting   authority).   No   state   has   sovereign   immunity   vis-­‐‑à-­‐‑vis   the   national   government.   And   if   we   are   to   consider   how   §1681a(b)   treats   other   sovereigns,   what   of   foreign   governments,   which   are   “persons”   under   that   stat-­‐‑ ute?   Foreign   governments   that   engage   in   commerce   in   the   United   States   cannot   invoke   immunity   under   the   Foreign   Sovereign   Immunities   Act.   See   generally   Argentina   v.   NML   Capital,   Ltd.,   134   S.   Ct.   2250   (2014).   If   the   definition   in   §1681a(b)   exposes   foreign   nations   to   damages   for   commer-­‐‑ cial  activity,  why  not  the  United  States?   What  is  more,  the  conclusion  of  this  argument  would  not   follow  if  the  premise  had  been  correct.  No  rule  of  law  estab-­‐‑ lishes  that,  if  states  cannot  be  liable,  then  the  United  States  is   6   No.  13-­‐‑1602   not  liable.  The  Religious  Freedom  Restoration  Act  illustrates   the  point.  It  forbids  all  governmental  bodies  to  impose  sub-­‐‑ stantial   burdens   on   religious   exercise,   unless   those   burdens   are   justified   by   a   compelling   governmental   interest.   42   U.S.C.  §2000bb–1.  City  of  Boerne  v.  Flores,  521  U.S.  507  (1997),   holds   that   Congress   lacks   authority   under   §5   of   the   Four-­‐‑ teenth  Amendment  to  subject  states  to  that  substantive  rule.   If   the   argument   the   United   States   makes   here   were   sound,   units  of  local  government  and  the  United  States  today  would   be  free  of  RFRA’s  obligations.  But  since  Boerne  the  Supreme   Court  has  continued  to  apply  the  statute  to  the  United  States.   See,  e.g.,  Burwell  v.  Hobby  Lobby  Stores,  Inc.,  No.  13–354  (U.S.   June  30,  2014);  Gonzales  v.  O  Centro  Espírita  Beneficente  União   do   Vegetal,   546   U.S.   418   (2006).   These   decisions   show   that   federal  statutes  can  apply  to  the  national  government  even  if   principles  of  sovereign  immunity  prevent  awards  of  damag-­‐‑ es   against   the   states.   Congress   can   give   consent   for   itself   even  though  not  for  the  states.   Our   conclusion   that   §1681a(b)   waives   the   United   States’   immunity   from   damages   for   violations   of   the   FCRA   brings   us   to   the   question   whether   Bormes   has   a   good   claim.   The   United  States,  which  prevailed  in  the  district  court  on  a  sov-­‐‑ ereign-­‐‑immunity   defense,   638   F.   Supp.   2d   958   (N.D.   Ill.   2009),  has  asked  us  to  affirm  on  the  merits  if  we  rule  against   it   on   sovereign   immunity.   It   is   entitled   to   make   such   an   ar-­‐‑ gument   in   defense   of   its   judgment   without   the   need   for   a   cross-­‐‑appeal.   Massachusetts   Mutual   Insurance   Co.   v.   Ludwig,   426  U.S.  479  (1976).   Bormes   relies   on   15   U.S.C.   §1681c(g)(1),   which   provides   that   “no   person   that   accepts   credit   cards   or   debit   cards   for   the   transaction   of   business   shall   print   more   than   the   last   5   No.  13-­‐‑1602   7   digits   of   the   card   number   or   the   expiration   date   upon   any   receipt  provided  to  the  cardholder  at  the  point  of  the  sale  or   transaction.”   (The   exception   in   §1681c(g)(2)   for   transactions   completed   by   handwriting   or   an   imprint   does   not   apply.)   Bormes   reads   this   statute   to   forbid   the   display   of   both   the   last   few   digits   (pay.gov   used   four   rather   than   five)   and   the   expiration  date  in  the  same  document.  We  may  assume  that   this  is  correct.  But  the  United  States  maintains  that  it  did  not   “print”   anything—instead   it   sent   Bormes   an   email,   which   was   electronic.   If   the   email   was   printed   after   receipt,   that   was   Bormes’s   doing   rather   than   its   own,   the   government   maintains.   Moreover,   whatever   printing   took   place   was   not   “provided  …  at  the  point  of  the  sale  or  transaction.”  Bormes   transacted   with   a   web   site,   and   the   receipt   was   sent   to   his   email  account,  from  which  he  could  obtain  access  in  multiple   ways  over  the  Internet.   This   conclusion   has   the   support   of   Shlahtichman   v.   1-­‐‑800   Contacts,  Inc.,  615  F.3d  794  (7th  Cir.  2010).  Bormes  concedes   that   Shlahtichman   is   dispositive   against   him   but   asks   us   to   overrule  it.  Because  the  only  other  appellate  decision  on  the   subject  has  agreed  with  Shlahtichman,  see  Simonoff  v.  Expedia,   Inc.,  643  F.3d  1202,  1207–10  (9th  Cir.  2011),  overruling  would   create   a   conflict   among   the   circuits.   Nonetheless,   Bormes   maintains,   reading   §1681c(g)(1)   as   Shlahtichman   did   makes   the   statute   substantially   inapplicable   to   transactions   on   the   Internet,   and   he   thinks   that   we   should   avoid   that   conse-­‐‑ quence  in  order  to  achieve  more  of  what  he  sees  as  the  legis-­‐‑ lative  goal.   Having   persuaded   us   to   stick   with   the   text   of   §1681a(b)   and   reject   the   United   States’   arguments   about   good   public   policy,  Bormes  can  hardly  expect  us  to  do  an  about  face  and   8   No.  13-­‐‑1602   modify   the   text   of   §1681c(g)(1)   in   favor   of   his   own   argu-­‐‑ ments   about   good   public   policy.   The   text   is   what   it   is,   no   matter   which   side   benefits.   We   said   in   van   Straaten   v.   Shell   Oil   Products   Co.,   678   F.3d   486   (7th   Cir.   2012),   that   §1681c(g)   would   be   applied   as   written,   without   contraction   or   en-­‐‑ largement  based  on  anyone’s  notions  of  wise  policy.   To   the   extent   policy   matters,   we   don’t   get   Bormes’s   ar-­‐‑ gument.   The   concern   underlying   §1681c(g)(1),   as   we   ex-­‐‑ plained  in  van  Straaten,  is  that  receipts  printed  at  the  point  of   sale  may  be  thrown  away  on  the  spot.  If  those  receipts  con-­‐‑ tain   the   full   name,   card   number,   and   expiration   date   of   the   credit   card,   they   may   facilitate   identity   theft.   But   if   nothing   is   printed   at   the   point   of   sale,   the   risk   is   substantially   less.   (Indeed,  without  most  of  the  credit  card’s  15  or  16  digits,  the   risk  is  zero;  adding  the  expiration  date  to  the  last  four  num-­‐‑ bers  does  not  pose  a  risk.)  A  consumer  might  print  an  email   at  home,  then  throw  it  away,  but  few  people  search  residen-­‐‑ tial   garbage   in   quest   of   credit-­‐‑card   numbers;   before   §1681c(g)  the  pickings  were  much  better  in  stores.   As  we  have  said,  however,  arguments  pro  and  con  about   wise   policy   are   irrelevant.   The   statute   as   written   applies   to   receipts   “printed   …   at   the   point   of   the   sale   or   transaction.”   The   email   receipt   that   Bormes   received   meets   neither   re-­‐‑ quirement.   So   although   the   United   States   has   waived   its   immunity   against   damages   actions   of   this   kind,   it   did   not   violate  the  statute  and  prevails  on  the  merits.   AFFIRMED