Denece Thomas v. TOMS King (Ohio), LLC

RECOMMENDED FOR PUBLICATION
Pursuant to Sixth Circuit I.O.P. 32.1(b)
File Name: 21a0102p.06

UNITED STATES COURT OF APPEALS
FOR THE SIXTH CIRCUIT

┐
DENECE THOMAS, on behalf of herself and all others
│
similarly situated,
│
Plaintiff-Appellant, > No. 20-3977
│
│
v. │
│
TOMS KING (OHIO), LLC; TOMS KING (OHIO II), │
LLC; TOMS KING SERVICES, LLC; DOES, 1–10, │
inclusive, │
Defendants-Appellees. │
┘

Appeal from the United States District Court
for the Northern District of Ohio at Cleveland.
No. 1:19-cv-01419—Christopher A. Boyko, District Judge.

Argued: April 27, 2021

Decided and Filed: May 11, 2021

Before: SUHRHEINRICH, GRIFFIN, and DONALD, Circuit Judges.

_________________

COUNSEL

ARGUED: Chant Yedalian, CHANT & COMPANY, Glendale, California, for Appellant.
Gregory W. Guevara, BOSE MCKINNEY & EVANS LLP, Indianapolis, Indiana, for Appellees.
ON BRIEF: Chant Yedalian, CHANT & COMPANY, Glendale, California, Brian K.
Herrington, CHHABRA GIBBS & HERRINGTON PLLC, Jackson, Mississipp, for Appellant.
Gregory W. Guevara, Elizabeth A. Roberge, Philip R. Zimmerly, BOSE MCKINNEY &
EVANS LLP, Indianapolis, Indiana, for Appellees.
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 2

_________________

OPINION
_________________

SUHRHEINRICH, Circuit Judge.

I. INTRODUCTION

After receiving a credit card receipt printed with the first six and last four digits of her
credit card, Plaintiff Denece Thomas (Plaintiff) sued Defendants TOMS King (Defendants)1 for
violating the “truncation requirement” of the Fair and Accurate Credit Transactions Act of 2003
(FACTA).2 That provision prohibits anyone who accepts credit or debit cards for payment from
printing more than the last five digits of a customer’s card number on the receipt, and offers
actual and statutory damages. The question before us is whether Defendants’ alleged violation
of that statute resulted in harm sufficiently concrete for Article III standing purposes. The
district court concluded that it did not and dismissed the case without prejudice for lack of
subject matter jurisdiction. Plaintiff appeals that decision.

FACTA reflects Congress’s concern with preventing identity theft, and its belief that
truncating card numbers is the most effective means of doing so. But a violation of the
truncation requirement does not automatically cause an injury in fact. And the complaint in this
case fails to establish that Defendants’ technical violation of the statute caused harm or presented
any material risk of harm. We therefore affirm the lower court’s ruling.

1Thomas named TOMS King (Ohio) LLC, TOMS King (Ohio II) LLC, TOMS King Services LLC
(collectively, TOMS King), and “Does 1–10.” The TOMS King Defendant filed a Rule 12(b)(1) motion to dismiss
for lack of subject matter jurisdiction. For ease of reference, we refer to the TOMS King Defendants simply as
Defendants.
2Pub. L. No. 108–159, 117 Stat. 1952 (codified as amended at 15 U.S.C. § 1681c(g)).
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 3

II. BACKGROUND

A. FACTA

First, a bit about the statute at issue. Congress enacted FACTA in 2003 as an amendment
to the Fair Credit Reporting Act (FCRA). Pub. L. No. 108–159, 117 Stat. 1952 (2003). One aim
of the legislation is “to prevent identity theft.” Id. To this end, § 1681 instructs that “no person
that accepts credit cards or debit cards for the transaction of business shall print more than the
last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder
at the point of sale or transaction.” 15 U.S.C. § 1681c(g)(1). Any person who willfully violates
this provision is liable for actual damages or statutory damages ranging from $100 to $1,000.
15 U.S.C. § 1681n(a)(1)(A). Punitive damages as well as attorneys’ fees are also available. Id.
§ 1681n(a)(2)–(3).

The legislation launched “hundreds of lawsuits” based on receipts printed with expiration
dates “even where the account number was properly truncated,” which prompted Congress to
amend FACTA in 2008. Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No.
110–241 § 2(a)(4)–(5), 122 Stat. 1565, 1565 (2008) (Clarification Act). Congressional findings
also noted that “[n]one of these lawsuits contained an allegation of harm to any consumer’s
identity.” Id. After finding that “[e]xperts in the field agree that proper truncation of the card
number . . . regardless of the inclusion of the expiration date, prevents a potential fraudster from
perpetrating identity theft or credit card fraud,” id. § 2(a)(6), Congress eliminated liability for
merchants who had mistakenly printed receipts between 2004 and 2008 with expiration dates but
otherwise complied with FACTA. Id. sec. 3, § 616(d), 122 Stat. at 1566 (codified at 15 U.S.C.
§ 1681n(d)). The stated purpose of the amendment is “to ensure that consumers suffering from
any actual harm to their credit or identity are protected while simultaneously limiting abusive
lawsuits that do not protect consumers but only result in increased cost to business and
potentially increased prices to consumers.” Id. § 2(b).
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 4

B. The Complaint

Plaintiff alleges that on June 26, 2017, at an undisclosed TOMS King location, for an
undisclosed purchase,3 she received an electronically printed receipt containing the first six and
last four digits of her card number. She asserts that all Class Members received noncompliant
receipts from Defendants within two years of the suit’s filing date. She therefore claims injury
because (1) her situation “is exactly the scenario Congress sought to avoid by passing FACTA,”
and (2) Defendants exposed her and the entire Class “to at least an increased and material risk of
identity theft and credit and/or debit card fraud.” In other words, according to the complaint,
Defendants’ “violation of FACTA’s prohibition against printing excess digits of a card number
presents a significant risk of the exact harm that Congress intended to prevent—the display of
card information that could be exploited by an identity thief.” And this harm is not made
harmless simply because the receipt was not seen by a potential identify thief: “Plaintiff and
class members must take additional steps to ensure the safety of his or her identity” like saving
the receipt. Furthermore, there is also a risk of harm because merchants often retain receipts,
allowing others access to card information. Plaintiff seeks statutory damages, punitive damages,
costs, and attorney fees.

C. The District Court’s Ruling

The district court held that Plaintiff lacked standing because she alleged merely a threat
of future harm that was not certainly impending. The court reasoned that no injury had yet
occurred because (1) both sides acknowledged that the first six digits identify the card issuer
only, (2) Plaintiff did not allege that receipt was lost, stolen, or viewed by a third person,
(3) Plaintiff merely speculated that Defendants had retained a copy of the receipt or its contents,
and (4) Plaintiff had safeguarded her identity by retaining the receipt.

The district court also held that the complaint asserted a mere technical violation of
FACTA unaccompanied by factual allegations of any actual material risk of identity theft. court

3TOMS King “owns and operates over 130 BURGER KING(®) restaurants across Illinois, Ohio, North
Carolina, Pennsylvania and Virginia.” TOMS King, https://www.tomsking.com/about.html (last visited Apr. 30,
2021).
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 5

found the violation purely technical because FACTA does not prohibit the printing of the issuing
institution on a credit card receipt. Thus, because “Defendants’ technical violation of FACTA
demonstrates no harm to Plaintiff’s identity,” and her “allegations of hypothetical future injury
are insufficiently concrete to confer Article III standing,” the court found that it lacked subject
matter jurisdiction. It dismissed the matter without prejudice.

III. STANDARD OF REVIEW

Our review of the district court’s dismissal of Plaintiff’s complaint for lack of subject
matter jurisdiction is de novo. Buchholz v. Meyer NJUS Tanick, 946 F.3d 855, 860 (6th Cir.
2020). Because Defendants are raising a facial (as opposed to factual) challenge, which focuses
exclusively on the sufficiency of the pleadings, we must accept all allegations as true. Rote v.
Zel Custom Mfg. LLC, 816 F.3d 383, 387 (6th Cir. 2016). And, at the pleadings stage, “general
factual allegations of injury . . . may suffice.” Lujan v. Defs. of Wildlife, 504 U.S. 555,
561 (1992). However, that does not mean that we must accept conclusory legal allegations as
true. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); Bell Atl. Corp. v. Twombly, 550 U.S. 544,
555–56 (2007). The burden of establishing standing belongs to Plaintiff. Lujan, 504 U.S. at 561.

IV. STANDING PRINCIPLES

We apply well-worn yet enduring standards. To satisfy Article III standing requirements,
Plaintiff must show that (1) she suffered an injury in fact, (2) caused by Defendants, that (3) is
redressable by a judicial decision. Spokeo v. Robins, 136 S. Ct. 1540, 1547 (2016). Only the
first element is at issue in this case. An injury in fact is one that is “real, not abstract, actual, not
theoretical, concrete, not amorphous.” Huff v. TeleCheck Servs., Inc., 923 F.3d 458, 462 (6th
Cir. 2019) (citing Spokeo, 136 S. Ct. at 1548), cert. denied, 140 S. Ct. 1117 (2020). An injury in
fact can be tangible or intangible. Spokeo, 136 S. Ct. at 1549.4

4Tangible injuries are easy to identify, like physical injury or economic loss. See Clinton v. New York, 524
U.S. 417, 432–33 (1998) (economic loss); Debernardis v. IQ Formulations, LLC., 942 F.3d 1076, 1085–86 (11th
Cir. 2019) (economic loss). Intangible injuries, such as abridgement of free speech or free exercise, can also be
concrete. See, e.g., Pleasant Grove City v. Summum, 555 U.S. 460 (2009) (free speech); Church of Lukumi Babalu
Aye, Inc. v. City of Hialeah, 508 U.S. 520 (1993) (free exercise). “[S]ome concrete, intangible injuries may also
flow from statutory violations.” Buchholz, 946 F.3d at 862 (citing Spokeo, 136 S. Ct. at 1549). Take for example,
the inability to obtain information that Congress has made public. See, e.g., Fed. Election Comm’n v. Akins,
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 6

Congress can give de facto intangible harms statutory status, but that “does not mean that
a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a
person a statutory right and purports to authorize that person to sue to vindicate that right.” Id.
In other words, “Article III standing requires a concrete injury even in the context of a statutory
violation.” Thole v. U.S. Bank N.A., 140 S. Ct. 1615, 1620–21 (2020) (quoting Spokeo, 136 S.
Ct. at 1549); see also Hagy v. Demers & Adams, 882 F.3d 616, 623 (6th Cir. 2018) (“That’s just
what we take Spokeo to mean when it said that ‘Congress cannot erase Article III’s standing
requirement.’” (quoting Spokeo, 136 S. Ct. at 1547–48)). The Supreme Court has instructed that
the lower courts look to congressional judgment and historical practice for guidance in making
that assessment. Spokeo, 136 S. Ct. at 1549.

V. ANALYSIS

Plaintiff claims that she has standing because Congress vested her with the right to have
merchants print no more than the last five digits of her credit card printed on a receipt;
(2) Defendants’ violation exposed her to an increased risk of identity theft; and (3) the violation
also placed a burden on her to safeguard her receipt.

A. Congressional Judgment

We can quickly dispense with Plaintiff’s claim that she has a concrete injury based on a
congressional grant of a statutory right and remedy. “After Spokeo, we know there is no such
thing as an ‘anything-hurts-so-long-as-Congress-says-it-hurts theory of Article III injury.’” Huff,
923 F.3d at 463 (quoting Hagy, 882 F.3d at 622); see also Frank v. Gaos, 139 S. Ct. 1041, 1046
(2019) (per curiam) (same). In other words, this argument is without merit.

But “the violation of a procedural right granted by statute can be sufficient in some
circumstances to constitute injury in fact . . . [and] a plaintiff in such a case need not allege any
additional harm beyond the one Congress has identified.” Spokeo, 136 S. Ct. at 1549; Huff,

524 U.S. 11, 20–25 (1998) (holding that inability to obtain information is an injury in fact); see also Perry v. Cable
News Network, Inc., 854 F.3d 1336, 1340–41 (11th Cir. 2017) (holding that a violation of Video Privacy Protection
Act, which prohibits wrongful disclosure by a video tape service provider of video tape rental or sale records, would
be a concrete injury since it was analogous to the well-established torts of invasion of privacy and intrusion upon
seclusion).
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 7

923 F.3d at 464 (“When Congress confers a procedural right to protect a plaintiff’s concrete
interests, a violation of that right may establish the requisite injury in fact.”) Plaintiff argues that
we should defer to Congress’s judgment that a bare violation of the statute is a concrete injury
because it engaged in extensive fact-finding; found that identity theft is rampant; and determined
that electronically printed receipts with excess digits provides identity thieves with “easy access”
to consumers’ card information. Appellant’s Br. at 9–10 (quoting H. Rep. 108–263, at 25;
S. Rep. No. 108–166, at 3). See Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1065 (D.C.
Cir. 2019) (quoting S. Rep. No. 108–166, at 3). Further, in the truncation requirement, Congress
identified a concrete interest, the risk of identity theft; created measures to combat that harm,
requiring merchants to truncate card numbers on receipts; and gave consumers a right to sue for
noncompliant receipts. Thus, she claims that she need not allege any harm beyond the violation
of the statute.

Those circuits that have weighed in on this issue basically agree that “not every violation
of FACTA’s truncation requirement creates a risk of identity theft.” Jeffries, 928 F.3d at 1065;
Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917 (11th Cir. 2020) (en banc); Kamal v. J.
Crew Grp., Inc., 918 F.3d 102 (3d Cir. 2019); Noble v. Nevada Checker Cab Corp., 726 F.
App’x 582 (9th Cir. 2018); Katz v. Donna Karan Co., LLC, 872 F.3d 114 (2d Cir. 2017). The
Second, Third, and Eleventh Circuits did so on identical facts to this case—the first six and last
four digits of the consumer’s credit card. See Muransky, 979 F.3d at 922, 928–29; Kamal,
918 F.3d at 106; Katz, 872 F.3d at 116. Cf. Noble, 726 F. App’x at 583 (first and last four
digits). Although reiterating “not every FACTA violation creates a concrete injury in fact,” the
Jeffries court ultimately concluded that the plaintiff had stated a FACTA claim because of the
“egregious” facts before it. See Jeffries, 928 F.3d at 1066.

Like the district court, several of these courts reasoned that because (1) the first six digits
of a card number reveal nothing more than the card issuer, and (2) FACTA does not prohibit
printing the identity of the card issuer on a receipt, there is no automatic concrete harm. In other
words, “printing the first six digits—the [issuer identification number]—is the equivalent of
printing the name of the issuing institution, information which need not be truncated under
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 8

FACTA.” Katz, 872 F.3d at 1205; Noble, 726 F. App’x at 584 (stating that “the first digit of a
credit card number merely identifies the brand of the card, and Congress has not prohibited
printing the identity of the credit card issuer along with the last five digits of the credit card
number”). Or, as the Eleventh Circuit put it: “Nothing in FACTA suggests some kind of
intrinsic worth in a compliant receipt, nor can we see any. So, it makes little sense to suggest
that receipt of a noncompliant receipt itself is a concrete injury.” Muransky, 979 F.3d at 929.

Plaintiff contends that this view is flawed because an individual card issuer such as Bank
of America or Chase may issue branded cards, such as Mastercard or Visa. Thus, printing the
card issuer’s name or the type of card does not necessarily provide the identity thief with the first
six digits of a card number.6 Even if she is right, Plaintiff has not advanced the ball because she
does not explain how knowledge of the card issuer, the card type, and the first six digits creates
or at least enables actual harm or a material risk of harm. In other words, printing the first six
digits does not inevitably lead to identity theft or increase the risk of it. Congress has not offered
any insight either. “In the absence of an explanation of how a . . . procedural violation
constitutes a real injury; we are left with a . . . gap between Congress’s authority and the problem
it seeks to resolve.” Huff, 923 F.3d at 466; see also Hagy, 882 F.3d at 622 (“Nowhere in the
[Fair Debt Collection Practices] Act (or for that matter the legislative record) does Congress
explain why the absence of such a warning always creates an Article III injury.”)

In fact, Congress itself recognized that not every violation of the statute establishes
standing. The Third Circuit explained that although the statutory text manifests Congress’s
intent to make printing all but the last five digits of a consumer’s card number a redressable
injury, the later-in-time Clarification Act, which limited liability for printing the expiration date,
“also expresses Congress’s judgment that not all procedural violations of FACTA will amount to

5The Katz court did so on a factual challenge to the complaint. In concluding that printing the first six and
last four digits of a credit card number did not cause a cognizable injury, the district court relied on information in a
website cited by the defendant explaining that the first six digits of a credit card number are known as the Issuer
Identification Number (IIN). 872 F.3d at 118. The Second Circuit affirmed the district court’s finding. Id. at 120.
6Plaintiffalso claims that the first six digits are significant to anti-fraud measures because the credit card
industry uses an algorithm to check the validity of a credit card number. Again, though, this fact does not establish
that a harm occurred here.
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 9

concrete harm.” Kamal, 918 F.3d at 113. The Muransky majority likewise found the
Clarification Act telling because it “offered a subsequent Congress’s view that some technical
FACTA violations caused consumers no harm: the statute’s stated ‘purpose’ was to protect
‘consumers suffering from any actual harm’ while also ‘limiting abusive lawsuits’ that would
drive up costs to consumers without offering them any actual protection.” Muransky, 979 F.3d at
921 (emphasis added) (citation omitted); see also Jeffries, 928 F.3d at 1065–66 (citing the
Clarification Act in support of its assertion that “not every violation of FACTA’s truncation
requirement creates a risk of identity theft”); Noble, 726 F. App’x at 584 (deferring to
Congress’s expertise that not every violation of the truncation requirement concrete). 7 But see
Muransky, 979 F.3d 941 (Wilson, J., dissenting) (noting that the Congress “left the truncation
requirement and enforcement mechanism untouched” in the Clarification Act, which meant that
it perceived the printing of extra digits caused real harm or the risk of harm (quoting Jeffries, 928
F.3d at 1068 (Rogers, J., concurring in part and in judgment))).

Plaintiff pivots to increased-risk-of-injury as real harm. See Spokeo, 136 S. Ct. at 1549
(“This does not mean, however, that the risk of real harm cannot satisfy the requirement of
concreteness.”) Thomas claims that the Jeffries court supports her position, namely that FACTA
creates a concrete interest “vest[ing] consumers with an interest in using their credit and debit
cards without facing an increased risk of identity theft.” 928 F.3d at 1064. She is partially
correct. In agreeing with the plaintiff’s position in that case, the D.C. Circuit reasoned that
(1) the truncation requirement “imposes on the merchant the duty not to print ‘more than the last
5 digits of the card number or the expiration date.’” Id. (quoting § 1681c(g)(1)); and (2) “[t]he
duty applies at the ‘point of the sale or transaction,’” so “a violation occurs regardless [of]
whether a plaintiff ever becomes the victim of any crime,” id. (quoting § 1681c(g)(1)). Thus,
“FACTA itself does not prohibit the crimes of identity theft or fraud; its truncation requirement
is a procedure designed to decrease the risk that a consumer would have his identity stolen.” Id.

7Noble relied on a prior Ninth Circuit case, Bassett v. ABM Parking Servs., Inc., 883 F.3d 776 (9th Cir.
2018). Bassett relied on the Clarification Act to conclude that the plaintiff did not suffer actual harm because his
receipt included the credit card expiration date. Id. at 782. Katz too relied on prior precedent, Crupar-Weinmann v.
Paris Baguette Am., Inc., 861 F.3d 76 (2d Cir. 2017), which held that printing the expiration date did not create
actual harm without more, because Congress itself had clarified the point in the Clarification Act. Id. at 81.
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 10

(cleaned up) (citing Muransky v. Godiva Chocolatier, Inc., 922 F.3d 1175, 1188 (11th Cir.
2019), vacated, 979 F.3d 917 (11th Cir. 2020) (en banc)).8

One of the dissenting views in Muransky takes this reasoning several steps further. Judge
Wilson found that three aspects of the statute show that Congress intended that “consumers have
an interest in avoiding the heightened risk of identity theft in addition to avoiding actual identity
theft.” Muransky, 979 F.3d at 939 (Wilson, J., dissenting). First, is FACTA’s damages scheme,
which “ha[s] no tie to actual identity theft; the consumer can recover them no matter if he ‘ever
becomes the victim of any crime.’” Id. (quoting Jeffries, 928 F.3d at 1064). In other words, the
statutory damages remedy addresses “a broader aim: to ‘decrease the risk that a consumer would
have his identity stolen.’” Id. (quoting Jeffries, 928 F.3d at 1064). Second, is the “point-of-sale”
feature. “The cause of action that Congress created” is complete when the receipt is printed,
“well before” any identity theft occurs. Id. at 940. “The point-of-sale trigger thus reveals that
Congress sought to protect an immediately harmed interest—the interest in avoiding the
heightened risk of identity theft.” Id. (citing Jeffries, 928 F.3d at 1064, 1067 n.3). Third, is the
statute of limitations, which “turns on the untruncated receipt alone.” Id. The FACTA
limitations period is two years from discovery of the noncompliant receipt but not later than five
years from its printing. Id. (citing 15 U.S.C. § 1681p). Thus, “[i]dentity theft plays no role in
this sequence—the statute is indifferent to when or whether identity theft occurs.” Id. As Judge
Wilson reasoned, “[i]f FACTA’s sole aim were to redress the harm of identity theft, that
limitations scheme would make no sense—it operates without regard for when (or even if)
identity theft occurs.” Id. That is why “Congress reasonably chose to start the clock the moment
the consumer discovers this point-of-sale injury.” Id.

As the Jeffries majority and Judge Wilson point out, the statute’s design reflects
Congress’s desire to reduce the risk of identity theft before, or regardless of whether, it ever
occurs. But, as the Jeffries’ court itself acknowledged, this reasoning goes only so far:
recognizing that “the [truncation] requirement . . . vests consumers with an interest in using their
credit and debit cards without facing an increased risk of identity theft,” 928 F.3d at 1064, did

8The Jeffries court found persuasive the panel decision in Muransky. The Muransky panel’s view was
vacated by the en banc court.
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 11

not resolve whether that interest “is concrete,” id. (“The question now becomes whether the
interest protected by FACTA—avoiding an increased risk of identity theft—is concrete.”). The
Jeffries court found that “[h]istory tilt[ed] toward concreteness,” because FACTA’s truncation
requirement resembles the common law breach of confidence tort and “g[a]ve weight to
Congress’s determination that printing too much credit card information on a receipt creates a
‘real’ or ‘de facto’ harm.” Id. at 1064–65.

But then the Jeffries asked another question: “whether the challenged violation of [the
plaintiff’s] statutory right harmed or created a ‘risk of real harm’ to the concrete interests
protected by FACTA.” Id. at 1065 (“Our analysis does not stop with the conclusion that FACTA
protects a concrete interest.”). That is, the Jeffries court did exactly what Spokeo instructed it to
do: perform its constitutional duty to verify that actual harm in the case sub judice occurred.
Noting that “not every FACTA violation creates a concrete injury in fact,” the D.C. Circuit found
that the alleged violation of the plaintiff’s right did so in that case because the defendant had
printed “all of the information” FACTA prohibits at the point of sale—credit card digits and
expiration date. Id. at 1066. Thus, the plaintiff’s receipt, which “contain[ed] all sixteen digits of
her credit card number, her credit card expiration date[,] and her credit card provider,” id. at
1062, “bore sufficient information for a criminal to defraud her.” id. at 1066. Armed with these
additional factual allegations—that the receipt contained all sixteen digits and the expiration
date—the D.C. Circuit concluded that:

At the point of sale—the time at which FACTA measures liability—there was no
way to know whether [the plaintiff] would recognize [the defendant’s] mistake
and mitigate any harm or whether the receipt would end up in the trash for anyone
to find or otherwise be accessed by a malevolent third party (e.g., an employee or
fellow customer). Accordingly, [the plaintiff] was not able to use her credit card
without incurring an increased risk of identity theft and, as a result, suffered a
concrete injury in fact. She has pleaded enough facts to establish standing.

Id. The court reiterated that “[b]ecause the receipt contained enough information to defraud [the
plaintiff], she suffered an injury in fact at the point of sale.” Id. at 1067.
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 12

The Jeffries court distinguished a case, Kamal, where, like here, the plaintiff alleged
harm merely because the credit card printed the first six and last four digits. In Kamal, the Third
Circuit found no injury because “the plaintiff failed to allege that ‘the receipt included enough
information to likely enable identity theft.’” Id. (quoting Kamal, 918 F.3d at 116). As Jeffries
pointed out, the Third Circuit “expressly stated its ‘analysis would be different if, for example,
[the plaintiff] had alleged that the receipt included all sixteen digits of his credit card number,
making the potential for fraud significantly less conjectural.’” Id. (quoting Kamal, 918 F.3d at
116).

The bottom line is that the Jeffries court did not find an automatic injury in fact based on
a purely procedural violation of FACTA; it found standing because the complaint alleged
sufficient facts to establish that a violation of the statute actually caused harm or risk of harm.

Plaintiff says that a concrete risk of avoiding identity theft is baked into the statute
because “the first 6 and last 4 digits of the card number either alone and/or in conjunction with
other information can be used to bolster the credibility of a criminal who is making pretext calls
to a card holder or engaging in e-mail phishing scams” to obtain sensitive information.
She explains in the complaint that:

[a]ccess to such information not only allows for the misuse of card information
but also allows criminals to potentially obtain additional credit cards, obtain loans
for vehicles, obtain home mortgages, obtain a passport in the consumer’s name,
and other similarly serious fraudulent acts that can cause serious harm to the
consumer’s financial and personal life.

But what the complaint does not aver is how the printing of the six first digits and last
four digits lead to the aforementioned evils, leaving it up to the court to infer “a highly
speculative change of future events.” Kamal, 918 F.3d at 116 (cleaned up). Such conclusory
allegations are too speculative to support an actual injury, let alone one that was certainly
impending. Cf. Buchholz, 946 F.3d at 865 (holding that the plaintiff’s allegation that he feared
litigation and suffered anxiety as result after receiving a debt collector’s letter signed by an
attorney was not a future harm that was “certainly impending” because the debt collector’s letter
did not threaten to sue, and plaintiff did not allege that he would refuse to pay if sued). More
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 13

importantly, “[n]owhere in the Act . . . does Congress explain” why the printing of more than the
last five digits “always creates an Article III injury.” Hagy, 882 F.3d at 622.

To recap: A violation of the statute does not automatically create a concrete injury of
increased risk of real harm even if Congress designed it so. And the factual allegations in this
complaint do not establish an increased risk of identity theft either because they do not show
how, even if Plaintiff’s receipt fell into the wrong hands, criminals would have a gateway to
consumers’ personal and financial data. Furthermore, as the district court noted, Plaintiff does
not allege that the receipt was lost, stolen, or seen by a third set of eyes, inside or outside of
Defendants’ employ.

Notwithstanding, Plaintiff does identify one potentially concrete harm: forcing her to
safeguard her receipt, which can be a legitimate injury. See Huff, 923 F.3d at 463 (suggesting
that wasted time is an actual injury); Jeffries, 928 F.3d at 1064 n.2. But a “‘hypothetical future
harm’ [that] is not ‘certainly impending’” is not a concrete injury, and so Plaintiff’s efforts to
protect her identity cannot be either. See Muransky, 979 F.3d at 931 (quoting Clapper v.
Amnesty Int’l USA, 568 U.S. 398, 416, 422 (2013)); Buccholz, 946 F.3d at 865 (same). In other
words, “[i]f [the] receipt would not offer any advantage to identity thieves, we could hardly say
that [Plaintiff] was injured because of the efforts [he] took to keep it out of their hands.”
Muransky, 979 F.3d at 931.

B. History

Thomas also invokes historical practice, asserting that a FACTA claim is analogous to
two common law torts: breach of confidence and invasion of privacy. As noted, Spokeo said that
“it is instructive to consider whether an alleged intangible harm has a close relationship to a harm
that has traditionally been regarded as providing a basis for a lawsuit in English or American
courts.” 136 S. Ct. at 1549.
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 14

1. Breach of Confidence Tort

A common law claim for breach of confidence occurs when a person discloses private
information to another person and the receiver of that information reveals it to a third party.
Jeffries, 928 F.3d at 1064. “This tort ‘is rooted in the concept that the law should recognize
some relationships as confidential to encourage uninhibited discussions between the parties
involved.’” Id. (quoting Young v. U.S. Dep’t of Justice, 882 F.2d 633, 640 (2d Cir. 1989)).

Some courts perceive a kinship between FACTA and a breach of confidence tort. The
D.C. Circuit in Jeffries concluded that a FACTA violation resembles a common law breach of
confidence because the truncation requirement establishes a similar relationship of trust between
consumer and merchant by requiring the merchant to safeguard a customer’s card information.
Id. at 1064–65. Judge Wilson shares the D.C. Circuit’s view that “history also ‘tilts toward
concreteness.’” Muransky, 979 F.3d at 942 (Wilson J. dissenting) (quoting Jeffries, 928 F.3d at
1064). He reasons that the “interest harmed in a breach-of-confidence case is the plaintiff’s
‘general interest in the security of the confidential relationship and his corresponding expectation
of secrecy.’” Id. (quoting Alan B. Vickery, Note, Breach of Confidence: An Emerging Tort, 82
Colum. L. Rev. 1426, 1434 (1982)). In his opinion, the “interest harmed in a FACTA case is the
same: the consumer expects the business to comply with FACTA and keep his card number
confidential.” Id. at 943.

Other courts do not see a resemblance. The Third Circuit in Kamal court rejected the
analogy on a claim similar to Thomas’s because there was no allegation of disclosure of the
consumer’s information to a third party. 918 F.3d at 114. The Eleventh Circuit en banc majority
questioned the breach of tort’s status in English or American courts, see Muransky, 979 F.3d at
931 (noting that the tort’s historical status is debated), but found any analogy lacking in any
event for two reasons. First, like the Kamal court, the Muransky majority focused on the absence
of disclosure to a third party. Second, a customer and a retail store do not share a confidential
relationship, which traditionally arise in the context of close professional relationships, like those
with doctors, therapists, and financial institutions. Id. at 932. “Handing a common form of
payment to a cashier at a retail store is simply not equivalent to these kinds of vulnerable,
confidential relationships.” Id. Thus, to the Eleventh Circuit’s mind, “[b]ecause no information
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 15

was disclosed, and no confidential relationship existed, the relationship between [the merchant’s]
conduct and a breach of confidence [was] anything but ‘close.’” Id. We agree with the Third
and Eleventh Circuit’s view and reject the analogy to a breach of confidence tort.

Even if we agreed that the truncation requirement shares common features of traditional
harms, there is no injury here because the receipt was not disclosed to a third party. In any event,
it did not disclose privileged information that increased the risk of harm.

2. Invasion of Privacy

Thomas also invokes the common law tort of invasion of privacy, which recognizes that
“an individual has an interest in preventing disclosure of personal information.” Perry, 854 F.3d
at 1340–41. Even if this tort has ancient origins, the analogy is flawed for the same reasons just
stated above.

C. Comparisons to Other Cases

Other cases involving statutory violations of consumer protection statutes bolster our
analysis. In Spokeo, the Supreme Court acknowledged that Congress enacted the FCRA to
ensure accurate credit reporting and “curb the dissemination of false information,” and also
found that a plaintiff “cannot satisfy the demands of Article III by alleging a bare procedural
violation.” 136 S. Ct. at 1545, 1550. Use of an incorrect zip code, for example, would not
constitute a concrete harm. Id. at 1550. Fast forward to the case on remand from the Supreme
Court with instructions to address concreteness. See id. The Ninth Circuit held that the
consumer’s alleged injuries were sufficiently concrete where he alleged that the defendant falsely
reported his professional, economic, and personal information, which could cause actual harm to
his employment prospects. Robins v. Spokeo, Inc., 867 F.3d 1108, 1117 (9th Cir. 2017).

In Buchholz, the plaintiff felt aggrieved after receiving two letters from a debt collector
that gave him the false impression that an attorney had determined he owed the debts, so he sued
under the Fair Debt Collection Practices Act (FDCPA). 946 F.3d at 859. Although we agreed
“that Congress passed the FDCPA to prevent debt collectors from engaging in abusive debt-
collection practices,” we held that the plaintiff had not established that he suffered a harm
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 16

Congress intended to prevent or that had a common law analog because he did not allege that he
did not owe the debt. Id. at 870. In Huff, we found no standing because the defendant check
verification company’s violation of the FCRA for inaccurately reporting his credit file had no
consequence to the consumer, like having a check declined, and therefore did not create an
imminent risk of injury. 923 F.3d at 461–65. In Hagy, a letter failing to disclose that it came
from a debt collector, which violated the FDCPA, failed to create standing because the letter
informed the plaintiff debtors that their debt had been extinguished. 882 F.3d at 618–22. In
Lyshe v. Levy, the plaintiff debtor alleged that a debt collection agency violated the FDCPA by
failing to provide electronic discovery and requiring that the plaintiff’s responses to requests for
admission be sworn and notarized. 854 F.3d 855, 855–57 (6th Cir. 2017). We found no standing
because (1) the FDCPA was not designed to prevent parties from having to visit a notary and
contact the defendant to obtain electronic copies of discovery, (2) the plaintiff had not alleged
that he suffered any harm, and (3) he conceded that he was at no risk to suffer of having to visit a
notary and contact the defendants to obtain electronic copies of discovery. Id. at 859.

On the flip side, the plaintiffs in Macy v. GC Services Ltd. Partnership had standing
because the debt-collection letter they received neglected to inform them that it was required to
provide verification of their debt’s validity only if they contested it in writing, which could have
caused them to contest it orally and waive some other FDCPA protections as a result. 897 F.3d
747, 761–68 (6th Cir. 2018). Because Congress sought to curb abusive debt collection practices
and tied the writing requirement to protecting concrete economic interests, the defendant’s
failure to include the words “in writing” created a material risk of harm. See Huff, 923 F.3d at
468 (discussing Macy).

The final example proves the point best. In Galaria v. Nationwide Mutual Insurance Co.,
the plaintiff sued under the FCRA after hackers stole their personal information, which included
names, dates of birth, marital statuses, employment, Social Security numbers, and driver’s
license numbers, from the defendants. 663 F. App’x 385, 386–87 (6th Cir. 2016). The plaintiffs
alleged that because of the identity theft, they would have to expend “hundreds of hours” and
“hundreds of dollars” to mitigate the increased risk of fraud by imposing credit freezes,
modifying financial accounts, reviewing credit reports and bank statements, and purchasing
 No. 20-3977 Thomas v. TOMS King (Ohio), LLC, et al. Page 17

mitigation products. Id. at 386–87. We agreed that the alleged theft of the plaintiffs’ personal
information constituted “a substantial risk of harm, coupled with reasonably incurred mitigation
costs,” because the alleged violation of the statute created a concrete risk that their data would be
used for fraudulent purposes. Id. at 388. The comparison highlights what’s missing in this case:
an allegation that the information revealed in this case—the first six (and therefore the card
issuer and type) and last four digits of Plaintiff’s credit card—created a substantial risk that
criminals could parlay that information into actual identity theft.

The bottom line in these cases, as in the one before us now, is that statutory-injury-for-
injury’s sake does not satisfy Article III’s injury in fact requirement. By exercising our
constitutional duty to make sure a plaintiff has standing, we ensure that Congress does not abuse
its constitutional power to define and create by “overrid[ing] [its] constitutional limits.” Hagy,
882 F.3d at 623; see also Huff, 923 F.3d at 462 (confining the judicial branch to resolving
concrete disputes limits its power “and checks the power of the legislative branch by prohibiting
it from using the Judiciary as an adjunct to its own powers.”).9

VI. CONCLUSION

AFFIRMED.

9There is a groundswell of support for Justice Thomas’s perspective that Article III standing distinguishes
between private and public rights. See Spokeo, 136 S. Ct. at 1551–53 (Thomas, J., concurring); see also Frank, 139
S. Ct. at 1046–47 (Thomas, J., dissenting); Buchholz, 946 F.3d at 871–74 (Murphy, J., concurring in part and
concurring in the judgment); Huff, 923 F.3d at 469; Muransky, 979 F.3d at 970–85 (Jordan, J., dissenting).
With respect to statutes creating private rights—that create duties owed to the plaintiffs as
individuals—a bare statutory violation may suffice to establish standing. But with respect to
statutes creating public rights—that create duties owed to the community as a whole—a bare
statutory violation may not suffice, and the plaintiff must show some individual harm beyond the
violation.
Huff, 923 F.3d at 469. As in Huff, that perspective was not raised in this case. Id. But “[t]he theory deserves further
consideration at some point.” Id.