Heuer v. Smithsonian Institution

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

)
NEIL H. HEUER, )
)
Plaintiff, )
)
v. ) Civil Action No. 17-cv-0147 (TSC)
)
SMITHSONIAN INSTITUTION, et al., )
)
Defendants. )
)

MEMORANDUM OPINION

Plaintiff Neil H. Heuer has filed a class action lawsuit against Defendants—the

Smithsonian Institution and the United States of America—alleging they violated the Fair Credit

Reporting Act (“FCRA”). Defendants have moved to dismiss Plaintiff’s lawsuit pursuant to

Federal Rule of Civil Procedure 12(b)(1) and 12(b)(6). ECF No. 35. For reasons explained

below, the court will GRANT Defendants’ motion.

I. BACKGROUND

The facts in this case are straightforward and not in dispute. Plaintiff, a resident of

Florida, alleges that on or about April 9, 2015, he visited the Smithsonian Institution’s National

Air and Space Museum in Washington, DC. ECF No. 34, Amended Complaint (“Am. Compl.”)

¶¶ 8, 26, 55. While there, he used a credit card to purchase tickets to watch a movie in the

museum’s IMAX theater and to enter the museum’s planetarium. Id. ¶ 55. A museum employee

issued Plaintiff a printed receipt captioned “SALES RECEIPT,” which also listed Plaintiff’s first

and last name, as well as the name of his card issuer (“AMEX”), and the first and last four digits

of his credit card number. Id. ¶ 29. Plaintiff was required to hand this receipt to another

museum employee to enter the IMAX theater, and the employee then handed the receipt back to

Page 1 of 12
Plaintiff. Id. ¶¶ 30-31. Plaintiff kept the receipt in his wallet until he returned home to Florida,

whereupon he disposed of it using a paper shredder. Id. ¶¶ 33-34.

Plaintiff then filed suit on behalf of himself and persons he alleges to be similarly

situated, claiming that Defendants violated the Fair and Accurate Credit Transactions Act of

2003 (FACTA)—an amendment to FCRA—which prohibits any “person” from printing “more

than the last 5 digits of the card number or the expiration date upon any receipt provided to the

cardholder at the point of the sale or transaction.” Pub. L. No. 108-159, § 113, 117 Stat. 1952,

1959–60 (codified at 15 U.S.C. § 1681c(g)(1)). Plaintiff alleges that Defendants breached this

provision by printing a receipt containing the first four and last four digits of his credit card

number, and that this breach violated his “substantive right to privacy, entrustment and bailment

of credit card information,” his “right to receive an electronic receipt with truncated credit card

information as established” by statute, and “caused [him] to safe keep and later destroy the

electronically printed receipt.” Am. Compl. ¶ 57. He seeks damages and a court order enjoining

Defendants from printing receipts in violation of the “receipt provision.” Id. at 18 (Prayer for

Relief).

Defendants have moved to dismiss the Amended Complaint, arguing that the court lacks

subject matter jurisdiction over Plaintiff’s lawsuit because it is barred by the doctrine of

sovereign immunity and, in the alternative, that Plaintiff lacks standing to sue, because any

violation of the statute has not caused him to suffer a concrete injury in fact.

II. LEGAL STANDARD

A. Rule 12(b)(1)

Pursuant to Federal Rule of Civil Procedure 12(b)(1), a defendant may move to dismiss a

complaint for lack of subject matter jurisdiction. The law presumes that “a cause lies outside [a

Page 2 of 12
federal court’s] limited jurisdiction” unless the party asserting jurisdiction establishes otherwise.

Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994); see also Georgiades v.

Martin-Trigona, 729 F.2d 831, 833, n.4 (D.C. Cir. 1984) (“It is the burden of the party claiming

subject matter jurisdiction to demonstrate that it exists.”). In evaluating a motion to dismiss

under Rule 12(b)(1), a court must assume the truth of all factual allegations and must review

“‘the complaint liberally, granting plaintiff the benefit of all inferences that can be derived from

the facts alleged.’” Am. Nat’l Ins. Co. v. F.D.I.C., 642 F.3d 1137, 1139 (D.C. Cir. 2011)

(quoting Thomas v. Principi, 394 F.3d 970, 972 (D.C. Cir. 2005)). Nevertheless, “‘the court

need not accept factual inferences drawn by plaintiffs if those inferences are not supported by

facts alleged in the complaint, nor must the [c]ourt accept plaintiff’s legal conclusions.’” Disner

v. United States, 888 F. Supp. 2d 83, 87 (D.D.C. 2012) (quoting Speelman v. United States, 461

F.Supp.2d 71, 73 (D.D.C. 2006)). Finally, a court “may consider materials outside the pleadings

in deciding whether to grant a motion to dismiss for lack of jurisdiction.” Jerome Stevens

Pharm., Inc. v. Food and Drug Admin., 402 F.3d 1249, 1253 (D.C. Cir. 2005) (citation omitted).

B. Rule 12(b)(6)

Rule 12(b)(6) permits a party to move for dismissal on the grounds that the complaint has

failed “to state a claim upon which relief can be granted.” Fed. R. Civ. P. 12(b)(6). A Rule

12(b)(6) motion “tests the legal sufficiency of a complaint.” Browning v. Clinton, 292 F.3d 235,

242 (D.C. Cir. 2002). To withstand a motion to dismiss under Rule 12(b)(6), “a complaint must

contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its

face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation marks and citation

omitted). A claim is facially plausible “when the plaintiff pleads factual content that allows the

Page 3 of 12
court to draw the reasonable inference that the defendant is liable for the misconduct alleged.”

Id.; see also Rollins v. Wackenhut Servs., Inc., 703 F.3d 122, 129–130 (D.C. Cir. 2012).

III. ANALYSIS

A. Sovereign Immunity

Defendants argue that the court lacks subject matter jurisdiction over Plaintiff’s suit

because Defendants are entitled to sovereign immunity from civil lawsuits, and Congress has not

waived their immunity from damages claims under FCRA. The court disagrees.

A waiver of sovereign immunity “must be unequivocally expressed in statutory

text.” F.A.A. v. Cooper, 566 U.S. 284, 290 (2012) (cleaned up). Any ambiguities must be

“construed in favor of immunity,” and ambiguity exists if there is a “plausible interpretation of

the statute that would not authorize money damages against the Government.” Id. at 290–91. At

the same time, waiving sovereign immunity does not require “magic words.” Id. at 291. The

Supreme Court instead requires only that the waiver “be clearly discernable from the statutory

text in light of traditional interpretive tools.” Id.

The FCRA provides that “[a]ny person who willfully fails to comply with any

requirement imposed under this subchapter with respect to any consumer is liable to that

consumer” for either “actual damages” or statutory “damages” within specified dollar ranges. 15

U.S.C. § 1681n(a)(1)(A). Likewise, the FCRA provides that “[a]ny person who is negligent in

failing to comply with any requirement imposed under this subchapter with respect to any

consumer is liable to that consumer” for “actual damages.” Id. § 1681o(a)(1). The FCRA also

defines the term “person” as used in sections 1681n and 1681o: “for the purposes of this

subchapter . . . [t]he term ‘person’ means any individual, partnership, corporation, trust, estate,

cooperative, association, government or governmental subdivision or agency, or other

Page 4 of 12
entity.” Id. § 1681a(a)–(b). For willful violations, the FCRA provides one cause of action

against “[a]ny person,” id. § 1681n(a)(1)(A), and an additional cause of action against any

“natural person,” id. § 1681n(a)(1)(B).

As the D.C. Circuit recently held in a FCRA case, “these provisions speak clearly enough

to waive federal sovereign immunity.” Mowrer v. U.S. Dep’t of Transp., 14 F.4th 723, 729 (D.C.

Cir. 2021). The Act’s definition of “person,” which includes “any . . . government,” 15 U.S.C. §

1681a(a)–(b), “surely includes the federal government,” Mowrer, 14 F.4th at 729. And by

distinguishing between liability that runs against “any” person and liability that runs only against

“natural” persons, the FCRA reflects “a calibrated approach to the question of which persons

should bear which liabilities.” Id. Consequently, the court finds that Congress has waived

Defendants’ federal sovereign immunity from FCRA damages claims. 1

B. Standing

Article III of the Constitution confines federal judicial power to the resolution of “Cases”

and “Controversies.” For there to be a case or controversy under Article III, the plaintiff must

have a “personal stake” in the case—in other words, standing. Raines v. Byrd, 521 U.S. 811, 819

(1997). Standing is a necessary predicate to any exercise of federal jurisdiction and, when it is

lacking, the dispute fails to present a concrete case or controversy under Article III. Ariz.

Christian Sch. Tuition Org. v. Winn, 131 S. Ct. 1436, 1442 (2011); Dominguez v. UAL Corp.,

666 F.3d 1359, 1361 (D.C. Cir. 2012).

1
The parties disagree on whether the Smithsonian Institution is entitled to assert sovereign
immunity. See ECF No. 35, Defs. Mot. at 5-6; ECF No. 36, Pl. Opp’n at 11 n.2. Without
deciding the issue, the D.C. Circuit has noted “[s]everal elements of the Smithsonian’s
congressional design” that suggest “it does have sovereign immunity.” Forman v. Small, 271
F.3d 285, 295 (D.C. Cir. 2001). The court need not reach this question here because, regardless
of whether the Smithsonian Institution is entitled to assert sovereign immunity, such immunity
has been waived. Mowrer, 14 F.4th at 729.
Page 5 of 12
 To have Article III standing to sue in federal court, a plaintiff must show (1) that they

suffered an injury in fact that is concrete, particularized, and actual or imminent; (2) that the

injury was likely caused by the defendant; and (3) that the injury would likely be redressed by

the relief sought. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–561 (1992). As the party

invoking federal jurisdiction, a plaintiff bears the burden of demonstrating that they have

standing. See id. at 561. At the pleading stage, “a plaintiff is required only to state plausibly that

each standing element exists.” Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1063 (D.C.

Cir. 2019) (citing Attias v. Carefirst, Inc., 865 F.3d 620, 625 (D.C. Cir. 2017)).

Defendants argue that Plaintiff has not plausibly stated that he suffered a concrete,

particularized, and actual or imminent injury. Plaintiff does not allege that Defendants’ conduct

caused him any physical or monetary harm. See generally Am. Compl. He instead contends that

Defendants’ conduct violated his statutory right and, as a result, exposed him to an increased risk

of identity theft. Id. ¶¶ 23, 65. He also alleges that because of Defendants’ conduct, he was

forced to take steps to safeguard the non-compliant receipt. Id. ¶¶ 34, 57.

“[T]he violation of a procedural right granted by statute can be sufficient in some

circumstances to constitute injury in fact.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1549 (2016).

Indeed, “Congress may create a statutory right or entitlement the alleged deprivation of which

can confer standing to sue even where the plaintiff would have suffered no judicially cognizable

injury in the absence of statute.” Warth v. Seldin, 422 U.S. 490, 514 (1975). But for “a statutory

violation to constitute an injury in fact, . . . the statute must protect the plaintiff’s concrete

interest—i.e., afford the putative plaintiff a right to be free of a harm capable of satisfying

Article III.” Jeffries, 928 F.3d at 1064.

Page 6 of 12
 The D.C. Circuit has held that FACTA “vests consumers with a concrete interest in using

their credit and debit cards without incurring an increased risk of identity theft.” Id. The Act’s

truncation requirement imposes on the merchant the duty not to print “more than the last 5 digits

of the card number or the expiration date,” 15 U.S.C. § 1681c(g)(1), a duty that applies at the

“point of the sale or transaction” regardless of whether a plaintiff ever becomes the victim of

identity theft or fraud, Jeffries, 928 F.3d at 1064. In other words, FACTA’s “truncation

requirement is a procedure designed to decrease the risk that a consumer would have his identity

stolen.” Id. (cleaned up). The Act “thus vests consumers with an interest in using their credit

and debit cards without facing an increased risk of identity theft.” Id. And that interest is

concrete in that it is closely related to “a harm that has traditionally been regarded as providing a

basis for a lawsuit in English or American courts,” specifically, a common law breach of

confidence. Id. (citing Spokeo, 136 S. Ct. at 1549). “FACTA protects against the risk of the

very harm the breach of confidence tort makes actionable—an unauthorized disclosure of

privileged information to a third party.” Id. at 1065. Accordingly, the interest protected by

FACTA—avoiding an increased risk of identity theft—is concrete.

But the analysis does not end there. Having determined that FACTA protects a concrete

interest, the court must determine whether Defendants’ alleged violation of FACTA harmed or

created a “risk of real harm” to Plaintiff’s concrete interest. Id.

In Jeffries, the defendant printed a receipt containing all sixteen digits of the plaintiff’s

credit card and its expiration date, in violation of FACTA. Id. at 1062. This presented a

“nightmare scenario” for the plaintiff, who was unable to use her credit card without incurring an

increased risk of identity theft. Id. at 1066. As a result, the court concluded that the plaintiff

suffered a concrete injury in fact. Id. The D.C. Circuit in Jeffries noted, however, that “not

Page 7 of 12
every violation of FACTA’s truncation requirement creates a risk of identity theft.” Id. at 1065.

For example, “printing an expiration date on a receipt without more—although a technical

violation of FACTA—does not create a risk of identity theft” and thus does not cause a concrete

injury in fact. Id. at 1066; accord Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 783 (9th

Cir. 2018) (no standing where plaintiff alleged FACTA violation when only expiration date was

printed on receipt); Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 81 (2d Cir.

2017) (same); Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir.

2016) (same).

This case lies somewhere between the “nightmare scenario” in Jeffries and those cases

involving the mere printing of an expiration date, in that Plaintiff’s receipt contained the first and

last four digits of his credit card number. The D.C. Circuit has not considered whether such a

disclosure increases the risk of identity theft sufficient to constitute concrete injury. Other

Circuits, however, have.

In Kamal v. J. Crew Grp., Inc., the defendant printed a receipt containing the first six

and last four digits of the plaintiff’s credit card, as well as the name of his card issuer (Discover).

918 F.3d 102, 107 (3d Cir. 2019). The plaintiff broadly alleged that the defendant’s conduct

“created a real risk of identity theft” and that “identity thieves . . . obtain Card receipts that are

lost or discarded, or through theft, and use the information on them to commit fraud and theft.”

Id. at 116. Based on these allegations, the Third Circuit affirmed the district court’s dismissal for

lack of standing because the plaintiff failed to allege that “the receipt included enough

information to likely enable identity theft.” Id. The court noted, however, that its “analysis

would be different if the plaintiff had alleged that the receipt included all sixteen digits of his

Page 8 of 12
credit card number, making the potential for fraud significantly less conjectural,” as was the case

in Jeffries. Id.

Other Circuits have reached the same conclusion in similar circumstances. See Thomas

v. TOMS King (Ohio), LLC, 997 F.3d 629, 636 (6th Cir. 2021) (no concrete injury where

defendant printed receipt containing first six and last four digits of plaintiff’s credit card); Noble

v. Nev. Checker Cab Corp., 726 F. App’x 582 (9th Cir. 2018) (same regarding first digit and last

four digits); Katz v. Donna Karan Co., 872 F.3d 114 (2d Cir. 2017) (same regarding first six and

last four digits). In each of these cases, the courts found it important that (1) the first digits of a

card number reveal nothing more than the card issuer, and (2) FACTA does not prohibit printing

the identity of the card issuer on a receipt. “In other words, ‘printing the first six digits—the

[issuer identification number]—is the equivalent of printing the name of the issuing institution,

information which need not be truncated under FACTA.’” Thomas, 997 F.3d at 636 (quoting

Katz, 872 F.3d at 120); see also Noble, 726 F. App’x at 584 (“[T]he first digit of a credit card

number merely identifies the brand of the card, and Congress has not prohibited printing the

identity of the credit card issuer along with the last five digits of the credit card number.”);

Kamal, 918 F.3d at 107 (noting that “the first six digits identify the issuing bank and card type”).

Defendants attach to their motion a declaration from John Duven, the Payment Card

Industry Accessor in the Smithsonian Institution’s Office of Chief Information Officer. See

Defs. Mot., Duven Decl. ¶ 2. Duvan attests that the first four digits of an American Express

credit card—such as the one used by Plaintiff—do not provide any sensitive information specific

to a cardholder. Id. ¶ 3. Specifically, the first two digits identify the issuing financial institution

(in this case, American Express), and the next two digits identify the type and currency of the

card. Id. In his opposition to Defendants’ motion, Plaintiff did not respond to this assertion, and

Page 9 of 12
the court therefore treats it as conceded. See Wannall v. Honeywell, Inc., 775 F.3d 425, 428

(D.C. Cir. 2014) (explaining that if a party files an opposition addressing only some of the

movant’s arguments, the court may treat the unaddressed arguments as conceded).

Because the first four digits of Plaintiff’s credit card do not reflect any sensitive

information specific to him, but rather information that merchants are otherwise permitted to

print on receipts, that disclosure alone appears less likely to have increased the risk of any “real

harm” to Plaintiff. See, e.g., Thomas, 997 F.3d at 636; Katz, 872 F.3d at 120; Noble, 726 F.

Appx. at 584. This finding is consistent with the D.C. Circuit’s reasoning in Jeffries.

In Jeffries, the D.C. Circuit emphasized the deference courts must afford to Congress’s

judgment about what credit card information—when presented on a receipt—presents a tolerable

versus intolerable risk of identity theft. 928 F.3d at 1065 (“Congress’s judgment about when

increased risk becomes intolerable is entitled to respect.”) (citing Spokeo, 136 S. Ct. at 1549). In

determining whether printing an expiration date on a receipt presents an intolerable risk of

identity theft, the D.C Circuit looked to Congress’s actions, specifically, to the Credit and Debit

Card Receipt Clarification Act of 2007. There, Congress observed that the inclusion of

expiration dates did not raise a material risk of identity theft and thus suspended the damages

provisions of FACTA as they relate to printing expiration dates. Id. (citing Credit and Debit

Card Receipt Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(4)–(5) 122 Stat. 1565,

1565). Bearing this in mind, the D.C. Circuit reasoned that printing a receipt with an expiration

date—though still a violation of FACTA—does not increase the risk of identity theft to an

“intolerable” level, and thus does not constitute a concrete injury in fact. Id.

The same reasoning applies to receipts showing the first four digits of a credit card

number. Those numbers reveal nothing more than the credit card issuer, type of currency, and

Page 10 of 12
type of card, information that Congress did not prohibit from printing on a receipt presumably

because it has judged that the disclosure of this information does not present an intolerable risk

of identity theft. See Thomas, 997 F.3d at 636; Katz, 872 F.3d at 120; Noble, 726 F. Appx. at

584; cf. Jeffries, 928 F.3d at 1066. Accordingly, the court concludes that printing a receipt with

the first four digits of a credit card—though a violation of FACTA—does not increase the risk of

identity theft to the level where it constitutes a concrete injury in fact.

Plaintiff also alleges that Defendant violated FACTA by including his name on the

printed receipt. Am. Compl. ¶¶ 4, 36. Plaintiff is incorrect: FACTA does not prohibit printing a

consumer’s name on a receipt, see generally Pub. L. No. 108-159, § 113, 117 Stat. 1952, and

Defendant’s doing so is therefore not material to the concrete interest FACTA seeks to protect or

the concrete harm it seeks to prevent. See Jeffries, 928 F.3d at 1065 (considering whether

statutory violation constitutes injury in fact) (emphasis added); see generally id. (giving no

weight to district court’s finding—319 F. Supp. 3d 525, 531 (D.D.C. 2018)—that credit card did

not contain plaintiff’s name). Plaintiff does not show that printing his name on his receipt

invaded any legally protected interest, Spokeo, 136 S. Ct. at 1549 (“Congress is well positioned

to identify intangible harms that meet minimum Article III requirements.”), or that such a

disclosure “has a close relationship to a harm that has traditionally been regarded as providing

the basis for a lawsuit in English or American courts,” id. For instance, as previously explained,

a FACTA violation bears a “close relationship” to the common law breach of confidence because

FACTA creates a “relationship of trust between the consumer and merchant, requiring the

merchant to safeguard the consumer’s credit or debit card information.” Jeffries, 928 F.3d at

1064–65. Plaintiff does not point to any law or tradition that establishes the same relationship of

trust for a person’s name.

Page 11 of 12
 Mindful of the D.C. Circuit’s finding that “not every violation of FACTA’s truncation

requirement creates a risk of identity theft,” Id. at 1065, the court concludes that this is one such

case in which the plaintiff has not plausibly stated that the alleged violation of FACTA has

created a risk of identity theft that amounts to a concrete injury in fact.

Plaintiff has also failed to plausibly state that the time he spent safeguarding the receipt

and disposing of it amounts to a concrete injury in fact. Where a “hypothetical future harm” is

not “certainly impending,” plaintiffs “cannot manufacture standing merely by inflicting harm on

themselves.” Clapper v. Amnesty Int’l USA, 568 U.S. 398, 416, 422 (2013). Plaintiff’s

management-of-risk claim is intertwined with his arguments about actual risk. If the receipt he

received on April 9, 2015, offered no advantage to identity thieves, Plaintiff can “hardly say that

he was injured because of the efforts he took to keep it out of their hands.” Muransky v. Godiva

Chocolatier, Inc., 979 F.3d 917, 931 (11th Cir. 2020) (noting that “any assertion of wasted time

and effort necessarily rises or falls along with [a court’s] determination of whether the risk posed

by [the defendant’s] FACTA violation, as pleaded by [the plaintiff], is itself a concrete harm”).

Plaintiff also does not allege that he treated the Smithsonian receipt any differently than any

other receipt, or that he spent any additional time safeguarding it. Without more, Plaintiff has

not adequately pled that he suffered a concrete injury in fact.

IV. CONCLUSION

For reasons explained above, the court will GRANT Defendants’ motion to dismiss

Plaintiff’s Amended Complaint.

Date: August 1, 2022
Tanya S. Chutkan
TANYA S. CHUTKAN
United States District Judge

Page 12 of 12