InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
11th Circuit: Future identity theft risk does not confer standing
On February 4, the U.S. Court of Appeals for the Eleventh Circuit affirmed dismissal of a class action complaint, which raised several claims against a restaurant following a data breach that exposed customers’ financial information, for the named plaintiff’s lack of standing. According to the opinion, a restaurant chain suffered a data breach when hackers gained access to customers’ credit and debit card information through an outside vendor’s remote connection tool. The restaurant chain provided notice to customers that their information “‘may’ have been accessed.” A consumer, who made two purchases during the data breach period, cancelled the credit cards he used and filed a class action two weeks after the announcement of the breach, alleging the company was negligent in failing to safeguard the credit card data, and violated the Florida Unfair and Deceptive Trade Practices Act (FUDTPA), among others. The district court dismissed the action for lack of standing, concluding that the consumer failed to identify a “single specific, concrete injury in fact that he or anyone else [] suffered as a result of any misuse of customer credit card information.”
On appeal, the 11th Circuit affirmed the district court’s holding. The appellate court rejected the consumer’s theories of standing, which were predicated on (i) a threatened “future injury” of identity theft, and (ii) the consumer’s alleged suffering of “mitigation injuries” (i.e., lost time, lost rewards points, and loss of access to accounts). The appellate court explained that in data breach cases like this, to have Article III standing the consumer must show a “substantial risk” of harm or that harm (e.g., identity theft) is “certainly impending.” The appellate court noted that despite the consumer still carrying “some risk of future harm involving identify theft,” that risk “is not substantial and is, at best, speculative” because the consumer “immediately cancelled his credit cards following disclosure [of the breach], effectively eliminating the risk of credit card fraud in the future.” Moreover, according to the appellate court, the consumer did not sufficiently allege an actual, present injury, through “inflicting injuries on himself to avoid an insubstantial, non-imminent risk of identity theft.” The appellate court reasoned that “[t]o hold otherwise would allow an enterprising plaintiff to secure a lower standard for Article III standing simply by making an expenditure based on a nonparanoid fear.”
Split en banc 11th Circuit vacates $6.3 million FACTA settlement
On October 28, the U.S. Court of Appeals for the Eleventh Circuit, in a 7-3 en banc decision, vacated a $6.3 million Fair and Accurate Credit Transactions Act (FACTA) class action settlement, concluding the plaintiffs lacked standing because they did not allege any concrete harm. According to the opinion, the named plaintiff filed a FACTA class action against a chocolate retailer, alleging that the retailer printed too many credit card digits on receipts over several years. The complaint only pursued statutory damages and explicitly stated it did “not intend[] to request any recovery for personal injury.” The parties agreed to settle the litigation for $6.3 million prior to the U.S. Supreme Court decision in Spokeo, Inc. v. Robins (holding that a plaintiff must allege a concrete injury, not just a statutory violation, to establish standing). After Spokeo, the district court approved the class action, and class objectors appealed, with one objector arguing that the district court lacked jurisdiction to approve the settlement because the named plaintiff did not allege an injury in fact. On appeal, the 11th Circuit issued multiple opinions, with the first two affirming the settlement approval. The full panel ordered a rehearing en banc, vacating the last opinion.
The en banc panel vacated the district court order approving the settlement, concluding that the named plaintiff lacked standing under Spokeo. Specifically, the panel rejected the named plaintiff’s argument that “receipt of a noncompliant receipt itself is a concrete injury,” noting that “nothing in FACTA suggests some kind of intrinsic worth in a compliant receipt.” Moreover, the panel disagreed with the named plaintiff’s distinction that his claim was a “substantive” violation and not just a “procedural” one, reasoning that “no matter what label you hang on a statutory violation, it must be accompanied by a concrete injury.” Because the complaint did not allege a concrete injury, the panel vacated the order.
In dissent, one judge argued that the named plaintiff plausibly alleged concrete harm by establishing that the retailer’s FACTA violation elevated his risk of identity theft. In the second dissent, another judge asserted that both common law and congressional intent support the conclusion that the plaintiff’s complaint constitutes a concrete injury in fact. And lastly, the third dissent argued that the order should not be dismissed outright because the majority made “assumptions about the risks of identity theft without the benefit of a factual record, expert reports, or adversarial testing of the issue in the district court.”
11th Circuit will not rehear en banc city’s Fair Housing Act suit
On April 27, a majority panel for the U.S. Court of Appeals for the Eleventh Circuit denied the City of Miami Gardens’s petition for rehearing en banc after determining that the City “faced an uphill battle” to establish standing to bring a Fair Housing Act lawsuit against a national bank because it mainly relied on “an attenuated theory of injury.” As previously covered by InfoBytes, last July the 11th Circuit dismissed the City’s lawsuit against the bank for lack of standing after concluding, among other things, that the City’s evidence that certain loans may go into foreclosure at some point in the future “does not satisfy the requirement that a threatened injury be ‘imminent, not conjectural or hypothetical,’” and that the City failed to provide evidence that certain foreclosed loans had an effect on property-tax revenues or municipal spending or were issued on discriminatory terms. In explaining their decision to not rehear its 2019 ruling en banc, the majority stated that its decision—that the City failed to satisfy its burden of establishing standing—respects “the concerns and fairness and notice demanded by” both U.S. Supreme Court and 11th Circuit precedent. Two dissenting judges countered, however, that the rehearing should have been granted because, among other things, the 11th Circuit’s dismissal for lack of standing was done sua sponte “even though the City received neither proper notice that it failed to prove standing nor a legitimate opportunity to discover or produce the requisite evidence.”
7th Circuit holds both parties lack standing in FCRA suit
On January 28, the U.S. Court of Appeals for the Seventh Circuit affirmed the dismissal of claims and counterclaims in a privacy lawsuit, holding that neither party had standing under the Fair Credit Reporting Act (FCRA). In 2016, the consumer filed a lawsuit against the credit reporting agency claiming privacy violations and emotional distress after the agency released his credit information without authorization. According to the consumer, his credit information appeared on a “prescreen list” given to a prospective lender that was no longer under contract with the agency to make loan offers to pre-screened consumers. The agency filed an FCRA counterclaim arguing that the plaintiff violated the FCRA when he obtained a copy of the prescreen list without authorization in order to file the lawsuit. The district court dismissed both claims, ruling that neither party had standing to sue because they had not suffered a concrete injury.
On appeal, the 7th Circuit agreed with the decision, concluding the plaintiff failed to meet the injury-in-fact requirements under Article III and that any harm he may have suffered when the prescreen list was shared was “exceedingly remote and speculative.” According to the appellate court, “[i]dentifying a violation of a statutory right does not automatically equate to showing injury-in-fact for standing purposes.” Moreover, the plaintiff “had to come forward with something showing that he did not receive a firm offer, that [the prospective lender] would not have honored a firm offer, that he was affected by the lack of a firm offer, or that he suffered any actual emotional damages,” the 7th Circuit wrote, which he failed to do. The 7th Circuit also agreed with the district court that the company’s alleged reputational harm was insufficient to confer standing. The appellate court further rejected the agency’s second argument that defending the suit counted as a concrete injury, holding that the agency was attempting to “shoehorn itself into another cause of action,” and that the FCRA does not create an independent cause of action for which the agency can recover its costs.
6th Circuit affirms dismissal of FDCPA action for lack of standing
On January 3, the U.S. Court of Appeals for the Sixth Circuit affirmed the dismissal for lack of standing of an FDCPA suit brought by a consumer who claimed that because collection letters sent to him by a law firm caused him anxiety, the firm had violated the FDCPA. According to the opinion, the consumer had two delinquent accounts with a bank, which the law firm attempted to recover by sending collection letters to the consumer. The consumer asserted that the letters the law firm sent caused him “an undue sense of anxiety” that he would be sued by the firm, and he subsequently filed a lawsuit against the firm for violating the FDCPA. The court held that the consumer did not have standing to sue under Article III of the U.S. Constitution, for three main reasons: (i) the debtor’s anxiety about a potential lawsuit amounted to a fear of future harm that was not “certainly impending” because the consumer had not alleged that the law firm had threatened to sue him or that he refused to pay, and, therefore, his anxiety did not satisfy the injury-in-fact element for Article III standing; (ii) the consumer was “anxious about the consequences of his decision to not pay the debts that he does not dispute he owes,” and such a “self-inflicted injury” is not a basis for standing because it was not “fairly traceable” to the law firm’s conduct, but instead reflected the consumer’s own behavior; and (iii) “even assuming [the law firm” violated the statute by misrepresenting that an attorney had reviewed [the consumer’s] debts,” that violation did not cause any injury to the consumer because the consumer gave the court “no reason to believe he did not owe the debts,” and, therefore, he could not show that the law firm’s alleged procedural violation of the FDCPA, by itself, was an “injury in fact.” Because the court held that the consumer did not have standing, it affirmed the lower court’s dismissal of the action.
9th Circuit allows FCRA action to move forward against national bank
On October 31, the U.S. Court of Appeals for the Ninth Circuit, in a split panel decision, reversed the district court’s dismissal of a consumer’s FCRA action against a national bank alleging the bank obtained her credit report for an impermissible purpose. According to the opinion, the consumer filed the complaint against the bank after reviewing her credit report and noticing the bank had submitted “numerous credit report inquiries” in violation of the FCRA because she “did not have a credit relationship with [the bank]” as specified in the FCRA and, therefore, the inquiries were not for a permissible purpose. The bank moved to dismiss the action, arguing that the consumer did not suffer any injury from the credit inquiries. The district court agreed, and dismissed her claim with prejudice for lack of standing and failure to state a claim.
On appeal, the majority disagreed with the district court, concluding that (i) a consumer suffers a concrete injury in fact when a credit report is obtained for an impermissible purpose; and (ii) a consumer only needs to allege that her credit report was obtained for an impermissible purpose to survive a motion to dismiss. The appellate majority emphasized that the consumer does not have the burden of pleading the actual purpose behind the bank’s use of her credit report; the burden is on the defendant to prove the credit report was obtained for an authorized purpose. Moreover, the majority noted that the consumer alleges she only learned about the bank’s inquiry after reviewing her credit report and, therefore, it is implied “that she never received a firm offer of credit from [the bank],” and taken together with the fact that the bank actually obtained her credit report, she stated a plausible claim for relief.
One panel judge concurred in part and dissented in part, arguing that the consumer had standing but failed to state a plausible claim. Specifically, the judge argued that “the majority characterize[d] [the] plaintiff’s claim in terms of ‘possibility,’” but “mere possibility of liability does not plead a plausible claim.” Moreover, the judge disagreed with the majority’s conclusion that the defendant bears the burden of proof in these instances, stating “the Supreme Court has expressly placed the burden of pleading a plausible claim squarely on the plaintiff rather than on the defendant.”
District Court allows NCUA to substitute plaintiff, denies dismissal of breach of contract claim in RMBS action
On October 15, the U.S. District Court for the Southern District of New York held that the NCUA may substitute a new plaintiff to represent the agency’s claims in a residential mortgage-backed securities (RMBS) action against an international bank serving as an RMBS trustee. In the same order, the court dismissed certain tort claims, but allowed claims for breach of contract to move forward against the trustee.
According to the opinion, NCUA brought the action on behalf of 97 trusts for which the international bank served as the trustee, even though NCUA only had direct interest in eight of the trusts. NCUA argued it had derivative standing to pursue the claims on behalf of the other 89 trusts “on the theory that it had a latent interest in the [the 89 trusts] after they wound down and as ‘an express third-party beneficiary under the [89 trusts] Indenture Agreements.’” The trustee moved to dismiss the action and after hearing oral arguments on the motion, the court stayed the case pending the outcome of NCUA’s appeal regarding derivative standing in similar action before the U.S. Court of Appeals for the Second Circuit. In August 2018, the 2nd Circuit held that NCUA lacked standing to bring the derivative claims because the trusts had granted the right, title, and interest to their assets, including the RMBS trusts, to the Indenture Trustee. (Previously covered by InfoBytes here.) Based on the appellate court decision in the similar action, NCUA moved to file a second amended complaint and substitute a newly appointed trustee as plaintiff for the claims made on behalf of the 89 trusts for which it did not have direct standing.
Despite the trustee’s objections, the district court granted NCUA’s request, concluding that NCUA’s claims were timely and allowing the NCUA’s “Extender Statute”—which gives the agency the ability to bring contract claims at “the longer of” “the 6-year period beginning on the date the claim accrues” or “the period applicable under State law”—to apply to the new substitute plaintiff. Additionally, the court denied the bank’s motion to dismiss NCUA’s breach of contract claim alleging the trustee had notice of the defects in the mortgage files held in the various trusts. The court concluded that NCUA sufficiently plead that the trustee “did indeed receive notice [of the defective mortgages] and should have thus acted,” under the Pooling and Servicing Agreements.
District Court allows majority of privacy invasion class action claims to proceed against social media company
On September 9, the U.S. District Court for the Northern District of California granted in part and denied in part a social media company’s motion to dismiss a multidistrict class action alleging the company failed to prevent third parties from accessing and misusing private data of its users, in violation of the Stored Communications Act (SCA), the Video Privacy Protection Act (VPPA), and various state laws. In the consolidated action, the plaintiffs allege that the company (i) made sensitive user information—including basic facts such as gender, age, and address; and substantive content such as photos, videos, and religious and political views—available to third parties without user consent; and (ii) failed to prevent those same third parties from selling or otherwise misusing the information. The company moved to dismiss the action, arguing, among other things, that “people have no legitimate privacy interest in any information they make available to their friends on social media.”
The district court disagreed, concluding that most of the plaintiffs’ claims should survive, and that the company “could not be more wrong” in its argument that its users lose all privacy interest in the information they share with their friends on social media. The court asserted that when a user shares information with a limited audience, they “retain privacy rights and can sue someone for violating them.” The court also rejected the company’s argument that the plaintiffs did not have standing to sue in federal court because they could not show “tangible negative consequences from the dissemination of [the] information.” The court noted that privacy invasion is a redressable injury in itself and does not need a secondary economic injury to confer standing. Additionally, while the court recognized that the company’s argument that the users consented to this practice has “some legal force,” it cannot “defeat the lawsuit entirely, at least at the pleading stage.” Therefore, the court denied the motion as to the VPPA and narrowed certain claims under the SCA and California state laws, mostly with regard to claims on behalf of users who signed up for the service after 2009, who purportedly authorized the company to share information through their friends with app developers.
11th Circuit: Unsolicited text message doesn't establish standing under TCPA
On August 28, the U.S. Court of Appeals for the 11th Circuit held that receiving one unsolicited text message is not enough of a concrete injury to establish standing under the TCPA. According to the opinion, a former client of an attorney received an unsolicited “multimedia text message” from the attorney offering a ten percent discount on services. The client filed a putative class action, alleging the attorney violated the TCPA arguing the text message caused him “‘to waste his time answering or otherwise addressing the message’” leaving his cell phone “‘unavailable for otherwise legitimate pursuits’” and resulted in “‘an invasion of [] privacy and right to enjoy the full utility’” of his cell phone. The attorney moved to dismiss the complaint for lack of standing and the district court denied the motion. However, the court allowed the attorney to pursue an interlocutory appeal.
On appeal, the 11th Circuit looked to the Supreme Court decision in Spokeo, Inc. v. Robins— which held that a plaintiff must allege a concrete injury, not just a statutory violation, to establish standing—as well as the legislative history of the TCPA and determined there was “little support” for treating the client’s allegations as a concrete injury. Specifically, the panel noted that the allegations of “a brief, inconsequential annoyance are categorically distinct from those kinds of real but intangible harms” Congress set out to protect. Moreover, the “chirp, buzz, or blink of a cell phone” is annoying, but not a basis for invoking federal court jurisdiction. The panel also acknowledged that Congress, not a federal court, is “well positioned” to assess the new harms of technology. Because the client failed to allege a concrete harm by receiving the unsolicited text message, the panel reversed the district court decision.
9th Circuit: Class decertification appropriate when representative lacks standing
On June 5, the U.S. Court of Appeals for the 9th Circuit affirmed a lower court’s decision to decertify a class of callers claiming their cellphone calls were unlawfully recorded, holding that the class representative lacked standing as to its individual claim. According to the opinion, customers of a concrete supplier alleged that calls placed to a phone system that the company began using in 2009 failed to inform callers that their cellphone calls were being recorded. In 2013, the company changed the recording to state that the calls maybe be “monitored or recorded.” The class representative sought to certify a class of all persons whose calls were recorded between the time that the company started using the call recording system in 2009 to when it updated the recording. The district court initially denied certification under the Federal Rule of Civil Procedure Rule 23’s predominance requirement, and later—after certifying the class based on evidence presented concerning the timing of certain recorded calls—decertified the class for failing to satisfy the “commonality” and “predominance” requirements once the concrete supplier identified nine customers who claimed they had actual knowledge of the recording practice during the class period. In addition, the court concluded that the class representative lacked standing to seek damages on its individual claim or injunctive relief because it lacked standing under the 2016 Supreme Court opinion Spokeo, Inc. v. Robins, which required that it show a concrete or particularized injury as a result of the concrete supplier's alleged violation.
On appeal, the 9th Circuit rejected the class’s argument that it “has standing to appeal the decertification order notwithstanding the adverse judgment against it on the merits” due to the following two exceptions to the mootness doctrine that may permit a class representative to appeal decertification even if its individual claims have been mooted: (i) the class representative “retains a ‘personal stake’ in class certification”; or (ii) “the claim on the merits is ‘capable of repetition, yet evading review,’” even though the class representative has lost “his personal stake in the outcome of the litigation.” The appellate court concluded that “neither of these mootness principles can remedy or excuse a lack of standing as to the representative's individual claims.”