FOR PUBLICATION
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
STEVEN BASSETT, No. 16-35933
Plaintiff-Appellant,
D.C. No.
v. 2:16-cv-00947-
TSZ
ABM PARKING SERVICES, INC., DBA
ABM Onsite Services - West, DBA
AMPCO System Parking; ABM OPINION
ONSITE SERVICES - WEST, INC.; ABM
INDUSTRIES, INC.,
Defendants-Appellees.
Appeal from the United States District Court
for the Western District of Washington
Thomas S. Zilly, Senior District Judge, Presiding
Submitted December 5, 2017 *
Seattle, Washington
Filed February 21, 2018
Before: Michael Daly Hawkins, M. Margaret McKeown,
and Morgan Christen, Circuit Judges.
Opinion by Judge McKeown
*
The panel unanimously concludes this case is suitable for decision
without oral argument. See Fed. R. App. P. 34(a)(2).
2 BASSETT V. ABM PARKING SERVICES
SUMMARY **
Standing / Fair Credit Reporting Act
The panel affirmed the district court’s dismissal due to
lack of standing in a putative class action alleging a violation
of the Fair Credit Reporting Act when the plaintiff received
a credit card receipt displaying the card’s full expiration
date.
In Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), the
Supreme Court held that to have Article III standing when
alleging only a statutory violation, a plaintiff must allege a
concrete injury in fact.
The panel joined the Second and Seventh Circuits in
affirming dismissal under identical circumstances, and held
that the plaintiff failed to allege a concrete injury in fact
sufficient to give him standing. The panel held that when
the plaintiff received the credit card receipt and there was no
identity thief there to snatch it, there was no injury.
**
This summary constitutes no part of the opinion of the court. It
has been prepared by court staff for the convenience of the reader.
BASSETT V. ABM PARKING SERVICES 3
COUNSEL
Darrell L. Cochran and Christopher E. Love, Pfau Cochran
Vertetis Amala PLLC, Tacoma, Washington, for Plaintiff-
Appellant.
Ryan P. McBride, Abraham K. Lorber, and Randall P.
Beighle, Lane Powell PC, Seattle, Washington, for
Defendants-Appellees.
OPINION
McKEOWN, Circuit Judge:
Today we answer a question that would certainly sound
exotic to our nation’s founders: Is receiving an overly
revealing credit card receipt—unseen by others and unused
by identity thieves—a sufficient injury to confer Article III
standing?
In response to growing credit card fraud and identity
theft, Congress enacted a series of protective laws. When
Steven Bassett used his credit card at an ABM parking
garage, he received a receipt displaying the card’s full
expiration date—a violation of the requirement that
businesses redact certain credit card information on printed
receipts. 15 U.S.C. § 1681c(g). Bassett sued but alleged
only a statutory violation and a potential for exposure to
actual injury. Like the district court, we conclude that
Bassett failed to allege a concrete injury sufficient to give
him standing. In doing so, we join the Second and Seventh
Circuits in affirming dismissal under identical
circumstances. See Crupar-Weinmann v. Paris Baguette
4 BASSETT V. ABM PARKING SERVICES
Am., Inc., 861 F.3d 76 (2d Cir. 2017); Meyers v. Nicolet Rest.
of De Pere, LLC, 843 F.3d 724 (7th Cir. 2016).
Background
The legislative backdrop for this case centers on FACTA
and FCRA. The Fair and Accurate Credit Transactions Act
of 2003 (“FACTA”), Pub. L. No. 108-159, 117 Stat. 1952,
amended the Fair Credit Reporting Act (“FCRA”) to limit
the information printed on receipts: “[N]o person that
accepts credit cards or debit cards for the transaction of
business shall print more than the last 5 digits of the card
number or the expiration date upon any receipt provided to
the cardholder at the point of the sale or transaction.” 1
15 U.S.C. § 1681c(g). The statute provides that “[a]ny
person who willfully fails to comply with [that requirement]
with respect to any consumer is liable to that consumer” for
statutory damages of between $100 and $1,000 per violation
or “any actual damages sustained by the consumer,” costs
and attorney’s fees, and potential punitive damages. Id.
§ 1681n.
Following the passage of FACTA, consumers filed a
spate of lawsuits against merchants who printed receipts
showing credit card expiration dates. In response, Congress
enacted the Credit and Debit Card Receipt Clarification Act
(the “Clarification Act”), Pub. L. No. 110-241, 122 Stat.
1565 (2008). The Clarification Act reiterated that the FCRA
prohibits the printing of receipts bearing a card’s expiration
date. Id. at 1566. But the congressional findings also noted
that “hundreds of lawsuits were filed alleging that the failure
to remove the expiration date was a willful violation of the
1
We use “FCRA” where “FCRA” or “FACTA” could be used
interchangeably.
BASSETT V. ABM PARKING SERVICES 5
[FCRA] even where the account number was properly
truncated,” and “[n]one of these lawsuits contained an
allegation of harm to any consumer’s identity.” Id. at 1565.
Congress went on to find that “[e]xperts in the field agree
that proper truncation of the card number, by itself as
required by the [FCRA], regardless of the inclusion of the
expiration date, prevents a potential fraudster from
perpetrating identity theft or credit card fraud.” Id.
To “ensure that consumers suffering from any actual
harm to their credit or identity are protected while
simultaneously limiting abusive lawsuits,” the Clarification
Act granted a temporary reprieve for merchants: “[A]ny
person who printed an expiration date on any receipt . . .
between December 4, 2004, and [June 3, 2008],” but
otherwise complied with the card number truncation
requirements, did not willfully violate the FCRA. Id. at
1566. The Act left the FCRA untouched for receipts printed
after June 3, 2008. Id.
When Bassett paid for parking at an ABM garage in
2016, he was issued a receipt bearing his credit card
expiration date. Bassett filed a putative class action lawsuit
against ABM Services, Inc.; ABM Onsite Services – West;
and ABM Industries, Inc. (collectively “ABM”) alleging
willful violations of the FCRA. Bassett’s claimed injury was
“exposure . . . to identity theft and credit/debit fraud,”
because he was at “imminent risk” that his “property would
be stolen and/or misused by identity thieves.” He did not
allege that a second receipt existed, that his receipt was lost
or stolen, or that he was the victim of identity theft. Rather,
he claimed that “the risk of harm created in printing the
expiration date on the receipt” was a “sufficiently concrete”
injury to confer Article III standing.
6 BASSETT V. ABM PARKING SERVICES
The district court granted ABM’s motion to dismiss the
complaint because Bassett failed to allege a sufficiently
concrete injury. In dismissing the case with prejudice, the
court concluded that Bassett alleged nothing more than a
“possible risk of [identity] theft.” Citing the Supreme
Court’s watershed decision on standing, Spokeo, Inc. v.
Robins, 136 S. Ct. 1540 (2016), the district court emphasized
that “[s]omething more is necessary” to allege a concrete
injury in fact, because “not every procedural violation gives
rise to standing.”
Analysis
I. SPOKEO AND DECISIONS OF OUR SISTER CIRCUITS
At its core, standing is “an essential and unchanging part
of the case-or-controversy requirement of Article III.” Lujan
v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). Our
analysis of this threshold issue begins with Spokeo. 136 S.
Ct. 1540. To have standing, Bassett must allege that he
“(1) suffered an injury in fact, (2) that is fairly traceable to
the challenged conduct of [ABM], and (3) that is likely to be
redressed by a favorable judicial decision.” Id. at 1547. An
injury in fact is “‘an invasion of a legally protected interest’
that is ‘concrete and particularized’ and ‘actual or imminent,
not conjectural or hypothetical.’” Id. at 1548 (quoting Lujan,
504 U.S. at 560).
This appeal turns on whether Bassett alleged a concrete
injury in fact. Spokeo, like this case, involved a putative
consumer class action alleging willful violations of the
FCRA. Robins claimed that Spokeo, a consumer reporting
agency, published inaccurate credit report information about
him, in violation of the FCRA. Id. at 1545–46. The district
court dismissed the complaint for lack of standing, but we
reversed. Id. at 1546. Because Robins alleged that “Spokeo
BASSETT V. ABM PARKING SERVICES 7
violated his statutory rights, not just the statutory rights of
other people,” and Robins’s “personal interests in the
handling of his credit information are individualized rather
than collective,” we concluded that Robins’s “alleged
violations of [his] statutory rights [were] sufficient to satisfy
the injury-in-fact requirement of Article III.” Id. (quoting
742 F.3d 409, 413–14 (9th Cir. 2014)). Finding this analysis
“incomplete,” the Supreme Court vacated and remanded to
consider whether Robins alleged a concrete injury in fact. Id.
at 1545.
The Court emphasized that “Article III standing requires
a concrete injury even in the context of a statutory violation.”
Id. at 1549. A plaintiff must show that a concrete injury
“actually exist[s]”; in other words, it is “real, and not
abstract.” Id. at 1548 (internal quotation marks omitted).
Intangible harms and a “risk of real harm” can be sufficiently
concrete. Id. at 1549–50. But “a bare procedural violation,
divorced from any concrete harm,” cannot “satisfy the
injury-in-fact requirement of Article III.” Id. at 1549.
Importantly, the Court noted that “[a] violation of one of the
FCRA’s procedural requirements may result in no harm”—
for example, “[i]t is difficult to imagine how the
dissemination of an incorrect zip code, without more, could
work any concrete harm.” Id. at 1550. The Court remanded
to determine “whether the particular procedural violations
alleged . . . entail a degree of risk sufficient to meet the
concreteness requirement.” Id.
Following Spokeo, two of our sister circuits dismissed for
lack of standing identical consumer class actions to the one
presented in this appeal—alleged violations of the FCRA’s
credit card expiration date redaction requirement. In Meyers
v. Nicolet Restaurant of De Pere, the Seventh Circuit held
that “Spokeo compels the conclusion that Meyers’[s]
8 BASSETT V. ABM PARKING SERVICES
allegations are insufficient to satisfy the injury-in-fact
requirement for Article III standing”:
The allegations demonstrate that Meyers did
not suffer any harm because of Nicolet’s
printing of the expiration date on his receipt.
Nor has the violation created any appreciable
risk of harm. After all, Meyers discovered the
violation immediately and nobody else ever
saw the non-compliant receipt. In these
circumstances, it is hard to imagine how the
expiration date’s presence could have
increased the risk that Meyers’[s] identity
would be compromised.
843 F.3d at 727. The court also observed that in the
Clarification Act, Congress was “quite concerned” about
abusive FCRA lawsuits where a consumer does not suffer
actual harm, and “specifically declared that failure to
truncate a card’s expiration date, without more, does not
heighten the risk of identity theft.” Id. at 727–28. Hence,
“without a showing of injury apart from the statutory
violation, the failure to truncate a credit card’s expiration
date is insufficient to confer Article III standing.” Id. at 728–
29.
The Second Circuit reached the same conclusion in
Crupar-Weinmann v. Paris Baguette America, Inc. In
holding that the alleged “bare procedural violation” did not
“present[] a material risk of harm to the underlying concrete
interest Congress sought to protect in passing FACTA”—
preventing identity theft and credit card fraud—the court
viewed as “dispositive” Congress’s findings in the
Clarification Act. 861 F.3d at 81. Specifically, the court
pointed to Congress’s finding that “[e]xperts in the field
BASSETT V. ABM PARKING SERVICES 9
agree that proper truncation of the card number, . . .
regardless of the inclusion of the expiration date, prevents a
potential fraudster from perpetrating identity theft or credit
card fraud.” Id. (alteration in original) (quoting 122 Stat. at
1565). That statement “ma[de] clear that Congress did not
think that the inclusion of a credit card expiration date on a
receipt increases the risk of material harm of identity theft,”
particularly in light of Congress’s concern about “abusive”
FCRA lawsuits. Id.
II. BASSETT’S ABSENCE OF INJURY
We think our sister circuits are correct. History and
congressional judgment “play important roles” in our
analysis of whether an injury is concrete. See Van Patten v.
Vertical Fitness Grp., LLC, 847 F.3d 1037, 1042–43 (9th
Cir. 2017) (quoting Spokeo, 136 S. Ct. at 1549). Both factors
counsel that Bassett did not allege a concrete injury.
A. NO HISTORICAL PREDICATE
We look to history because “the doctrine of standing
derives from the case-or-controversy requirement, and
because that requirement in turn is grounded in historical
practice.” Spokeo, 136 S. Ct. at 1549. Bassett’s theory of
injury is not supported by historical practice. Indeed, his
claimed “exposure” to identity theft—caused by ABM’s
printing of his credit card expiration date on a receipt that he
alone viewed—does not have “a close relationship to a harm
that has traditionally been regarded as providing a basis for
a lawsuit in English or American courts.” Id.
Bassett urges us to look to the “close” historical
relationship between his alleged injury and privacy-based
torts centered on wrongful disclosures of information. But
even assuming that “unauthorized disclosures of
10 BASSETT V. ABM PARKING SERVICES
information” are legally cognizable, ABM did not disclose
Bassett’s information to anyone but Bassett. See In re
Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d
625, 636 (3d Cir. 2017). Without disclosure of private
information to a third party, it hardly matters that “[a]ctions
to remedy . . . invasions of privacy, intrusion upon seclusion,
and nuisance have long been heard by American courts, and
the right of privacy is recognized by most states.” Van
Patten, 847 F.3d at 1043.
It is important to distinguish the alleged harm here from
cases where we have recognized a privacy-based injury,
such as Van Patten. There, we held that a consumer who
received unsolicited text messages in violation of the
Telephone Consumer Protection Act alleged a sufficiently
concrete injury because “unrestricted telemarketing can be
an intrusive invasion of privacy and [is] a nuisance.” Id.
(quoting Pub. L. 102-243, § 2, 105 Stat. 2394 (1991)).
Bassett’s case is likewise dissimilar from Syed v. M-I, LLC,
in which we determined that an employee sufficiently
alleged a concrete injury where a prospective employer
unlawfully obtained a consumer report about him without his
consent, in violation of the employee’s “right to
information” and “right to privacy” secured by the FCRA.
853 F.3d 492, 499–500 (9th Cir. 2017). Whereas an
undisclosed receipt may not “cause harm or present any
material risk of harm,” Spokeo, 136 S. Ct. at 1550,
unconsented text messages and consumer reports divulged
to one’s employer necessarily infringe privacy interests and
present harm. Van Patten, 847 F.3d at 1043; Syed, 853 F.3d
at 499.
B. CONGRESSIONAL JUDGMENT
In adopting the FCRA’s credit card expiration date
requirement, Congress did not “elevat[e] to the status of
BASSETT V. ABM PARKING SERVICES 11
legally cognizable injuries concrete, de facto injuries that
were previously inadequate in law.” Lujan, 504 U.S. at 578.
We look to Congress because “Congress is well positioned
to identify intangible harms that meet minimum Article III
requirements.” Spokeo, 136 S. Ct. at 1549. But Congress’s
creation of a prohibition “does not mean that a plaintiff
automatically satisfies the injury-in-fact requirement” just
because “a statute grants [him] a statutory right and purports
to authorize [him] to sue to vindicate that right.” Id. Bassett
cannot, therefore, “allege a bare procedural violation,
divorced from any concrete harm, and satisfy the injury-in-
fact requirement of Article III.” Id.
Spokeo laid to rest the notion that because the FCRA
authorizes citizen suits and statutory damages, it must mean
that allegations of a statutory violation meet the standing
requirement. The statute does not eliminate this
constitutional floor. As the Supreme Court emphasized,
“Congress cannot erase Article III’s standing requirements
by statutorily granting the right to sue to a plaintiff who
would not otherwise have standing.” Id. at 1547–48
(quoting Raines v. Byrd, 521 U.S. 811, 820, n.3 (1997)).
Spokeo rejected our conclusion that a FCRA plaintiff need
only invoke a FCRA violation and seek statutory damages to
allege a concrete injury. Id. at 1546, 1549. In doing so, the
Court cast aside our prior dictum that “[a]llowing consumers
to recover statutory damages furthers [the FCRA’s] purpose
by deterring businesses from willfully making consumer
financial data available, even where no actual harm results.”
Bateman v. Am. Multi-Cinema, Inc., 623 F.3d 708, 718 (9th
Cir. 2010) (emphasis added).
Far from “elevating” expiration date violations, the
Clarification Act suggests that alleged injuries like Bassett’s
are not concrete. Bassett’s suit replicates those addressed in
12 BASSETT V. ABM PARKING SERVICES
the statute: it “alleg[es] that the failure to remove the
expiration date was a willful violation of the [FCRA] even
where the account number was properly truncated,” and does
not “contain[] an allegation of harm to any consumer’s
identity.” 122 Stat. at 1565. Congress stressed that “proper
truncation of the card number, by itself as required by the
[FCRA], regardless of the inclusion of the expiration date,
prevents a potential fraudster from perpetrating identity theft
or credit card fraud.” Id. Distinguishing between
“consumers suffering from any actual harm to their credit or
identity” and those pursuing “abusive lawsuits,” Congress
clarified that printing the expiration date on a receipt was not
a willful violation of the FCRA during a temporary safe-
harbor period. Id. at 1566 (emphasis added).
Of course, Congress did not eliminate the FCRA’s
expiration date requirement in the Clarification Act. But
both the Clarification Act’s finding that a disclosed
expiration date by itself poses minimal risk and the law’s
temporary elimination of liability for such violations counsel
that Bassett did not allege a concrete injury. On balance,
congressional judgment weighs against Bassett.
III. BASSETT’S STATUTORY THEORIES OF INJURY
On remand from the Supreme Court in Spokeo, we
acknowledged that “while [plaintiffs] may not show an
injury-in-fact merely by pointing to a statutory cause of
action, the Supreme Court also recognized that some
statutory violations, alone, do establish concrete harm.”
Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017).
Bassett offers two alternative statutory theories of injury
regarding the FCRA’s expiration date requirement. At
maximum, Bassett asserts, the FCRA creates a “substantive
right,” the invasion of which is an injury that confers
BASSETT V. ABM PARKING SERVICES 13
standing. See Eichenberger v. ESPN, Inc., 876 F.3d 979,
982–84 (9th Cir. 2017). At minimum, the law establishes a
procedural right, the violation of which creates a material
risk of harm sufficient to confer standing. See Robins,
867 F.3d at 1114–17. 2 Neither theory is persuasive in this
context.
Bassett’s argument that Congress “created a substantive
right that is invaded by a statutory violation” is unconvincing
because it depends entirely on the framing of the right. One
could fairly characterize the “right” granted to Bassett by the
FCRA (from most abstract to most specific) as “the right to
be free from identity theft,” “the right to be free from
disclosure to others of his full credit card information,” or
“the right to be free from receiving a receipt showing his
credit card expiration date.” 3 Only the last “right” was
violated in this case. Such a framing-dependent exercise is
2
We note that the distinction between a “substantive” statutory
violation that alone creates standing, and a “procedural” statutory
violation that may cause harm or a material risk of harm sufficient for
standing, can be a murky one. In assessing constitutional standing, we
must always analyze whether the alleged harm is concrete, with an eye
toward history and congressional judgment (as we explained in Section
II). The “substantive” and “procedural” analyses that have appeared in
our case law are variations on that calculus.
3
A line of cases recognizes that a violation of a substantive statutory
right to obtain truthful information is a sufficiently concrete injury to
confer standing. See FEC v. Akins, 524 U.S. 11, 21 (1998); Havens
Realty Corp. v. Coleman, 455 U.S. 363, 374–75 (1982); Syed, 853 F.3d
at 499. Nevertheless, the FCRA provision challenged in this case does
not confer a substantive right to obtain a receipt. See 15 U.S.C.
§ 1681c(g). And, in any event, Bassett’s receipt contains truthful
information.
14 BASSETT V. ABM PARKING SERVICES
arbitrary, and thus bears minimally on whether Bassett
suffered a concrete injury in fact.
To the extent the FCRA arguably creates a “substantive
right,” it rests on nondisclosure of a consumer’s private
financial information to identity thieves. See Bateman,
623 F.3d at 717 (describing the FCRA’s card number
redaction requirements as “an effort to combat identity
theft”). We recently held, for example, that a statute barring
video service providers from disclosing knowingly and
without consent a consumer’s “personally identifiable
information” to third parties establishes a “substantive right
to privacy.” See Eichenberger, 876 F.3d at 982–84. But
here, Bassett’s private information was not disclosed to
anyone but himself, and therefore no such substantive right
was invaded. See id. at 983–84 (noting that whereas “the
FCRA outlines procedural obligations that sometimes
protect individual interests, the [Video Privacy Protection
Act] identifies a substantive right to privacy that suffers any
time a video service provider discloses otherwise private
information” to a third party).
Bassett’s allegations of FCRA procedural violations also
do not “entail a degree of risk sufficient to meet the
concreteness requirement.” Spokeo, 136 S. Ct. at 1550. In
assessing violations of procedural statutory rights, we
consider whether “the specific procedural violations alleged
. . . actually harm, or present a material risk of harm to
[Bassett’s] interests.” Robins, 867 F.3d at 1113.
Bassett did not allege that another copy of the receipt
existed, that his receipt was lost or stolen, that he was the
victim of identity theft, or even that another person apart
from his lawyers viewed the receipt. See Meyers, 843 F.3d
at 727. Nor did he allege that any risk of harm is real, “not
conjectural or hypothetical,” given that he could shred the
BASSETT V. ABM PARKING SERVICES 15
offending receipt along with any remaining risk of
disclosure. Lujan, 504 U.S. at 560.
Like the dissemination of an incorrect zip code, it is
difficult to see how issuing a receipt to only the card owner
and with only the expiration date, “without more, could work
any concrete harm.” Spokeo, 136 S. Ct. at 1550. Indeed,
Congress found that receipts like Bassett’s that truncate the
credit card number but reveal the expiration date “prevent[]
a potential fraudster from perpetrating identity theft or credit
card fraud.” 122 Stat. at 1565. Bassett’s theory of
“exposure” to identity theft is therefore “too speculative for
Article III purposes.” See Missouri ex rel. Koster v. Harris,
847 F.3d 646, 654 (9th Cir. 2017) (quoting Lujan, 504 U.S.
at 564 n.2); see also Clapper v. Amnesty Int’l USA, 568 U.S.
398, 409 (2013) (a “threatened injury must be certainly
impending to constitute injury in fact” (quoting Whitmore v.
Arkansas, 495 U.S. 149, 158 (1990)). 4
We need not answer whether a tree falling in the forest
makes a sound when no one is there to hear it. But when this
receipt fell into Bassett’s hands in a parking garage and no
identity thief was there to snatch it, it did not make an injury.
AFFIRMED.
4
It is no help to Bassett that some courts have found injuries
sufficiently concrete where plaintiffs alleged theft of their private
information, even when that information had not yet been used against
them (e.g., no fraudulent charges had been made). See Galaria v.
Nationwide Mut. Ins. Co., 663 F. App’x 384, 387–89 (6th Cir. 2016);
Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 693 (7th Cir. 2015);
Krottner v. Starbucks Corp., 628 F.3d 1139, 1142–43 (9th Cir. 2010).
Bassett alleged no such theft.