Dr. David S. Muransky v. Godiva Chocolatier, Inc.

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 1 of 148

[PUBLISH]

IN THE UNITED STATES COURT OF APPEALS

FOR THE ELEVENTH CIRCUIT

________________________

No. 16-16486 & 16-16783

________________________

D.C. Docket No. 0:15-cv-60716-WPD

DR. DAVID S. MURANSKY,

individually and on behalf of all others similarly situated,

Plaintiff - Appellee,

JAMES H. PRICE,

ERIC ALAN ISAACSON,

Interested Parties - Appellants

versus

GODIVA CHOCOLATIER, INC.,

a New Jersey corporation,

Defendant - Appellee.

________________________

Appeals from the United States District Court

for the Southern District of Florida

________________________

(October 28, 2020)

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 2 of 148

Before WILLIAM PRYOR, Chief Judge, WILSON, MARTIN, JORDAN,

NEWSOM, BRANCH, GRANT, LUCK, LAGOA, ED CARNES,* Circuit

Judges.**

GRANT, Circuit Judge, delivered the opinion of the Court, in which WILLIAM

PRYOR, Chief Judge, NEWSOM, BRANCH, LUCK, LAGOA, and ED

CARNES, Circuit Judges, joined.

GRANT, Circuit Judge:

In Spokeo, Inc. v. Robins, the Supreme Court took on a standing question

that had bedeviled litigants, scholars, and lower courts—whether pleading that a

statutory requirement was violated is enough to establish standing, even if the

plaintiff suffered no injury from the alleged violation. The answer was a

resounding no: a party does not have standing to sue when it pleads only the bare

violation of a statute.

That holding left the class action litigants here in an awkward spot. Years

ago, the named plaintiff pleaded this case as a pure statutory violation. He alleged

that Godiva chocolate stores had printed too many credit card digits on hundreds of

thousands of receipts over the course of several years, and pointed out that those

extra numbers were prohibited under a federal law aimed at preventing identity

theft. His complaint disclaimed any recovery for actual damages, and why not—

with per-violation statutory damages of up to $1,000, the potential class recovery

*

We heard this case en banc while Judge Ed Carnes was an active judge, and he elected to

continue to participate in the decision of this case after becoming a senior circuit judge. See

Eleventh Circuit Rule 35-9 (“Senior circuit judges of the Eleventh Circuit . . . may continue to

participate in the decision of a case that was heard or reheard by the court en banc at a time when

such judge was in regular active service.”); see also Gogel v. Kia Motors Mfg. of Ga., Inc., 967

F.3d 1121, 1125 n.** (11th Cir. 2020) (en banc).

**

Judge Rosenbaum and Judge Jill Pryor are recused. Judge Andrew Brasher joined the Court on

June 30, 2020, and did not participate in this decision.

2

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 3 of 148

was staggering even if no one actually suffered any harm. Godiva, it seems, also

found the potential damages staggering, and the parties agreed on a class

settlement not too long after the lawsuit was filed.

So why are the litigants in an awkward spot? As they admitted in the district

court, Spokeo was on the horizon during settlement talks, but had not yet been

decided; it formed an ominous backdrop for their negotiations. Both parties had an

interest in settling before that case was decided, because the Supreme Court’s

decision was likely to shift the bargaining calculus dramatically. So they settled.

And having reached a deal in the shadow of Spokeo, neither side was ready to start

all over after it was decided. Together, they pushed through the class fairness

hearing, and landed here for a fairness review after a few class members objected

to the settlement.

But even if the parties wish to bargain around Spokeo, we cannot indulge

them. Federal courts retain our constitutional duty to evaluate whether a plaintiff

has pleaded a concrete injury—even where Congress has said that a party may sue

over a statutory violation. Having shut his eyes and closed his ears to the

requirements of Spokeo while his claims were still at the district court, the named

plaintiff now tries to say that those claims surely show concrete injury under

Spokeo in any event. He has done his best to argue that the statutory violation he

alleged carries with it both harm and risk of harm—and does so every time. But

the emperor still has no clothes; the bare procedural violation the plaintiff alleges is

just as bare as it ever was. Because the plaintiff alleged only a statutory violation,

and not a concrete injury, he has no standing. That means we cannot evaluate the

3

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 4 of 148

fairness of the parties’ settlement, and we vacate the district court’s order

approving it.

I.

A.

Before turning to why alleging the violation of a statute is not enough to

establish standing, we should say a few words about the statute at issue here. The

Fair and Accurate Credit Transactions Act sets out a wide range of protections and

procedures. Pub. L. No. 108-159, 117 Stat. 1952 (2003). One of the (many) stated

goals of the legislation is “to prevent identity theft.” Id. In support of that goal,

FACTA forbids merchants from printing more than the last five digits of the card

number (or the card’s expiration date) on receipts offered to customers. Id. sec.

113, § 605(g), 117 Stat. at 1959 (codified at 15 U.S.C. § 1681c(g)(1)). A willful

violation exposes a company to liability for actual damages—if any were

sustained—or statutory damages ranging from $100 to $1,000 per violation. 15

U.S.C. § 1681n(a)(1)(A). Punitive damages and attorney’s fees are also available.

Id. § 1681n(a)(2)–(3).

Several years after the passage of FACTA, in response to “hundreds” of

lawsuits seeking damages because credit card expiration dates had been printed on

receipts—lawsuits that otherwise contained no “allegation of harm to any

consumer’s identity”—Congress enacted what’s known as the Clarification Act.

Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241

§ 2(a)(4)–(5), 122 Stat. 1565, 1565 (2008). That law retroactively eliminated

liability for merchants who had printed credit card expiration dates on receipts but

4

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 5 of 148

complied with the other receipt-printing limitations. Id. sec. 3, § 616(d), 122 Stat.

at 1566 (codified at 15 U.S.C. § 1681n(d)). The Clarification Act offered a

subsequent Congress’s view that some technical FACTA violations caused

consumers no harm: the statute’s stated “purpose” was to protect “consumers

suffering from any actual harm” while also “limiting abusive lawsuits” that would

drive up costs to consumers without offering them any actual protection. Id.

§ 2(b), 122 Stat. at 1566.

B.

With that background, we return to the allegations in front of us. Dr. David

Muransky used his credit card to spend $19.26 at a Godiva retail store in Florida.

He was handed a receipt containing the first six and last four digits of his sixteen-

digit credit card number—too many digits under FACTA.

Muransky got busy, filing a class action complaint against Godiva less than

a week later. He alleged that Godiva had willfully printed more digits than the law

allowed and that the excess digits were a national problem for the company.

Muransky’s complaint made clear that the alleged FACTA violations were

“statutory in nature” and that the suit was expressly “not intended to request any

recovery for personal injury.” He alleged the class’s harm, and risk of harm, from

those statutory violations in broad terms: “Plaintiff and the members of the class

have all suffered irreparable harm as a result of the Defendant’s unlawful and

wrongful conduct,” and “Plaintiff and members of the class continue to be exposed

to an elevated risk of identity theft.” No additional details were offered.

5

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 6 of 148

The class of injured persons that Muransky proposed consisted of anyone in

the United States who, in the two preceding years, received a point-of-sale receipt

from Godiva that displayed more than the last five digits of their credit or debit

card number. He sought statutory damages, punitive damages, and costs—as well

as attorney’s fees. Because of the size of the putative class, Godiva faced a

startling liability of more than $342 million.

After a few motions to dismiss were rejected, Godiva’s answer to the

complaint included a standing argument: “Neither Dr. Muransky nor any member

of the proposed class has suffered any injury in fact. They therefore lack standing

to prosecute their alleged claims.”

Given the dramatic size of the potential damages, it is no surprise that the

parties soon began settlement negotiations. They tried to move quickly—both

Muransky and Godiva admit that one of the driving forces in those negotiations

was the Supreme Court’s impending decision in Spokeo, Inc. v. Robins, 136 S. Ct.

1540 (2016). As Muransky later told the trial court, “the class faced considerable

uncertainty with regard to the Supreme Court’s anticipated decision in Spokeo, Inc.

v. Robins which, depending on the outcome, could have resulted in the case’s

dismissal for failure to present an injury in fact.” Godiva’s briefing acknowledged

the same—the potential outcome of Spokeo factored heavily into the settlement

negotiations.

The flush of negotiations led to an agreement in principle to settle the case:

Godiva would pay $6.3 million instead of the $342 million initially sought.

Almost a third of the pot, $2.1 million, would go to the class attorneys, with an

6

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 7 of 148

additional $10,000 going to Muransky “for his service as Class Representative.”

The average class member, according to Muransky, would net about $60 when all

was said and done.

With Spokeo still outstanding, the district court certified the class, granted

preliminary approval of the settlement, and directed notice to the class members.

Four class members filed various objections after they heard about the suit—

including Appellants James Price and Eric Isaacson—though none of the objectors

initially argued that Muransky lacked standing.

But by the time the district court held a fairness hearing on the proposed

settlement, things had changed: the Supreme Court had issued its decision in

Spokeo. Objector Isaacson took notice, and argued to the district court that it had

an obligation to examine whether Muransky’s claim satisfied the requirements of

Article III standing as described in Spokeo. Muransky, he said, bore the burden of

establishing the elements of standing as the party invoking federal jurisdiction—

and in the absence of standing, the district court “would have no choice” but to

dismiss the case. Neither Godiva nor Muransky offered anything in response.

Roughly a week later, the district court—without addressing Spokeo or

Article III standing—approved the class settlement. The court instead offered a

general conclusion that it had “jurisdiction over the subject matter of this

litigation,” before going on to approve the settlement. Isaacson and Price

appealed.

Objector Price raised the same issues he raised below—the contents of the

class notice, the attorney’s fee award, and the incentive award to Muransky.

7

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 8 of 148

Objector Isaacson, in addition to several other objections, offered the one we face

here today: that the court lacked Article III jurisdiction to approve the settlement

because Muransky had not suffered an injury in fact.

A panel of our Court disagreed, affirming the settlement’s approval after

concluding that Muransky had satisfied the requirements of Article III—even

considering Spokeo. A few months later, the panel vacated its first opinion and

issued a new one in its place. Although the superseding opinion contained a

revised standing analysis, it reached the same conclusions as the first: Muransky

had Article III standing, the objections failed on the merits, and the class settlement

was properly approved.

The panel’s new standing analysis resulted in a categorical rule: “if Congress

adopts procedures designed to minimize the risk of harm to a concrete interest,

then a violation of that procedure that causes even a marginal increase in the risk of

harm to the interest is sufficient to constitute a concrete injury.” Muransky v.

Godiva Chocolatier, Inc., 922 F.3d 1175, 1188 (11th Cir.), reh’g en banc granted,

opinion vacated, 939 F.3d 1278 (11th Cir. 2019). The level of risk required was

alternatively described as “no more than an identifiable trifle.” Id. at 1186

(quotation marks and citation omitted). So in the panel’s view, by setting out a

statutory requirement for the number of digits on a receipt, Congress had judged

that any violation of that requirement would increase the consumer’s risk of

identity theft—and this Court was bound to accept that congressional assessment

of injury. See id. at 1188.

8

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 9 of 148

In response, the full Court ordered rehearing en banc and vacated the panel

opinion. In a testament to the complications of this case, the four parties offer

different perspectives on Muransky’s Article III standing. Objector Isaacson

maintains that Muransky lacks standing because he was not injured and says this

case should be dismissed. Muransky and Objector Price both argue that Muransky

has standing (though they disagree about the merits of the settlement approval).

For its part, Godiva declines to offer the Court any perspective at all, claiming that

it is “prevented from answering this question” by the settlement agreement.

II.

Whether the plaintiffs have standing to sue is a threshold jurisdictional

question that we review de novo. Debernardis v. IQ Formulations, LLC, 942 F.3d

1076, 1083 (11th Cir. 2019).

III.

At the heart of this case is one question: whether the judiciary must assume

that whenever Congress creates a legal entitlement, any violation of that

entitlement causes a concrete injury. Although courts “sometimes make standing

law more complicated than it needs to be,” a well-trod path leads us to the answer

here. Thole v. U.S. Bank N.A., 140 S. Ct. 1615, 1622 (2020). The Supreme Court

“has rejected the argument that ‘a plaintiff automatically satisfies the injury-in-fact

requirement whenever a statute grants a person a statutory right and purports to

authorize that person to sue to vindicate that right.’” Id. at 1620 (quoting Spokeo,

136 S. Ct. at 1549). And that rejection is derived from the now-familiar

admonition that alleging a “bare procedural violation, divorced from any concrete

9

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 10 of 148

harm” is not enough to support standing. Spokeo, 136 S. Ct. at 1549. So, even

considering the welter of standing doctrines that can clutter our analysis, we know

one thing to be true—alleging a statutory violation is not enough to show injury in

fact.

Why not? Article III of the Constitution limits federal courts to deciding

“Cases” or “Controversies.” U.S. Const. art. III, § 2. The existence of a case or

controversy is a “bedrock requirement” of our jurisdiction; we cannot exercise

judicial power without it. Raines v. Byrd, 521 U.S. 811, 818 (1997) (quoting

Valley Forge Christian Coll. v. Ams. United for Separation of Church and State,

Inc., 454 U.S. 464, 471 (1982)). So in order to find out if we can hear a party’s

claim, we need to consider whether that party has a case or controversy rather than,

say, a strong and abiding interest in an issue, or a desire to obtain attorney’s fees.

Standing, ripeness, and mootness are three traditional doctrines governing

whether a case or controversy exists. Standing—“perhaps the most important of

the jurisdictional doctrines”—is the only one at issue here. FW/PBS, Inc. v. City of

Dallas, 493 U.S. 215, 231 (1990) (quoting Allen v. Wright, 468 U.S. 737, 750

(1984)) (alterations adopted). For a party to have standing to bring a lawsuit, it

must have “(1) suffered an injury in fact, (2) that is fairly traceable to the

challenged conduct of the defendant, and (3) that is likely to be redressed by a

favorable judicial decision.” Spokeo, 136 S. Ct. at 1547 (citing Lujan v. Defs. of

Wildlife, 504 U.S. 555, 560–61 (1992)). In plainer language, the plaintiff needs to

show that the defendant harmed him, and that a court decision can either eliminate

the harm or compensate for it. That standard applies equally in the class action

10

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 11 of 148

setting; a district court is “powerless to approve a proposed class settlement” if “no

named plaintiff has standing.” Frank v. Gaos, 139 S. Ct. 1041, 1046 (2019).

Our inquiry becomes narrower as we move down the standing decision tree;

injury is the only element we need to consider here. At the pleading stage of a

case, “general factual allegations of injury” can suffice. Lujan, 504 U.S. at 561.

But that is not a free pass—these general factual allegations must “plausibly and

clearly allege a concrete injury.” Thole, 140 S. Ct. at 1621; see also Ashcroft v.

Iqbal, 556 U.S. 662, 678–79 (2009); Bell Atl. Corp. v. Twombly, 550 U.S. 544,

555–56 (2007); Salcedo v. Hanna, 936 F.3d 1162, 1168 (11th Cir. 2019). “[M]ere

conclusory statements do not suffice.” Iqbal, 556 U.S. at 678 (punctuation

omitted). Although Iqbal and Twombly have put a finer point on it, this standard is

not new—it’s long been known that even at the pleading stage, the “litigant must

clearly and specifically set forth facts” to satisfy the requirements of Article III.

Whitmore v. Arkansas, 495 U.S. 149, 155 (1990). We will not “imagine or piece

together an injury sufficient to give [a] plaintiff standing when it has demonstrated

none,” and we are powerless to “create jurisdiction by embellishing a deficient

allegation of injury.” Miccosukee Tribe of Indians of Fla. v. Fla. State Athletic

Comm’n, 226 F.3d 1226, 1229–30 (11th Cir. 2000) (citing Whitmore, 495 U.S. at

155).

What is required, then? A plaintiff needs to plead (and later support) an

injury that is concrete, particularized, and actual or imminent, rather than

11

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 12 of 148

conjectural or hypothetical.1 See Spokeo, 136 S. Ct. at 1548 (quoting Lujan, 504

U.S. at 560). Our inquiry narrows again; we only consider concreteness here. A

lot of ink has been spilled to explain what concrete means, but the best word may

also be the simplest—“real.” Id. And statutory violations do not—cannot—give

us permission to offer plaintiffs a wink and a nod on concreteness. Plaintiffs must

show, and the courts must ensure, that an alleged injury is concrete, or else we

have no jurisdiction to consider it. Id. at 1548–49.

As the parties recognized—or, less charitably, feared—during their

settlement negotiations, the Supreme Court’s Spokeo, Inc. v. Robins decision is

central to our concreteness analysis. That’s because Spokeo was not only about

concreteness; it was also about Congress. Spokeo cautioned that “Congress’ role in

identifying and elevating intangible harms does not mean that a plaintiff

automatically satisfies the injury-in-fact requirement whenever a statute grants a

person a statutory right and purports to authorize that person to sue to vindicate

that right.” Id. at 1549. So although a congressional judgment may be “instructive

and important” to this Court’s analysis, we need to come to our own conclusion

that the alleged harm is concrete before we can find that a plaintiff has standing.

Id.

1

We note that the burden of establishing these elements of standing continues—and, in fact,

increases—all the way through the litigation. Lujan, 504 U.S. at 561. The elements need to be

supported “with the manner and degree of evidence required at the successive stages of the

litigation”—though what that means at the class settlement stage has been the subject of some

debate. Id. Because Muransky has not offered any allegations beyond those in his complaint,

and because we can resolve the case on the basis of his deficient pleadings, we do not need to

wrestle with that question here.

12

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 13 of 148

Echoing Lujan v. Defenders of Wildlife, the Spokeo decision also

acknowledged that Congress may “elevate to the status of legally cognizable

injuries concrete, de facto injuries that were previously inadequate in law” and that

“Congress has the power to define injuries and articulate chains of causation that

will give rise to a case or controversy where none existed before.” Spokeo, 136 S.

Ct. at 1549 (citation omitted and alterations adopted). Congress can certainly

create new legal entitlements, the denial of which will constitute a concrete injury.

See, e.g., FEC v. Akins, 524 U.S. 11, 21–24 (1998) (inability to obtain information

is an injury in fact); Pub. Citizen v. U.S. Dep’t of Justice, 491 U.S. 440, 449 (1989)

(same). It can also recognize and provide legal remedies for concrete injuries that

already exist, but for which there is no cause of action. But this is a limited

authority to provide legal process relating to actual harms, not a blanket power to

authorize suit in the absence of harm: Congress “cannot erase Article III’s

standing requirements by statutorily granting the right to sue to a plaintiff who

would not otherwise have standing.” Spokeo, 136 S. Ct. at 1548 (quoting Raines,

521 U.S. at 820 n.3). 2

A.

Now to the mechanics of pleading. Plaintiffs can show a concrete, or “real,”

harm in two ways. The first is to show that the statutory violation itself caused a

harm. It’s safe to say that pointing to a direct harm is the most straightforward way

2

Our dissenting colleague’s long discussion of the public-private rights theory is interesting to

consider as a matter of first principles. See Jordan Dissent at 115–47. But it is also irrelevant to

the work that we have to do as an inferior court in this appeal. That work is to apply the binding

caselaw of the Supreme Court, which does not currently endorse the theory pressed by our

colleague.

13

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 14 of 148

to show a concrete injury—in fact, it’s probably what most people think of

naturally. Such harms can be tangible or intangible. Tangible harms are the most

obvious and easiest to understand; physical injury or financial loss come to mind as

examples.

Claims of intangible harm, on the other hand, can be tricky: some are

concrete, some are not. Violations of the rights to free speech or free exercise, for

instance, are intangible harms that are also both direct and concrete. Spokeo, 136

S. Ct. at 1549 (collecting cases). “[C]onscientious objection” to a law or “fears of

hypothetical future harm”? Not so much. See Diamond v. Charles, 476 U.S. 54,

67 (1986); Clapper v. Amnesty Int’l USA, 568 U.S. 398, 416 (2013). And

questions of whether alleged intangible harms are concrete have an extra wrinkle

when the plaintiff’s claim stems from the violation of a statute.

Shedding some light on how to draw that difficult line, Spokeo instructs that

we may consider “both history and the judgment of Congress.” Spokeo, 136 S. Ct.

at 1549. History first—by looking to history, we can discern a concrete injury

where the “intangible harm has a close relationship to a harm that has traditionally

been regarded as providing a basis for a lawsuit in English or American courts.”

Id. The fit between a new statute and a pedigreed common-law cause of action

need not be perfect, but we are called to consider at a minimum whether the harms

match up between the two. Likewise, congressional judgment may illuminate a

concrete injury because, as a body, Congress “is well positioned to identify

intangible harms that meet minimum Article III requirements.” Id. But as we have

already explained, congressional judgment only goes so far, and does not relieve

14

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 15 of 148

the judiciary of our constitutional duty to independently determine whether the

plaintiff has suffered a concrete injury.

Our own post-Spokeo precedent illustrates how both history and

congressional judgment can fit into the concreteness analysis. In several cases, we

have concluded that a plaintiff had standing because the statutory violation at issue

led to a type of harm that has historically been recognized as actionable. For

example, we held that CNN’s dissemination of a plaintiff’s news-viewing history

to a third-party, in violation of the Video Privacy Protection Act, could constitute a

concrete injury because it was analogous to torts that were well-established in

American courts—namely, invasion of privacy and intrusion upon seclusion.

Perry v. Cable News Network, Inc., 854 F.3d 1336, 1340–41 (11th Cir. 2017). We

reached a similar conclusion when we held that an agency’s violation of the Fair

Credit Reporting Act—offering an allegedly inaccurate statement in a plaintiff’s

credit report—was analogous to the longstanding tort for publication of defamatory

material. Pedro v. Equifax, Inc., 868 F.3d 1275, 1279–80 (11th Cir. 2017).

We have also relied on the judgment of Congress to discern concrete

injuries. In Debernardis v. IQ Formulations, LLC, for instance, we considered the

plaintiffs’ claim that they were sold an adulterated dietary supplement as defined

by the Food, Drug, and Cosmetic Act because the manufacturer failed to provide

notice to the Food and Drug Administration that a new dietary ingredient was safe.

942 F.3d at 1080–82. Although the plaintiffs suffered no physical harm from the

supplement, we concluded that they were sold a worthless product “that Congress

judged insufficiently safe for human ingestion.” Id. at 1085. That deprived the

15

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 16 of 148

plaintiffs of the benefit of their bargain and amounted to a direct economic loss

that supported standing. Id. at 1085–86. In short, a variety of approaches can

demonstrate direct harm to a plaintiff.

Even without any direct harm, a plaintiff can establish an injury in fact by

showing that a statutory violation created a “risk of real harm.” Spokeo, 136 S. Ct.

at 1549 (citing Clapper, 568 U.S. 398). But while very nearly any level of direct

injury is sufficient to show a concrete harm, the risk-of-harm analysis entails a

more demanding standard—courts are charged with considering the magnitude of

the risk. That means we evaluate whether the claimed “procedural

violations . . . entail a degree of risk sufficient to meet the concreteness

requirement.” Id. at 1550.

If some degrees of risk are called sufficient, that means others must be

insufficient. Although Spokeo did not trace a numerical line between the two, it

did explain that the risk must be “material.” Id. That’s a familiar word that, in this

context, means “important; essential; relevant.” New Oxford American Dictionary

(3d ed. 2010); see also The American Heritage Dictionary of the English Language

(5th ed. 2018) (“Being both relevant and consequential; crucial.”). We recognize

that “material risk of harm” is a somewhat indefinite term. Spokeo, 136 S. Ct. at

1550; Nicklaw v. CitiMortgage, Inc., 839 F.3d 998, 1002–03 (11th Cir. 2016). One

thing is definite, however. Whatever “material” may mean, conceivable and

trifling are not on the list.

And for all the things that Spokeo broke new ground on, the high standard

for risk of harm was not one of them. The Supreme Court has long indicated that

16

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 17 of 148

standing predicated on a risk of harm must be based on something more than a

minor or theoretical risk—“a ‘substantial risk’ that the harm will occur,” for

example. Clapper, 568 U.S. at 414 n.5 (citation omitted). Other cases use slightly

different formulations to describe a significant or substantial risk, but they are

consistent in recognizing a high standard for the risk-of-harm analysis, and a robust

judicial role in assessing that risk. See, e.g., Thole, 140 S. Ct. at 1622

(“substantially increased risk”); Dep’t of Commerce v. New York, 139 S. Ct. 2551,

2565 (2019) (“a substantial risk that the harm will occur” (quoting Susan B.

Anthony List v. Driehaus, 573 U.S. 149, 158 (2014))); Monsanto Co. v. Geertson

Seed Farms, 561 U.S. 139, 153, 155 (2010) (“substantial risk” or “significant

risk”); Pennell v. City of San Jose, 485 U.S. 1, 8 (1988) (“realistic danger of

sustaining a direct injury” (citation omitted)); Blum v. Yaretsky, 457 U.S. 991,

1000 (1982) (a “sufficiently substantial” threat). We do not see, we should add, a

“material” or “substantial” difference among these terms, and the Supreme Court

has not suggested one.

Our Court has already put this standard to work. In Nicklaw v.

CitiMortgage, Inc., we concluded that a plaintiff had suffered neither direct harm

nor a “material risk of harm” when his mortgage company recorded the discharge

of his debt later than it should have. 839 F.3d at 1000, 1003. The plaintiff, after

all, had brought his lawsuit two years after the lender had finally (albeit tardily)

fulfilled its duty, and there was no allegation that the lender’s earlier failure had

already injured him or would pose any risk in the future. Id. at 1003. With neither

17

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 18 of 148

a direct harm nor a material risk of harm, the plaintiff had suffered no concrete

injury. See id.

We add that the lack of a numerical standard governing the quantum of risk

that is sufficient to support standing does not mean that the standard is zero, that

the standard is minimal, or that we simply defer to Congress. And the limits on

congressional authority do not disappear when the statutory right at issue protects

against a risk of future harm; it would be backwards to say that Congress gets less

than complete deference when it seeks to identify actual harm, but is due blind,

unreviewable deference if it seeks to protect against a risk of actual harm. The

same is true for pleading requirements. A conclusory statement that a statutory

violation caused an injury is not enough, so neither is a conclusory statement that a

statutory violation caused a risk of injury.

B.

To boil down the lessons above, we consider two things when we evaluate

whether concrete harm flows from an alleged statutory violation—and thus

whether the plaintiff has standing. First, we ask if the violation itself caused harm,

whether tangible or intangible, to the plaintiff. If so, that’s enough. If not, we ask

whether the violation posed a material risk of harm to the plaintiff. If the answer to

both questions is no, the plaintiff has failed to meet his burden of establishing

standing.3

3

We will confess that we find ourselves somewhat perplexed by our dissenting colleague’s

repeated assertions that we believe only identity theft can cause injury under FACTA. See

Wilson Dissent at 36, 42–43, 47. Both identity theft and a material risk of identity theft plainly

qualify as injuries under that statute and under this opinion. Nor do we see how interpreting the

18

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 19 of 148

The heart of Muransky’s claim is that “he was provided with an

electronically printed receipt” that “displayed the last four digits of his credit card

as well as the first six digits of his account number” and that, because of this type

of violation, he and other class members “have all suffered irreparable harm” and

“continue to be exposed to an elevated risk of identity theft.” And, as we have

explained, the complaint emphasizes that the wrongs committed by Godiva are

“statutory in nature” and expressly disclaims any recovery for “personal injury”

arising from the violations.

Relying on these allegations, all of which are grounded in the statute,

Muransky now argues that the extra digits on his receipt can be counted as a

concrete injury in four different ways. Three of his arguments suggest that the

statutory violation itself—his receipt of the receipt—caused him a direct harm. His

alternative argument is that the violation exposed him to an increased risk of

identity theft. But Muransky’s efforts to recharacterize the statutory violation he

pleaded to fit within Spokeo’s limits demonstrate, if anything, a commitment to the

idea that the violation alone must somehow be enough.

1.

His first argument is that he had a “substantive right” to a properly truncated

receipt, and that the violation of that right, “by itself, is a concrete injury.” This

interest protected by FACTA as avoidance of “risk of identity theft” moves the ball. To begin,

this opinion makes clear that anyone who properly pleads a material risk of identity theft would

have standing. Second, if the harm the statute protects against is “risk of identity theft” rather

than “identity theft,” that would mean that we would need to consider whether a statutory

violation led to a material risk of a risk of identity theft. We fail to see how that word-soup

analysis would help plaintiffs in any event—either they suffer a material risk of harm or they do

not.

19

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 20 of 148

argument gets at the core of his complaint’s allegations—statutory-violation-qua-

injury was the predominant theory of harm throughout the litigation. Muransky

also presses a new argument that the (unpleaded) efforts he took to safeguard his

receipt qualify as an injury in fact. Finally, he pivots to historical analogue,

asserting that the mishandling of his account information is actionable because it

bears a close resemblance to a common-law breach of confidence. None of these

direct-injury claims holds up.

i.

We have already explained the key holding from Spokeo: a “bare procedural

violation, divorced from any concrete harm” is not enough to establish an Article

III injury. Spokeo, 136 S. Ct. at 1549. But we restate the point here to explicitly

reject any argument that the complaint’s conclusory statement that “Plaintiff and

the members of the class have all suffered irreparable harm as a result of the

Defendant’s unlawful and wrongful conduct” is enough to show concrete injury;

that claim would be so flimsy after Spokeo (not to mention Iqbal) that Muransky

himself does not raise it. Nothing in FACTA suggests some kind of intrinsic worth

in a compliant receipt, nor can we see any. So it makes little sense to suggest that

receipt of a noncompliant receipt itself is a concrete injury.

To resist the force of that intuition, Muransky attempts to reframe the nature

of his injury by relying on a fuzzy distinction between “substantive” and

“procedural” rights. He argues that Godiva’s statutory violation deprived him of a

substantive right to receive “a properly truncated receipt,” and that the violation of

a substantive right, unlike a procedural right, automatically inflicts an injury in

20

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 21 of 148

fact—even if it causes no harm. This, it turns out, is a dressed up version of the

same argument that the Eighth Circuit accepted before Spokeo, but had to walk

back after it: “Our prior statement that ‘[i]njury in fact may thus be shown solely

by the invasion of a legal right that Congress created,’ is no longer good law in

light of the Supreme Court’s subsequent holding in Spokeo, Inc. v. Robins [that]

‘Article III standing requires a concrete injury even in the context of a statutory

violation.’” Golan v. FreeEats.com, Inc., 930 F.3d 950, 957–58 (8th Cir. 2019)

(quotation marks and citations omitted).

In an attempt to resuscitate that argument, Muransky contends that the

holding in Spokeo applies only to what he calls “procedural” statutory violations,

and not to what he calls “substantive” ones. He argues that Spokeo confirms his

view when it says that even a procedural violation “can be sufficient in some

circumstances to constitute injury in fact.” Spokeo, 136 S. Ct. at 1549. Muransky

is absolutely right that Spokeo makes this point, but he’s absolutely wrong that it

saves his claim.

Spokeo’s statement stands for the unremarkable proposition that, in some

cases, the violation of a procedural right set out in a statute will necessarily result

in the harm that Congress was trying to prevent. A prime example is the illegal

deprivation of information: “a plaintiff suffers an ‘injury in fact’ when the plaintiff

fails to obtain information which must be publicly disclosed pursuant to a statute.”

Akins, 524 U.S. at 21 (citation omitted); see also Havens Realty Corp. v. Coleman,

455 U.S. 363, 373 (1982) (denial of “legal right to truthful information about

available housing” is an Article III injury). That, the Supreme Court has already

21

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 22 of 148

made clear, is not a “bare” procedural violation, or one that is “divorced from any

concrete harm”; if a statute protects against a lack of information, the denial of

access to information is a concrete injury. For FACTA, on the other hand, a

violation of the statute does not directly result in the harm Congress was trying to

prevent. That is, no one’s identity is stolen at the moment a receipt is printed with

too many digits. See Pub. L. No. 108-159, 117 Stat. at 1952 (a goal of FACTA is

“to prevent identity theft”).

So while some statutory violations, by their very nature, will be coextensive

with the harm that Congress was trying to prevent, labels do not control our

analysis. We are not the first court to recognize that arguments grounded in a

distinction between substantive and procedural rights miss the point and are

“unconvincing” because they depend “entirely on the framing of the right.”

Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 782 (9th Cir. 2018); see also

Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 n.2 (7th Cir. 2016).

The question, always, is whether an injury in fact accompanies a statutory

violation.

Confronting this argument again also feels a little like Groundhog Day,

because we already rejected it in Nicklaw. There, the plaintiff claimed that,

because “the New York legislature intended to create a substantive right to have

the certificate of discharge timely recorded,” the plaintiff automatically suffered a

concrete injury when the discharge was untimely filed. 839 F.3d at 1002

(emphasis added). There too, we held that the “relevant question” was “whether

Nicklaw was harmed when this statutory right was violated.” Id. The point is that

22

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 23 of 148

for standing purposes, no matter what label you hang on a statutory violation, it

must be accompanied by a concrete injury.

We thus continue to adhere to our decision in Nicklaw. Muransky’s

assertion that he does not need to show anything more than a noncompliant receipt

because his statutory right was “substantive” cannot be squared with our

precedent—or with the central holding of Spokeo. To avoid “alleging a bare

procedural violation,” the plaintiff must show either some harm caused by the

violation or a material risk of harm. Spokeo, 136 S. Ct. at 1550. What Muransky

has missed is that the word “bare” is just as important as the word “procedural.”

ii.

Perhaps suspecting that a statutory violation alone would no longer be

sufficient after we considered Spokeo, Muransky claims on appeal that the time he

spent safeguarding his receipt also constitutes a direct injury in fact.

Although we have held that “allegations of wasted time can state a concrete

harm for standing purposes,” we have also declined to find standing when no such

allegations were pleaded. Salcedo, 936 F.3d at 1173. In Salcedo, we rejected the

plaintiff’s assertion at oral argument that receiving unwanted text messages caused

him to waste time. Id. at 1168. We did so for a simple reason: his complaint

lacked any “specific time allegation.” Id. So too here. Muransky never alleged

that he treated his Godiva receipt differently than any other, or that he spent any

additional time safeguarding it.

But even if Muransky had alleged that he spent additional time destroying or

safeguarding his receipt, he would not succeed on this theory. Where a

23

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 24 of 148

“hypothetical future harm” is not “certainly impending,” plaintiffs “cannot

manufacture standing merely by inflicting harm on themselves.” Clapper, 568

U.S. at 416, 422. Muransky is no different than the Clapper plaintiffs in this

respect—his management-of-risk claim is bound up with his arguments about

actual risk. If his Godiva receipt would not offer any advantage to identity thieves,

we could hardly say that he was injured because of the efforts he took to keep it out

of their hands. To be fair, we have not yet addressed Muransky’s risk-of-harm

claims, but any assertion of wasted time and effort necessarily rises or falls along

with this Court’s determination of whether the risk posed by Godiva’s FACTA

violation, as pleaded by Muransky, is itself a concrete harm.

iii.

In his final attempt to show a direct harm, Muransky argues—for the first

time—that Godiva’s FACTA violation is analogous to a common-law breach of

confidence tort. To succeed on this theory, he needs to show that the violation

bears “a ‘close relationship’ to a traditionally redressable harm.” Salcedo, 936

F.3d at 1172 (quoting Spokeo, 136 S. Ct. at 1549). His argument proceeds along

the following lines: FACTA requires merchants to keep credit card information

secret. By handing him a receipt with too many digits of his credit card number

exposed, Godiva “disclosed” information that he provided in confidence and gave

criminals “easy access” to it. Because that disclosure (to him) bears a close

relationship to the common-law breach of confidence tort, he says, it qualifies as a

concrete harm.

24

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 25 of 148

Not so fast. As an initial matter, the parties dispute whether a breach of

confidence tort can fairly be said to have “traditionally been regarded as providing

a basis for a lawsuit in English or American courts.” Spokeo, 136 S. Ct. at 1549.

There is arguable support for both views in academic literature and caselaw. As a

1982 note cited by both Muransky and Isaacson explains, following its recognition

in 1849, “the breach of confidence tort has become the basis of an extensive body

of law” in England. Alan B. Vickery, Note, Breach of Confidence: An Emerging

Tort, 82 Colum. L. Rev. 1426, 1452–54 (1982). But that same source goes on to

state that the “law of breach of confidence in the United States, at least with

respect to personal information, has not enjoyed a similar development,” and that

the tort was “emerging” in a “rudimentary” form after initially dying “out in its

infancy.” Id. at 1451–52, 1454. The observation that the tort was “emerging” in

the 1980s is consistent with the Second Circuit’s 1989 description of a breach of

confidence as “a relative newcomer to the tort family.” Young v. U.S. Dep’t of

Justice, 882 F.2d 633, 640 (2d Cir. 1989).

One of the unexpected consequences of the common-law-analogy approach

to identifying harms is the growing insistence on hammering square causes of

action into round torts. Litigants and courts alike can be drawn into overthinking

what was really a simple instruction: see if a new harm is similar to an old harm.

Another risk is that courts will be unnecessarily drawn into an arcane evaluation of

a tort’s origins. Fortunately, we are not put to that test today. We need not resolve

whether breach of confidence is sufficiently ancient, because even if we assume

25

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 26 of 148

that a breach of confidence was traditionally redressable in English and American

common-law courts, we are unpersuaded by its analogy to the facts of this case.

A breach of confidence, at least as defined by the article cited by the parties,

involves “the unconsented, unprivileged disclosure to a third party of nonpublic

information that the defendant has learned within a confidential relationship.”

Vickery, supra, at 1455; see also Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 114

(3d Cir. 2019); Vassiliades v. Garfinckel’s, 492 A.2d 580, 591 (D.C. 1985).

Godiva’s FACTA violation shares very little with this definition. Two key

elements of a breach of confidence are completely absent from the violation he

complains of. To begin, there was no “disclosure to a third party.” Muransky was

handed a receipt that bore his own information, and he does not allege that anyone

else ever saw it. To describe this act as a “disclosure” would distort the meaning

of the term.

Nor can we see how Muransky could have had a confidential relationship

with the Godiva retail store. A breach of confidence “is rooted in the concept that

the law should recognize some relationships as confidential to encourage

uninhibited discussions between the parties involved.” Young, 882 F.2d at 640; see

also David A. Elder, Privacy Torts § 5:3 (2019). Given this understanding, it is

unsurprising that breach of confidence claims traditionally arise in the context of

close professional relationships—those involving physicians, therapists, financial

institutions, and the like. See, e.g., Suburban Tr. Co. v. Waller, 408 A.2d 758, 764

(Md. Ct. Spec. App. 1979) (bank); Doe v. Roe, 400 N.Y.S.2d 668, 676 (N.Y. Sup.

Ct. 1977) (psychiatrist); Horne v. Patton, 287 So. 2d 824, 829 (Ala. 1973) (medical

26

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 27 of 148

doctor). Handing a common form of payment to a cashier at a retail store is simply

not equivalent to these kinds of vulnerable, confidential relationships.

Because no information was disclosed, and no confidential relationship

existed, the relationship between Godiva’s conduct and a breach of confidence is

anything but “close”: a Godiva clerk handed Muransky a receipt containing a

portion of his own credit card information. The fit between a traditionally

understood harm and a more recent statutory cause of action need not be perfect,

but the association here is too strained. Accordingly, we cannot say—at least

based on a breach-of-confidence theory—that Muransky has pleaded the kind of

injury that “has traditionally been regarded as providing a basis for a lawsuit.”

Spokeo, 136 S. Ct. at 1549.

2.

Because Muransky failed to allege that the FACTA violation caused him a

direct harm, we move on to consider whether he pleaded that the extra digits

caused him to suffer a material risk of harm. In arguing that he did, Muransky

returns, really, to the same point we dismissed earlier: that the inquiry begins and

ends with deference to congressional judgment. As he sees it, by requiring the

truncation of all but the last five digits of a credit card, Congress has decided that

printing additional digits creates a real risk of identity theft. End of story; there is

no role for the courts.

What Muransky asks is for us to abandon our judicial role by merging the

ordinary steps in the analysis—concluding that because the statute protects a

concrete interest, any violation automatically threatens that interest and thus

27

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 28 of 148

supports standing. Although that approach would simplify our job, it is

inconsistent with Spokeo and with what the Constitution demands of us. But first,

as a practical matter, there is good reason to doubt that Congress has deemed every

violation of FACTA to pose a material risk of identity theft. FACTA did not

specifically address the kind of partial truncation that occurred in this case—an

observation made by the Third Circuit when it noted (with respect to an identical

FACTA violation) that the “congressional findings of risk are not tailored to the

FACTA violation . . . pleaded.” Kamal, 918 F.3d at 115–16 n.5. Moreover,

Congress expressly recognized in the Clarification Act that not all violations of the

truncation requirement pose a serious threat to consumers. See Pub. L. No. 110-

241 § 2(b), 122 Stat. at 1566. So Congress itself has made clear that not every

FACTA violation carries with it a risk of harm.

Still, even if Congress had explicitly stated in the text of the statute that

every FACTA violation poses a material risk of harm, that alone would not carry

the day. Although the judgment of Congress is an “instructive and important” tool

to identify Article III injuries, we cannot accept Muransky’s argument that once

Congress has spoken, the courts have no further role. Spokeo, 136 S. Ct. at 1549.

“Congress cannot erase Article III’s standing requirements by statutorily granting

the right to sue to a plaintiff who would not otherwise have standing.” Id. at 1547–

48 (citation omitted). And as Spokeo emphasized, deciding whether a given risk of

harm meets the materiality threshold is an independent responsibility of federal

courts. See Kamal, 918 F.3d at 115 (“But the lesson of Spokeo is that we must

confirm a concrete injury or material risk exists even when Congress confers a

28

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 29 of 148

right of action.”). Indeed, the Spokeo majority’s ultimate instruction to the Ninth

Circuit on remand was to determine “whether the particular procedural violations

alleged in this case entail a degree of risk sufficient to meet the concreteness

requirement.” Spokeo, 136 S. Ct. at 1550. That instruction applies equally here.

It thus falls to us to consider Muransky’s claim. The question is whether

Muransky has alleged a material risk of harm, one that is “sufficient to meet the

concreteness requirement.” Id. Factual allegations that establish a risk that is

substantial, significant, or poses a realistic danger will clear this bar—but

Muransky gives us very little to go on. In his complaint, he offers the naked

assertion that he “and members of the class continue to be exposed to an elevated

risk of identity theft.” Nothing indicates how much risk this might be, however,

and no facts alleged in the complaint provide insight into what degree of “elevated

risk” Muransky faced, or why.

That kind of conclusory allegation is simply not enough. Muransky did not

plead facts that, taken as true, plausibly allege a material risk, or significant risk, or

substantial risk, or anything approaching a realistic danger. See Iqbal, 556 U.S. at

678–79. The thing is, contrary to our dissenting colleague’s assertion, Muransky

did not offer “a general factual contention subject to proof or disproof with

evidence at later stages of litigation.” Jordan Dissent at 101. In fact, he was not

trying to do so, and his own brief headings tell us why. Muransky’s argument to

this Court—still—is that Congress determined that he was put at risk and that

Congress’s judgment of risk is sufficient. And he later adds that he is relieved of

any duty to plead facts supporting a risk of harm because “Congress already found

29

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 30 of 148

the risk substantial.” So instead of actually pleading a material risk of harm, he has

provided us with a threadbare allegation that he was exposed to an increased risk

of identity theft. But an allegation of risk is not excused from the ordinary bar on

conclusory allegations—it would not be (indeed is not here) enough to plead that

“the defendant broke the law and injured me in doing so.” That is, again, merely a

reiteration of the statutory violation. If this pleading is enough to show standing,

then there is no violation of FACTA that would not be.

Late-breaking allegations in unsworn briefs before this Court do not change

that. According to Isaacson (and various amici), the extra numbers on Muransky’s

receipt merely contain information that is already allowed to be printed on it

elsewhere—the card issuer, for example. This observation was credited by the

Second Circuit, which has said that printing “the first six digits of a credit card

. . . is the equivalent of printing the name of the issuing institution.” Katz v. Donna

Karan Co., LLC, 872 F.3d 114, 120 (2d Cir. 2017). For his part, Muransky argues

that the six digits do contain information that can be exploited by identity thieves,

such as the card level or industry program, and that access to it enables identity

thieves to conduct “phishing” inquiries.4 But all of that is really beside the point.

Maybe these facts are true; perhaps they are not. Neither scenario would change

our ruling, which is based on Muransky’s pleading of a statutory violation. He

pleaded nothing about any specific risks from the sequence of numbers included on

his receipt, and did not address the issue before the district court at any time. It

4

Muransky, we note, does not offer this factual assertion to show that he has or can plead an

elevated risk of identity theft, but as support for his argument that we should defer to Congress’s

judgment of risk.

30

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 31 of 148

was his burden to satisfy the court that standing exists, and thus to plead something

more than a conclusory allegation of harm. If anything about Godiva’s violation

subjected him to an increased risk of identity theft, it was Muransky’s burden to

tell the court about it.

Perhaps before Spokeo there was an argument that Muransky’s claim could

have survived as pleaded, but now his allegation—consisting of nothing more than

a “bare procedural violation, divorced from any concrete harm”—is too thin to

survive. Spokeo, 136 S. Ct. at 1549.

3.

The conclusion we reach here—that Muransky has alleged neither a harm

nor a material risk of harm—is in accord with the majority of other circuits to

consider this same question. The Second, Third, and Ninth Circuits have each

considered FACTA violations involving partially truncated credit-card numbers.

All three concluded that the violation created neither a harm nor a material risk of

harm. See Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 106, 119 (3d Cir. 2019);

Noble v. Nevada Checker Cab Corp., 726 F. App’x 582, 583–84 (9th Cir. 2018)

(unpublished); Katz v. Donna Karan Co., LLC, 872 F.3d 114, 117, 121 (2d Cir.

2017). Two out of the three, we should add, were dismissed on the pleadings

without considering extrinsic evidence—just like this case will be. Similarly, after

Spokeo, every circuit to have considered a FACTA violation involving an

undeleted expiration date has held that, without more, it does not confer standing.

See Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 783 (9th Cir. 2018);

31

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 32 of 148

Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 81–82 (2d Cir. 2017);

Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016).5

The only circuit to conclude that a bare violation of FACTA’s receipt

requirements could support standing reached that conclusion on significantly

different facts. Last year, the D.C. Circuit considered a case where a merchant

printed the entire credit card number, as well as the expiration date, on a

customer’s receipt. Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1066 (D.C.

Cir. 2019). Because the merchant “printed all of the information in both

categories” it created “the nightmare scenario FACTA was enacted to prevent” and

provided “sufficient information for a criminal to defraud her.” Id. That factual

scenario is different than the violation Muransky complains about, and we do not

consider it here.

4.

Because Muransky has failed to allege either a harm or a material risk of

harm stemming from the FACTA violation, he lacks standing to bring this lawsuit.

And because federal courts are “powerless to approve a proposed class settlement”

if “no named plaintiff has standing,” we necessarily conclude that the district court

acted without jurisdiction. Frank, 139 S. Ct. at 1046. Accordingly, “we have

jurisdiction on appeal, not of the merits but merely for the purpose of correcting

the error of the lower court in entertaining the suit.” Steel Co. v. Citizens for a

5

Contrary to our dissenting colleague’s assertion, neither we nor our sister circuits have

“misread[] FACTA” any more than the Supreme Court misread FCRA when it required the

plaintiff in Spokeo to plead something beyond the violation of that statute. Wilson Dissent at 36.

We seek only to ensure that the plaintiff has, as he must under the Constitution, an actual

controversy rather than a theoretical one.

32

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 33 of 148

Better Env’t, 523 U.S. 83, 95 (1998) (citation omitted). The proper remedy is for

us to remand to the district court for a dismissal without prejudice. Stalley ex rel.

United States v. Orlando Reg’l Healthcare Sys., Inc., 524 F.3d 1229, 1232, 1234–

35 (11th Cir. 2008).

Muransky complains that at “no time in the district court proceedings was

standing challenged” and suggests that standing was only “mentioned . . . at the

final approval hearing.” Those statements are not completely right. But even if

they were, our decision would not change. As we have said before, it “is not unfair

to require every plaintiff to file a complaint which contains sufficient allegations of

standing.” Church v. City of Huntsville, 30 F.3d 1332, 1336 (11th Cir. 1994).

That lack of unfairness is particularly acute here, where the plaintiff was

aware from the very beginning that his standing was in question and was critical to

the success of his claim. In its answer to the complaint, one of Godiva’s defenses

was that “[n]either Dr. Muransky nor any member of the proposed class has

suffered any injury in fact” and that they “lack standing to prosecute their alleged

claims.” With this defense in the backdrop, both Muransky and Godiva admitted

that Spokeo was a driving force in their settlement negotiations. Muransky himself

admitted that the impending decision in Spokeo, “depending on the outcome, could

have resulted in the case’s dismissal for failure to present an injury in fact.” And

of course, Isaacson raised the Spokeo decision at the fairness hearing and urged the

district court to exercise its obligation to assure itself of standing. Indeed, though

it is rare, from time to time plaintiffs have even filed affidavits in this Court to firm

33

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 34 of 148

up standing allegations. See Ouachita Watch League v. Jacobs, 463 F.3d 1163,

1170 (11th Cir. 2006). No such attempt was made here.

At any point in this series of events, Muransky could have confronted the

standing issue head on, or requested leave to amend his complaint. We do not

think it is too much to ask that litigants who are aware that their allegations may

not satisfy constitutional standing requirements take the time to firm up those

allegations—if it is possible to do so—before an en banc circuit court confirms

their suspicions of inadequacy. This is not a case where a surprise standing issue

was thrust upon an unaware plaintiff.

Because no court has had the opportunity to consider any facts supporting

Muransky’s conclusory allegation of harm, we cannot say that no one could ever

show standing for a similar procedural violation. In fact, Muransky himself could

try to do so, because we are dismissing his claim without prejudice. But for now,

Muransky has not alleged any facts to support his claim beyond that of a bare

procedural violation. That is not enough.

We close with this. One of our dissenting colleagues suggests that

Muransky and his counsel should have yet another opportunity on remand to plead

or demonstrate harm—one last bite at the apple. See Jordan Dissent at 97, 100.

The problem with that solution—even setting aside that the parties have been

aware of the potential standing infirmities from the start—is that Muransky has

never asked for it. Not before the panel, and not before our full Court. Instead, he

and his counsel have pressed for their preferred theory of standing: “the violation

of Dr. Muransky’s substantive FACTA rights, by itself, is a concrete injury.”

34

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 35 of 148

Muransky, for whatever reason, has never sought to replead or prove standing

under a different theory. We defer to the parties on how to litigate their claims,

and decline to offer them a solution they have not sought. Because, under Spokeo,

the bare statutory violation pleaded by Muransky on behalf of the class is not

sufficient, we dismiss his claims.

* * *

Muransky has alleged that a cashier handed him a receipt containing some of

his own credit card information printed on it. Although the receipt violated the law

because it contained too many digits, Muransky has alleged no concrete harm or

material risk of harm stemming from the violation. Because this amounts to

nothing more than a “bare procedural violation, divorced from any concrete harm,”

Muransky has failed to allege that he has standing to bring this lawsuit. Spokeo,

136 S. Ct. at 1549. And in the absence of a named plaintiff with standing, neither

this Court nor the district court has jurisdiction over this case. We therefore

VACATE the order of the district court and REMAND with instructions to

dismiss without prejudice.

35

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 36 of 148

WILSON, Circuit Judge, dissenting:

The Fair and Accurate Credit Transactions Act is a bipartisan marvel. Built

in the shadow of the credit-card boom, the Act—known as FACTA—passed in

Congress with staggering support. Days later, President George W. Bush lauded

the bill in the Roosevelt Room for “protecting our citizens by taking the offensive

against identity theft.” Credit Transactions Act Signing, C-SPAN (Dec. 4, 2003),

https://www.c-span.org/video/?179442-1/credit-transactions-act-signing. The

bill’s “offensive” includes the truncation requirement, which made it the law that

no business may print more than the last five digits of their customers’ credit or

debit card number on store receipts. President Bush extolled that the truncation

requirement “will help prevent identity theft before it occurs.” Id. (emphasis

added). To enforce the new rule, FACTA imposed steep statutory penalties for

businesses that play fast and loose with this sensitive information.

Today this court misreads FACTA and dilutes core protections provided by

Congress. FACTA’s truncation requirement protects against both actual identity

theft and a consumer’s interest in using a credit or debit card without incurring any

heightened risk of identity theft. By assuming that the truncation requirement

redresses only actual identity theft and nothing more, the majority overlooks that

FACTA protects against a point-of-sale harm—the consumer suffers a heightened

risk of identity theft the moment the business prints an untruncated receipt. The

36

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 37 of 148

court’s mistake all but ensures that consumers in the Eleventh Circuit must now

allege, support, and prove that they suffered actual identity theft (or at least soon

will) because of a defendant’s FACTA violation in order to avail themselves of the

law’s protections. It is tough, though—and sometimes impossible—to trace an

identity thief. As a result, the majority’s decision essentially eviscerates this

statute in our circuit, stripping thousands of consumers who receive untruncated

receipts of a universally championed remedy.

Neither Article III nor Spokeo compel this result. Because Muransky

plausibly alleged that Godiva’s FACTA violation elevated his risk of identity theft

the moment the receipt was printed, he has shown that the violation harmed a

concrete interest that FACTA protects. That is enough to satisfy standing at this

phase of the case, so I dissent.

I.

Article III standing has three well-worn requirements: injury in fact,

causation, and redressability. See Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61

(1992). This case turns on injury in fact. To satisfy that prong, the plaintiff must

show, among other things, that he has suffered an injury that is “concrete.” Id. at

560. A concrete injury is a real one; it is not “hypothetical or speculative,” but in

fact exists. Salcedo v. Hanna, 936 F.3d 1162, 1167 (11th Cir. 2019). The standard

for establishing concrete injury climbs higher as the case inches forward. Lujan,

37

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 38 of 148

504 U.S. at 561. But when we analyze the plaintiff’s injury using only the

allegations in the plaintiff’s complaint, we take those allegations as true.

McElmurray v. Consol. Gov’t of Augusta-Richmond Cnty., 501 F.3d 1244, 1251

(11th Cir. 2007). The allegations need not be specific; when we rely on the

complaint, “general factual allegations . . . will suffice.” MSPA Claims 1, LLC v.

Tenet Fla., Inc., 918 F.3d 1312, 1318 (11th Cir. 2019). 1 The question is whether,

taking his allegations as true, the plaintiff has plausibly alleged a concrete injury.

Trichell v. Midland Credit Mgmt., Inc., 964 F.3d 990, 996 (11th Cir. 2020).

For a while, many debated whether the violation of a statute inherently

creates a concrete injury under Article III. Compare Edwards v. First Am. Corp.,

610 F.3d 514, 517 (9th Cir. 2010) (holding that a statutory violation alone is

enough), with David v. Alphin, 704 F.3d 327, 338–39 (4th Cir. 2013) (holding that

a statutory violation alone is not enough). Spokeo, Inc. v. Robins put that debate to

bed. 578 U.S. ___, 136 S. Ct. 1540 (2016). As the majority explains, Spokeo held

that the violation of a statute does not always cause a concrete injury; “bare

1

The majority says that Muransky must “clearly and specifically” allege facts to survive a

standing analysis at the pleading stage. Majority Op. at 11. But that view neglects Lujan’s

statement that, “[a]t the pleading stage, general factual allegations of injury” can suffice, “for on

a motion to dismiss we presume that general allegations embrace those specific facts that are

necessary to support the claim.” 504 U.S. at 561 (alteration accepted) (internal quotation mark

omitted). True, Muransky must provide specific facts when pressed at summary judgment. Id.

But when we scan his standing based on just his complaint, we presume that his general factual

allegations contain the specific facts he needs.

38

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 39 of 148

procedural violation[s],” without more, are not enough. Id. at 1549. Rather, a

statutory violation must cause concrete harm. Id. at 1548–49.

When does that happen? At first blush, it seems simple: a statutory violation

causes a concrete harm when it causes a real harm or a material risk of real harm.

See id. at 1548–50. But that simple statement begs a trickier question: What is a

“real harm”?

Spokeo states that there are two types of real harm: tangible and intangible.

See id. at 1549. A tangible harm is a palpable one, something that most would

know hurts without much thought. It is a harm painfully obvious—often

physically obvious—to the common observer (like losing money, a benefit, or a

job). See, e.g., Young Apartments, Inc. v. Town of Jupiter, 529 F.3d 1027, 1038

(11th Cir. 2008) (holding that a lost rent payment was a concrete injury for

standing purposes). These harms are almost always concrete. See Spokeo, 136 S.

Ct. at 1548–49.

An intangible harm, in contrast, is harder to define yet still offensive; it is

one that infringes on a person’s interests or rights (like infringement of your

freedom of speech or exercise of religion). See id. at 1549. Due to their

conceptual nature, not all intangible harms are “real” enough to be concrete.

In the statutory context, Spokeo explains how we should decide whether an

alleged intangible harm is concrete. See id. at 1549–50. First, we ask whether the

39

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 40 of 148

statute protects “concrete interests (as opposed to purely procedural rights).” See,

e.g., Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017) (Spokeo II)

(applying Spokeo), cert. denied, 138 S. Ct. 931 (2018) (mem.); see also Kamal v. J.

Crew Grp., Inc., 918 F.3d 102, 112–13 (3d Cir. 2019) (same). Second, we ask if

the violation “actually harm[ed]” or “present[ed] a material risk of harm” to a

concrete interest that the statute protects. Spokeo II, 867 F.3d at 1113; see also

Kamal, 918 F.3d at 112. If the answer to both questions is yes, the statutory

violation causes a concrete injury. Spokeo II, 867 F.3d at 1113; Kamal, 918 F.3d

at 112. 2

Muransky has established concrete injury under this test. FACTA protects

his concrete interest in using his credit or debit card without incurring a heightened

risk of identity theft. And Muransky plausibly alleged that Godiva’s violation in

fact heightened his risk of identity theft, harming an interest that FACTA protects.

2

I agree with the majority that the distinction between “substantive” and “procedural” rights is

semantical. The question is simply whether the violation harmed (or created a material risk of

harm to) a concrete interest. See Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 n.2

(7th Cir. 2016) (“[W]hether the right is characterized as ‘substantive’ or ‘procedural,’ its

violation must be accompanied by an injury-in-fact. . . . That is one of the lessons of Spokeo.”).

Sometimes that happens innately—the violation always harms an underlying concrete interest.

See Nayab v. Capital One Bank (USA), N.A., 942 F.3d 480, 490 (9th Cir. 2019) (holding that

when “every” statutory violation “offends the interests that the statute protects,” plaintiffs need

not allege more harm to establish standing); see also Havens Realty Corp. v. Coleman, 455 U.S.

363, 373–74 (1982) (holding that a violation of a statute establishing “an enforceable right to

truthful information [about] the availability of housing” was such a statute, since the violation

always harmed the concrete interest in truthful information). But that is not always the case, and

thus we must decide for ourselves whether a violation harmed a concrete interest.

40

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 41 of 148

Because the violation actually harmed Muransky’s concrete interest, we need not

analyze whether the violation presented a material risk of harm.

II.

First up is the concrete interest. To decide whether a statute protects a

concrete interest, we look to “history and the judgment of Congress.” Spokeo, 136

S. Ct. at 1549. An interest is more likely to be concrete if it has a “close

relationship to a harm that has traditionally been regarded as providing a basis for a

lawsuit in English or American courts.” Id. So too is an interest that Congress has

identified and judged as important and worth protecting. See id. But the interest

need not pass both litmus tests: a substantial showing in either category can suffice

to establish a concrete interest. See Dreher v. Experian Info. Sols., Inc., 856 F.3d

337, 345–46 (4th Cir. 2017) (noting that the lack of a common-law analog is “not

fatal” to a plaintiff’s standing if Congress has judged the interest as concrete);

Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1068 (D.C. Cir. 2019) (Rogers,

J., concurring in part and concurring in judgment) (agreeing that the defendant’s

alleged FACTA violation harmed a concrete interest because Congress identified

the interest as concrete, no matter if a common-law analog exists).

But even if Muransky had to clear both hurdles, he does so with space to

spare. Both Congress and history have established that a consumer has a concrete

41

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 42 of 148

interest in using a credit or debit card without incurring a heightened risk of

identity theft. See Jeffries, 928 F.3d at 1064–65 (majority opinion).

A.

Let’s start in Congress. Statutory text, legislative history, and public policy

make clear that Congress, in passing FACTA, recognized that consumers have a

concrete interest in using their cards without fear that each swipe will raise their

risk of identity theft.

Statutory Text. The surest mark of what Congress meant is what Congress

wrote. Three aspects of FACTA make clear that Congress thought that consumers

have an interest in avoiding the heightened risk of identity theft in addition to

avoiding actual identity theft.

The first is FACTA’s damages structure. The statute allows a consumer to

recover statutory damages whenever a business willfully prints more than the last

five digits of the consumer’s card number. 15 U.S.C. § 1681n(a)(1)(A). These

damages have no tie to actual identity theft; the consumer can recover them no

matter if he “ever becomes the victim of any crime.” Jeffries, 928 F.3d at 1064.

That damages scheme clashes with the majority’s take on FACTA’s

purpose. The majority assumes that FACTA guards against only the harm of

identity theft. See Majority Op. at 22 (claiming that the “harm Congress was

trying to prevent” through FACTA was stolen identity). But why would the statute

42

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 43 of 148

allow damages divorced from identity theft if its sole purpose were to combat

identity theft? It wouldn’t; it would instead bind FACTA’s damages scheme to the

harm of identity theft. So there must be a more nuanced method to Congress’s

madness—we interpret statutes “to avoid constitutional difficulties,” not create

them. Off. of Senator Mark Dayton v. Hanson, 550 U.S. 511, 514 (2007). That

method becomes clear once we accept that Congress enacted the statutory-damages

remedy to address a broader aim: to “decrease the risk that a consumer would have

his identity stolen.” Jeffries, 928 F.3d at 1064 (alteration accepted) (emphasis

added). Its presence tells us that actual identity theft is not the only concern

driving FACTA. Rather, this statutory scheme also protects another interest, one

prone to harm even without identity theft: the consumer’s interest “in using [a]

credit [or] debit card[] without incurring an increased risk of identity theft.” Id.

(emphasis added).

The second statutory clue is FACTA’s point-of-sale trigger. The statute

“imposes a truncation duty at the point of sale when identity theft cannot yet have

occurred.” Id. at 1067 n.3. The cause of action that Congress created does not

become complete when the consumer suffers identity theft; it is complete well

before that, the moment the business prints out too many card digits. See 15

U.S.C. § 1681c(g)(1). If FACTA were concerned with just identity theft, though,

its penalty would not accrue at the point of sale (before identity theft can occur); it

43

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 44 of 148

would accrue at the point of identity harm (when one suffers harm from identity

theft). The point-of-sale trigger thus reveals that Congress sought to protect an

immediately harmed interest—the interest in avoiding the heightened risk of

identity theft. See Jeffries, 928 F.3d at 1064, 1067 n.3.

The last indication—perhaps the most telling—is FACTA’s statute of

limitations. The statute of limitations turns on the untruncated receipt alone. The

limitations period for a FACTA violation is two years from the discovery of the

untruncated receipt but not later than five years from the printing of the

untruncated receipt. 15 U.S.C. § 1681p. Identity theft plays no role in this

sequence—the statute is indifferent to when or whether identity theft occurs. We

must ask, then: If the statute aims to redress only the harm of identity theft, why is

its limitations period apathetic to the harm of identity theft? Wouldn’t the

limitations period run sometime after the theft occurs?

Indeed, an example reveals the catch-22 that awaits a FACTA claimant

under the majority’s one-track view of FACTA’s protected interest. Suppose you

purchase a box of chocolates from a Godiva Chocolatier. After paying for the box

with your credit card, you notice that the cashier handed you a receipt showing

more than the last five digits of your card number. Although this act violated the

statute, the majority says you cannot sue yet; FACTA protects against only the

harm of identity theft, and you have not yet felt the hurt. But assume that the

44

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 45 of 148

cashier remembers your number, jots it down, and lays in wait. Two years and a

day later, you learn that the cashier, using the information on your receipt, has

stolen your identity, racking up thousands in credit card debt. Now that you have

suffered actual identity theft, the majority would say that you still cannot sue. The

statute of limitations began when you discovered the printed receipt, and now it

has run.

If FACTA’s sole aim were to redress the harm of identity theft, that

limitations scheme would make no sense—it operates without regard for when (or

even if) identity theft occurs. But the limitations scheme makes perfect sense once

we accept that FACTA also seeks to protect a consumer’s interest in using a credit

or debit card without incurring the heightened risk of identity theft. See Jeffries,

928 F.3d at 1064–65. In Congress’s eyes, that harm can occur at the point of sale,

the moment Godiva prints an untruncated receipt. Accordingly, Congress

reasonably chose to start the clock the moment the consumer discovers this point-

of-sale injury.

Legislative History. The legislative history also confirms that FACTA

sought to do more than just redress actual identity theft. When Congress passed

FACTA, the crime of identity theft had “reached almost epidemic proportions.”

H.R. Rep. No. 108-263, 25 (2003). Consumers were “increasingly concerned

about the risk of their personal financial information falling into the wrong hands.”

45

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 46 of 148

Id. (emphasis added). In fact, a “hotline established by the Federal Trade

Commission to field consumer complaints and questions about identity theft

logged over 160,000 calls in 2002 alone.” Id.

To ease these concerns, Congress found it “vitally important to address

measures which will help prevent identity theft” before it occurs. S. Rep. No. 108-

166, 8 (2003). The result was FACTA: a law designed to lessen consumer worries

by “limit[ing] the number of opportunities for identity thieves to ‘pick off’ key

card account information.” Id. at 13; see also In re Zappos.com, Inc., 888 F.3d

1020, 1027 (9th Cir. 2018) (“Congress has treated credit card numbers as

sufficiently sensitive to warrant legislation prohibiting merchants from printing

such numbers on receipts—specifically to reduce the risk of identity theft.”).

President Bush confirmed this purpose at the bill’s signing, noting that FACTA

would “help prevent identity theft before it occurs.” Credit Transactions Act

Signing, C-SPAN (Dec. 4, 2003), https://www.c-span.org/video/?179442-1/credit-

transactions-act-signing.

Not a shred of legislative history suggests that Congress wrote FACTA to

remedy only actual or inevitably impending identity theft. The history says just the

opposite. Congress’s focus on preventing identity theft before it occurs shows that,

in passing FACTA, Congress was concerned with more than just the actual harm

of identity theft. It believed that consumers have an interest in participating in the

46

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 47 of 148

market without increasing their chances of suffering identity theft. See Jeffries,

928 F.3d at 1064–65 (respecting Congress’s judgment that consumers have “an

interest in using their credit and debit cards without facing an increased risk of

identity theft”). We must defer to this legislative prerogative. See Spokeo, 136 S.

Ct. at 1549.

The majority takes a different view. It says that a later Clarification Act

makes clear that Congress’s “‘purpose’ was to protect ‘consumers suffering from

any actual harm’” from identity theft. Majority Op. at 5. But all Congress

recognized in the Clarification Act is that the failure to truncate an expiration date

does not pose “actual harm” to any interest. See Credit and Debit Card Receipt

Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(4)–(6), (b) (2008). In

contrast, Congress reiterated that “proper truncation of the card number, by

itself . . . prevents a potential fraudster from perpetrating identity theft or credit

card fraud.” Id. § 2(a)(6) (emphasis added). As a result, Congress “left the

truncation requirement and enforcement mechanism untouched,” affirming that the

failure to hide customers’ credit or debit card numbers can still put them in harm’s

way: it can heighten their risk of identity theft, a harm FACTA sought to prevent.

See Jeffries, 928 F.3d at 1068 (Rogers, J., concurring in part and concurring in

judgment).

47

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 48 of 148

Public Policy. Good policy often flows from good sense, and it makes

sense why Congress identified the heightened risk of identity theft as a concrete

interest. For one, a higher risk of identity theft can lead to another concrete harm:

actual identity theft. See Redman v. RadioShack, Corp., 768 F.3d 622, 626 (7th

Cir. 2014) (“[T]he less information the receipt contains the less likely is an identity

thief who happens to come upon the receipt to be able to figure out the

cardholder’s full account information and thus be able to make purchases . . . .”).

For another, consumers are less likely to use credit cards if their transactions are

unprotected, hamstringing economic efficiency and consumer spending. And a

higher risk of identity theft can divert consumer resources toward theft-prevention

measures, rather than typical economic goods and services. So Congress had good

reason to recognize that freedom from the heightened risk of identity theft is itself

a concrete interest.

*

It is worth reporting the violence that the majority’s logic does to this

statute. The holding hiding behind its reasoning is that a plaintiff can enforce a

FACTA violation only if it causes (or will soon cause) harm from identity theft.

That view decimates the class that this statute sought to protect. FACTA of course

provides a remedy for those who suffer identity theft. But it also provides a

remedy for those who do not—it lets consumers recover damages at the point of

48

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 49 of 148

sale well before identity theft could occur. 15 U.S.C. §§ 1681c(g)(1),

1681n(a)(1)(A). We are supposed to construe FACTA so that this feature is not

“inoperative or superfluous, void or insignificant.” Corley v. United States, 556

U.S. 303, 314 (2009). But by shrinking FACTA to cover just those that suffer or

will soon suffer identity theft, the majority ignores this directive, rewrites the

statute, and blinks FACTA as Congress knew it out of existence.

I would take a different route. Congress passed FACTA to fight identity

theft, but it did not elevate this interest to the exclusion of all others. Another

interest—one just as important—was encouraging consumers to use their credit or

debit cards without fear that their usage would raise their risk of identity theft.

Because Congress identified this interest as important and worth protecting, we

should defer to its determination and dub the interest concrete. See Spokeo, 136 S.

Ct. at 1549.

B.

Congress’s thoughts on the matter are enough to cement Muransky’s interest

in avoiding the heightened risk of identity theft. See id. But if there were any

doubt, history also “tilts toward concreteness.” Jeffries, 928 F.3d at 1064 (majority

opinion). Again, an interest is more likely to be concrete if it has a “close

relationship to a harm that has traditionally been regarded as providing a basis for

a lawsuit.” Spokeo II, 867 F.3d at 1115. A consumer’s interest in engaging in

49

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 50 of 148

commerce without heightening his risk of identity theft fits that bill: it bears a close

relationship to an interest harmed in a common-law breach-of-confidence claim. 3

The tort of breach of confidence historically allowed a plaintiff to recover

against a party who failed to adequately protect a plaintiff’s confidential

information. See Alan B. Vickery, Breach of Confidence: An Emerging Tort, 82

Colum. L. Rev. 1426, 1427–28 (1982). It “is rooted in the concept that the law

should recognize some relationships as confidential to encourage uninhibited

discussions between the parties involved.” Young v. U.S. Dep’t of Just., 882 F.2d

633, 640 (2d Cir. 1989). The plaintiff in a breach-of-confidence claim relies on an

“assurance of secrecy . . . . in forming the relationship, and thereafter in revealing

what [he] would otherwise hold back.” Vickery, supra, at 1428. For that reason,

an interest harmed in a breach-of-confidence case is the plaintiff’s “general interest

in the security of the confidential relationship and his corresponding expectation of

secrecy.” Id. at 1434. An interest harmed in a FACTA case is the same: the

consumer expects the business to comply with FACTA and keep his card number

confidential. The failure to do so undermines the “security of the confidential

relationship” and the consumer’s “expectation” that his card number will stay

hidden. See Vickery, supra, at 1434; see also Jeffries, 928 F.3d at 1065. And

3

The majority assumes that the breach-of-confidence tort is old enough to serve as a historical

analog. I do the same and note that there is good cause for that assumption. See Corliss v. E.W.

Walker Co., 64 F. 280, 281–83 (C.C.D. Mass. 1894) (discussing the breach-of-confidence tort).

50

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 51 of 148

because of the breach, the consumer is more “likely to remain silent in

circumstances that would otherwise call for frankness,” see Vickery, supra, at

1434, precisely the type of economic inefficiency Congress sought to avoid

through FACTA. See, e.g., H.R. Rep. No. 108-263, 23 (noting that “[o]ne of the

hallmarks of the modern U.S. economy is quick and convenient access to

consumer credit”).

The majority fires two shots at this historical connection, but neither lands.

It first argues that a FACTA violation does not track the typical elements of a

breach-of-confidence claim, as a FACTA claim does not require disclosure to a

third party. See Majority Op. at 26. This argument fails on two levels.

To start, a statutory harm need not “exactly track[ a] common law” analog to

be concrete. See Spokeo II, 867 F.3d at 1115. Nor must the violation “give rise to

a cause of action under common law.” Susinno v. Work Out World Inc., 862 F.3d

346, 351 (3d Cir. 2017). Rather, the harm need only bear a “close relationship to a

harm that has traditionally been regarded as providing a basis for a lawsuit,” so that

it is similar “in kind and in degree.” Salcedo, 936 F.3d at 1171 (emphasis added).

If a plaintiff had “to satisfy every element of a common law cause of action before

qualifying for statutory relief, Congress’s power to ‘elevate intangible harms’ by

defining injuries and chains of causation” that create a “‘case or controversy where

none existed before’ would be illusory.” Trichell, 964 F.3d at 1010 (Martin, J.,

51

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 52 of 148

concurring in part and dissenting in part) (alteration accepted) (quoting Spokeo,

136 S. Ct. at 1549); see also Spokeo II, 867 F.3d at 1115; Steel Co. v. Citizens for a

Better Env’t, 523 U.S. 83, 102 (1998) (holding that judicial power extends to

“cases and controversies of the sort traditionally amenable to, and resolved by, the

judicial process” (emphasis added)). So even if “there are differences between

[FACTA’s] cause of action and those recognized at common law, the relevant

point is that Congress has chosen to protect against a harm that is at least closely

similar in kind to others that have traditionally served as the basis for lawsuit.” See

Spokeo II, 867 F.3d at 1115. Assurance that a plaintiff’s confidential disclosure

will remain hidden and will not spike his risk of injury lies at the heart of both a

FACTA claim and a breach-of-confidence claim. So FACTA’s underlying interest

has a historical partner. See id. (holding that the Fair Credit Reporting Act

protected against a harm bearing a close relationship to the harm suffered in a

defamation suit, even though the elements of the claims did not match).

Another reason: the element of third-party disclosure is not inextricably tied

to the harms underlying a breach-of-confidence claim. To the contrary, a

“seemingly innocuous or limited disclosure may nevertheless injure the wronged

party directly because of the special significance that the party attaches to the

information.” Vickery, supra, at 1434 n.29. And “even if the disclosure is

innocuous, the wronged party may well fear future disclosures of more damaging

52

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 53 of 148

information.” Id. In other words, the “harm in a breach-of-confidence case occurs

when the plaintiff’s trust in the breaching party is violated, whether or not the

breach has other consequences.” Jeffries, 928 F.3d at 1064 (internal quotation

mark omitted). In the FACTA context, the business breaches that trust when it

prints more than five card digits, harming the consumer’s expectation that his

disclosure will not increase his chances that a thief will uncover his card number.

That harm occurs at the point of sale, no matter if a third party ever sees the

receipt. See id. at 1064–65.

Next up, the majority says that the harms do not match because Muransky

does not have a confidential relationship with Godiva. Majority Op. at 27. In the

majority’s eyes, breach of confidence involves “close professional relationships,”

like that between a doctor and a patient. Id. The majority claims that a customer-

merchant relationship does not create similar secrecy duties. Id.

That oversimplifies the situation. The exchange of card information

between a customer and merchant no doubt triggers a confidential relationship.

The “essential ingredients of what can be termed a ‘confidential relationship’” are

“the assurance of secrecy and the reliance it evokes.” Vickery, supra, at 1428. A

consumer paying with a credit or debit card would naturally believe that the

merchant will keep his card number secret—a belief that FACTA codified. And

that belief spurs consumer spending, as it lets the consumer breathe easy knowing

53

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 54 of 148

that his card information will stay safe throughout the transaction. So a typical

card transaction has both assurance and reliance—the key triggers of

confidentiality.

Legal elements aside, that relationship stands on common sense. Few would

say that confidential financial information is less sensitive than confidential

medical or legal information. For this reason, scholars have noted that “given their

relationship to consumers, the holders of consumer data in commercial transactions

should be labeled with a distinct term: data confidants.” Alicia Solow-Niederman,

Beyond the Privacy Torts: Reinvigorating A Common Law Approach for Data

Breaches, 127 Yale L.J.F. 614, 625 (2018). So just as governing ethical standards

recognize a “relationship of trust” between a doctor and her patient or a lawyer and

her client, FACTA’s truncation requirement recognizes “a similar relationship of

trust between consumer and merchant, requiring the merchant to safeguard the

consumer’s credit or debit card information.” Jeffries, 928 F.3d at 1064–65.

Bottom line: customer and merchant do share a confidential relationship.

All things said, a FACTA violation and a breach-of-confidence tort each

concretely harm the plaintiff’s expectation that his confidential disclosure will be

protected. For FACTA specifically, the harmed interest is the consumer’s

expectation that his credit card purchase will not heighten his risk of identity theft.

See id. Because this interest is “similar in kind” and bears a “close relationship” to

54

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 55 of 148

the interest harmed in a breach-of-confidence case, see Spokeo II, 867 F.3d at

1115, history settles that this interest is concrete. See Jeffries, 928 F.3d at 1064–

65.

III.

Since FACTA protects Muransky’s concrete interest in using his credit or

debit card without incurring the heightened risk of identity theft, all that’s left is

whether Muransky plausibly alleged that Godiva’s FACTA violation “actually

harm[ed]” or “present[ed] a material risk of harm” to this interest. See Spokeo II,

867 F.3d at 1113; see also Kamal, 918 F.3d at 112. He did—he alleged that

Godiva’s violation in fact heightened his risk of identity theft. So he has pled

“actual[] harm” to an interest that FACTA protects. See Spokeo II, 867 F.3d at

1113.

Muransky alleged two core facts in his complaint: (1) Godiva violated

FACTA when it printed 10 digits of his card number, and (2) this violation

“elevated his risk of identity theft.” Both statements are facts, not legal

conclusions. So we must accept them as true when analyzing standing at this

stage, because “[w]ithout the benefit of discovery, we are not in a position to

55

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 56 of 148

second guess the harm [he] allege[s].” See Debernardis v. IQ Formulations, LLC,

942 F.3d 1076, 1090 (11th Cir. 2019) (Sutton, J., concurring). 4

Accepting these facts as true, Muransky has alleged that Godiva’s FACTA

violation harmed his interest in avoiding a heightened risk of identity theft the

moment the violation occurred. His harm is not one that might happen in the

future (so that we would need to analyze whether he alleged a material risk of real

harm); it is a real harm to a concrete interest, one that Muransky adequately alleges

happened the moment Godiva printed the untruncated receipt. See Spokeo II, 867

F.3d at 1118 (explaining that the material-risk-of-harm standard plays no role

when the complaint alleges that “the challenged conduct and the attendant injury

have already occurred”). Whether Muransky can prove down the road that

Godiva’s FACTA violation heightened his risk of identity theft is another matter.

See Lujan, 504 U.S. at 561 (noting that the plaintiff’s burden of proof increases as

the case advances). For now, it is enough that he alleged that the violation harmed

his interest in using his card without suffering a heightened risk of identity theft.

See McElmurray, 501 F.3d at 1251.5

4

The majority is thus wrong to say that Muransky alleged a “pure statutory violation.” Majority

Op. at 2. If that were so, he would not have alleged another fact—that Godiva’s FACTA

violation raised his risk of identity theft. He would have instead said that Godiva printed the

receipt, violating FACTA—period. Because he alleged additional facts, we must take him at his

word that he suffered additional harm.

5

Because Muransky alleges a direct harm, the majority’s focus on whether Muransky alleged a

material risk of identity theft is irrelevant (and for the same reason, I diverge from my dissenting

56

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 57 of 148

To sidestep this conclusion, the majority calls Muransky’s complaint

conclusory. It says that it need not accept Muransky’s allegation that Godiva’s

violation increased his risk of identity theft because he has not given specific facts

to explain how the violation did so. But we have said time and again that a

plaintiff’s allegation of injury need not be specific at the pleading stage—“general

factual allegations . . . will suffice.” MSPA Claims, 918 F.3d at 1318. At this

stage, Lujan tells us to presume that Muransky’s “general allegations embrace

those specific facts that are necessary to support the claim.” 504 U.S. at 561; see

also Wilding v. DNC Servs. Corp., 941 F.3d 1116, 1124 (11th Cir. 2019) (applying

this rule), cert. denied, 590 U.S. ___, 140 S. Ct. 2828 (2020) (mem.).

Article III does not command Muransky to provide these facts at the

pleading phase; Lujan says that is what discovery is for. See 504 U.S. at 561; see

also Debernardis, 942 F.3d at 1090 (Sutton, J., concurring). Based on this

principle, we routinely accept general factual allegations on the promise that

specific support will come later. See, e.g., Debernardis, 942 F.3d at 1085

colleague’s discussion of materiality). See infra at 75–78. Our job when analyzing a direct-

harm theory is not to decide whether the violation “materially” harmed the statutory interest; our

job is to decide whether the violation “actually harm[ed]” the statutory interest. See Spokeo II,

867 F.3d at 1113, 1118. FACTA protects Muransky’s concrete interest in using his card

“without incurring an increased risk of identity theft,” see Jeffries, 928 F.3d at 1066, and

Muransky claimed that he suffered an increased risk at the point of sale. That is an alleged

actual harm, not an alleged material risk of actual harm, so materiality plays no role. The only

question is whether he has alleged enough facts to plausibly establish direct harm at the pleading

stage.

57

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 58 of 148

(majority opinion) (accepting “at the motion to dismiss stage” the general

allegation that a “dietary supplement that is deemed adulterated and cannot

lawfully be sold has no value”). It is inconsistent that the majority demands those

specifics from Muransky right now.

IV.

To close, I note that the majority’s cases are not persuasive for a mix of

reasons. Some cases dealt with a different truncation failure: the failure to truncate

the expiration date—a violation that Congress judged as not creating concrete

harm. See, e.g., Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 777 (9th Cir.

2018); Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 78 (2d Cir.

2017); Meyers, 843 F.3d at 725. Another came with an evidentiary record (not on

an analysis of the complaint), in which the district court found that the violation

there did not harm or raise a material risk of harm to a concrete interest. Katz v.

Donna Karan Co., L.L.C., 872 F.3d 114, 119–120 (2d Cir. 2017). And both Kamal

and Noble v. Nevada Checker Cab. Co., 726 F. App’x 582, 583–84 (9th Cir. 2018)

incorrectly determined that FACTA redresses only actual identity theft; the Ninth

Circuit also chose not to publish Noble, so the opinion is not precedential. See

Kamal, 918 F.3d at 115; Noble, 726 F. App’x at 583–84; see also Jeffries, 928 F.3d

at 1067 n.3 (rejecting the Third Circuit’s position that “FACTA protects an interest

in avoiding actual identity theft, rather than increased risk of identity theft”).

58

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 59 of 148

Far more persuasive is the D.C. Circuit’s published opinion in Jeffries.

There, the D.C. Circuit considered most of the cases cited above and rejected their

reasoning. It held that FACTA protects a consumer’s interest in using a credit or

debit card without incurring an increased risk of identity theft. Jeffries, 928 F.3d at

1064–65. And then the court held that the FACTA violation alleged there harmed

that interest at the point of sale. Id. at 1066–67. To be sure, the FACTA violation

there was worse than the one levied here: the defendant printed all 16 digits of the

plaintiff’s card number. But Jeffries did not turn on that fact; its reasoning extends

to this case just the same. As in Jeffries, the interest at issue is the consumer’s

interest in avoiding the increased risk of identity theft. And as in Jeffries, the

plaintiff has alleged that the FACTA violation in fact increased his risk of identity

theft, harming an interest that the statute protects. Like the court in Jeffries, we

should take the plaintiff at his word for now and hold that he has established

standing at this phase of the case.

* * *

The majority claims that Muransky “shut his eyes and closed his ears to the

requirements of Spokeo.” Majority Op. at 3. Yet the majority shuts its eyes and

closes its ears to the interest that FACTA protects. The statute protects

Muransky’s concrete interest in avoiding a heightened risk of identity theft. And

Muransky plausibly alleged that the moment Godiva printed the untruncated

59

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 60 of 148

receipt, he sustained an injury sufficient to confer standing to maintain a claim

under FACTA. The mistake the majority makes is to require anything more.

60

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 61 of 148

MARTIN, Circuit Judge, dissenting:

Not all statutory violations result in a concrete injury. The Supreme Court

told us so in Spokeo, Inc. v. Robins, 578 U.S. ___, 136 S. Ct. 1540 (2016). Id. at

1547–48. Today, the majority extends this principle from Spokeo to conclude that

courts may ignore the judgment of Congress when assessing whether a party has

met the concreteness requirement of Article III. The majority opinion holds that a

receipt displaying ten digits of a customer’s credit card number does not pose a

material risk of identity theft, and therefore is not a concrete injury. The majority

says this means plaintiffs have no standing here, even though Congress established

the point of intolerable risk at more than the last five digits being displayed on a

receipt. Because Congress’s judgment is deserving of deference under these

circumstances, and because congressional judgment supports a finding of

concreteness, I respectfully dissent from the majority’s opinion.

Spokeo also tells us we may find concrete injury where a statutory violation

bears a close relationship to a type of harm that has traditionally been actionable at

common law. 136 S. Ct. at 1549. In contrast to the majority, I view Dr.

Muransky’s FACTA violation as bearing a close relationship to a common law

breach of confidence tort. I therefore respectfully dissent on this ground as well.

61

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 62 of 148

I.

In April 2015, Dr. David Muransky filed a class action lawsuit against

Godiva Chocolatier (“Godiva”), alleging that Godiva violated the Fair and

Accurate Transactions Act (“FACTA” or the “Act”), 15 U.S.C. § 1681c(g), when it

issued him a receipt containing the first six and last four digits of his card number.

His central claim is that by issuing him this receipt, Godiva willfully violated

FACTA, which, among other things, prohibits merchants from printing “more than

the last 5 digits of the credit card number . . . upon any receipt provided to the

cardholder at the point of the sale or transaction.” Id. § 1681c(g). He alleged in

his complaint that Godiva’s violation of FACTA’s truncation requirement exposed

him and the class members “to an elevated risk of identity theft.”

The majority opinion recounts the dense and winding path this case has

taken since filed. Maj. Op. at 5–9. I will briefly review this history as well. After

Dr. Muransky filed his complaint, the parties engaged in mediation, and reached an

agreement to settle the case for $6.3 million. Notice of the settlement was sent to

class members, and James H. Price and Alan Isaacson filed objections. At the

District Court’s fairness hearing, Mr. Isaacson, but not Mr. Price, challenged Dr.

Muransky’s standing. The District Court approved the settlement reached by the

class members and Godiva. Then, both Mr. Price and Mr. Isaacson challenged that

approval on appeal. Throughout this appeal, Mr. Isaacson has maintained his

62

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 63 of 148

argument that Dr. Muransky lacks standing, while Mr. Price has joined Dr.

Muransky in arguing that Dr. Muransky has standing.

For all its procedural complexity, this appeal presents only a simple

question. Did Dr. Muransky establish Article III standing by alleging a violation

of FACTA’s truncation requirement, based on a receipt showing 10 of the 16 digits

of his credit card? I believe he did.

II.

I begin, as I must, with the standard announced by the Supreme Court in

Spokeo. To satisfy the injury-in-fact requirement of Article III, a plaintiff must

allege an injury that is both “concrete and particularized,” as well as “actual and

imminent.” Spokeo, 136 S. Ct. at 1548. The discussion here is about the first of

these requirements: whether Dr. Muransky’s complaint alleges an injury that is

sufficiently concrete. The majority accurately recounts that an injury need not be

“tangible” to be concrete. Id. at 1549. And even intangible injuries, such as the

“risk of real harm,” can satisfy Article III’s concreteness requirement. Id. When

we are tasked with deciding whether an intangible injury is sufficiently concrete,

Spokeo tells us that “both history and the judgment of Congress” inform our

analysis. Id. On this much, the majority and I agree.

Absent from the majority opinion, however, is the mention of another

command from Spokeo. It tells us that when a statutory right itself protects a

63

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 64 of 148

concrete interest, a plaintiff need not allege “any additional harm beyond the one

Congress has identified.” Id. In practical terms, a complaint alleging a statutory

violation, and nothing more, can be sufficient to establish standing at the pleading

stage, so long as the statutory violation itself protects a concrete interest. Strubel v.

Comenity Bank, 842 F.3d 181, 190–91 (2d Cir. 2016). And in determining

whether a statutory provision protects a concrete interest, we are guided by

congressional judgment and common law principles. See Perry v. Cable News

Network, Inc., 854 F.3d 1336, 1340–41 (11th Cir. 2017) (holding that a plaintiff

alleging a violation of the Video Privacy Protection Act need not allege “any

additional harm beyond the statutory violation” because both congressional

judgment and common law support a finding of concreteness).

Focusing, for now, on Spokeo’s discussion of the role of Congress, the

Court recognized that congressional judgment is “instructive and important

because Congress is well positioned to identify intangible harms that meet

minimum Article III requirements.” Cordoba v. DIRECTV, LLC, 942 F.3d 1259,

1268 (11th Cir. 2019) (quotation marks omitted); see also Daniel Townsend, Who

Should Define Injuries for Article III Standing?, 68 Stan. L. Rev. Online 76, 81–83

(2015) (explaining that Congress is better positioned to gather facts and make

empirical judgments about whether a practice is injurious). And as the majority

recognizes, Congress may thus “elevat[e] intangible harms” by defining injuries

64

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 65 of 148

and chains of causation that will “give rise to a case or controversy where none

existed before.” Spokeo, 136 S. Ct. at 1549 (quotation marks omitted).

Where the intangible injury identified by Congress is a risk of harm, Spokeo

tells us that the risk must be “material.” Id. at 1550. The majority “recognize[s]

that ‘material risk of harm’ is a somewhat indefinite term,” and says that in this

context, “material” means “important; essential; relevant.” Maj. Op. at 16 (citing

New Oxford American Dictionary (3d ed. 2010)). I agree. In Spokeo, the Court

gave us the example of including the wrong zip code on a credit report as one

insufficiently “material” risk of harm. 136 S. Ct. at 1550. In the context of the

Fair Credit Reporting Act, which creates a statutory cause of action for

inaccuracies on credit reports, the Court puzzled about “how the dissemination of

an incorrect zip code, without more, could work any concrete harm.” Id. Since the

concrete interest intended to be protected by the FCRA is avoiding the harms that

come from false credit reporting, it was not obvious to the Court how a mistaken

zip code was “essential” or “relevant” to that interest.

The majority suggests here that Spokeo did not “br[eak] new ground” on the

amount or type of risk required to establish standing. Maj. Op. at 16. I think it did.

Although several earlier Supreme Court decisions described the required level of

risk as “substantial” or “certainly impending,” Clapper v. Amnesty Int’l USA, 568

U.S. 398, 414 & n.5, 133 S. Ct. 1138, 1150 & n.5 (2013) (listing cases), Spokeo

65

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 66 of 148

did not include this description. See 136 S. Ct. at 1550. This was no accident.

The cases in which the Court described the necessary risk as “substantial” or

“certainly impending” did not address a statutory cause of action itself designed to

prevent future harm. See, e.g., Clapper, 568 U.S. at 401, 133 S. Ct. at 1143

(holding that certain attorneys and organizations did not have standing to challenge

the constitutionality of a provision of the Foreign Intelligence Surveillance Act of

1978). With this in mind, the Third Circuit recognized that the Supreme Court

decided in Spokeo to require a lesser magnitude of risk for statutory injuries in

order to “strike[] a balance between Congress’s power to define injuries . . . and

the requirement that—absent a statutory right of action—a threatened harm be

certainly impending or based on a substantial risk of harm to amount to injury in

fact.” Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 113 n.4 (3d Cir. 2019) (citation

and quotation marks omitted).

I also part ways with the majority in its explanation of how courts decide

whether the risk of harm identified by Congress is sufficiently material for Article

III purposes. While the majority acknowledges that congressional judgment plays

a role in identifying intangible injuries of the “direct” variety (for example,

interference with free speech or free exercise rights), it effectively concludes that

congressional judgment plays no role when identifying whether a prohibited

practice presents a risk of real harm. Maj. Op. at 27–29. The implication of this

66

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 67 of 148

holding is that when courts are confronted with prophylactic legislation designed to

reduce a risk of harm from occurring—like the statute at issue here—we operate

with a blank canvas in deciding whether the risk of harm is sufficiently material.

Id. at 16. I don’t think this approach can be reconciled with Spokeo’s command

that the “judgment of Congress” plays an important role in determining whether an

injury satisfies Article III’s concreteness requirement. 136 S. Ct. at 1549. And

while it is surely the courts, and not Congress, that are ultimately responsible for

deciding whether an injury is sufficiently concrete under Article III, our role does

not require or allow us to ignore the judgment of Congress entirely.

It is these principles that frame the concreteness inquiry here. Dr.

Muransky’s complaint alleges that Godiva violated FACTA’s truncation

requirement when it issued him a receipt that displayed the first six and the last

four digits of his credit card number. He says he suffered irreparable harm from

Godiva’s violation of the truncation requirement because it “exposed [him] to an

elevated risk of identity theft.” This Court must therefore decide whether the risk

of identity theft that Dr. Muransky suffered on account of Godiva’s FACTA

violation constitutes a concrete injury. And in making this determination, this

Court must consider whether congressional judgment and the common law support

a finding of concreteness under these circumstances.

67

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 68 of 148

II.

A.

First, the judgment of Congress. When it enacted FACTA, Congress

prohibited merchants from printing “more than the last 5 digits of the card number

or the expiration date upon any receipt provided to the cardholder.” 15 U.S.C.

§ 1681c(g)(1). FACTA provides that any merchant willfully violating this

requirement is liable for “any actual damages sustained by the consumer . . . or

damages of not less than $100 and not more than $1,000.” Id. § 1681n(a)(1)(A).

While Congress’s creation of a statutory cause of action certainly evinces a

judgment that violations of the truncation requirement cause harm, Spokeo tells us

that this fact alone is not sufficient to satisfy Article III’s standing requirements.

See 136 S. Ct. at 1547–48. Congress’s decision to sanction lawsuits for violations

of the truncation requirement is therefore only the starting point of the inquiry into

Congress’s judgment.

We go next, then, to the history of FACTA. That history confirms that

Congress considered the violation at issue here—a receipt displaying the first six

and last four digits of the customer’s credit card—to pose a material risk of identity

theft. When it enacted FACTA, Congress sought to “protect[] consumers from

identity theft.” Harris v. Mexican Specialty Foods, Inc., 564 F.3d 1301, 1306

(11th Cir. 2009); see also S. Rep. 108-166 at *6 (Oct. 16, 2003) (observing that

68

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 69 of 148

FACTA was enacted to address “the emergence and impact of identity theft on the

credit granting and reporting systems”). FACTA was necessary, Congress found,

in light of the increased use of credit in the late 1990s and early 2000s, which

“create[d] a target-rich environment for . . . sophisticated criminals, many of whom

are organized and operate across international borders.” S. Rep. 108-166 at *8; see

also Credit and Debit Card Receipt Clarification Act of 2007 (“Clarification Act”),

Pub. L. No. 110-241, § 2(a)(1), 122 Stat. 1565, 1565 (finding that “the purpose[]”

of FACTA is to “reduce identity theft and credit card fraud”). When he signed

FACTA into law, President George W. Bush echoed Congress’s findings. He

stated that “this law will help prevent identity theft before it occurs, by requiring

merchants to delete all but the last five digits of a credit card number on store

receipts.” Remarks on Signing the Fair and Accurate Credit Transactions Act of

2003, 39 Weekly Comp. Pres. Doc. 1746, 1748 (Dec. 4, 2003); see also S. Rep.

108-166 at 6 (concluding that the truncation requirement “limit[s] the number of

opportunities for identity thieves to ‘pick off’ key card account information”).

The history of FACTA following its initial enactment confirms that

Congress considered the type of violation at issue here to pose a material risk of

harm. After FACTA’s truncation requirement went into effect, “hundreds of

lawsuits were filed” alleging that merchants violated FACTA by “fail[ing] to

remove the expiration date” as required by 15 U.S.C. § 1681c(g)(1). Clarification

69

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 70 of 148

Act § 2(a)(4). In June 2008, the Clarification Act became law, and gave amnesty

to merchants who printed a card’s expiration date in the years since FACTA was

enacted. Id. § 3(a). Congress gave this amnesty because a complaint alleging a

mere violation of the expiration date requirement did not “contain[] an allegation

of harm to any consumer’s identity.” Id. § 2(a)(5). Notably, while Congress was

at it, it gave no amnesty to merchants who printed more than the allowed number

of digits. See id. § 3(a). Rather, Congress observed that “[e]xperts in the field

agree that proper truncation of the card number, by itself as required by [FACTA],

. . . regardless of the inclusion of the expiration date, prevents a potential fraudster

from perpetrating identity theft or credit card fraud.” Id. § 2(a)(6). By granting

amnesty only as to the expiration date, the Clarification Act sought to curtail

“abusive lawsuits” concerning a requirement that “do[es] not protect consumers.”

Id. at § 2(b).1

This demonstrates that, while Congress did not consider all violations of the

truncation requirement to pose a serious threat to consumers, it maintained its

concern about the violation pled here—a receipt showing more than the last five

digits of a card number—to entail material risk of identity theft. Congress’s view

1

The majority reads the Clarification Act to imply that the FACTA violation alleged here was

not concrete, because of its acknowledgment that some FACTA claims do not cause “actual

harm.” Maj. Op. at 28. To the contrary, the fact that the Clarification Act left the digit

truncation requirement in place while granting amnesty for violations of the expiration date

requirement indicates that Congress continued to view the former as a category of FACTA

violations that cause “actual harm.” Clarification Act § 2(b).

70

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 71 of 148

was based on a finding that “[e]xperts in the field agree that proper truncation of

the card number, by itself” minimizes the risk of identity theft. Clarification Act

§ 2(a)(6). Congress’s judgment thus supports a finding of concreteness here. See

Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1066 (D.C. Cir. 2019) (noting

that, while “every FACTA violation [does not] create[] a concrete injury in fact,” a

receipt displaying a card’s entire number and expiration date caused concrete

injury because it was the “nightmare scenario” Congress sought to prevent).

As I said at the start, when a statutory violation itself protects a concrete

interest, a plaintiff need not allege anything more than a violation of the statute

itself. See Perry, 854 F.3d at 1340. Because the judgment of Congress supports a

finding of concreteness here, Dr. Muransky was not required to allege any

additional harm beyond the statutory violation alleged in his complaint. On this

basis alone, I would hold that Dr. Muransky established Article III standing.

B.

The majority opinion takes a dramatically different path. It starts by

eschewing any deference to congressional judgment in determining whether Dr.

Muransky’s FACTA violation entailed a sufficiently high risk of identity theft.

See Maj. Op. at 27–28. We cannot defer to Congress, the majority reasons, so we

must instead look to Dr. Muransky’s complaint to see if he has alleged facts

establishing that a receipt showing ten digits of a credit card number poses a risk of

71

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 72 of 148

identity theft. Id. at 28–29. Although Dr. Muransky alleged that he suffered an

elevated risk of identity theft as a result of the FACTA violation at issue here, the

majority says that allegation “is simply not enough.” In so holding, the majority

assumes, without offering any explanation, that Dr. Muransky did not face a

“material risk, or significant risk, or substantial risk, or anything approaching a

realistic danger” due to the receipt at issue. Id. at 29. This analysis errs at every

step.

To begin, the majority starts on incorrect footing by effectively concluding

that congressional judgment is owed no deference in deciding whether a risk of

harm clears the concreteness bar.2 Maj. Op. at 27–28. The majority says it is

required to do so because (1) Spokeo tells us that the creation of a statutory cause

of action does not automatically confer standing, and (2) courts have an

independent responsibility to decide whether a risk of harm meets the materiality

threshold. Id. Both of these premises are true, but neither lead to the conclusion

that courts may ignore the judgment of Congress.

2

The majority notes, in passing, that there is “good reason to doubt” that Congress’s judgment

supports a finding of materiality because Congress did not “specifically address the kind of

partial truncation that occurred in this case.” Maj. Op. at 28 (citing Kamal, 918 F.3d at 115–16

n.5). What Congress said was that proper truncation—i.e., revealing no more than the last five

digits of a card—prevents the risk of identity theft, and Dr. Muransky’s receipt revealed more

than the last five digits. See Clarification Act § 2(a)(6). That Congress did not separately

address every possible fact scenario that could constitute a violation of the truncation

requirement does not dilute its judgment supporting a finding of concreteness here.

72

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 73 of 148

First, it is true that Spokeo told us “Congress cannot erase Article III’s

standing requirements by statutorily granting the right to sue to a plaintiff who

would not otherwise have standing.” 136 S. Ct. at 1547–48. This premise does

not, however, erase Congressional judgment from the equation entirely. Indeed,

Spokeo says quite the opposite. It notes that Congressional judgment is

“instructive and important” in determining whether an injury is concrete because

Congress “is well positioned to identify intangible harms that meet minimum

Article III requirements.” Id. at 1549. I have already walked through the

application of these principles here. A violation of the truncation requirement is

not a concrete harm merely because Congress gave litigants the right to sue. It is a

concrete harm, however, because congressional factfinding in the FACTA context

lends significant support to the idea that a failure to adhere to the digit truncation

requirement results in a material risk of harm.

Relatedly, the majority repeats throughout its opinion that deference to the

judgment of Congress would mean, in practical terms, that “there is no violation of

FACTA that would not be” “enough to show standing.” Maj. Op. at 30. This is

not so, and we need not travel far for an example of why this is wrong. As set out

above, when Congress passed the Clarification Act, it expressed a judgment that

the expiration date requirement “do[es] not protect consumers” and does not result

in “consumers suffering from any actual harm.” Id. at § 2(b). So even though

73

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 74 of 148

FACTA continues to provide a statutory cause of action for violating the expiration

date requirement, see 15 U.S.C. § 1681c(g)(1), the judgment of Congress would

not lend itself to a finding of concreteness. Every one of our sister circuits to

consider the question of expiration dates has reached the same conclusion. See

Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 783 (9th Cir. 2018); Crupar-

Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 82 (2d Cir. 2017); Meyers v.

Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 728–29 (7th Cir. 2016).

The next reason the majority gives for rejecting congressional judgment in

its evaluation of the risk of harm, is that federal courts have an “independent

responsibility” to “decid[e] whether a given risk . . . meets the materiality

threshold.” Maj. Op. at 28. Again, this principle is accurate. After all, federal

courts must satisfy themselves of Article III standing even where a plaintiff alleges

a statutory violation. See, e.g., Summers v. Earth Island Inst., 555 U.S. 488, 497,

129 S. Ct. 1142, 1151 (2009) (observing that the “requirement of injury in fact is a

hard floor of Article III jurisdiction that cannot be removed by statute”). But as set

out above, there is nothing incompatible with the court satisfying itself of an

injury’s concreteness, and considering the judgment of Congress at the same time.

Deference to congressional judgment does not mean “no role for the courts.” Maj.

Op. at 27. To the contrary, I see at least a couple ways in which federal courts

might complement, rather than erase Congress’s judgment.

74

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 75 of 148

First, as discussed here, courts can and should determine whether the

judgment of Congress in fact supports the conclusion that a risk of harm was

sufficiently material. In that regard, the history of FACTA supports a finding of

materiality as to Dr. Muransky’s allegations. I recognize there are circumstances

in which congressional judgment would not support a finding of concreteness, as

with violations of FACTA’s expiration date requirement. And I agree with the

view of the majority that it is the responsibility of courts to make that evaluation,

even in the face of a statutory cause of action. See, e.g., Jeffries, 928 F.3d at 1066

(concluding that a FACTA violation presented a sufficiently material risk of harm

in part because it was the “nightmare scenario” Congress sought to prevent in

enacting the statute).

Second, I acknowledge there are instances in which courts must themselves

determine whether a risk of harm is sufficiently material. In Spokeo, for instance,

the Supreme Court noted that not all FCRA violations result in a material risk of

harm to the concrete interests the protected by that statute. 136 S. Ct. at 1550. The

example I have already given comes from the Court’s observation that “[i]t is

difficult to imagine how the dissemination of an incorrect zip code, without more,

could work any concrete harm.” Id. Whether a credit report containing inaccurate

personal information creates a risk of concrete harm is precisely the type of

standing question that is susceptible to this sort of commonsense analysis by

75

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 76 of 148

federal courts. See Robins v. Spokeo, Inc., 867 F.3d 1108, 1117 (9th Cir. 2017) (in

the context of an FCRA violation, concluding that inaccuracies concerning “age,

marital status, educational background, and employment history” present a

material risk of harm because this is “the type [of information] that may be

important to employers or others making use of a consumer report”).

After rejecting consideration of or giving weight to Congress’s judgment,

the majority concludes that the FACTA violation alleged in Dr. Muransky’s

complaint does not entail a material risk of harm, and so is not a concrete injury. It

assumes, without explanation, that Dr. Muransky’s allegation that he suffered an

elevated risk of harm from Godiva’s FACTA violation is not enough to meet the

materiality threshold because a receipt showing 10 of a card’s 16 digits does not

pose “anything approaching a realistic danger” of identity theft. Maj. Op. at 29. I

think this weighing of the facts goes too far. Some questions of materiality, like

whether an incorrect zip code on a credit report can cause harm, lend themselves to

such commonsense judgments. However, questions about the number of digits of

a credit or debit card an identity thief needs in order to steal one’s identity is not

one of them. And aside from the majority’s intuition about what card information

is (or is not) useful to identity thieves, there is nothing in the record of this case to

suggest that Congress was wrong when it decided that a FACTA violation of this

76

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 77 of 148

sort creates a material risk of identity theft. 3 In circumstances such as these—

where neither commonly held understandings nor the record undermine

congressional factfinding—Spokeo suggests that courts should be guided in their

risk analysis by the judgment of Congress. 136 S. Ct. at 1549 (observing that

“Congress is well positioned to identify intangible harms that meet minimum

Article III requirements”). On the issue of the number of digits that create risk,

Congress’s judgment, after hearing from experts on the matter, was that printing

anything more than the last five digits of a credit card number poses an intolerable

risk of harm to consumers. This judgment supports the conclusion that Dr.

Muransky faced a material risk of harm, and thus a concrete injury, when Godiva

printed a receipt showing the first six and last four digits of his credit card number.

3

Perhaps cognizant that this record is bereft of any factfinding on whether the risk posed by

Godiva’s FACTA violation is sufficiently material, Mr. Isaacson sought to fill this gap in two

ways. First, he argues on appeal that the first six digits of a card number equates to printing the

name of the card’s issuing institution. But just as a plaintiff cannot raise “[l]ate-breaking

allegations in unsworn briefs” to shore up standing, Maj. Op. at 30, neither can a defendant raise

factual contentions in an unsworn brief to disprove standing. And Mr. Isaacson’s brief presents

the only factual offering in this record about what these digits stand for. Second, Mr. Isaacson

asks us to rely on opinions by our sister circuits recognizing that the first six digits of a card

number identifies the issuing institution. Br. of Appellant Isaacson at 3 (citing Katz v. Donna

Karan Co., 872 F.3d 114, 118 (2d Cir. 2017) (observing that the district court found on a factual

challenge to standing that printing the first six digits of a credit card number poses no risk of

identity theft)). Mr. Isaacson effectively asks us to take judicial notice of facts found in another

court’s opinion. This we may not do. See McIvor v. Credit Control Servs., Inc., 773 F.3d 909,

914 (8th Cir. 2014) (“Judicial notice of another court's opinion takes notice of the existence of

the opinion, which is not subject to reasonable dispute over its authenticity, but not of the facts

summarized in the opinion.” (quotation marks omitted)).

77

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 78 of 148

I accept that Congress’s judgment as to the materiality of a risk is not

infallible. An example of this is the Second Circuit’s decision in Katz, 872 F.3d

114, which also involved a FACTA claim based on a receipt showing the first six

and last four digits of a credit card number. Id. at 116. There, the defendant raised

a factual challenge to standing in a Federal Rule of Civil Procedure 12(b)(1)

motion to dismiss. Id. at 119–20. As part of that motion, the defendant presented

extrinsic evidence supporting its argument that the first six digits of a credit card

number revealed only the cardholder’s issuing institution, and thus presented no

material risk of identity theft. Id. The district court found in favor of the

defendant, and the Second Circuit concluded that the district court’s factual

ruling—that the first six digits identify only the card’s issuer—was not clearly

erroneous. Id. at 120. Katz thus demonstrates how the introduction of extrinsic

evidence in the District Court may, in some circumstances, work to undermine

Congress’s judgment. Here, however, neither Mr. Isaacson nor Godiva raised any

factual challenge to Dr. Muransky’s standing in the District Court. For that reason,

no record was developed in this case like that available to the Second Circuit in

Katz. In the absence of record evidence suggesting that Congress misjudged the

number of card digits necessary to cause a material risk identity theft, we are left to

conclude that the FACTA violation at issue constitutes a concrete injury.

78

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 79 of 148

At the final step of its analysis, the majority says Dr. Muransky failed to

establish standing in his complaint because he pled only that he suffered a FACTA

violation. Maj. Op. at 29–30. Thus, the majority reasons, Dr. Muransky violated

the requirement that pleadings must contain more than conclusory allegations of

harm. Id. (citing Ashcroft v. Iqbal, 556 U.S. 662, 678–79, 129 S. Ct. 1937, 1949–

50 (2009)). But again, when a statute itself protects a concrete interest, an

allegation that the defendant violated that statutory requirement is anything but

conclusory. See Spokeo, 136 S. Ct. at 1549 (concluding that where the statutory

right at issue itself protects a concrete interest, a plaintiff need not allege

“additional harm” beyond the statutory violation). Because the FACTA violation

alleged by Dr. Muransky itself constitutes a concrete harm, he was not required to

plead additional facts showing how a receipt revealing the first six and last four

digits of a credit card creates a risk of identity theft. 4

4

Dr. Muransky argues for the first time on appeal that he suffered an injury because, as a result

of Godiva’s FACTA violation, he was forced to safeguard his receipt to keep it from falling into

the hands of identity thieves. Br. of Appellee Muransky at 39–42. I agree with the majority that

Dr. Muransky cannot raise this new theory of standing at this late stage. Maj. Op. at 23 (citing

Salcedo v. Hanna, 936 F.3d 1162, 1173 (11th Cir. 2019)). I also agree with the majority that the

viability of Dr. Muransky’s safeguarding theory is in any event bound up in whether he faced a

material risk of harm. Id. However, because I would hold that Dr. Muransky did face a material

risk of identity theft stemming from Godiva’s FACTA violation, I would also hold that Dr.

Muransky could have proceeded on his safeguarding theory had he raised it in his complaint.

79

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 80 of 148

III.

I return now to the lesson from Spokeo that courts deciding whether an

injury is sufficiently concrete should be guided by “history and the judgment of

Congress.” Spokeo, 136 S. Ct. at 1543. I have set out how the judgment of

Congress alone supports a finding of concreteness in this case. I now address how

history also strongly suggests that Dr. Muransky’s alleged injury is concrete.

Spokeo says courts may find an injury to be sufficiently concrete if the

“alleged intangible harm has a close relationship to a harm that has traditionally

been regarded as providing a basis for a lawsuit in English or American courts.”

Id. at 1549. In this circumstance, it is sufficient for a plaintiff, at the pleading

stage, to allege only a violation of the statutory right bearing a close relationship to

the common law harm. See Perry, 854 F.3d at 1340–41 (finding a close

relationship between violations of the Video Privacy Protection Act and the tort of

intrusion upon seclusion). The match between the statutory violation and the tort

traditionally recognized at common law need not be perfect. See Golan v.

FreeEats.com, Inc., 930 F.3d 950, 958 (8th Cir. 2019) (“An alleged harm need not

actually have been actionable at common law to satisfy this inquiry, rather it must

have a ‘close relationship’ to the type of harm that has traditionally been

recognized as actionable.”); Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th

Cir. 2017) (recognizing a close relationship between a statutory violation and

80

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 81 of 148

common law tort where the statute “codifies a context-specific extension of

the substantive right to privacy” (emphasis omitted)).

I agree with Dr. Muransky that the injury asserted here bears a close

relationship to a common law breach of confidence tort. A breach of confidence

lies where a person offers private information to a third party in confidence, and

the third party discloses that information. Alan B. Vickery, Breach of Confidence:

An Emerging Tort, 82 Colum. L. Rev. 1426, 1427–28 (1982). The basic elements

of this tort are: “(1) the plaintiff conveyed confidential and novel information to

the defendant; (2) the defendant had knowledge that the information was being

disclosed in confidence; (3) there was an understanding between the defendant and

the plaintiff that the confidence be maintained; and (4) there was a disclosure or

use in violation of the understanding.” Berkla v. Corel Corp., 302 F.3d 909, 917

(9th Cir. 2002) (quotation marks omitted). The tort of breach of confidence “‘is

rooted in the concept that the law should recognize some relationships as

confidential to encourage uninhibited discussions between the parties involved.’”

Jeffries, 928 F.3d at 1064 (quoting Young v. U.S. Dep’t of Justice, 882 F.2d 633,

640 (2d Cir. 1989)).

A breach of confidence tort is not a perfect analogue to the FACTA violation

at issue here. As the majority notes, the two ways in which a breach of confidence

tort is distinguishable from the violation alleged by Dr. Muransky are (1) that a

81

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 82 of 148

breach of confidence requires a disclosure, and Dr. Muransky has not alleged his

credit card information was disclosed to anyone; and (2) the relationship between

Dr. Muransky and Godiva is not the prototypical confidential relationship giving

rise to breach of confidence torts. Maj. Op. at 26–27. The majority seems to think

this these differences make a breach of confidence tort ill-suited to the FACTA

violation at issue here. I think not.

To begin, history may support a finding of concreteness even if a plaintiff

cannot satisfy all the elements of a closely related tort. That is because, under

Spokeo, congressionally proscribed “conduct [need not] give rise to a cause of

action under common law.” Susinno v. Work Out World Inc., 862 F.3d 346, 351

(3d Cir. 2017) (quotation marks omitted). “If a plaintiff were required to satisfy

every element of a common law cause of action before qualifying for statutory

relief, Congress’s power to ‘elevate intangible harms’ by defining injuries and

chains of causation which will ‘give rise to a case or controversy where none

existed before’ would be illusory.” Trichell v. Midland Credit Mgmt., Inc., 964

F.3d 990, 1010 (11th Cir. 2020) (Martin, J., concurring in part and dissenting in

part) (alterations adopted) (quoting Spokeo, 136 S. Ct. at 1549)).

As to Dr. Muransky’s failure to allege that Godiva disclosed his credit card

information to a third party, Spokeo also recognized that a material risk of

intangible harm is sufficient to establish a concrete injury in fact. 136 S. Ct. at

82

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 83 of 148

1549. Here, the FACTA violation alleged by Dr. Muransky posed a material risk

that his identity would be stolen, which is “the very harm the breach of confidence

tort makes actionable—an unauthorized disclosure of privileged information to a

third party.” Jeffries, 928 F.3d at 1065. Thus, the fact that Dr. Muransky did not

actually fall victim to identity theft does not preclude our court from finding that

the violation he alleged here bears a close relationship to a breach of confidence

tort.

And with respect to the relationship between Dr. Muransky and Godiva, I

recognize that the breach of confidence tort has historically applied to traditional

confidential relationships, like that between a customer and his bank. See, e.g.,

Suburban Trust Co. v. Waller, 408 A.2d 758, 761 (Md. Ct. App. 1979). But I see

no reason why a relationship between a consumer and a point-of-sale merchant

should not be viewed as confidential. When a consumer makes a purchase using a

credit or debit card, he provides confidential identifying information to a merchant.

In doing so, the consumer places trust in the merchant to safeguard that

information from potential identity thieves. 39 Weekly Comp. Pres. Doc. 1746,

1748 (noting that receipts printed by merchants “should not hold the key to [a

consumer’s] savings and financial secrets”). I therefore view the confidential

relationship been a consumer and a merchant as an appropriate “context-specific

83

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 84 of 148

extension” of a traditional breach of confidence tort. See Eichenberger, 876 F.3d

at 983.

For these reasons, I believe Dr. Muransky has alleged a concrete injury that

is closely related to a harm traditionally protected at common law. Therefore, he

was not required to allege any further harm beyond the FACTA violation asserted

in his complaint.5

IV.

Congress enacted FACTA in an effort to reduce the risk of identity theft by

requiring merchants to truncate credit card numbers on printed receipts, and in

doing so, set the tolerable level of risk at no more than the last five digits of a card

number. Dr. Muransky alleges he suffered a concrete injury when Godiva printed

the first six and last four digits of his card number. Both the common law and the

judgment of Congress support a conclusion that the FACTA violation alleged in

Dr. Muransky’s complaint constitutes a concrete injury in fact. I believe Spokeo

5

As the majority points out, Maj. Op. at 25, the parties dispute whether a breach of confidence

tort was “traditionally . . . regarded as providing a basis for a lawsuit in English or American

courts.” Spokeo, 136 S. Ct. at 1549. Dr. Muransky notes that English courts recognized the tort

as early as 1849, see Prince Albert v. Strange, 41 Eng. Rep. 1171 (Ch. 1849), while American

courts recognized the tort as early as 1894, see Corliss v. E.W. Walker Co., 64 F. 280 (C.C.D.

Mass. 1894). Mr. Isaacson, meanwhile, cites an article that (a) described the tort as “emerging”

as of 1982; and (b) described the tort as “dy[ing] out in its infancy” in the United States, while

forming the “basis of an extensive body of law” in England. Vickery, 82 Colum. L. Rev. at

1452–54. I believe Dr. Muransky has the better of this argument. The fact that a tort did not

gain prominence in the United States until the 1980s does not mean it was not traditionally

regarded as providing a basis for suit. And Mr. Isaacson has failed to cite a single court decision

refusing to recognize a breach of confidence tort as actionable.

84

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 85 of 148

commands us to find that Dr. Muransky has satisfied the injury in fact requirement

of Article III. I therefore respectfully dissent.

85

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 86 of 148

JORDAN, Circuit Judge, dissenting:

I join the dissents of Judges Wilson and Martin. They each demonstrate, for

different reasons, that Dr. Muransky has Article III standing based on the allegations

of his complaint. I write to make two additional points, one procedural and one

substantive.

The procedural point is that, regardless of what one thinks about the

disagreement between the majority and the dissents on Article III standing, this case

should not be dismissed outright, and at most should be remanded for further

proceedings. Assuming for the sake of argument that the majority’s view of standing

is correct, Mr. Isaacson did not raise his standing argument until the fairness hearing,

and even then, he did so only obliquely. Supreme Court precedent and procedural

fairness dictate that Dr. Muransky have an opportunity to amend his complaint or

present facts in support of standing.

Not only is dismissal unfair to Dr. Muransky, but it requires the majority to

make assumptions about the risks of identity theft without the benefit of a factual

record, expert reports, or adversarial testing of the issue in the district court. The

majority essentially relies on its common sense to conclude that when a vendor prints

a receipt displaying the first six and last four digits of a credit card number, the risk

of identity theft is “remote.” But that is a fact-based and value-laden judgment,

which appellate courts are ill-equipped to make in the abstract.

86

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 87 of 148

The result of dismissing in this procedural context is problematic for another

reason. The majority does not and cannot explain what analysis or assumptions lead

to its conclusion of remoteness, and it fails to describe the standard it applies or

delineate the boundaries of Article III jurisdiction. The majority’s “I know it when

I see it” approach to standing, cf. Jacobellis v. Ohio, 378 U.S. 184, 197 (1964)

(Stewart, J., concurring), is a problem for future litigants and courts, especially in

data privacy cases, where the harm is perhaps difficult to quantify and describe, but

which Congress has nonetheless identified and attempted to prevent by legislation.

The second point, the substantive one, concerns the doctrine of Article III

standing. That we need to resolve what is essentially a policy question to determine

the boundaries of our subject-matter jurisdiction reminds us how far standing

doctrine has drifted from its beginnings and from constitutional first principles.

Standing, as we know it today, was a twentieth-century innovation. But to the extent

that the current doctrine can be reconciled with the Constitution, it is designed to

safeguard the separation of powers between the branches of government and ensure

that courts hear—in the words of James Madison—cases only “of a Judiciary

Nature.” Cases like this one, involving the alleged invasion of a congressionally-

created private right by a private party against another private party, do not implicate

structural or institutional concerns. They are exactly the type of cases suited for

initial congressional judgment and ensuing judicial resolution.

87

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 88 of 148

There has been a long tradition—before the Founding and after—of English

and American courts hearing cases involving the invasions or violations of private

legal rights, including new private rights created by statute, regardless of whether

the plaintiff could allege some injury beyond the invasion of the right itself. The

Supreme Court’s standing cases, from the early twentieth century to the present,

have not upset that tradition.

The better way to understand standing here is not through the lens of injury-

in-fact, but under the rights-based model that Justice Thomas and others have

outlined. That framework is grounded in the traditional distinction between public

and private rights, which early American jurists understood well, and which

perseveres in other areas of law. Properly rooted in history and tradition, this rights-

based framework harmonizes modern standing doctrine with Article III. It also

offers a straightforward and consistent method for resolving difficult standing

questions, such as the one presented here, which have been unnecessarily

complicated by a narrow focus on the injury-in-fact requirement.

Under this rights-based framework, Dr. Muransky easily alleged the invasion

of a private legal right—the right to receive a receipt truncating all but the last five

digits of his credit card number. That right was supposed to inure to his benefit

under a law that Congress enacted, and the violation itself was something that a

vendor did directly to him. The violation, in other words, was personal to him. By

88

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 89 of 148

requiring Dr. Muransky to demonstrate a separate injury in this context, we turn

Article III on its head.

I

To justify dismissal, the majority argues that “[t]his is not a case where a

surprise standing issue was thrust upon an unaware plaintiff.” I strongly disagree.

Dr. Muransky never had any reason to doubt that he met his burden to establish

standing, and he was led to believe that subject-matter jurisdiction was not an issue,

even after the Supreme Court decided Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).

To see why, we must review the district court proceedings in detail and without the

benefit of hindsight.

A

Dr. Muransky filed his complaint in June of 2015. He alleged that Godiva

printed a receipt displaying the last four and first six digits of his credit card number.

He claimed, correctly, that Godiva violated the FACTA, 15 U.S.C. § 1681c(g)(1).

And he asserted that the violation burdened him and putative class members with an

“elevated risk of identity theft”—the very risk that Congress sought to mitigate when

it enacted the FACTA.

When Dr. Muransky made these allegations, he was justified in believing they

were sufficient to establish Article III standing. The majority appears to concede

this point, acknowledging that “[p]erhaps before Spokeo there was an argument that

89

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 90 of 148

[Dr.] Muransky’s claim could have survived as pleaded[.]” But this

acknowledgment is an understatement, for it was clear that standing existed. Our

own cases reiterated that “Congress may enact statutes creating legal rights, the

invasion of which creates standing, even though no injury would exist without the

statute.” Houston v. Marod Supermarkets, Inc., 733 F.3d 1323, 1330 (11th Cir.

2013) (internal quotation marks omitted). This was not surprising given cases like

Havens Realty Corp. v. Coleman, 455 U.S. 363, 373–74 (1982), which held that a

“tester” plaintiff who received false information in violation of the Fair Housing Act

had standing to sue, even though he did not intend to rent or purchase a home or

apartment and did not suffer an actual injury.

With respect to the FACTA, the Eighth Circuit had relied on Coleman to hold

that a violation of §1681c(g) was, by itself, sufficient for an Article III injury. See

Hammer v. Sam’s E., Inc., 754 F.3d 492, 498–99 (8th Cir. 2014) (“[T]he actual-

injury requirement may be satisfied solely by the invasion of a legal right that

Congress created. This is not a novel principle within the law of standing.”). Lower

courts, including one in in this circuit, had reached the same conclusion. See Amason

v. Kangaroo Exp., No. 7:09–CV–2117–RDP, 2013 WL 987935, at *6–7 (N.D. Ala.

Mar. 11, 2013); Armes v. Sogro, Inc., 932 F. Supp. 2d 931, 938 (E.D. Wis. 2013);

90

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 91 of 148

Korman v. Walking Co., 503 F. Supp. 2d 755, 759 (E.D. Pa. 2007). The majority is

mistaken in suggesting that the law in 2015 was in a state of flux. 1

Understandably, then, Godiva did not make any real attempt to challenge Dr.

Muransky’s standing. The majority points to the fact that Godiva raised standing as

an affirmative defense in its answer to the complaint, but that defense was a mere

placeholder—a single, conclusory statement that “[n]either Dr. Muransky nor any

member of the proposed class has suffered any injury in fact.” Godiva did not say

anything more, and it is not clear whether this argument was even a facial attack on

the complaint or a factual attack. The defense therefore could have been stricken as

conclusory under Rule 12(f). See, e.g., Losada v. Norwegian (Bahamas) Ltd., 296

F.R.D. 688, 690 (S.D. Fla. 2013) (“Where an affirmative defense is ‘no more than

bare bones conclusory allegations, it must be stricken.’”) (quoting Microsoft Corp.

v. Jesse’s Computers & Repair, Inc., 211 F.R.D. 681, 684 (M.

This text is long and has been trimmed here. Open the source document for the complete record.