# Dr. David S. Muransky v. Godiva Chocolatier, Inc.

> Court of Appeals for the Eleventh Circuit · October 28, 2020

URL: https://www.frixlaw.com/law-library/cases/4581562

## Case

- **Court:** Court of Appeals for the Eleventh Circuit
- **Decided:** October 28, 2020
- **Precedential status:** Published
- **Opinion:** Opinion
- **Nature of suit:** ENB
- **Cited by:** 0 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/4581562

## How later opinions describe it (automated extraction)

- observing that the district court found on a factual challenge to standing that printing the first six digits of a credit card number poses no risk of identity theft
- holding that a statutory violation alone is enough
- holding that a statutory violation alone is not enough
- noting that the causation prong of Article III standing “is an issue best left to the rigors of evidentiary proof at a future stage of the proceedings, rather than dispensed with as a threshold question of constitutional standing”

## Opinion text

USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 1 of 148

[PUBLISH]

IN THE UNITED STATES COURT OF APPEALS

FOR THE ELEVENTH CIRCUIT
________________________

No. 16-16486 & 16-16783
________________________

D.C. Docket No. 0:15-cv-60716-WPD

DR. DAVID S. MURANSKY,
individually and on behalf of all others similarly situated,

Plaintiff - Appellee,

JAMES H. PRICE,
ERIC ALAN ISAACSON,
Interested Parties - Appellants

versus

GODIVA CHOCOLATIER, INC.,
a New Jersey corporation,

Defendant - Appellee.
________________________

Appeals from the United States District Court
for the Southern District of Florida
________________________

(October 28, 2020)
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 2 of 148

Before WILLIAM PRYOR, Chief Judge, WILSON, MARTIN, JORDAN,
NEWSOM, BRANCH, GRANT, LUCK, LAGOA, ED CARNES,* Circuit
Judges.**

GRANT, Circuit Judge, delivered the opinion of the Court, in which WILLIAM
PRYOR, Chief Judge, NEWSOM, BRANCH, LUCK, LAGOA, and ED
CARNES, Circuit Judges, joined.

GRANT, Circuit Judge:
In Spokeo, Inc. v. Robins, the Supreme Court took on a standing question

that had bedeviled litigants, scholars, and lower courts—whether pleading that a
statutory requirement was violated is enough to establish standing, even if the
plaintiff suffered no injury from the alleged violation. The answer was a
resounding no: a party does not have standing to sue when it pleads only the bare
violation of a statute.
That holding left the class action litigants here in an awkward spot. Years

ago, the named plaintiff pleaded this case as a pure statutory violation. He alleged
that Godiva chocolate stores had printed too many credit card digits on hundreds of
thousands of receipts over the course of several years, and pointed out that those
extra numbers were prohibited under a federal law aimed at preventing identity
theft. His complaint disclaimed any recovery for actual damages, and why not—
with per-violation statutory damages of up to $1,000, the potential class recovery

*
We heard this case en banc while Judge Ed Carnes was an active judge, and he elected to
continue to participate in the decision of this case after becoming a senior circuit judge. See
Eleventh Circuit Rule 35-9 (“Senior circuit judges of the Eleventh Circuit . . . may continue to
participate in the decision of a case that was heard or reheard by the court en banc at a time when
such judge was in regular active service.”); see also Gogel v. Kia Motors Mfg. of Ga., Inc., 967
F.3d 1121, 1125 n.** (11th Cir. 2020) (en banc).
**
Judge Rosenbaum and Judge Jill Pryor are recused. Judge Andrew Brasher joined the Court on
June 30, 2020, and did not participate in this decision.
2
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 3 of 148

was staggering even if no one actually suffered any harm. Godiva, it seems, also
found the potential damages staggering, and the parties agreed on a class

settlement not too long after the lawsuit was filed.
So why are the litigants in an awkward spot? As they admitted in the district
court, Spokeo was on the horizon during settlement talks, but had not yet been

decided; it formed an ominous backdrop for their negotiations. Both parties had an
interest in settling before that case was decided, because the Supreme Court’s
decision was likely to shift the bargaining calculus dramatically. So they settled.
And having reached a deal in the shadow of Spokeo, neither side was ready to start
all over after it was decided. Together, they pushed through the class fairness
hearing, and landed here for a fairness review after a few class members objected

to the settlement.
But even if the parties wish to bargain around Spokeo, we cannot indulge
them. Federal courts retain our constitutional duty to evaluate whether a plaintiff
has pleaded a concrete injury—even where Congress has said that a party may sue
over a statutory violation. Having shut his eyes and closed his ears to the
requirements of Spokeo while his claims were still at the district court, the named
plaintiff now tries to say that those claims surely show concrete injury under
Spokeo in any event. He has done his best to argue that the statutory violation he
alleged carries with it both harm and risk of harm—and does so every time. But
the emperor still has no clothes; the bare procedural violation the plaintiff alleges is
just as bare as it ever was. Because the plaintiff alleged only a statutory violation,
and not a concrete injury, he has no standing. That means we cannot evaluate the
3
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 4 of 148

fairness of the parties’ settlement, and we vacate the district court’s order
approving it.

I.
A.
Before turning to why alleging the violation of a statute is not enough to

establish standing, we should say a few words about the statute at issue here. The
Fair and Accurate Credit Transactions Act sets out a wide range of protections and
procedures. Pub. L. No. 108-159, 117 Stat. 1952 (2003). One of the (many) stated
goals of the legislation is “to prevent identity theft.” Id. In support of that goal,
FACTA forbids merchants from printing more than the last five digits of the card
number (or the card’s expiration date) on receipts offered to customers. Id. sec.

113, § 605(g), 117 Stat. at 1959 (codified at 15 U.S.C. § 1681c(g)(1)). A willful
violation exposes a company to liability for actual damages—if any were
sustained—or statutory damages ranging from $100 to $1,000 per violation. 15
U.S.C. § 1681n(a)(1)(A). Punitive damages and attorney’s fees are also available.
Id. § 1681n(a)(2)–(3).
Several years after the passage of FACTA, in response to “hundreds” of
lawsuits seeking damages because credit card expiration dates had been printed on
receipts—lawsuits that otherwise contained no “allegation of harm to any
consumer’s identity”—Congress enacted what’s known as the Clarification Act.
Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241
§ 2(a)(4)–(5), 122 Stat. 1565, 1565 (2008). That law retroactively eliminated
liability for merchants who had printed credit card expiration dates on receipts but
4
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 5 of 148

complied with the other receipt-printing limitations. Id. sec. 3, § 616(d), 122 Stat.
at 1566 (codified at 15 U.S.C. § 1681n(d)). The Clarification Act offered a

subsequent Congress’s view that some technical FACTA violations caused
consumers no harm: the statute’s stated “purpose” was to protect “consumers
suffering from any actual harm” while also “limiting abusive lawsuits” that would

drive up costs to consumers without offering them any actual protection. Id.
§ 2(b), 122 Stat. at 1566.
B.
With that background, we return to the allegations in front of us. Dr. David
Muransky used his credit card to spend $19.26 at a Godiva retail store in Florida.
He was handed a receipt containing the first six and last four digits of his sixteen-

digit credit card number—too many digits under FACTA.
Muransky got busy, filing a class action complaint against Godiva less than
a week later. He alleged that Godiva had willfully printed more digits than the law
allowed and that the excess digits were a national problem for the company.
Muransky’s complaint made clear that the alleged FACTA violations were
“statutory in nature” and that the suit was expressly “not intended to request any
recovery for personal injury.” He alleged the class’s harm, and risk of harm, from
those statutory violations in broad terms: “Plaintiff and the members of the class
have all suffered irreparable harm as a result of the Defendant’s unlawful and
wrongful conduct,” and “Plaintiff and members of the class continue to be exposed
to an elevated risk of identity theft.” No additional details were offered.

5
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 6 of 148

The class of injured persons that Muransky proposed consisted of anyone in
the United States who, in the two preceding years, received a point-of-sale receipt

from Godiva that displayed more than the last five digits of their credit or debit
card number. He sought statutory damages, punitive damages, and costs—as well
as attorney’s fees. Because of the size of the putative class, Godiva faced a

startling liability of more than $342 million.
After a few motions to dismiss were rejected, Godiva’s answer to the
complaint included a standing argument: “Neither Dr. Muransky nor any member
of the proposed class has suffered any injury in fact. They therefore lack standing
to prosecute their alleged claims.”
Given the dramatic size of the potential damages, it is no surprise that the

parties soon began settlement negotiations. They tried to move quickly—both
Muransky and Godiva admit that one of the driving forces in those negotiations
was the Supreme Court’s impending decision in Spokeo, Inc. v. Robins, 136 S. Ct.

1540 (2016). As Muransky later told the trial court, “the class faced considerable
uncertainty with regard to the Supreme Court’s anticipated decision in Spokeo, Inc.
v. Robins which, depending on the outcome, could have resulted in the case’s

dismissal for failure to present an injury in fact.” Godiva’s briefing acknowledged
the same—the potential outcome of Spokeo factored heavily into the settlement
negotiations.
The flush of negotiations led to an agreement in principle to settle the case:
Godiva would pay $6.3 million instead of the $342 million initially sought.
Almost a third of the pot, $2.1 million, would go to the class attorneys, with an
6
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 7 of 148

additional $10,000 going to Muransky “for his service as Class Representative.”
The average class member, according to Muransky, would net about $60 when all

was said and done.
With Spokeo still outstanding, the district court certified the class, granted
preliminary approval of the settlement, and directed notice to the class members.

Four class members filed various objections after they heard about the suit—
including Appellants James Price and Eric Isaacson—though none of the objectors
initially argued that Muransky lacked standing.
But by the time the district court held a fairness hearing on the proposed
settlement, things had changed: the Supreme Court had issued its decision in
Spokeo. Objector Isaacson took notice, and argued to the district court that it had

an obligation to examine whether Muransky’s claim satisfied the requirements of
Article III standing as described in Spokeo. Muransky, he said, bore the burden of
establishing the elements of standing as the party invoking federal jurisdiction—
and in the absence of standing, the district court “would have no choice” but to
dismiss the case. Neither Godiva nor Muransky offered anything in response.
Roughly a week later, the district court—without addressing Spokeo or
Article III standing—approved the class settlement. The court instead offered a
general conclusion that it had “jurisdiction over the subject matter of this
litigation,” before going on to approve the settlement. Isaacson and Price
appealed.
Objector Price raised the same issues he raised below—the contents of the
class notice, the attorney’s fee award, and the incentive award to Muransky.
7
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 8 of 148

Objector Isaacson, in addition to several other objections, offered the one we face
here today: that the court lacked Article III jurisdiction to approve the settlement

because Muransky had not suffered an injury in fact.
A panel of our Court disagreed, affirming the settlement’s approval after
concluding that Muransky had satisfied the requirements of Article III—even

considering Spokeo. A few months later, the panel vacated its first opinion and
issued a new one in its place. Although the superseding opinion contained a
revised standing analysis, it reached the same conclusions as the first: Muransky
had Article III standing, the objections failed on the merits, and the class settlement
was properly approved.
The panel’s new standing analysis resulted in a categorical rule: “if Congress

adopts procedures designed to minimize the risk of harm to a concrete interest,
then a violation of that procedure that causes even a marginal increase in the risk of
harm to the interest is sufficient to constitute a concrete injury.” Muransky v.
Godiva Chocolatier, Inc., 922 F.3d 1175, 1188 (11th Cir.), reh’g en banc granted,
opinion vacated, 939 F.3d 1278 (11th Cir. 2019). The level of risk required was
alternatively described as “no more than an identifiable trifle.” Id. at 1186
(quotation marks and citation omitted). So in the panel’s view, by setting out a
statutory requirement for the number of digits on a receipt, Congress had judged
that any violation of that requirement would increase the consumer’s risk of
identity theft—and this Court was bound to accept that congressional assessment
of injury. See id. at 1188.

8
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 9 of 148

In response, the full Court ordered rehearing en banc and vacated the panel
opinion. In a testament to the complications of this case, the four parties offer

different perspectives on Muransky’s Article III standing. Objector Isaacson
maintains that Muransky lacks standing because he was not injured and says this
case should be dismissed. Muransky and Objector Price both argue that Muransky

has standing (though they disagree about the merits of the settlement approval).
For its part, Godiva declines to offer the Court any perspective at all, claiming that
it is “prevented from answering this question” by the settlement agreement.
II.
Whether the plaintiffs have standing to sue is a threshold jurisdictional
question that we review de novo. Debernardis v. IQ Formulations, LLC, 942 F.3d

1076, 1083 (11th Cir. 2019).
III.
At the heart of this case is one question: whether the judiciary must assume
that whenever Congress creates a legal entitlement, any violation of that
entitlement causes a concrete injury. Although courts “sometimes make standing
law more complicated than it needs to be,” a well-trod path leads us to the answer
here. Thole v. U.S. Bank N.A., 140 S. Ct. 1615, 1622 (2020). The Supreme Court
“has rejected the argument that ‘a plaintiff automatically satisfies the injury-in-fact
requirement whenever a statute grants a person a statutory right and purports to
authorize that person to sue to vindicate that right.’” Id. at 1620 (quoting Spokeo,
136 S. Ct. at 1549). And that rejection is derived from the now-familiar
admonition that alleging a “bare procedural violation, divorced from any concrete
9
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 10 of 148

harm” is not enough to support standing. Spokeo, 136 S. Ct. at 1549. So, even
considering the welter of standing doctrines that can clutter our analysis, we know

one thing to be true—alleging a statutory violation is not enough to show injury in
fact.
Why not? Article III of the Constitution limits federal courts to deciding

“Cases” or “Controversies.” U.S. Const. art. III, § 2. The existence of a case or
controversy is a “bedrock requirement” of our jurisdiction; we cannot exercise
judicial power without it. Raines v. Byrd, 521 U.S. 811, 818 (1997) (quoting
Valley Forge Christian Coll. v. Ams. United for Separation of Church and State,
Inc., 454 U.S. 464, 471 (1982)). So in order to find out if we can hear a party’s
claim, we need to consider whether that party has a case or controversy rather than,

say, a strong and abiding interest in an issue, or a desire to obtain attorney’s fees.
Standing, ripeness, and mootness are three traditional doctrines governing
whether a case or controversy exists. Standing—“perhaps the most important of
the jurisdictional doctrines”—is the only one at issue here. FW/PBS, Inc. v. City of
Dallas, 493 U.S. 215, 231 (1990) (quoting Allen v. Wright, 468 U.S. 737, 750
(1984)) (alterations adopted). For a party to have standing to bring a lawsuit, it
must have “(1) suffered an injury in fact, (2) that is fairly traceable to the
challenged conduct of the defendant, and (3) that is likely to be redressed by a
favorable judicial decision.” Spokeo, 136 S. Ct. at 1547 (citing Lujan v. Defs. of
Wildlife, 504 U.S. 555, 560–61 (1992)). In plainer language, the plaintiff needs to
show that the defendant harmed him, and that a court decision can either eliminate
the harm or compensate for it. That standard applies equally in the class action
10
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 11 of 148

setting; a district court is “powerless to approve a proposed class settlement” if “no
named plaintiff has standing.” Frank v. Gaos, 139 S. Ct. 1041, 1046 (2019).

Our inquiry becomes narrower as we move down the standing decision tree;
injury is the only element we need to consider here. At the pleading stage of a
case, “general factual allegations of injury” can suffice. Lujan, 504 U.S. at 561.

But that is not a free pass—these general factual allegations must “plausibly and
clearly allege a concrete injury.” Thole, 140 S. Ct. at 1621; see also Ashcroft v.
Iqbal, 556 U.S. 662, 678–79 (2009); Bell Atl. Corp. v. Twombly, 550 U.S. 544,

555–56 (2007); Salcedo v. Hanna, 936 F.3d 1162, 1168 (11th Cir. 2019). “[M]ere
conclusory statements do not suffice.” Iqbal, 556 U.S. at 678 (punctuation
omitted). Although Iqbal and Twombly have put a finer point on it, this standard is
not new—it’s long been known that even at the pleading stage, the “litigant must
clearly and specifically set forth facts” to satisfy the requirements of Article III.
Whitmore v. Arkansas, 495 U.S. 149, 155 (1990). We will not “imagine or piece
together an injury sufficient to give [a] plaintiff standing when it has demonstrated
none,” and we are powerless to “create jurisdiction by embellishing a deficient
allegation of injury.” Miccosukee Tribe of Indians of Fla. v. Fla. State Athletic

Comm’n, 226 F.3d 1226, 1229–30 (11th Cir. 2000) (citing Whitmore, 495 U.S. at
155).
What is required, then? A plaintiff needs to plead (and later support) an

injury that is concrete, particularized, and actual or imminent, rather than

11
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 12 of 148

conjectural or hypothetical.1 See Spokeo, 136 S. Ct. at 1548 (quoting Lujan, 504
U.S. at 560). Our inquiry narrows again; we only consider concreteness here. A

lot of ink has been spilled to explain what concrete means, but the best word may
also be the simplest—“real.” Id. And statutory violations do not—cannot—give
us permission to offer plaintiffs a wink and a nod on concreteness. Plaintiffs must
show, and the courts must ensure, that an alleged injury is concrete, or else we
have no jurisdiction to consider it. Id. at 1548–49.
As the parties recognized—or, less charitably, feared—during their

settlement negotiations, the Supreme Court’s Spokeo, Inc. v. Robins decision is
central to our concreteness analysis. That’s because Spokeo was not only about
concreteness; it was also about Congress. Spokeo cautioned that “Congress’ role in
identifying and elevating intangible harms does not mean that a plaintiff
automatically satisfies the injury-in-fact requirement whenever a statute grants a
person a statutory right and purports to authorize that person to sue to vindicate
that right.” Id. at 1549. So although a congressional judgment may be “instructive
and important” to this Court’s analysis, we need to come to our own conclusion
that the alleged harm is concrete before we can find that a plaintiff has standing.
Id.

1
We note that the burden of establishing these elements of standing continues—and, in fact,
increases—all the way through the litigation. Lujan, 504 U.S. at 561. The elements need to be
supported “with the manner and degree of evidence required at the successive stages of the
litigation”—though what that means at the class settlement stage has been the subject of some
debate. Id. Because Muransky has not offered any allegations beyond those in his complaint,
and because we can resolve the case on the basis of his deficient pleadings, we do not need to
wrestle with that question here.
12
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 13 of 148

Echoing Lujan v. Defenders of Wildlife, the Spokeo decision also
acknowledged that Congress may “elevate to the status of legally cognizable

injuries concrete, de facto injuries that were previously inadequate in law” and that
“Congress has the power to define injuries and articulate chains of causation that
will give rise to a case or controversy where none existed before.” Spokeo, 136 S.

Ct. at 1549 (citation omitted and alterations adopted). Congress can certainly
create new legal entitlements, the denial of which will constitute a concrete injury.
See, e.g., FEC v. Akins, 524 U.S. 11, 21–24 (1998) (inability to obtain information
is an injury in fact); Pub. Citizen v. U.S. Dep’t of Justice, 491 U.S. 440, 449 (1989)
(same). It can also recognize and provide legal remedies for concrete injuries that
already exist, but for which there is no cause of action. But this is a limited

authority to provide legal process relating to actual harms, not a blanket power to
authorize suit in the absence of harm: Congress “cannot erase Article III’s
standing requirements by statutorily granting the right to sue to a plaintiff who
would not otherwise have standing.” Spokeo, 136 S. Ct. at 1548 (quoting Raines,
521 U.S. at 820 n.3). 2
A.
Now to the mechanics of pleading. Plaintiffs can show a concrete, or “real,”
harm in two ways. The first is to show that the statutory violation itself caused a
harm. It’s safe to say that pointing to a direct harm is the most straightforward way

2
Our dissenting colleague’s long discussion of the public-private rights theory is interesting to
consider as a matter of first principles. See Jordan Dissent at 115–47. But it is also irrelevant to
the work that we have to do as an inferior court in this appeal. That work is to apply the binding
caselaw of the Supreme Court, which does not currently endorse the theory pressed by our
colleague.
13
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 14 of 148

to show a concrete injury—in fact, it’s probably what most people think of
naturally. Such harms can be tangible or intangible. Tangible harms are the most

obvious and easiest to understand; physical injury or financial loss come to mind as
examples.
Claims of intangible harm, on the other hand, can be tricky: some are

concrete, some are not. Violations of the rights to free speech or free exercise, for
instance, are intangible harms that are also both direct and concrete. Spokeo, 136
S. Ct. at 1549 (collecting cases). “[C]onscientious objection” to a law or “fears of
hypothetical future harm”? Not so much. See Diamond v. Charles, 476 U.S. 54,
67 (1986); Clapper v. Amnesty Int’l USA, 568 U.S. 398, 416 (2013). And
questions of whether alleged intangible harms are concrete have an extra wrinkle

when the plaintiff’s claim stems from the violation of a statute.
Shedding some light on how to draw that difficult line, Spokeo instructs that
we may consider “both history and the judgment of Congress.” Spokeo, 136 S. Ct.
at 1549. History first—by looking to history, we can discern a concrete injury
where the “intangible harm has a close relationship to a harm that has traditionally
been regarded as providing a basis for a lawsuit in English or American courts.”
Id. The fit between a new statute and a pedigreed common-law cause of action
need not be perfect, but we are called to consider at a minimum whether the harms
match up between the two. Likewise, congressional judgment may illuminate a
concrete injury because, as a body, Congress “is well positioned to identify
intangible harms that meet minimum Article III requirements.” Id. But as we have
already explained, congressional judgment only goes so far, and does not relieve
14
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 15 of 148

the judiciary of our constitutional duty to independently determine whether the
plaintiff has suffered a concrete injury.

Our own post-Spokeo precedent illustrates how both history and
congressional judgment can fit into the concreteness analysis. In several cases, we
have concluded that a plaintiff had standing because the statutory violation at issue

led to a type of harm that has historically been recognized as actionable. For
example, we held that CNN’s dissemination of a plaintiff’s news-viewing history
to a third-party, in violation of the Video Privacy Protection Act, could constitute a
concrete injury because it was analogous to torts that were well-established in
American courts—namely, invasion of privacy and intrusion upon seclusion.
Perry v. Cable News Network, Inc., 854 F.3d 1336, 1340–41 (11th Cir. 2017). We

reached a similar conclusion when we held that an agency’s violation of the Fair
Credit Reporting Act—offering an allegedly inaccurate statement in a plaintiff’s
credit report—was analogous to the longstanding tort for publication of defamatory
material. Pedro v. Equifax, Inc., 868 F.3d 1275, 1279–80 (11th Cir. 2017).
We have also relied on the judgment of Congress to discern concrete
injuries. In Debernardis v. IQ Formulations, LLC, for instance, we considered the
plaintiffs’ claim that they were sold an adulterated dietary supplement as defined
by the Food, Drug, and Cosmetic Act because the manufacturer failed to provide
notice to the Food and Drug Administration that a new dietary ingredient was safe.
942 F.3d at 1080–82. Although the plaintiffs suffered no physical harm from the
supplement, we concluded that they were sold a worthless product “that Congress
judged insufficiently safe for human ingestion.” Id. at 1085. That deprived the
15
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 16 of 148

plaintiffs of the benefit of their bargain and amounted to a direct economic loss
that supported standing. Id. at 1085–86. In short, a variety of approaches can

demonstrate direct harm to a plaintiff.
Even without any direct harm, a plaintiff can establish an injury in fact by
showing that a statutory violation created a “risk of real harm.” Spokeo, 136 S. Ct.

at 1549 (citing Clapper, 568 U.S. 398). But while very nearly any level of direct
injury is sufficient to show a concrete harm, the risk-of-harm analysis entails a
more demanding standard—courts are charged with considering the magnitude of
the risk. That means we evaluate whether the claimed “procedural
violations . . . entail a degree of risk sufficient to meet the concreteness
requirement.” Id. at 1550.

If some degrees of risk are called sufficient, that means others must be
insufficient. Although Spokeo did not trace a numerical line between the two, it
did explain that the risk must be “material.” Id. That’s a familiar word that, in this
context, means “important; essential; relevant.” New Oxford American Dictionary
(3d ed. 2010); see also The American Heritage Dictionary of the English Language
(5th ed. 2018) (“Being both relevant and consequential; crucial.”). We recognize
that “material risk of harm” is a somewhat indefinite term. Spokeo, 136 S. Ct. at
1550; Nicklaw v. CitiMortgage, Inc., 839 F.3d 998, 1002–03 (11th Cir. 2016). One
thing is definite, however. Whatever “material” may mean, conceivable and

trifling are not on the list.
And for all the things that Spokeo broke new ground on, the high standard
for risk of harm was not one of them. The Supreme Court has long indicated that
16
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 17 of 148

standing predicated on a risk of harm must be based on something more than a
minor or theoretical risk—“a ‘substantial risk’ that the harm will occur,” for

example. Clapper, 568 U.S. at 414 n.5 (citation omitted). Other cases use slightly
different formulations to describe a significant or substantial risk, but they are
consistent in recognizing a high standard for the risk-of-harm analysis, and a robust

judicial role in assessing that risk. See, e.g., Thole, 140 S. Ct. at 1622
(“substantially increased risk”); Dep’t of Commerce v. New York, 139 S. Ct. 2551,
2565 (2019) (“a substantial risk that the harm will occur” (quoting Susan B.
Anthony List v. Driehaus, 573 U.S. 149, 158 (2014))); Monsanto Co. v. Geertson
Seed Farms, 561 U.S. 139, 153, 155 (2010) (“substantial risk” or “significant
risk”); Pennell v. City of San Jose, 485 U.S. 1, 8 (1988) (“realistic danger of

sustaining a direct injury” (citation omitted)); Blum v. Yaretsky, 457 U.S. 991,
1000 (1982) (a “sufficiently substantial” threat). We do not see, we should add, a
“material” or “substantial” difference among these terms, and the Supreme Court
has not suggested one.
Our Court has already put this standard to work. In Nicklaw v.
CitiMortgage, Inc., we concluded that a plaintiff had suffered neither direct harm

nor a “material risk of harm” when his mortgage company recorded the discharge
of his debt later than it should have. 839 F.3d at 1000, 1003. The plaintiff, after
all, had brought his lawsuit two years after the lender had finally (albeit tardily)

fulfilled its duty, and there was no allegation that the lender’s earlier failure had
already injured him or would pose any risk in the future. Id. at 1003. With neither

17
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 18 of 148

a direct harm nor a material risk of harm, the plaintiff had suffered no concrete
injury. See id.

We add that the lack of a numerical standard governing the quantum of risk
that is sufficient to support standing does not mean that the standard is zero, that
the standard is minimal, or that we simply defer to Congress. And the limits on

congressional authority do not disappear when the statutory right at issue protects
against a risk of future harm; it would be backwards to say that Congress gets less
than complete deference when it seeks to identify actual harm, but is due blind,
unreviewable deference if it seeks to protect against a risk of actual harm. The
same is true for pleading requirements. A conclusory statement that a statutory
violation caused an injury is not enough, so neither is a conclusory statement that a

statutory violation caused a risk of injury.
B.
To boil down the lessons above, we consider two things when we evaluate
whether concrete harm flows from an alleged statutory violation—and thus
whether the plaintiff has standing. First, we ask if the violation itself caused harm,
whether tangible or intangible, to the plaintiff. If so, that’s enough. If not, we ask
whether the violation posed a material risk of harm to the plaintiff. If the answer to
both questions is no, the plaintiff has failed to meet his burden of establishing
standing.3

3
We will confess that we find ourselves somewhat perplexed by our dissenting colleague’s
repeated assertions that we believe only identity theft can cause injury under FACTA. See
Wilson Dissent at 36, 42–43, 47. Both identity theft and a material risk of identity theft plainly
qualify as injuries under that statute and under this opinion. Nor do we see how interpreting the

18
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 19 of 148

The heart of Muransky’s claim is that “he was provided with an
electronically printed receipt” that “displayed the last four digits of his credit card

as well as the first six digits of his account number” and that, because of this type
of violation, he and other class members “have all suffered irreparable harm” and
“continue to be exposed to an elevated risk of identity theft.” And, as we have

explained, the complaint emphasizes that the wrongs committed by Godiva are
“statutory in nature” and expressly disclaims any recovery for “personal injury”
arising from the violations.
Relying on these allegations, all of which are grounded in the statute,
Muransky now argues that the extra digits on his receipt can be counted as a
concrete injury in four different ways. Three of his arguments suggest that the

statutory violation itself—his receipt of the receipt—caused him a direct harm. His
alternative argument is that the violation exposed him to an increased risk of
identity theft. But Muransky’s efforts to recharacterize the statutory violation he
pleaded to fit within Spokeo’s limits demonstrate, if anything, a commitment to the
idea that the violation alone must somehow be enough.
1.
His first argument is that he had a “substantive right” to a properly truncated
receipt, and that the violation of that right, “by itself, is a concrete injury.” This

interest protected by FACTA as avoidance of “risk of identity theft” moves the ball. To begin,
this opinion makes clear that anyone who properly pleads a material risk of identity theft would
have standing. Second, if the harm the statute protects against is “risk of identity theft” rather
than “identity theft,” that would mean that we would need to consider whether a statutory
violation led to a material risk of a risk of identity theft. We fail to see how that word-soup
analysis would help plaintiffs in any event—either they suffer a material risk of harm or they do
not.
19
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 20 of 148

argument gets at the core of his complaint’s allegations—statutory-violation-qua-
injury was the predominant theory of harm throughout the litigation. Muransky

also presses a new argument that the (unpleaded) efforts he took to safeguard his
receipt qualify as an injury in fact. Finally, he pivots to historical analogue,
asserting that the mishandling of his account information is actionable because it

bears a close resemblance to a common-law breach of confidence. None of these
direct-injury claims holds up.
i.
We have already explained the key holding from Spokeo: a “bare procedural
violation, divorced from any concrete harm” is not enough to establish an Article
III injury. Spokeo, 136 S. Ct. at 1549. But we restate the point here to explicitly

reject any argument that the complaint’s conclusory statement that “Plaintiff and
the members of the class have all suffered irreparable harm as a result of the
Defendant’s unlawful and wrongful conduct” is enough to show concrete injury;
that claim would be so flimsy after Spokeo (not to mention Iqbal) that Muransky
himself does not raise it. Nothing in FACTA suggests some kind of intrinsic worth
in a compliant receipt, nor can we see any. So it makes little sense to suggest that
receipt of a noncompliant receipt itself is a concrete injury.
To resist the force of that intuition, Muransky attempts to reframe the nature
of his injury by relying on a fuzzy distinction between “substantive” and
“procedural” rights. He argues that Godiva’s statutory violation deprived him of a
substantive right to receive “a properly truncated receipt,” and that the violation of
a substantive right, unlike a procedural right, automatically inflicts an injury in
20
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 21 of 148

fact—even if it causes no harm. This, it turns out, is a dressed up version of the
same argument that the Eighth Circuit accepted before Spokeo, but had to walk

back after it: “Our prior statement that ‘[i]njury in fact may thus be shown solely
by the invasion of a legal right that Congress created,’ is no longer good law in
light of the Supreme Court’s subsequent holding in Spokeo, Inc. v. Robins [that]

‘Article III standing requires a concrete injury even in the context of a statutory
violation.’” Golan v. FreeEats.com, Inc., 930 F.3d 950, 957–58 (8th Cir. 2019)
(quotation marks and citations omitted).
In an attempt to resuscitate that argument, Muransky contends that the
holding in Spokeo applies only to what he calls “procedural” statutory violations,
and not to what he calls “substantive” ones. He argues that Spokeo confirms his

view when it says that even a procedural violation “can be sufficient in some
circumstances to constitute injury in fact.” Spokeo, 136 S. Ct. at 1549. Muransky
is absolutely right that Spokeo makes this point, but he’s absolutely wrong that it
saves his claim.
Spokeo’s statement stands for the unremarkable proposition that, in some
cases, the violation of a procedural right set out in a statute will necessarily result
in the harm that Congress was trying to prevent. A prime example is the illegal
deprivation of information: “a plaintiff suffers an ‘injury in fact’ when the plaintiff
fails to obtain information which must be publicly disclosed pursuant to a statute.”
Akins, 524 U.S. at 21 (citation omitted); see also Havens Realty Corp. v. Coleman,
455 U.S. 363, 373 (1982) (denial of “legal right to truthful information about
available housing” is an Article III injury). That, the Supreme Court has already
21
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 22 of 148

made clear, is not a “bare” procedural violation, or one that is “divorced from any
concrete harm”; if a statute protects against a lack of information, the denial of

access to information is a concrete injury. For FACTA, on the other hand, a
violation of the statute does not directly result in the harm Congress was trying to
prevent. That is, no one’s identity is stolen at the moment a receipt is printed with

too many digits. See Pub. L. No. 108-159, 117 Stat. at 1952 (a goal of FACTA is
“to prevent identity theft”).
So while some statutory violations, by their very nature, will be coextensive
with the harm that Congress was trying to prevent, labels do not control our
analysis. We are not the first court to recognize that arguments grounded in a
distinction between substantive and procedural rights miss the point and are

“unconvincing” because they depend “entirely on the framing of the right.”
Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 782 (9th Cir. 2018); see also
Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 n.2 (7th Cir. 2016).
The question, always, is whether an injury in fact accompanies a statutory
violation.
Confronting this argument again also feels a little like Groundhog Day,

because we already rejected it in Nicklaw. There, the plaintiff claimed that,
because “the New York legislature intended to create a substantive right to have
the certificate of discharge timely recorded,” the plaintiff automatically suffered a

concrete injury when the discharge was untimely filed. 839 F.3d at 1002
(emphasis added). There too, we held that the “relevant question” was “whether
Nicklaw was harmed when this statutory right was violated.” Id. The point is that
22
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 23 of 148

for standing purposes, no matter what label you hang on a statutory violation, it
must be accompanied by a concrete injury.

We thus continue to adhere to our decision in Nicklaw. Muransky’s
assertion that he does not need to show anything more than a noncompliant receipt
because his statutory right was “substantive” cannot be squared with our

precedent—or with the central holding of Spokeo. To avoid “alleging a bare
procedural violation,” the plaintiff must show either some harm caused by the
violation or a material risk of harm. Spokeo, 136 S. Ct. at 1550. What Muransky
has missed is that the word “bare” is just as important as the word “procedural.”
ii.
Perhaps suspecting that a statutory violation alone would no longer be

sufficient after we considered Spokeo, Muransky claims on appeal that the time he
spent safeguarding his receipt also constitutes a direct injury in fact.
Although we have held that “allegations of wasted time can state a concrete
harm for standing purposes,” we have also declined to find standing when no such
allegations were pleaded. Salcedo, 936 F.3d at 1173. In Salcedo, we rejected the
plaintiff’s assertion at oral argument that receiving unwanted text messages caused
him to waste time. Id. at 1168. We did so for a simple reason: his complaint
lacked any “specific time allegation.” Id. So too here. Muransky never alleged
that he treated his Godiva receipt differently than any other, or that he spent any
additional time safeguarding it.
But even if Muransky had alleged that he spent additional time destroying or
safeguarding his receipt, he would not succeed on this theory. Where a
23
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 24 of 148

“hypothetical future harm” is not “certainly impending,” plaintiffs “cannot
manufacture standing merely by inflicting harm on themselves.” Clapper, 568

U.S. at 416, 422. Muransky is no different than the Clapper plaintiffs in this
respect—his management-of-risk claim is bound up with his arguments about
actual risk. If his Godiva receipt would not offer any advantage to identity thieves,

we could hardly say that he was injured because of the efforts he took to keep it out
of their hands. To be fair, we have not yet addressed Muransky’s risk-of-harm
claims, but any assertion of wasted time and effort necessarily rises or falls along
with this Court’s determination of whether the risk posed by Godiva’s FACTA
violation, as pleaded by Muransky, is itself a concrete harm.
iii.

In his final attempt to show a direct harm, Muransky argues—for the first
time—that Godiva’s FACTA violation is analogous to a common-law breach of
confidence tort. To succeed on this theory, he needs to show that the violation
bears “a ‘close relationship’ to a traditionally redressable harm.” Salcedo, 936
F.3d at 1172 (quoting Spokeo, 136 S. Ct. at 1549). His argument proceeds along
the following lines: FACTA requires merchants to keep credit card information
secret. By handing him a receipt with too many digits of his credit card number
exposed, Godiva “disclosed” information that he provided in confidence and gave
criminals “easy access” to it. Because that disclosure (to him) bears a close
relationship to the common-law breach of confidence tort, he says, it qualifies as a
concrete harm.

24
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 25 of 148

Not so fast. As an initial matter, the parties dispute whether a breach of
confidence tort can fairly be said to have “traditionally been regarded as providing

a basis for a lawsuit in English or American courts.” Spokeo, 136 S. Ct. at 1549.
There is arguable support for both views in academic literature and caselaw. As a
1982 note cited by both Muransky and Isaacson explains, following its recognition

in 1849, “the breach of confidence tort has become the basis of an extensive body
of law” in England. Alan B. Vickery, Note, Breach of Confidence: An Emerging
Tort, 82 Colum. L. Rev. 1426, 1452–54 (1982). But that same source goes on to
state that the “law of breach of confidence in the United States, at least with
respect to personal information, has not enjoyed a similar development,” and that
the tort was “emerging” in a “rudimentary” form after initially dying “out in its

infancy.” Id. at 1451–52, 1454. The observation that the tort was “emerging” in
the 1980s is consistent with the Second Circuit’s 1989 description of a breach of
confidence as “a relative newcomer to the tort family.” Young v. U.S. Dep’t of
Justice, 882 F.2d 633, 640 (2d Cir. 1989).
One of the unexpected consequences of the common-law-analogy approach
to identifying harms is the growing insistence on hammering square causes of
action into round torts. Litigants and courts alike can be drawn into overthinking
what was really a simple instruction: see if a new harm is similar to an old harm.
Another risk is that courts will be unnecessarily drawn into an arcane evaluation of
a tort’s origins. Fortunately, we are not put to that test today. We need not resolve
whether breach of confidence is sufficiently ancient, because even if we assume

25
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 26 of 148

that a breach of confidence was traditionally redressable in English and American
common-law courts, we are unpersuaded by its analogy to the facts of this case.

A breach of confidence, at least as defined by the article cited by the parties,
involves “the unconsented, unprivileged disclosure to a third party of nonpublic
information that the defendant has learned within a confidential relationship.”

Vickery, supra, at 1455; see also Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 114
(3d Cir. 2019); Vassiliades v. Garfinckel’s, 492 A.2d 580, 591 (D.C. 1985).
Godiva’s FACTA violation shares very little with this definition. Two key
elements of a breach of confidence are completely absent from the violation he
complains of. To begin, there was no “disclosure to a third party.” Muransky was
handed a receipt that bore his own information, and he does not allege that anyone

else ever saw it. To describe this act as a “disclosure” would distort the meaning
of the term.
Nor can we see how Muransky could have had a confidential relationship
with the Godiva retail store. A breach of confidence “is rooted in the concept that
the law should recognize some relationships as confidential to encourage
uninhibited discussions between the parties involved.” Young, 882 F.2d at 640; see
also David A. Elder, Privacy Torts § 5:3 (2019). Given this understanding, it is
unsurprising that breach of confidence claims traditionally arise in the context of
close professional relationships—those involving physicians, therapists, financial
institutions, and the like. See, e.g., Suburban Tr. Co. v. Waller, 408 A.2d 758, 764
(Md. Ct. Spec. App. 1979) (bank); Doe v. Roe, 400 N.Y.S.2d 668, 676 (N.Y. Sup.
Ct. 1977) (psychiatrist); Horne v. Patton, 287 So. 2d 824, 829 (Ala. 1973) (medical
26
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 27 of 148

doctor). Handing a common form of payment to a cashier at a retail store is simply
not equivalent to these kinds of vulnerable, confidential relationships.

Because no information was disclosed, and no confidential relationship
existed, the relationship between Godiva’s conduct and a breach of confidence is
anything but “close”: a Godiva clerk handed Muransky a receipt containing a
portion of his own credit card information. The fit between a traditionally
understood harm and a more recent statutory cause of action need not be perfect,
but the association here is too strained. Accordingly, we cannot say—at least

based on a breach-of-confidence theory—that Muransky has pleaded the kind of
injury that “has traditionally been regarded as providing a basis for a lawsuit.”
Spokeo, 136 S. Ct. at 1549.
2.
Because Muransky failed to allege that the FACTA violation caused him a
direct harm, we move on to consider whether he pleaded that the extra digits
caused him to suffer a material risk of harm. In arguing that he did, Muransky
returns, really, to the same point we dismissed earlier: that the inquiry begins and
ends with deference to congressional judgment. As he sees it, by requiring the

truncation of all but the last five digits of a credit card, Congress has decided that
printing additional digits creates a real risk of identity theft. End of story; there is
no role for the courts.
What Muransky asks is for us to abandon our judicial role by merging the
ordinary steps in the analysis—concluding that because the statute protects a
concrete interest, any violation automatically threatens that interest and thus
27
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 28 of 148

supports standing. Although that approach would simplify our job, it is
inconsistent with Spokeo and with what the Constitution demands of us. But first,

as a practical matter, there is good reason to doubt that Congress has deemed every
violation of FACTA to pose a material risk of identity theft. FACTA did not
specifically address the kind of partial truncation that occurred in this case—an

observation made by the Third Circuit when it noted (with respect to an identical
FACTA violation) that the “congressional findings of risk are not tailored to the
FACTA violation . . . pleaded.” Kamal, 918 F.3d at 115–16 n.5. Moreover,
Congress expressly recognized in the Clarification Act that not all violations of the
truncation requirement pose a serious threat to consumers. See Pub. L. No. 110-
241 § 2(b), 122 Stat. at 1566. So Congress itself has made clear that not every

FACTA violation carries with it a risk of harm.
Still, even if Congress had explicitly stated in the text of the statute that
every FACTA violation poses a material risk of harm, that alone would not carry
the day. Although the judgment of Congress is an “instructive and important” tool
to identify Article III injuries, we cannot accept Muransky’s argument that once
Congress has spoken, the courts have no further role. Spokeo, 136 S. Ct. at 1549.
“Congress cannot erase Article III’s standing requirements by statutorily granting
the right to sue to a plaintiff who would not otherwise have standing.” Id. at 1547–
48 (citation omitted). And as Spokeo emphasized, deciding whether a given risk of
harm meets the materiality threshold is an independent responsibility of federal
courts. See Kamal, 918 F.3d at 115 (“But the lesson of Spokeo is that we must
confirm a concrete injury or material risk exists even when Congress confers a
28
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 29 of 148

right of action.”). Indeed, the Spokeo majority’s ultimate instruction to the Ninth
Circuit on remand was to determine “whether the particular procedural violations

alleged in this case entail a degree of risk sufficient to meet the concreteness
requirement.” Spokeo, 136 S. Ct. at 1550. That instruction applies equally here.
It thus falls to us to consider Muransky’s claim. The question is whether

Muransky has alleged a material risk of harm, one that is “sufficient to meet the
concreteness requirement.” Id. Factual allegations that establish a risk that is
substantial, significant, or poses a realistic danger will clear this bar—but
Muransky gives us very little to go on. In his complaint, he offers the naked
assertion that he “and members of the class continue to be exposed to an elevated
risk of identity theft.” Nothing indicates how much risk this might be, however,

and no facts alleged in the complaint provide insight into what degree of “elevated
risk” Muransky faced, or why.
That kind of conclusory allegation is simply not enough. Muransky did not
plead facts that, taken as true, plausibly allege a material risk, or significant risk, or
substantial risk, or anything approaching a realistic danger. See Iqbal, 556 U.S. at
678–79. The thing is, contrary to our dissenting colleague’s assertion, Muransky
did not offer “a general factual contention subject to proof or disproof with
evidence at later stages of litigation.” Jordan Dissent at 101. In fact, he was not
trying to do so, and his own brief headings tell us why. Muransky’s argument to
this Court—still—is that Congress determined that he was put at risk and that
Congress’s judgment of risk is sufficient. And he later adds that he is relieved of
any duty to plead facts supporting a risk of harm because “Congress already found
29
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 30 of 148

the risk substantial.” So instead of actually pleading a material risk of harm, he has
provided us with a threadbare allegation that he was exposed to an increased risk

of identity theft. But an allegation of risk is not excused from the ordinary bar on
conclusory allegations—it would not be (indeed is not here) enough to plead that
“the defendant broke the law and injured me in doing so.” That is, again, merely a

reiteration of the statutory violation. If this pleading is enough to show standing,
then there is no violation of FACTA that would not be.
Late-breaking allegations in unsworn briefs before this Court do not change
that. According to Isaacson (and various amici), the extra numbers on Muransky’s
receipt merely contain information that is already allowed to be printed on it
elsewhere—the card issuer, for example. This observation was credited by the

Second Circuit, which has said that printing “the first six digits of a credit card
. . . is the equivalent of printing the name of the issuing institution.” Katz v. Donna
Karan Co., LLC, 872 F.3d 114, 120 (2d Cir. 2017). For his part, Muransky argues
that the six digits do contain information that can be exploited by identity thieves,
such as the card level or industry program, and that access to it enables identity
thieves to conduct “phishing” inquiries.4 But all of that is really beside the point.

Maybe these facts are true; perhaps they are not. Neither scenario would change
our ruling, which is based on Muransky’s pleading of a statutory violation. He
pleaded nothing about any specific risks from the sequence of numbers included on

his receipt, and did not address the issue before the district court at any time. It

4
Muransky, we note, does not offer this factual assertion to show that he has or can plead an
elevated risk of identity theft, but as support for his argument that we should defer to Congress’s
judgment of risk.
30
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 31 of 148

was his burden to satisfy the court that standing exists, and thus to plead something
more than a conclusory allegation of harm. If anything about Godiva’s violation

subjected him to an increased risk of identity theft, it was Muransky’s burden to
tell the court about it.
Perhaps before Spokeo there was an argument that Muransky’s claim could

have survived as pleaded, but now his allegation—consisting of nothing more than
a “bare procedural violation, divorced from any concrete harm”—is too thin to
survive. Spokeo, 136 S. Ct. at 1549.
3.
The conclusion we reach here—that Muransky has alleged neither a harm
nor a material risk of harm—is in accord with the majority of other circuits to

consider this same question. The Second, Third, and Ninth Circuits have each
considered FACTA violations involving partially truncated credit-card numbers.
All three concluded that the violation created neither a harm nor a material risk of
harm. See Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 106, 119 (3d Cir. 2019);
Noble v. Nevada Checker Cab Corp., 726 F. App’x 582, 583–84 (9th Cir. 2018)
(unpublished); Katz v. Donna Karan Co., LLC, 872 F.3d 114, 117, 121 (2d Cir.
2017). Two out of the three, we should add, were dismissed on the pleadings
without considering extrinsic evidence—just like this case will be. Similarly, after
Spokeo, every circuit to have considered a FACTA violation involving an
undeleted expiration date has held that, without more, it does not confer standing.
See Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 783 (9th Cir. 2018);

31
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 32 of 148

Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 81–82 (2d Cir. 2017);
Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016).5

The only circuit to conclude that a bare violation of FACTA’s receipt
requirements could support standing reached that conclusion on significantly
different facts. Last year, the D.C. Circuit considered a case where a merchant

printed the entire credit card number, as well as the expiration date, on a
customer’s receipt. Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1066 (D.C.
Cir. 2019). Because the merchant “printed all of the information in both
categories” it created “the nightmare scenario FACTA was enacted to prevent” and
provided “sufficient information for a criminal to defraud her.” Id. That factual
scenario is different than the violation Muransky complains about, and we do not

consider it here.
4.
Because Muransky has failed to allege either a harm or a material risk of
harm stemming from the FACTA violation, he lacks standing to bring this lawsuit.
And because federal courts are “powerless to approve a proposed class settlement”
if “no named plaintiff has standing,” we necessarily conclude that the district court
acted without jurisdiction. Frank, 139 S. Ct. at 1046. Accordingly, “we have
jurisdiction on appeal, not of the merits but merely for the purpose of correcting
the error of the lower court in entertaining the suit.” Steel Co. v. Citizens for a

5
Contrary to our dissenting colleague’s assertion, neither we nor our sister circuits have
“misread[] FACTA” any more than the Supreme Court misread FCRA when it required the
plaintiff in Spokeo to plead something beyond the violation of that statute. Wilson Dissent at 36.
We seek only to ensure that the plaintiff has, as he must under the Constitution, an actual
controversy rather than a theoretical one.
32
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 33 of 148

Better Env’t, 523 U.S. 83, 95 (1998) (citation omitted). The proper remedy is for
us to remand to the district court for a dismissal without prejudice. Stalley ex rel.

United States v. Orlando Reg’l Healthcare Sys., Inc., 524 F.3d 1229, 1232, 1234–
35 (11th Cir. 2008).
Muransky complains that at “no time in the district court proceedings was

standing challenged” and suggests that standing was only “mentioned . . . at the
final approval hearing.” Those statements are not completely right. But even if
they were, our decision would not change. As we have said before, it “is not unfair
to require every plaintiff to file a complaint which contains sufficient allegations of
standing.” Church v. City of Huntsville, 30 F.3d 1332, 1336 (11th Cir. 1994).
That lack of unfairness is particularly acute here, where the plaintiff was

aware from the very beginning that his standing was in question and was critical to
the success of his claim. In its answer to the complaint, one of Godiva’s defenses
was that “[n]either Dr. Muransky nor any member of the proposed class has
suffered any injury in fact” and that they “lack standing to prosecute their alleged
claims.” With this defense in the backdrop, both Muransky and Godiva admitted
that Spokeo was a driving force in their settlement negotiations. Muransky himself
admitted that the impending decision in Spokeo, “depending on the outcome, could
have resulted in the case’s dismissal for failure to present an injury in fact.” And
of course, Isaacson raised the Spokeo decision at the fairness hearing and urged the
district court to exercise its obligation to assure itself of standing. Indeed, though
it is rare, from time to time plaintiffs have even filed affidavits in this Court to firm

33
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 34 of 148

up standing allegations. See Ouachita Watch League v. Jacobs, 463 F.3d 1163,
1170 (11th Cir. 2006). No such attempt was made here.

At any point in this series of events, Muransky could have confronted the
standing issue head on, or requested leave to amend his complaint. We do not
think it is too much to ask that litigants who are aware that their allegations may

not satisfy constitutional standing requirements take the time to firm up those
allegations—if it is possible to do so—before an en banc circuit court confirms
their suspicions of inadequacy. This is not a case where a surprise standing issue
was thrust upon an unaware plaintiff.
Because no court has had the opportunity to consider any facts supporting
Muransky’s conclusory allegation of harm, we cannot say that no one could ever

show standing for a similar procedural violation. In fact, Muransky himself could
try to do so, because we are dismissing his claim without prejudice. But for now,
Muransky has not alleged any facts to support his claim beyond that of a bare
procedural violation. That is not enough.
We close with this. One of our dissenting colleagues suggests that
Muransky and his counsel should have yet another opportunity on remand to plead
or demonstrate harm—one last bite at the apple. See Jordan Dissent at 97, 100.
The problem with that solution—even setting aside that the parties have been
aware of the potential standing infirmities from the start—is that Muransky has
never asked for it. Not before the panel, and not before our full Court. Instead, he
and his counsel have pressed for their preferred theory of standing: “the violation
of Dr. Muransky’s substantive FACTA rights, by itself, is a concrete injury.”
34
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 35 of 148

Muransky, for whatever reason, has never sought to replead or prove standing
under a different theory. We defer to the parties on how to litigate their claims,

and decline to offer them a solution they have not sought. Because, under Spokeo,
the bare statutory violation pleaded by Muransky on behalf of the class is not
sufficient, we dismiss his claims.

* * *
Muransky has alleged that a cashier handed him a receipt containing some of
his own credit card information printed on it. Although the receipt violated the law
because it contained too many digits, Muransky has alleged no concrete harm or
material risk of harm stemming from the violation. Because this amounts to
nothing more than a “bare procedural violation, divorced from any concrete harm,”

Muransky has failed to allege that he has standing to bring this lawsuit. Spokeo,
136 S. Ct. at 1549. And in the absence of a named plaintiff with standing, neither
this Court nor the district court has jurisdiction over this case. We therefore
VACATE the order of the district court and REMAND with instructions to
dismiss without prejudice.

35
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 36 of 148

WILSON, Circuit Judge, dissenting:

The Fair and Accurate Credit Transactions Act is a bipartisan marvel. Built

in the shadow of the credit-card boom, the Act—known as FACTA—passed in

Congress with staggering support. Days later, President George W. Bush lauded

the bill in the Roosevelt Room for “protecting our citizens by taking the offensive

against identity theft.” Credit Transactions Act Signing, C-SPAN (Dec. 4, 2003),

https://www.c-span.org/video/?179442-1/credit-transactions-act-signing. The

bill’s “offensive” includes the truncation requirement, which made it the law that

no business may print more than the last five digits of their customers’ credit or

debit card number on store receipts. President Bush extolled that the truncation

requirement “will help prevent identity theft before it occurs.” Id. (emphasis

added). To enforce the new rule, FACTA imposed steep statutory penalties for

businesses that play fast and loose with this sensitive information.

Today this court misreads FACTA and dilutes core protections provided by

Congress. FACTA’s truncation requirement protects against both actual identity

theft and a consumer’s interest in using a credit or debit card without incurring any

heightened risk of identity theft. By assuming that the truncation requirement

redresses only actual identity theft and nothing more, the majority overlooks that

FACTA protects against a point-of-sale harm—the consumer suffers a heightened

risk of identity theft the moment the business prints an untruncated receipt. The

36
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 37 of 148

court’s mistake all but ensures that consumers in the Eleventh Circuit must now

allege, support, and prove that they suffered actual identity theft (or at least soon

will) because of a defendant’s FACTA violation in order to avail themselves of the

law’s protections. It is tough, though—and sometimes impossible—to trace an

identity thief. As a result, the majority’s decision essentially eviscerates this

statute in our circuit, stripping thousands of consumers who receive untruncated

receipts of a universally championed remedy.

Neither Article III nor Spokeo compel this result. Because Muransky

plausibly alleged that Godiva’s FACTA violation elevated his risk of identity theft

the moment the receipt was printed, he has shown that the violation harmed a

concrete interest that FACTA protects. That is enough to satisfy standing at this

phase of the case, so I dissent.

I.

Article III standing has three well-worn requirements: injury in fact,

causation, and redressability. See Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61

(1992). This case turns on injury in fact. To satisfy that prong, the plaintiff must

show, among other things, that he has suffered an injury that is “concrete.” Id. at

560. A concrete injury is a real one; it is not “hypothetical or speculative,” but in

fact exists. Salcedo v. Hanna, 936 F.3d 1162, 1167 (11th Cir. 2019). The standard

for establishing concrete injury climbs higher as the case inches forward. Lujan,

37
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 38 of 148

504 U.S. at 561. But when we analyze the plaintiff’s injury using only the

allegations in the plaintiff’s complaint, we take those allegations as true.

McElmurray v. Consol. Gov’t of Augusta-Richmond Cnty., 501 F.3d 1244, 1251

(11th Cir. 2007). The allegations need not be specific; when we rely on the

complaint, “general factual allegations . . . will suffice.” MSPA Claims 1, LLC v.

Tenet Fla., Inc., 918 F.3d 1312, 1318 (11th Cir. 2019). 1 The question is whether,

taking his allegations as true, the plaintiff has plausibly alleged a concrete injury.

Trichell v. Midland Credit Mgmt., Inc., 964 F.3d 990, 996 (11th Cir. 2020).

For a while, many debated whether the violation of a statute inherently

creates a concrete injury under Article III. Compare Edwards v. First Am. Corp.,

610 F.3d 514, 517 (9th Cir. 2010) (holding that a statutory violation alone is

enough), with David v. Alphin, 704 F.3d 327, 338–39 (4th Cir. 2013) (holding that

a statutory violation alone is not enough). Spokeo, Inc. v. Robins put that debate to

bed. 578 U.S. ___, 136 S. Ct. 1540 (2016). As the majority explains, Spokeo held

that the violation of a statute does not always cause a concrete injury; “bare

1
The majority says that Muransky must “clearly and specifically” allege facts to survive a
standing analysis at the pleading stage. Majority Op. at 11. But that view neglects Lujan’s
statement that, “[a]t the pleading stage, general factual allegations of injury” can suffice, “for on
a motion to dismiss we presume that general allegations embrace those specific facts that are
necessary to support the claim.” 504 U.S. at 561 (alteration accepted) (internal quotation mark
omitted). True, Muransky must provide specific facts when pressed at summary judgment. Id.
But when we scan his standing based on just his complaint, we presume that his general factual
allegations contain the specific facts he needs.
38
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 39 of 148

procedural violation[s],” without more, are not enough. Id. at 1549. Rather, a

statutory violation must cause concrete harm. Id. at 1548–49.

When does that happen? At first blush, it seems simple: a statutory violation

causes a concrete harm when it causes a real harm or a material risk of real harm.

See id. at 1548–50. But that simple statement begs a trickier question: What is a

“real harm”?

Spokeo states that there are two types of real harm: tangible and intangible.

See id. at 1549. A tangible harm is a palpable one, something that most would

know hurts without much thought. It is a harm painfully obvious—often

physically obvious—to the common observer (like losing money, a benefit, or a

job). See, e.g., Young Apartments, Inc. v. Town of Jupiter, 529 F.3d 1027, 1038

(11th Cir. 2008) (holding that a lost rent payment was a concrete injury for

standing purposes). These harms are almost always concrete. See Spokeo, 136 S.

Ct. at 1548–49.

An intangible harm, in contrast, is harder to define yet still offensive; it is

one that infringes on a person’s interests or rights (like infringement of your

freedom of speech or exercise of religion). See id. at 1549. Due to their

conceptual nature, not all intangible harms are “real” enough to be concrete.

In the statutory context, Spokeo explains how we should decide whether an

alleged intangible harm is concrete. See id. at 1549–50. First, we ask whether the

39
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 40 of 148

statute protects “concrete interests (as opposed to purely procedural rights).” See,

e.g., Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017) (Spokeo II)

(applying Spokeo), cert. denied, 138 S. Ct. 931 (2018) (mem.); see also Kamal v. J.

Crew Grp., Inc., 918 F.3d 102, 112–13 (3d Cir. 2019) (same). Second, we ask if

the violation “actually harm[ed]” or “present[ed] a material risk of harm” to a

concrete interest that the statute protects. Spokeo II, 867 F.3d at 1113; see also

Kamal, 918 F.3d at 112. If the answer to both questions is yes, the statutory

violation causes a concrete injury. Spokeo II, 867 F.3d at 1113; Kamal, 918 F.3d

at 112. 2

Muransky has established concrete injury under this test. FACTA protects

his concrete interest in using his credit or debit card without incurring a heightened

risk of identity theft. And Muransky plausibly alleged that Godiva’s violation in

fact heightened his risk of identity theft, harming an interest that FACTA protects.

2
I agree with the majority that the distinction between “substantive” and “procedural” rights is
semantical. The question is simply whether the violation harmed (or created a material risk of
harm to) a concrete interest. See Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 n.2
(7th Cir. 2016) (“[W]hether the right is characterized as ‘substantive’ or ‘procedural,’ its
violation must be accompanied by an injury-in-fact. . . . That is one of the lessons of Spokeo.”).
Sometimes that happens innately—the violation always harms an underlying concrete interest.
See Nayab v. Capital One Bank (USA), N.A., 942 F.3d 480, 490 (9th Cir. 2019) (holding that
when “every” statutory violation “offends the interests that the statute protects,” plaintiffs need
not allege more harm to establish standing); see also Havens Realty Corp. v. Coleman, 455 U.S.
363, 373–74 (1982) (holding that a violation of a statute establishing “an enforceable right to
truthful information [about] the availability of housing” was such a statute, since the violation
always harmed the concrete interest in truthful information). But that is not always the case, and
thus we must decide for ourselves whether a violation harmed a concrete interest.
40
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 41 of 148

Because the violation actually harmed Muransky’s concrete interest, we need not

analyze whether the violation presented a material risk of harm.

II.

First up is the concrete interest. To decide whether a statute protects a

concrete interest, we look to “history and the judgment of Congress.” Spokeo, 136

S. Ct. at 1549. An interest is more likely to be concrete if it has a “close

relationship to a harm that has traditionally been regarded as providing a basis for a

lawsuit in English or American courts.” Id. So too is an interest that Congress has

identified and judged as important and worth protecting. See id. But the interest

need not pass both litmus tests: a substantial showing in either category can suffice

to establish a concrete interest. See Dreher v. Experian Info. Sols., Inc., 856 F.3d

337, 345–46 (4th Cir. 2017) (noting that the lack of a common-law analog is “not

fatal” to a plaintiff’s standing if Congress has judged the interest as concrete);

Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1068 (D.C. Cir. 2019) (Rogers,

J., concurring in part and concurring in judgment) (agreeing that the defendant’s

alleged FACTA violation harmed a concrete interest because Congress identified

the interest as concrete, no matter if a common-law analog exists).

But even if Muransky had to clear both hurdles, he does so with space to

spare. Both Congress and history have established that a consumer has a concrete

41
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 42 of 148

interest in using a credit or debit card without incurring a heightened risk of

identity theft. See Jeffries, 928 F.3d at 1064–65 (majority opinion).

A.

Let’s start in Congress. Statutory text, legislative history, and public policy

make clear that Congress, in passing FACTA, recognized that consumers have a

concrete interest in using their cards without fear that each swipe will raise their

risk of identity theft.

Statutory Text. The surest mark of what Congress meant is what Congress

wrote. Three aspects of FACTA make clear that Congress thought that consumers

have an interest in avoiding the heightened risk of identity theft in addition to

avoiding actual identity theft.

The first is FACTA’s damages structure. The statute allows a consumer to

recover statutory damages whenever a business willfully prints more than the last

five digits of the consumer’s card number. 15 U.S.C. § 1681n(a)(1)(A). These

damages have no tie to actual identity theft; the consumer can recover them no

matter if he “ever becomes the victim of any crime.” Jeffries, 928 F.3d at 1064.

That damages scheme clashes with the majority’s take on FACTA’s

purpose. The majority assumes that FACTA guards against only the harm of

identity theft. See Majority Op. at 22 (claiming that the “harm Congress was

trying to prevent” through FACTA was stolen identity). But why would the statute

42
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 43 of 148

allow damages divorced from identity theft if its sole purpose were to combat

identity theft? It wouldn’t; it would instead bind FACTA’s damages scheme to the

harm of identity theft. So there must be a more nuanced method to Congress’s

madness—we interpret statutes “to avoid constitutional difficulties,” not create

them. Off. of Senator Mark Dayton v. Hanson, 550 U.S. 511, 514 (2007). That

method becomes clear once we accept that Congress enacted the statutory-damages

remedy to address a broader aim: to “decrease the risk that a consumer would have

his identity stolen.” Jeffries, 928 F.3d at 1064 (alteration accepted) (emphasis

added). Its presence tells us that actual identity theft is not the only concern

driving FACTA. Rather, this statutory scheme also protects another interest, one

prone to harm even without identity theft: the consumer’s interest “in using [a]

credit [or] debit card[] without incurring an increased risk of identity theft.” Id.

(emphasis added).

The second statutory clue is FACTA’s point-of-sale trigger. The statute

“imposes a truncation duty at the point of sale when identity theft cannot yet have

occurred.” Id. at 1067 n.3. The cause of action that Congress created does not

become complete when the consumer suffers identity theft; it is complete well

before that, the moment the business prints out too many card digits. See 15

U.S.C. § 1681c(g)(1). If FACTA were concerned with just identity theft, though,

its penalty would not accrue at the point of sale (before identity theft can occur); it

43
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 44 of 148

would accrue at the point of identity harm (when one suffers harm from identity

theft). The point-of-sale trigger thus reveals that Congress sought to protect an

immediately harmed interest—the interest in avoiding the heightened risk of

identity theft. See Jeffries, 928 F.3d at 1064, 1067 n.3.

The last indication—perhaps the most telling—is FACTA’s statute of

limitations. The statute of limitations turns on the untruncated receipt alone. The

limitations period for a FACTA violation is two years from the discovery of the

untruncated receipt but not later than five years from the printing of the

untruncated receipt. 15 U.S.C. § 1681p. Identity theft plays no role in this

sequence—the statute is indifferent to when or whether identity theft occurs. We

must ask, then: If the statute aims to redress only the harm of identity theft, why is

its limitations period apathetic to the harm of identity theft? Wouldn’t the

limitations period run sometime after the theft occurs?

Indeed, an example reveals the catch-22 that awaits a FACTA claimant

under the majority’s one-track view of FACTA’s protected interest. Suppose you

purchase a box of chocolates from a Godiva Chocolatier. After paying for the box

with your credit card, you notice that the cashier handed you a receipt showing

more than the last five digits of your card number. Although this act violated the

statute, the majority says you cannot sue yet; FACTA protects against only the

harm of identity theft, and you have not yet felt the hurt. But assume that the

44
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 45 of 148

cashier remembers your number, jots it down, and lays in wait. Two years and a

day later, you learn that the cashier, using the information on your receipt, has

stolen your identity, racking up thousands in credit card debt. Now that you have

suffered actual identity theft, the majority would say that you still cannot sue. The

statute of limitations began when you discovered the printed receipt, and now it

has run.

If FACTA’s sole aim were to redress the harm of identity theft, that

limitations scheme would make no sense—it operates without regard for when (or

even if) identity theft occurs. But the limitations scheme makes perfect sense once

we accept that FACTA also seeks to protect a consumer’s interest in using a credit

or debit card without incurring the heightened risk of identity theft. See Jeffries,

928 F.3d at 1064–65. In Congress’s eyes, that harm can occur at the point of sale,

the moment Godiva prints an untruncated receipt. Accordingly, Congress

reasonably chose to start the clock the moment the consumer discovers this point-

of-sale injury.

Legislative History. The legislative history also confirms that FACTA

sought to do more than just redress actual identity theft. When Congress passed

FACTA, the crime of identity theft had “reached almost epidemic proportions.”

H.R. Rep. No. 108-263, 25 (2003). Consumers were “increasingly concerned

about the risk of their personal financial information falling into the wrong hands.”

45
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 46 of 148

Id. (emphasis added). In fact, a “hotline established by the Federal Trade

Commission to field consumer complaints and questions about identity theft

logged over 160,000 calls in 2002 alone.” Id.

To ease these concerns, Congress found it “vitally important to address

measures which will help prevent identity theft” before it occurs. S. Rep. No. 108-

166, 8 (2003). The result was FACTA: a law designed to lessen consumer worries

by “limit[ing] the number of opportunities for identity thieves to ‘pick off’ key

card account information.” Id. at 13; see also In re Zappos.com, Inc., 888 F.3d

1020, 1027 (9th Cir. 2018) (“Congress has treated credit card numbers as

sufficiently sensitive to warrant legislation prohibiting merchants from printing

such numbers on receipts—specifically to reduce the risk of identity theft.”).

President Bush confirmed this purpose at the bill’s signing, noting that FACTA

would “help prevent identity theft before it occurs.” Credit Transactions Act

Signing, C-SPAN (Dec. 4, 2003), https://www.c-span.org/video/?179442-1/credit-

transactions-act-signing.

Not a shred of legislative history suggests that Congress wrote FACTA to

remedy only actual or inevitably impending identity theft. The history says just the

opposite. Congress’s focus on preventing identity theft before it occurs shows that,

in passing FACTA, Congress was concerned with more than just the actual harm

of identity theft. It believed that consumers have an interest in participating in the

46
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 47 of 148

market without increasing their chances of suffering identity theft. See Jeffries,

928 F.3d at 1064–65 (respecting Congress’s judgment that consumers have “an

interest in using their credit and debit cards without facing an increased risk of

identity theft”). We must defer to this legislative prerogative. See Spokeo, 136 S.

Ct. at 1549.

The majority takes a different view. It says that a later Clarification Act

makes clear that Congress’s “‘purpose’ was to protect ‘consumers suffering from

any actual harm’” from identity theft. Majority Op. at 5. But all Congress

recognized in the Clarification Act is that the failure to truncate an expiration date

does not pose “actual harm” to any interest. See Credit and Debit Card Receipt

Clarification Act of 2007, Pub. L. No. 110-241, § 2(a)(4)–(6), (b) (2008). In

contrast, Congress reiterated that “proper truncation of the card number, by

itself . . . prevents a potential fraudster from perpetrating identity theft or credit

card fraud.” Id. § 2(a)(6) (emphasis added). As a result, Congress “left the

truncation requirement and enforcement mechanism untouched,” affirming that the

failure to hide customers’ credit or debit card numbers can still put them in harm’s

way: it can heighten their risk of identity theft, a harm FACTA sought to prevent.

See Jeffries, 928 F.3d at 1068 (Rogers, J., concurring in part and concurring in

judgment).

47
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 48 of 148

Public Policy. Good policy often flows from good sense, and it makes

sense why Congress identified the heightened risk of identity theft as a concrete

interest. For one, a higher risk of identity theft can lead to another concrete harm:

actual identity theft. See Redman v. RadioShack, Corp., 768 F.3d 622, 626 (7th

Cir. 2014) (“[T]he less information the receipt contains the less likely is an identity

thief who happens to come upon the receipt to be able to figure out the

cardholder’s full account information and thus be able to make purchases . . . .”).

For another, consumers are less likely to use credit cards if their transactions are

unprotected, hamstringing economic efficiency and consumer spending. And a

higher risk of identity theft can divert consumer resources toward theft-prevention

measures, rather than typical economic goods and services. So Congress had good

reason to recognize that freedom from the heightened risk of identity theft is itself

a concrete interest.

*

It is worth reporting the violence that the majority’s logic does to this

statute. The holding hiding behind its reasoning is that a plaintiff can enforce a

FACTA violation only if it causes (or will soon cause) harm from identity theft.

That view decimates the class that this statute sought to protect. FACTA of course

provides a remedy for those who suffer identity theft. But it also provides a

remedy for those who do not—it lets consumers recover damages at the point of

48
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 49 of 148

sale well before identity theft could occur. 15 U.S.C. §§ 1681c(g)(1),

1681n(a)(1)(A). We are supposed to construe FACTA so that this feature is not

“inoperative or superfluous, void or insignificant.” Corley v. United States, 556

U.S. 303, 314 (2009). But by shrinking FACTA to cover just those that suffer or

will soon suffer identity theft, the majority ignores this directive, rewrites the

statute, and blinks FACTA as Congress knew it out of existence.

I would take a different route. Congress passed FACTA to fight identity

theft, but it did not elevate this interest to the exclusion of all others. Another

interest—one just as important—was encouraging consumers to use their credit or

debit cards without fear that their usage would raise their risk of identity theft.

Because Congress identified this interest as important and worth protecting, we

should defer to its determination and dub the interest concrete. See Spokeo, 136 S.

Ct. at 1549.

B.

Congress’s thoughts on the matter are enough to cement Muransky’s interest

in avoiding the heightened risk of identity theft. See id. But if there were any

doubt, history also “tilts toward concreteness.” Jeffries, 928 F.3d at 1064 (majority

opinion). Again, an interest is more likely to be concrete if it has a “close

relationship to a harm that has traditionally been regarded as providing a basis for

a lawsuit.” Spokeo II, 867 F.3d at 1115. A consumer’s interest in engaging in

49
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 50 of 148

commerce without heightening his risk of identity theft fits that bill: it bears a close

relationship to an interest harmed in a common-law breach-of-confidence claim. 3

The tort of breach of confidence historically allowed a plaintiff to recover

against a party who failed to adequately protect a plaintiff’s confidential

information. See Alan B. Vickery, Breach of Confidence: An Emerging Tort, 82

Colum. L. Rev. 1426, 1427–28 (1982). It “is rooted in the concept that the law

should recognize some relationships as confidential to encourage uninhibited

discussions between the parties involved.” Young v. U.S. Dep’t of Just., 882 F.2d

633, 640 (2d Cir. 1989). The plaintiff in a breach-of-confidence claim relies on an

“assurance of secrecy . . . . in forming the relationship, and thereafter in revealing

what [he] would otherwise hold back.” Vickery, supra, at 1428. For that reason,

an interest harmed in a breach-of-confidence case is the plaintiff’s “general interest

in the security of the confidential relationship and his corresponding expectation of

secrecy.” Id. at 1434. An interest harmed in a FACTA case is the same: the

consumer expects the business to comply with FACTA and keep his card number

confidential. The failure to do so undermines the “security of the confidential

relationship” and the consumer’s “expectation” that his card number will stay

hidden. See Vickery, supra, at 1434; see also Jeffries, 928 F.3d at 1065. And

3
The majority assumes that the breach-of-confidence tort is old enough to serve as a historical
analog. I do the same and note that there is good cause for that assumption. See Corliss v. E.W.
Walker Co., 64 F. 280, 281–83 (C.C.D. Mass. 1894) (discussing the breach-of-confidence tort).
50
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 51 of 148

because of the breach, the consumer is more “likely to remain silent in

circumstances that would otherwise call for frankness,” see Vickery, supra, at

1434, precisely the type of economic inefficiency Congress sought to avoid

through FACTA. See, e.g., H.R. Rep. No. 108-263, 23 (noting that “[o]ne of the

hallmarks of the modern U.S. economy is quick and convenient access to

consumer credit”).

The majority fires two shots at this historical connection, but neither lands.

It first argues that a FACTA violation does not track the typical elements of a

breach-of-confidence claim, as a FACTA claim does not require disclosure to a

third party. See Majority Op. at 26. This argument fails on two levels.

To start, a statutory harm need not “exactly track[ a] common law” analog to

be concrete. See Spokeo II, 867 F.3d at 1115. Nor must the violation “give rise to

a cause of action under common law.” Susinno v. Work Out World Inc., 862 F.3d

346, 351 (3d Cir. 2017). Rather, the harm need only bear a “close relationship to a

harm that has traditionally been regarded as providing a basis for a lawsuit,” so that

it is similar “in kind and in degree.” Salcedo, 936 F.3d at 1171 (emphasis added).

If a plaintiff had “to satisfy every element of a common law cause of action before

qualifying for statutory relief, Congress’s power to ‘elevate intangible harms’ by

defining injuries and chains of causation” that create a “‘case or controversy where

none existed before’ would be illusory.” Trichell, 964 F.3d at 1010 (Martin, J.,

51
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 52 of 148

concurring in part and dissenting in part) (alteration accepted) (quoting Spokeo,

136 S. Ct. at 1549); see also Spokeo II, 867 F.3d at 1115; Steel Co. v. Citizens for a

Better Env’t, 523 U.S. 83, 102 (1998) (holding that judicial power extends to

“cases and controversies of the sort traditionally amenable to, and resolved by, the

judicial process” (emphasis added)). So even if “there are differences between

[FACTA’s] cause of action and those recognized at common law, the relevant

point is that Congress has chosen to protect against a harm that is at least closely

similar in kind to others that have traditionally served as the basis for lawsuit.” See

Spokeo II, 867 F.3d at 1115. Assurance that a plaintiff’s confidential disclosure

will remain hidden and will not spike his risk of injury lies at the heart of both a

FACTA claim and a breach-of-confidence claim. So FACTA’s underlying interest

has a historical partner. See id. (holding that the Fair Credit Reporting Act

protected against a harm bearing a close relationship to the harm suffered in a

defamation suit, even though the elements of the claims did not match).

Another reason: the element of third-party disclosure is not inextricably tied

to the harms underlying a breach-of-confidence claim. To the contrary, a

“seemingly innocuous or limited disclosure may nevertheless injure the wronged

party directly because of the special significance that the party attaches to the

information.” Vickery, supra, at 1434 n.29. And “even if the disclosure is

innocuous, the wronged party may well fear future disclosures of more damaging

52
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 53 of 148

information.” Id. In other words, the “harm in a breach-of-confidence case occurs

when the plaintiff’s trust in the breaching party is violated, whether or not the

breach has other consequences.” Jeffries, 928 F.3d at 1064 (internal quotation

mark omitted). In the FACTA context, the business breaches that trust when it

prints more than five card digits, harming the consumer’s expectation that his

disclosure will not increase his chances that a thief will uncover his card number.

That harm occurs at the point of sale, no matter if a third party ever sees the

receipt. See id. at 1064–65.

Next up, the majority says that the harms do not match because Muransky

does not have a confidential relationship with Godiva. Majority Op. at 27. In the

majority’s eyes, breach of confidence involves “close professional relationships,”

like that between a doctor and a patient. Id. The majority claims that a customer-

merchant relationship does not create similar secrecy duties. Id.

That oversimplifies the situation. The exchange of card information

between a customer and merchant no doubt triggers a confidential relationship.

The “essential ingredients of what can be termed a ‘confidential relationship’” are

“the assurance of secrecy and the reliance it evokes.” Vickery, supra, at 1428. A

consumer paying with a credit or debit card would naturally believe that the

merchant will keep his card number secret—a belief that FACTA codified. And

that belief spurs consumer spending, as it lets the consumer breathe easy knowing

53
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 54 of 148

that his card information will stay safe throughout the transaction. So a typical

card transaction has both assurance and reliance—the key triggers of

confidentiality.

Legal elements aside, that relationship stands on common sense. Few would

say that confidential financial information is less sensitive than confidential

medical or legal information. For this reason, scholars have noted that “given their

relationship to consumers, the holders of consumer data in commercial transactions

should be labeled with a distinct term: data confidants.” Alicia Solow-Niederman,

Beyond the Privacy Torts: Reinvigorating A Common Law Approach for Data

Breaches, 127 Yale L.J.F. 614, 625 (2018). So just as governing ethical standards

recognize a “relationship of trust” between a doctor and her patient or a lawyer and

her client, FACTA’s truncation requirement recognizes “a similar relationship of

trust between consumer and merchant, requiring the merchant to safeguard the

consumer’s credit or debit card information.” Jeffries, 928 F.3d at 1064–65.

Bottom line: customer and merchant do share a confidential relationship.

All things said, a FACTA violation and a breach-of-confidence tort each

concretely harm the plaintiff’s expectation that his confidential disclosure will be

protected. For FACTA specifically, the harmed interest is the consumer’s

expectation that his credit card purchase will not heighten his risk of identity theft.

See id. Because this interest is “similar in kind” and bears a “close relationship” to

54
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 55 of 148

the interest harmed in a breach-of-confidence case, see Spokeo II, 867 F.3d at

1115, history settles that this interest is concrete. See Jeffries, 928 F.3d at 1064–

65.

III.

Since FACTA protects Muransky’s concrete interest in using his credit or

debit card without incurring the heightened risk of identity theft, all that’s left is

whether Muransky plausibly alleged that Godiva’s FACTA violation “actually

harm[ed]” or “present[ed] a material risk of harm” to this interest. See Spokeo II,

867 F.3d at 1113; see also Kamal, 918 F.3d at 112. He did—he alleged that

Godiva’s violation in fact heightened his risk of identity theft. So he has pled

“actual[] harm” to an interest that FACTA protects. See Spokeo II, 867 F.3d at

1113.

Muransky alleged two core facts in his complaint: (1) Godiva violated

FACTA when it printed 10 digits of his card number, and (2) this violation

“elevated his risk of identity theft.” Both statements are facts, not legal

conclusions. So we must accept them as true when analyzing standing at this

stage, because “[w]ithout the benefit of discovery, we are not in a position to

55
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 56 of 148

second guess the harm [he] allege[s].” See Debernardis v. IQ Formulations, LLC,

942 F.3d 1076, 1090 (11th Cir. 2019) (Sutton, J., concurring). 4

Accepting these facts as true, Muransky has alleged that Godiva’s FACTA

violation harmed his interest in avoiding a heightened risk of identity theft the

moment the violation occurred. His harm is not one that might happen in the

future (so that we would need to analyze whether he alleged a material risk of real

harm); it is a real harm to a concrete interest, one that Muransky adequately alleges

happened the moment Godiva printed the untruncated receipt. See Spokeo II, 867

F.3d at 1118 (explaining that the material-risk-of-harm standard plays no role

when the complaint alleges that “the challenged conduct and the attendant injury

have already occurred”). Whether Muransky can prove down the road that

Godiva’s FACTA violation heightened his risk of identity theft is another matter.

See Lujan, 504 U.S. at 561 (noting that the plaintiff’s burden of proof increases as

the case advances). For now, it is enough that he alleged that the violation harmed

his interest in using his card without suffering a heightened risk of identity theft.

See McElmurray, 501 F.3d at 1251.5

4
The majority is thus wrong to say that Muransky alleged a “pure statutory violation.” Majority
Op. at 2. If that were so, he would not have alleged another fact—that Godiva’s FACTA
violation raised his risk of identity theft. He would have instead said that Godiva printed the
receipt, violating FACTA—period. Because he alleged additional facts, we must take him at his
word that he suffered additional harm.
5
Because Muransky alleges a direct harm, the majority’s focus on whether Muransky alleged a
material risk of identity theft is irrelevant (and for the same reason, I diverge from my dissenting

56
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 57 of 148

To sidestep this conclusion, the majority calls Muransky’s complaint

conclusory. It says that it need not accept Muransky’s allegation that Godiva’s

violation increased his risk of identity theft because he has not given specific facts

to explain how the violation did so. But we have said time and again that a

plaintiff’s allegation of injury need not be specific at the pleading stage—“general

factual allegations . . . will suffice.” MSPA Claims, 918 F.3d at 1318. At this

stage, Lujan tells us to presume that Muransky’s “general allegations embrace

those specific facts that are necessary to support the claim.” 504 U.S. at 561; see

also Wilding v. DNC Servs. Corp., 941 F.3d 1116, 1124 (11th Cir. 2019) (applying

this rule), cert. denied, 590 U.S. ___, 140 S. Ct. 2828 (2020) (mem.).

Article III does not command Muransky to provide these facts at the

pleading phase; Lujan says that is what discovery is for. See 504 U.S. at 561; see

also Debernardis, 942 F.3d at 1090 (Sutton, J., concurring). Based on this

principle, we routinely accept general factual allegations on the promise that

specific support will come later. See, e.g., Debernardis, 942 F.3d at 1085

colleague’s discussion of materiality). See infra at 75–78. Our job when analyzing a direct-
harm theory is not to decide whether the violation “materially” harmed the statutory interest; our
job is to decide whether the violation “actually harm[ed]” the statutory interest. See Spokeo II,
867 F.3d at 1113, 1118. FACTA protects Muransky’s concrete interest in using his card
“without incurring an increased risk of identity theft,” see Jeffries, 928 F.3d at 1066, and
Muransky claimed that he suffered an increased risk at the point of sale. That is an alleged
actual harm, not an alleged material risk of actual harm, so materiality plays no role. The only
question is whether he has alleged enough facts to plausibly establish direct harm at the pleading
stage.
57
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 58 of 148

(majority opinion) (accepting “at the motion to dismiss stage” the general

allegation that a “dietary supplement that is deemed adulterated and cannot

lawfully be sold has no value”). It is inconsistent that the majority demands those

specifics from Muransky right now.

IV.

To close, I note that the majority’s cases are not persuasive for a mix of

reasons. Some cases dealt with a different truncation failure: the failure to truncate

the expiration date—a violation that Congress judged as not creating concrete

harm. See, e.g., Bassett v. ABM Parking Servs., Inc., 883 F.3d 776, 777 (9th Cir.

2018); Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76, 78 (2d Cir.

2017); Meyers, 843 F.3d at 725. Another came with an evidentiary record (not on

an analysis of the complaint), in which the district court found that the violation

there did not harm or raise a material risk of harm to a concrete interest. Katz v.

Donna Karan Co., L.L.C., 872 F.3d 114, 119–120 (2d Cir. 2017). And both Kamal

and Noble v. Nevada Checker Cab. Co., 726 F. App’x 582, 583–84 (9th Cir. 2018)

incorrectly determined that FACTA redresses only actual identity theft; the Ninth

Circuit also chose not to publish Noble, so the opinion is not precedential. See

Kamal, 918 F.3d at 115; Noble, 726 F. App’x at 583–84; see also Jeffries, 928 F.3d

at 1067 n.3 (rejecting the Third Circuit’s position that “FACTA protects an interest

in avoiding actual identity theft, rather than increased risk of identity theft”).

58
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 59 of 148

Far more persuasive is the D.C. Circuit’s published opinion in Jeffries.

There, the D.C. Circuit considered most of the cases cited above and rejected their

reasoning. It held that FACTA protects a consumer’s interest in using a credit or

debit card without incurring an increased risk of identity theft. Jeffries, 928 F.3d at

1064–65. And then the court held that the FACTA violation alleged there harmed

that interest at the point of sale. Id. at 1066–67. To be sure, the FACTA violation

there was worse than the one levied here: the defendant printed all 16 digits of the

plaintiff’s card number. But Jeffries did not turn on that fact; its reasoning extends

to this case just the same. As in Jeffries, the interest at issue is the consumer’s

interest in avoiding the increased risk of identity theft. And as in Jeffries, the

plaintiff has alleged that the FACTA violation in fact increased his risk of identity

theft, harming an interest that the statute protects. Like the court in Jeffries, we

should take the plaintiff at his word for now and hold that he has established

standing at this phase of the case.

* * *

The majority claims that Muransky “shut his eyes and closed his ears to the

requirements of Spokeo.” Majority Op. at 3. Yet the majority shuts its eyes and

closes its ears to the interest that FACTA protects. The statute protects

Muransky’s concrete interest in avoiding a heightened risk of identity theft. And

Muransky plausibly alleged that the moment Godiva printed the untruncated

59
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 60 of 148

receipt, he sustained an injury sufficient to confer standing to maintain a claim

under FACTA. The mistake the majority makes is to require anything more.

60
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 61 of 148

MARTIN, Circuit Judge, dissenting:

Not all statutory violations result in a concrete injury. The Supreme Court

told us so in Spokeo, Inc. v. Robins, 578 U.S. ___, 136 S. Ct. 1540 (2016). Id. at

1547–48. Today, the majority extends this principle from Spokeo to conclude that

courts may ignore the judgment of Congress when assessing whether a party has

met the concreteness requirement of Article III. The majority opinion holds that a

receipt displaying ten digits of a customer’s credit card number does not pose a

material risk of identity theft, and therefore is not a concrete injury. The majority

says this means plaintiffs have no standing here, even though Congress established

the point of intolerable risk at more than the last five digits being displayed on a

receipt. Because Congress’s judgment is deserving of deference under these

circumstances, and because congressional judgment supports a finding of

concreteness, I respectfully dissent from the majority’s opinion.

Spokeo also tells us we may find concrete injury where a statutory violation

bears a close relationship to a type of harm that has traditionally been actionable at

common law. 136 S. Ct. at 1549. In contrast to the majority, I view Dr.

Muransky’s FACTA violation as bearing a close relationship to a common law

breach of confidence tort. I therefore respectfully dissent on this ground as well.

61
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 62 of 148

I.

In April 2015, Dr. David Muransky filed a class action lawsuit against

Godiva Chocolatier (“Godiva”), alleging that Godiva violated the Fair and

Accurate Transactions Act (“FACTA” or the “Act”), 15 U.S.C. § 1681c(g), when it

issued him a receipt containing the first six and last four digits of his card number.

His central claim is that by issuing him this receipt, Godiva willfully violated

FACTA, which, among other things, prohibits merchants from printing “more than

the last 5 digits of the credit card number . . . upon any receipt provided to the

cardholder at the point of the sale or transaction.” Id. § 1681c(g). He alleged in

his complaint that Godiva’s violation of FACTA’s truncation requirement exposed

him and the class members “to an elevated risk of identity theft.”

The majority opinion recounts the dense and winding path this case has

taken since filed. Maj. Op. at 5–9. I will briefly review this history as well. After

Dr. Muransky filed his complaint, the parties engaged in mediation, and reached an

agreement to settle the case for $6.3 million. Notice of the settlement was sent to

class members, and James H. Price and Alan Isaacson filed objections. At the

District Court’s fairness hearing, Mr. Isaacson, but not Mr. Price, challenged Dr.

Muransky’s standing. The District Court approved the settlement reached by the

class members and Godiva. Then, both Mr. Price and Mr. Isaacson challenged that

approval on appeal. Throughout this appeal, Mr. Isaacson has maintained his

62
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 63 of 148

argument that Dr. Muransky lacks standing, while Mr. Price has joined Dr.

Muransky in arguing that Dr. Muransky has standing.

For all its procedural complexity, this appeal presents only a simple

question. Did Dr. Muransky establish Article III standing by alleging a violation

of FACTA’s truncation requirement, based on a receipt showing 10 of the 16 digits

of his credit card? I believe he did.

II.

I begin, as I must, with the standard announced by the Supreme Court in

Spokeo. To satisfy the injury-in-fact requirement of Article III, a plaintiff must

allege an injury that is both “concrete and particularized,” as well as “actual and

imminent.” Spokeo, 136 S. Ct. at 1548. The discussion here is about the first of

these requirements: whether Dr. Muransky’s complaint alleges an injury that is

sufficiently concrete. The majority accurately recounts that an injury need not be

“tangible” to be concrete. Id. at 1549. And even intangible injuries, such as the

“risk of real harm,” can satisfy Article III’s concreteness requirement. Id. When

we are tasked with deciding whether an intangible injury is sufficiently concrete,

Spokeo tells us that “both history and the judgment of Congress” inform our

analysis. Id. On this much, the majority and I agree.

Absent from the majority opinion, however, is the mention of another

command from Spokeo. It tells us that when a statutory right itself protects a

63
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 64 of 148

concrete interest, a plaintiff need not allege “any additional harm beyond the one

Congress has identified.” Id. In practical terms, a complaint alleging a statutory

violation, and nothing more, can be sufficient to establish standing at the pleading

stage, so long as the statutory violation itself protects a concrete interest. Strubel v.

Comenity Bank, 842 F.3d 181, 190–91 (2d Cir. 2016). And in determining

whether a statutory provision protects a concrete interest, we are guided by

congressional judgment and common law principles. See Perry v. Cable News

Network, Inc., 854 F.3d 1336, 1340–41 (11th Cir. 2017) (holding that a plaintiff

alleging a violation of the Video Privacy Protection Act need not allege “any

additional harm beyond the statutory violation” because both congressional

judgment and common law support a finding of concreteness).

Focusing, for now, on Spokeo’s discussion of the role of Congress, the

Court recognized that congressional judgment is “instructive and important

because Congress is well positioned to identify intangible harms that meet

minimum Article III requirements.” Cordoba v. DIRECTV, LLC, 942 F.3d 1259,

1268 (11th Cir. 2019) (quotation marks omitted); see also Daniel Townsend, Who

Should Define Injuries for Article III Standing?, 68 Stan. L. Rev. Online 76, 81–83

(2015) (explaining that Congress is better positioned to gather facts and make

empirical judgments about whether a practice is injurious). And as the majority

recognizes, Congress may thus “elevat[e] intangible harms” by defining injuries

64
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 65 of 148

and chains of causation that will “give rise to a case or controversy where none

existed before.” Spokeo, 136 S. Ct. at 1549 (quotation marks omitted).

Where the intangible injury identified by Congress is a risk of harm, Spokeo

tells us that the risk must be “material.” Id. at 1550. The majority “recognize[s]

that ‘material risk of harm’ is a somewhat indefinite term,” and says that in this

context, “material” means “important; essential; relevant.” Maj. Op. at 16 (citing

New Oxford American Dictionary (3d ed. 2010)). I agree. In Spokeo, the Court

gave us the example of including the wrong zip code on a credit report as one

insufficiently “material” risk of harm. 136 S. Ct. at 1550. In the context of the

Fair Credit Reporting Act, which creates a statutory cause of action for

inaccuracies on credit reports, the Court puzzled about “how the dissemination of

an incorrect zip code, without more, could work any concrete harm.” Id. Since the

concrete interest intended to be protected by the FCRA is avoiding the harms that

come from false credit reporting, it was not obvious to the Court how a mistaken

zip code was “essential” or “relevant” to that interest.

The majority suggests here that Spokeo did not “br[eak] new ground” on the

amount or type of risk required to establish standing. Maj. Op. at 16. I think it did.

Although several earlier Supreme Court decisions described the required level of

risk as “substantial” or “certainly impending,” Clapper v. Amnesty Int’l USA, 568

U.S. 398, 414 & n.5, 133 S. Ct. 1138, 1150 & n.5 (2013) (listing cases), Spokeo

65
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 66 of 148

did not include this description. See 136 S. Ct. at 1550. This was no accident.

The cases in which the Court described the necessary risk as “substantial” or

“certainly impending” did not address a statutory cause of action itself designed to

prevent future harm. See, e.g., Clapper, 568 U.S. at 401, 133 S. Ct. at 1143

(holding that certain attorneys and organizations did not have standing to challenge

the constitutionality of a provision of the Foreign Intelligence Surveillance Act of

1978). With this in mind, the Third Circuit recognized that the Supreme Court

decided in Spokeo to require a lesser magnitude of risk for statutory injuries in

order to “strike[] a balance between Congress’s power to define injuries . . . and

the requirement that—absent a statutory right of action—a threatened harm be

certainly impending or based on a substantial risk of harm to amount to injury in

fact.” Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 113 n.4 (3d Cir. 2019) (citation

and quotation marks omitted).

I also part ways with the majority in its explanation of how courts decide

whether the risk of harm identified by Congress is sufficiently material for Article

III purposes. While the majority acknowledges that congressional judgment plays

a role in identifying intangible injuries of the “direct” variety (for example,

interference with free speech or free exercise rights), it effectively concludes that

congressional judgment plays no role when identifying whether a prohibited

practice presents a risk of real harm. Maj. Op. at 27–29. The implication of this

66
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 67 of 148

holding is that when courts are confronted with prophylactic legislation designed to

reduce a risk of harm from occurring—like the statute at issue here—we operate

with a blank canvas in deciding whether the risk of harm is sufficiently material.

Id. at 16. I don’t think this approach can be reconciled with Spokeo’s command

that the “judgment of Congress” plays an important role in determining whether an

injury satisfies Article III’s concreteness requirement. 136 S. Ct. at 1549. And

while it is surely the courts, and not Congress, that are ultimately responsible for

deciding whether an injury is sufficiently concrete under Article III, our role does

not require or allow us to ignore the judgment of Congress entirely.

It is these principles that frame the concreteness inquiry here. Dr.

Muransky’s complaint alleges that Godiva violated FACTA’s truncation

requirement when it issued him a receipt that displayed the first six and the last

four digits of his credit card number. He says he suffered irreparable harm from

Godiva’s violation of the truncation requirement because it “exposed [him] to an

elevated risk of identity theft.” This Court must therefore decide whether the risk

of identity theft that Dr. Muransky suffered on account of Godiva’s FACTA

violation constitutes a concrete injury. And in making this determination, this

Court must consider whether congressional judgment and the common law support

a finding of concreteness under these circumstances.

67
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 68 of 148

II.

A.

First, the judgment of Congress. When it enacted FACTA, Congress

prohibited merchants from printing “more than the last 5 digits of the card number

or the expiration date upon any receipt provided to the cardholder.” 15 U.S.C.

§ 1681c(g)(1). FACTA provides that any merchant willfully violating this

requirement is liable for “any actual damages sustained by the consumer . . . or

damages of not less than $100 and not more than $1,000.” Id. § 1681n(a)(1)(A).

While Congress’s creation of a statutory cause of action certainly evinces a

judgment that violations of the truncation requirement cause harm, Spokeo tells us

that this fact alone is not sufficient to satisfy Article III’s standing requirements.

See 136 S. Ct. at 1547–48. Congress’s decision to sanction lawsuits for violations

of the truncation requirement is therefore only the starting point of the inquiry into

Congress’s judgment.

We go next, then, to the history of FACTA. That history confirms that

Congress considered the violation at issue here—a receipt displaying the first six

and last four digits of the customer’s credit card—to pose a material risk of identity

theft. When it enacted FACTA, Congress sought to “protect[] consumers from

identity theft.” Harris v. Mexican Specialty Foods, Inc., 564 F.3d 1301, 1306

(11th Cir. 2009); see also S. Rep. 108-166 at *6 (Oct. 16, 2003) (observing that

68
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 69 of 148

FACTA was enacted to address “the emergence and impact of identity theft on the

credit granting and reporting systems”). FACTA was necessary, Congress found,

in light of the increased use of credit in the late 1990s and early 2000s, which

“create[d] a target-rich environment for . . . sophisticated criminals, many of whom

are organized and operate across international borders.” S. Rep. 108-166 at *8; see

also Credit and Debit Card Receipt Clarification Act of 2007 (“Clarification Act”),

Pub. L. No. 110-241, § 2(a)(1), 122 Stat. 1565, 1565 (finding that “the purpose[]”

of FACTA is to “reduce identity theft and credit card fraud”). When he signed

FACTA into law, President George W. Bush echoed Congress’s findings. He

stated that “this law will help prevent identity theft before it occurs, by requiring

merchants to delete all but the last five digits of a credit card number on store

receipts.” Remarks on Signing the Fair and Accurate Credit Transactions Act of

2003, 39 Weekly Comp. Pres. Doc. 1746, 1748 (Dec. 4, 2003); see also S. Rep.

108-166 at 6 (concluding that the truncation requirement “limit[s] the number of

opportunities for identity thieves to ‘pick off’ key card account information”).

The history of FACTA following its initial enactment confirms that

Congress considered the type of violation at issue here to pose a material risk of

harm. After FACTA’s truncation requirement went into effect, “hundreds of

lawsuits were filed” alleging that merchants violated FACTA by “fail[ing] to

remove the expiration date” as required by 15 U.S.C. § 1681c(g)(1). Clarification

69
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 70 of 148

Act § 2(a)(4). In June 2008, the Clarification Act became law, and gave amnesty

to merchants who printed a card’s expiration date in the years since FACTA was

enacted. Id. § 3(a). Congress gave this amnesty because a complaint alleging a

mere violation of the expiration date requirement did not “contain[] an allegation

of harm to any consumer’s identity.” Id. § 2(a)(5). Notably, while Congress was

at it, it gave no amnesty to merchants who printed more than the allowed number

of digits. See id. § 3(a). Rather, Congress observed that “[e]xperts in the field

agree that proper truncation of the card number, by itself as required by [FACTA],

. . . regardless of the inclusion of the expiration date, prevents a potential fraudster

from perpetrating identity theft or credit card fraud.” Id. § 2(a)(6). By granting

amnesty only as to the expiration date, the Clarification Act sought to curtail

“abusive lawsuits” concerning a requirement that “do[es] not protect consumers.”

Id. at § 2(b).1

This demonstrates that, while Congress did not consider all violations of the

truncation requirement to pose a serious threat to consumers, it maintained its

concern about the violation pled here—a receipt showing more than the last five

digits of a card number—to entail material risk of identity theft. Congress’s view

1
The majority reads the Clarification Act to imply that the FACTA violation alleged here was
not concrete, because of its acknowledgment that some FACTA claims do not cause “actual
harm.” Maj. Op. at 28. To the contrary, the fact that the Clarification Act left the digit
truncation requirement in place while granting amnesty for violations of the expiration date
requirement indicates that Congress continued to view the former as a category of FACTA
violations that cause “actual harm.” Clarification Act § 2(b).
70
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 71 of 148

was based on a finding that “[e]xperts in the field agree that proper truncation of

the card number, by itself” minimizes the risk of identity theft. Clarification Act

§ 2(a)(6). Congress’s judgment thus supports a finding of concreteness here. See

Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1066 (D.C. Cir. 2019) (noting

that, while “every FACTA violation [does not] create[] a concrete injury in fact,” a

receipt displaying a card’s entire number and expiration date caused concrete

injury because it was the “nightmare scenario” Congress sought to prevent).

As I said at the start, when a statutory violation itself protects a concrete

interest, a plaintiff need not allege anything more than a violation of the statute

itself. See Perry, 854 F.3d at 1340. Because the judgment of Congress supports a

finding of concreteness here, Dr. Muransky was not required to allege any

additional harm beyond the statutory violation alleged in his complaint. On this

basis alone, I would hold that Dr. Muransky established Article III standing.

B.

The majority opinion takes a dramatically different path. It starts by

eschewing any deference to congressional judgment in determining whether Dr.

Muransky’s FACTA violation entailed a sufficiently high risk of identity theft.

See Maj. Op. at 27–28. We cannot defer to Congress, the majority reasons, so we

must instead look to Dr. Muransky’s complaint to see if he has alleged facts

establishing that a receipt showing ten digits of a credit card number poses a risk of

71
USCA11 Case: 16-16486 Date Filed: 10/28/2020 Page: 72 of 148

identity theft. Id. at 28–29. Although Dr. Muransky alleged that he suffered an

elevated risk of identity theft as a result of the FACTA violation at issue here, the

majority says that allegation “is simply not enough.” In so holding, the majority

assumes, without offering any explanation, that Dr. Muransky did not face a

“material risk, or significant risk, or substantial risk, or anything approaching a

realistic danger” due to the receipt at issue. Id. at 29. This analysis errs at every

step.

To begin, the majority starts on incorrect footing by effectively concluding

that congressional judgment is owed no deference in deciding whether a risk of

harm clears the concreteness bar.2 Maj. Op. at 27–28. The majority says it is

required to do so because (1) Spokeo tells us that the creation of a statutory cause

of action does not automatically confer standing, and (2) courts have an

independent responsibility to decide whether a risk of harm meets the materiality

threshold. Id. Both of these premises are true, but neither lead to the conclusion

that courts may ignore the judgment of Congress.

2
The

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/4581562. Public record. Not legal advice.