Background

The legislative backdrop for this case centers on FACTA and FCRA. The Fair and Accurate Credit Transactions Act of 2003 (“FACTA”), Pub. L. No. 108-159, 117 Stat. 1952, amended the Fair Credit Reporting Act (“FCRA”) to limit the information printed on receipts: “[N]o person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.” 1 15 U.S.C. § 1681c(g). The statute provides that “[a]ny person who willfully fails to comply with [that requirement] with respect to any consumer is liable to that consumer” for statutory damages of between $100 and $1,000 per violation or “any actual damages sustained by the consumer,” costs and attorney’s fees, and potential punitive damages. Id. § 1681n.

Following the passage of FACTA, consumers filed a spate of lawsuits against merchants who printed receipts showing credit card expiration dates. In response, Congress enacted the Credit and Debit Card Receipt Clarification Act (the “Clarification Act”), Pub. L. No. 110-241, 122 Stat. 1565 (2008). The Clarification Act reiterated that the FCRA prohibits the printing of receipts bearing a card’s expiration date. Id. at 1566. But the congressional findings also noted that “hundreds of lawsuits were filed alleging that the failure to remove the expiration date was a willful violation of the

1 We use “FCRA” where “FCRA” or “FACTA” could be used interchangeably.

BASSETT V. ABM PARKING SERVICES 5

[FCRA] even where the account number was properly truncated,” and “[n]one of these lawsuits contained an allegation of harm to any consumer’s identity.” Id. at 1565. Congress went on to find that “[e]xperts in the field agree that proper truncation of the card number, by itself as required by the [FCRA], regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud.” Id.

To “ensure that consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits,” the Clarification Act granted a temporary reprieve for merchants: “[A]ny person who printed an expiration date on any receipt . . . between December 4, 2004, and [June 3, 2008],” but otherwise complied with the card number truncation requirements, did not willfully violate the FCRA. Id. at 1566. The Act left the FCRA untouched for receipts printed after June 3, 2008. Id.

When Bassett paid for parking at an ABM garage in 2016, he was issued a receipt bearing his credit card expiration date. Bassett filed a putative class action lawsuit against ABM Services, Inc.; ABM Onsite Services – West; and ABM Industries, Inc. (collectively “ABM”) alleging willful violations of the FCRA. Bassett’s claimed injury was “exposure . . . to identity theft and credit/debit fraud,” because he was at “imminent risk” that his “property would be stolen and/or misused by identity thieves.” He did not allege that a second receipt existed, that his receipt was lost or stolen, or that he was the victim of identity theft. Rather, he claimed that “the risk of harm created in printing the expiration date on the receipt” was a “sufficiently concrete” injury to confer Article III standing. The district court granted ABM’s motion to dismiss the complaint because Bassett failed to allege a sufficiently concrete injury. In dismissing the case with prejudice, the court concluded that Bassett alleged nothing more than a “possible risk of [identity] theft.” Citing the Supreme Court’s watershed decision on standing, Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), the district court emphasized that “[s]omething more is necessary” to allege a concrete injury in fact, because “not every procedural violation gives rise to standing.”

Analysis

I. SPOKEO AND DECISIONS OF OUR SISTER CIRCUITS

At its core, standing is “an essential and unchanging part of the case-or-controversy requirement of Article III.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). Our analysis of this threshold issue begins with Spokeo. 136 S. Ct. 1540. To have standing, Bassett must allege that he “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of [ABM], and (3) that is likely to be redressed by a favorable judicial decision.” Id. at 1547. An injury in fact is “‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Id. at 1548 (quoting Lujan, 504 U.S. at 560).

This appeal turns on whether Bassett alleged a concrete injury in fact. Spokeo, like this case, involved a putative consumer class action alleging willful violations of the FCRA. Robins claimed that Spokeo, a consumer reporting agency, published inaccurate credit report information about him, in violation of the FCRA. Id. at 1545–46. The district court dismissed the complaint for lack of standing, but we reversed. Id. at 1546. Because Robins alleged that “Spokeo

BASSETT V. ABM PARKING SERVICES 7

violated his statutory rights, not just the statutory rights of other people,” and Robins’s “personal interests in the handling of his credit information are individualized rather than collective,” we concluded that Robins’s “alleged violations of [his] statutory rights [were] sufficient to satisfy the injury-in-fact requirement of Article III.” Id. (quoting 742 F.3d 409, 413–14 (9th Cir. 2014)). Finding this analysis “incomplete,” the Supreme Court vacated and remanded to consider whether Robins alleged a concrete injury in fact. Id. at 1545.

The Court emphasized that “Article III standing requires a concrete injury even in the context of a statutory violation.” Id. at 1549. A plaintiff must show that a concrete injury “actually exist[s]”; in other words, it is “real, and not abstract.” Id. at 1548 (internal quotation marks omitted). Intangible harms and a “risk of real harm” can be sufficiently concrete. Id. at 1549–50. But “a bare procedural violation, divorced from any concrete harm,” cannot “satisfy the injury-in-fact requirement of Article III.” Id. at 1549. Importantly, the Court noted that “[a] violation of one of the FCRA’s procedural requirements may result in no harm”— for example, “[i]t is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.” Id. at 1550. The Court remanded to determine “whether the particular procedural violations alleged . . . entail a degree of risk sufficient to meet the concreteness requirement.” Id.

Following Spokeo, two of our sister circuits dismissed for lack of standing identical consumer class actions to the one presented in this appeal—alleged violations of the FCRA’s credit card expiration date redaction requirement. In Meyers v. Nicolet Restaurant of De Pere, the Seventh Circuit held that “Spokeo compels the conclusion that Meyers’[s] allegations are insufficient to satisfy the injury-in-fact requirement for Article III standing”:

The allegations demonstrate that Meyers did not suffer any harm because of Nicolet’s printing of the expiration date on his receipt. Nor has the violation created any appreciable risk of harm. After all, Meyers discovered the violation immediately and nobody else ever saw the non-compliant receipt. In these circumstances, it is hard to imagine how the expiration date’s presence could have increased the risk that Meyers’[s] identity would be compromised.

843 F.3d at 727. The court also observed that in the Clarification Act, Congress was “quite concerned” about abusive FCRA lawsuits where a consumer does not suffer actual harm, and “specifically declared that failure to truncate a card’s expiration date, without more, does not heighten the risk of identity theft.” Id. at 727–28. Hence, “without a showing of injury apart from the statutory violation, the failure to truncate a credit card’s expiration date is insufficient to confer Article III standing.” Id. at 728– 29.

The Second Circuit reached the same conclusion in Crupar-Weinmann v. Paris Baguette America, Inc. In holding that the alleged “bare procedural violation” did not “present[] a material risk of harm to the underlying concrete interest Congress sought to protect in passing FACTA”— preventing identity theft and credit card fraud—the court viewed as “dispositive” Congress’s findings in the Clarification Act. 861 F.3d at 81. Specifically, the court pointed to Congress’s finding that “[e]xperts in the field

BASSETT V. ABM PARKING SERVICES 9

agree that proper truncation of the card number, . . . regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud.” Id. (alteration in original) (quoting 122 Stat. at 1565). That statement “ma[de] clear that Congress did not think that the inclusion of a credit card expiration date on a receipt increases the risk of material harm of identity theft,” particularly in light of Congress’s concern about “abusive” FCRA lawsuits. Id.

II. BASSETT’S ABSENCE OF INJURY

We think our sister circuits are correct. History and congressional judgment “play important roles” in our analysis of whether an injury is concrete. See Van Patten v. Vertical Fitness Grp., LLC, 847 F.3d 1037, 1042–43 (9th Cir. 2017) (quoting Spokeo, 136 S. Ct. at 1549). Both factors counsel that Bassett did not allege a concrete injury.

A. NO HISTORICAL PREDICATE

We look to history because “the doctrine of standing derives from the case-or-controversy requirement, and because that requirement in turn is grounded in historical practice.” Spokeo, 136 S. Ct. at 1549. Bassett’s theory of injury is not supported by historical practice. Indeed, his claimed “exposure” to identity theft—caused by ABM’s printing of his credit card expiration date on a receipt that he alone viewed—does not have “a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Id.

Bassett urges us to look to the “close” historical relationship between his alleged injury and privacy-based torts centered on wrongful disclosures of information. But even assuming that “unauthorized disclosures of information” are legally cognizable, ABM did not disclose Bassett’s information to anyone but Bassett. See In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 636 (3d Cir. 2017). Without disclosure of private information to a third party, it hardly matters that “[a]ctions to remedy . . . invasions of privacy, intrusion upon seclusion, and nuisance have long been heard by American courts, and the right of privacy is recognized by most states.” Van Patten, 847 F.3d at 1043.

It is important to distinguish the alleged harm here from cases where we have recognized a privacy-based injury, such as Van Patten. There, we held that a consumer who received unsolicited text messages in violation of the Telephone Consumer Protection Act alleged a sufficiently concrete injury because “unrestricted telemarketing can be an intrusive invasion of privacy and [is] a nuisance.” Id. (quoting Pub. L. 102-243, § 2, 105 Stat. 2394 (1991)). Bassett’s case is likewise dissimilar from Syed v. M-I, LLC, in which we determined that an employee sufficiently alleged a concrete injury where a prospective employer unlawfully obtained a consumer report about him without his consent, in violation of the employee’s “right to information” and “right to privacy” secured by the FCRA. 853 F.3d 492, 499–500 (9th Cir. 2017). Whereas an undisclosed receipt may not “cause harm or present any material risk of harm,” Spokeo, 136 S. Ct. at 1550, unconsented text messages and consumer reports divulged to one’s employer necessarily infringe privacy interests and present harm. Van Patten, 847 F.3d at 1043; Syed, 853 F.3d at 499.

B. CONGRESSIONAL JUDGMENT

In adopting the FCRA’s credit card expiration date requirement, Congress did not “elevat[e] to the status of

BASSETT V. ABM PARKING SERVICES 11

legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.” Lujan, 504 U.S. at 578. We look to Congress because “Congress is well positioned to identify intangible harms that meet minimum Article III requirements.” Spokeo, 136 S. Ct. at 1549. But Congress’s creation of a prohibition “does not mean that a plaintiff automatically satisfies the injury-in-fact requirement” just because “a statute grants [him] a statutory right and purports to authorize [him] to sue to vindicate that right.” Id. Bassett cannot, therefore, “allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in- fact requirement of Article III.” Id.

Spokeo laid to rest the notion that because the FCRA authorizes citizen suits and statutory damages, it must mean that allegations of a statutory violation meet the standing requirement. The statute does not eliminate this constitutional floor. As the Supreme Court emphasized, “Congress cannot erase Article III’s standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.” Id. at 1547–48 (quoting Raines v. Byrd, 521 U.S. 811, 820, n.3 (1997)). Spokeo rejected our conclusion that a FCRA plaintiff need only invoke a FCRA violation and seek statutory damages to allege a concrete injury. Id. at 1546, 1549. In doing so, the Court cast aside our prior dictum that “[a]llowing consumers to recover statutory damages furthers [the FCRA’s] purpose by deterring businesses from willfully making consumer financial data available, even where no actual harm results.” Bateman v. Am. Multi-Cinema, Inc., 623 F.3d 708, 718 (9th Cir. 2010) (emphasis added).

Far from “elevating” expiration date violations, the Clarification Act suggests that alleged injuries like Bassett’s are not concrete. Bassett’s suit replicates those addressed in the statute: it “alleg[es] that the failure to remove the expiration date was a willful violation of the [FCRA] even where the account number was properly truncated,” and does not “contain[] an allegation of harm to any consumer’s identity.” 122 Stat. at 1565. Congress stressed that “proper truncation of the card number, by itself as required by the [FCRA], regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud.” Id. Distinguishing between “consumers suffering from any actual harm to their credit or identity” and those pursuing “abusive lawsuits,” Congress clarified that printing the expiration date on a receipt was not a willful violation of the FCRA during a temporary safe- harbor period. Id. at 1566 (emphasis added).

Of course, Congress did not eliminate the FCRA’s expiration date requirement in the Clarification Act. But both the Clarification Act’s finding that a disclosed expiration date by itself poses minimal risk and the law’s temporary elimination of liability for such violations counsel that Bassett did not allege a concrete injury. On balance, congressional judgment weighs against Bassett.

III. BASSETT’S STATUTORY THEORIES OF INJURY

On remand from the Supreme Court in Spokeo, we acknowledged that “while [plaintiffs] may not show an injury-in-fact merely by pointing to a statutory cause of action, the Supreme Court also recognized that some statutory violations, alone, do establish concrete harm.” Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017).

Bassett offers two alternative statutory theories of injury regarding the FCRA’s expiration date requirement. At maximum, Bassett asserts, the FCRA creates a “substantive right,” the invasion of which is an injury that confers

BASSETT V. ABM PARKING SERVICES 13

standing. See Eichenberger v. ESPN, Inc., 876 F.3d 979, 982–84 (9th Cir. 2017). At minimum, the law establishes a procedural right, the violation of which creates a material risk of harm sufficient to confer standing. See Robins, 867 F.3d at 1114–17. 2 Neither theory is persuasive in this context.

Bassett’s argument that Congress “created a substantive right that is invaded by a statutory violation” is unconvincing because it depends entirely on the framing of the right. One could fairly characterize the “right” granted to Bassett by the FCRA (from most abstract to most specific) as “the right to be free from identity theft,” “the right to be free from disclosure to others of his full credit card information,” or “the right to be free from receiving a receipt showing his credit card expiration date.” 3 Only the last “right” was violated in this case. Such a framing-dependent exercise is

2 We note that the distinction between a “substantive” statutory violation that alone creates standing, and a “procedural” statutory violation that may cause harm or a material risk of harm sufficient for standing, can be a murky one. In assessing constitutional standing, we must always analyze whether the alleged harm is concrete, with an eye toward history and congressional judgment (as we explained in Section II). The “substantive” and “procedural” analyses that have appeared in our case law are variations on that calculus. 3 A line of cases recognizes that a violation of a substantive statutory right to obtain truthful information is a sufficiently concrete injury to confer standing. See FEC v. Akins, 524 U.S. 11, 21 (1998); Havens Realty Corp. v. Coleman, 455 U.S. 363, 374–75 (1982); Syed, 853 F.3d at 499. Nevertheless, the FCRA provision challenged in this case does not confer a substantive right to obtain a receipt. See 15 U.S.C. § 1681c(g). And, in any event, Bassett’s receipt contains truthful information. arbitrary, and thus bears minimally on whether Bassett suffered a concrete injury in fact.

To the extent the FCRA arguably creates a “substantive right,” it rests on nondisclosure of a consumer’s private financial information to identity thieves. See Bateman, 623 F.3d at 717 (describing the FCRA’s card number redaction requirements as “an effort to combat identity theft”). We recently held, for example, that a statute barring video service providers from disclosing knowingly and without consent a consumer’s “personally identifiable information” to third parties establishes a “substantive right to privacy.” See Eichenberger, 876 F.3d at 982–84. But here, Bassett’s private information was not disclosed to anyone but himself, and therefore no such substantive right was invaded. See id. at 983–84 (noting that whereas “the FCRA outlines procedural obligations that sometimes protect individual interests, the [Video Privacy Protection Act] identifies a substantive right to privacy that suffers any time a video service provider discloses otherwise private information” to a third party).

Bassett’s allegations of FCRA procedural violations also do not “entail a degree of risk sufficient to meet the concreteness requirement.” Spokeo, 136 S. Ct. at 1550. In assessing violations of procedural statutory rights, we consider whether “the specific procedural violations alleged . . . actually harm, or present a material risk of harm to [Bassett’s] interests.” Robins, 867 F.3d at 1113.

Bassett did not allege that another copy of the receipt existed, that his receipt was lost or stolen, that he was the victim of identity theft, or even that another person apart from his lawyers viewed the receipt. See Meyers, 843 F.3d at 727. Nor did he allege that any risk of harm is real, “not conjectural or hypothetical,” given that he could shred the

BASSETT V. ABM PARKING SERVICES 15

offending receipt along with any remaining risk of disclosure. Lujan, 504 U.S. at 560.

Like the dissemination of an incorrect zip code, it is difficult to see how issuing a receipt to only the card owner and with only the expiration date, “without more, could work any concrete harm.” Spokeo, 136 S. Ct. at 1550. Indeed, Congress found that receipts like Bassett’s that truncate the credit card number but reveal the expiration date “prevent[] a potential fraudster from perpetrating identity theft or credit card fraud.” 122 Stat. at 1565. Bassett’s theory of “exposure” to identity theft is therefore “too speculative for Article III purposes.” See Missouri ex rel. Koster v. Harris, 847 F.3d 646, 654 (9th Cir. 2017) (quoting Lujan, 504 U.S. at 564 n.2); see also Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013) (a “threatened injury must be certainly impending to constitute injury in fact” (quoting Whitmore v. Arkansas, 495 U.S. 149, 158 (1990)). 4

We need not answer whether a tree falling in the forest makes a sound when no one is there to hear it. But when this receipt fell into Bassett’s hands in a parking garage and no identity thief was there to snatch it, it did not make an injury.

AFFIRMED.

4 It is no help to Bassett that some courts have found injuries sufficiently concrete where plaintiffs alleged theft of their private information, even when that information had not yet been used against them (e.g., no fraudulent charges had been made). See Galaria v. Nationwide Mut. Ins. Co., 663 F. App’x 384, 387–89 (6th Cir. 2016); Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 693 (7th Cir. 2015); Krottner v. Starbucks Corp., 628 F.3d 1139, 1142–43 (9th Cir. 2010). Bassett alleged no such theft.