9th Cir. Says FACTA Violation on Receipt Does Not Confer Art. III Standing without Concrete Injury Being Fairly Traceable; And, 9th. Cir. Wasn’t Buying Traceability

In Daniel v. National Park Service, 2018 WL 2424494 (9th Cir. 2018), the Court of Appeals for the Ninth Circuit again addressed the impact of Spokeo within the context of a FACTA-receipt case.  The Court found that not only must a concrete injury be pleaded, but the injury must be fairly traceable to the violation.

We recently considered whether “receiving an overly revealing credit card receipt—unseen by others and unused by identity thieves—[is] a sufficient injury to confer Article III standing.” See Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 777 (9th Cir. 2018). Bassett’s theory of injury—an “exposure” to identity theft “caused by [the issuer’s] printing of his credit card expiration date on a receipt that he alone viewed”—did not “have ‘a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.’ ” Id. (quoting Spokeo, 136 S.Ct. at 1549). Nor did Congress “elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.” Id. at 781–82 (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 578, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). It was no stretch to conclude that a receipt showing the credit card expiration date, by itself, was not a concrete injury. Id. at 780.  In contrast to Bassett, Daniel alleged a concrete, particularized injury by claiming that after the Yellowstone transaction, her debit card was used fraudulently and she suffered damages from her stolen identity. Identity theft and fraudulent charges are concrete harms particularized to Daniel and establish a sufficient injury at the pleading stage. See generally Spokeo, 136 S.Ct. at 1548–50; In re Zappos.com, Inc., 888 F.3d 1020, 1028 (9th Cir. 2018) (holding that specific allegations of hackers accessing a plaintiff’s personal information that “could be used to help commit identity fraud or identity theft” are a sufficient injury). . . .The trickier question is whether the fraudulent charges on Daniel’s debit card and her stolen identity are “fairly traceable” to the Park Service’s printing of a receipt showing the expiration date of that debit card. At the pleading stage, Daniel does not need to prove proximate causation. See Lexmark Int’l, Inc. v. Static Control Components, Inc., ––– U.S. ––––, 134 S.Ct. 1377, 1391 n.6, 188 L.Ed.2d 392 (2014). But she still bears the burden of “demonstrating that her injury-in-fact is … fairly traceable to the challenged action”—here, the Park Service’s issuance of the receipt. Davidson v. Kimberly-Clark Corp., 889 F.3d 956, –––– (9th Cir. 2018) (citing Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139, 149, 130 S.Ct. 2743, 177 L.Ed.2d 461 (2010) ). Daniel’s threadbare allegations fall short of demonstrating that link.  Daniel’s complaint contains only two generic statements that attempt to draw a connection between the receipt and her later identity theft. She alleged: “After this debit card transaction, Plaintiff Daniel’s personal debit card was used fraudulently and she suffered damages from the stolen identity.” She went on to claim: “Based on information and belief, the fraudulent use of Plaintiff Daniel’s debit card was caused in part by the inclusion of the expiration date of her debit card on the receipt of her purchase from Defendant National Park Service.”  The latter statement is a legal conclusion, and is therefore not entitled to an assumption of truth at the pleading stage. See Ashcroft v. Iqbal, 556 U.S. 662, 678–80, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). The former statement presents no specific factual allegations plausibly tying the Park Service receipt to her identity theft. These naked assertions fail our edict that a plaintiff may not “rely on a bare legal conclusion to assert injury-in-fact, or engage in an ingenious academic exercise in the conceivable to explain how defendants’ actions caused his injury.” Maya v. Centex Corp., 658 F.3d 1060, 1068 (9th Cir. 2011) (internal quotation marks and footnotes omitted).  Like Bassett, Daniel “did not allege that another copy of the receipt existed, that h[er] receipt was lost or stolen, … or even that another person apart from h[er] lawyers viewed the receipt.” Bassett, 883 F.3d at 783.2 Merely asserting that a theft occurred at an unspecified time “after” the debit card transaction—absent any other details—does not connect the dots. Even crediting that temporal allegation as true, as we must at this stage, Daniel alleged no link between the receipt and the identity theft. See Syed v. M-I, LLC, 853 F.3d 492, 499 n.4 (9th Cir. 2017); Maya, 658 F.3d at 1068–73.  We are left with an allegation of a “bare procedural violation” of the FCRA and a generic allegation of later harm that is “divorced from” that violation. See Spokeo, 136 S.Ct. at 1549; Bassett, 883 F.3d at 781, 783. Because the “fairly traceable” leg of standing is no less essential to the “irreducible constitutional minimum” of standing than the injury leg, Daniel failed to adequately allege standing. Spokeo, 136 S.Ct. at 1547 (quoting Lujan, 504 U.S. at 560, 112 S.Ct. 2130).