Oral argument — Ahmed Kamal v. J.Crew Group Inc

Kamal v. J.Crew Group 17-2345, 17-2453 Good morning, your honors. May it please the court, my name is Marvin Frank. I'm here for Ahmed Kamal, the plaintiff in this action. And we've been dismissed on Article 3 grounds that there's no standing to proceed a fair and accurate Credit Transaction Act case factor. Would you like to reserve some time? Yes, your honor. I'd like to reserve two minutes. That'll be granted. Thank you, your honor. The issue question before the court is whether Congress, when it passed FACTA, created a cause of action that, when violated, caused a concrete injury. That's the bugaboo that's going around with the FACTA cases is whether or not there's a concrete injury. In this case, a number of things are not in dispute. First thing is Congress held extensive hearings and investigated extensively as to the need for FACTA. Second point, Congress prohibited the printing of all but the last five digits of the credit card number on the receipt. In this case, not only were the last few digits printed, but the first six digits were also printed. Of course there was no ultimate harm. In other words, there was no allegation of identity theft here, right? You said to the point, that's the issue before the court, that there was no identity theft. Or that there was no risk here of real harm. Well, that's the argument, but that's why I went through the extensive investigation as to whether or not there is risk. And Congress found that there was risk. Is that the end of the story then? Excuse me, sir? If we agree that Congress created the risk, that's the end of it? I certainly don't want that to be the case, but... Of course, we still have the Constitution. We still do have the Constitution that there has to be a harm. There's confusing lore out there as to what constitutes the actual harm. An intangible harm is defined by Spokio, and this court has dealt with it in Horizon and the Cicino case most recently. And it would appear that in those cases, it seems like there's a test. They call it the Horizon test, and Cicino called it the Horizon test. And when one suit is under statute alleging the very injury the statute is intended to prevent, and that's printing the excess numbers, and the injury has a close relationship to a harm traditionally providing a basis for a lawsuit in English or American courts, a concrete injury has been pleaded. That's the question here. That's a two-part test. But how is this the injury that Congress intended to prevent? Here, what is the injury that was suffered? It's the risk of identity theft, that there's a risk-based injury. But how is there when a receipt is printed and taken by a person and put in their pocket? Well, eventually, it's going to be thrown out. There are millions of receipts printed. Eventually, the receipt will be thrown out. The receipt will be thrown out. And then what happens? And then that places the person who received the receipt under the risk that somebody, a dumpster diver we have in our complaint, or somebody else is going to get these numbers. And then what they're going to do? And then it's going to be an identity theft. But wait, wait, wait. These numbers will enable you instantly. Well, not instantly, but a sophisticated thief has been shown to be able to use the additional numbers. The first six numbers. The first six numbers. In fact, there's a British study that shows that you can get it in six seconds. You can get the entire number using the first six digits and the last few. But you can get the entire number. And once you get the entire number, of course, with electronic means, the identity thieves can access your bank accounts and others. You're at risk. Now, you ask a different question, Judge Rendell. You ask the question, well, you received the piece of paper. You stuck it in your pocket. How, then, is it J.Crew's fault that you are at risk for identity theft? That was in the papers on both sides. And the answer is that in this specific case, that will get thrown out. I mean, in this case, it's out of the record. So, in this specific instance, it will, you know, not that it cannot be used because we have it. But in the vast majority of cases, it has to be thrown out. And it never gets burnt. It never gets shredded. It just gets thrown into the garbage. And the allegations in the complaint are by having it thrown into the garbage, it makes it available to someone, no matter how remote the possibility is. Well, you say available no matter how remote. I mean, isn't that the key? Most of our situations involving standing where there is a risk of real harm to a concrete interest is where there is a measure of some risk and some real harm so that the person's identity can easily be determined. Here, where you have the it's going to get thrown in the garbage and then someone has to pull it out and presumably it hasn't been affected by the surrounding avocados and oranges and everything else that's in the garbage. I mean, aren't we talking about a very remote potential here? Well, Congress didn't think so. In fact, they didn't think so at all. That's not the test. Congress said this is a harm that we want to avoid. But if from a concrete standpoint under the Constitution, you know, we have to go by the Constitution, not what Congress said, don't we? Well, the Constitution talks about a risk that's an old risk that's recognized under English or common law. And that's a horizon test. You know, I'll go back to that piece of it. And when you look at that, I call it a privacy test. Invasion of privacy? It's an invasion of privacy. But this invasion of privacy doesn't occur on the facts here. The printing of five letters or even ten letters isn't an invasion of privacy, is it? No, we're out of the statute. Okay. We're back to English law. And what English law would say is an invasion of privacy? Well, a financial interest is an invasion of privacy. If you have numbers that can expose your bank accounts. But we don't have that. We have, he's complaining, you printed this. By virtue of you printing this on this receipt, invasion of privacy. Well, it certainly is a violation of the statute. Aren't the facts in Horizon and Cicino different? I mean, can't we distinguish those cases on the basis of what happened with the receipt after it was received? Or it was on the computers? Well, certainly the Cicino is a PCPA case. And Horizon is a little different also. Sure. But the concepts are exactly the same. A stolen laptop. Well, that was a stolen laptop. It was an identity theft issue type of thing. And somebody had a laptop which had all the relevant information on it. Sure. Well, isn't that different from this circumstance? There was, I believe, that's the Horizon case, and I believe in the Horizon case, there was no identity theft, that the person didn't lose money on it. It was the potential for having lost money that was the issue. That people were able to collect, you know, based upon the potential. In this case, it's a potential case also. In the FACTA case, it's the issue of credit card receipts of gold in the thieves' hands. And how do you keep the gold out of your hands? Well, it was very simple. All you have to do is not print the numbers. And for some reason, and we say willfully, and the district court found that there was a willfulness aspect of it. It isn't as if it's a strict liability statute. It's not. There's a willfulness aspect to it that requires that in those cases where the person was not armed, where there was no identity theft, that you have to show that the company that printed the receipt acted willfully. And the district court, in an earlier decision, before Robbins had come down, found that there was willfulness. Can I ask you a question? Are you aware of a case, Long v. SEPTA, an appeal that's pending before this court? It involves an FCRA, a standing issue under FCRA. No, I thought you were going to say Long v. Tommy Hilfiger. But that's another one of these cases. Long v. SEPTA. We may ask counsel to give us some supplemental briefing on the facts of that case. Just didn't know if you were aware of it. Let me ask you a question. You were good enough to point out the Hendrick case as a related case, a case of the same issue. That's been settled. You probably know that. Are there other cases in the system now that present the same issue? Oh, absolutely. Genak came down. Are there any in the Courts of Appeals? I'm not aware of it being in the Court of Appeal. Okay. But are there others? I interrupted you. There are others pending in the federal system, I assume. There's a number of them pending in this circuit. Genak, I think, is in the Western District of Pennsylvania, and it was decided by a magistrate judge in favor of liability, and I believe it was affirmed. That's not in your briefs, though, is it? Genak is in the briefs, but the affirmation by the district judge was sent as supplemental authority. Okay. I'm having trouble getting past the fact of the printing doesn't cause an injury. And the law, I thought that would be an easy one because the printing of the numbers themselves would certainly be easily used by someone who wants to be an identity thief. That represented scientific evidence. The Department of Justice found that in the Babazin case, something like that. And I thought that we'd get past that. But the fact that the person that J. Crew gave Mr. Kamal the receipt, and therefore there could never be an identity theft because he received the receipt, well, how do you then have any type of cause of action that protects consumers without the consumer having gotten the receipt? Most consumers, by the way, if you ask retailers, say, don't give me the receipt, throw it out. So they stick it in their own garbage cans, which aren't dressed with avocados or any other delicious foods. They're sitting there and then the identity thieves come and take them and use them. In other cases, there are millions of these. What do people do with them? Try to ask someone if they actually ever reconcile their credit card statements. They never do. My kids don't, even though I yell at them. What they do is they throw them out, and they may or may not look at the credit card statement to see if they recognize anything that's on there. So you've got to do something with these credit card receipts. You've got to stop them. So the question then becomes, whose burden should it be to solve this little problem? And the burden is easy. Just don't print the numbers rather than requiring millions of people to burn, destroy, shred, or make utterly unavailable the numbers. I thought it was a reasonable thing for Congress to do. Thank you, Counselor. Good morning, Your Honors. May it please the Court, my name is Andrew Bunn, and I'm here on behalf of the defendants' appellees, which I'm just going to call J. Crew for simplicity's sake. In the Spokio case, the Court pointed out that there can be circumstances when you have a cause of action that is created by Congress, but where there is a procedural violation of that statute, divorced from any concrete injury, then there is no standing because it doesn't satisfy the injury in fact requirement of Article III. Horizon acknowledged that there can be that case, but in the Horizon case the Court said this is not that circumstance, so we do not need to explore the outer boundaries of where concrete injury is or is not. So CINO repeated all of those quotations from both cases, and so it's clear that there is such a circumstance, and we believe that this case is that circumstance, because what we have here is alleged a statutory violation from the printing of the first six digits, but there is no concrete injury alleged in the three complaints that were filed in this case. Is there an intangible injury here? Well, there certainly is not a tangible injury, and there is not one alleged, but what Mr. Kamal alleges is that the mere violation of the statute in and of itself constitutes a concrete injury. I think that really is only Part 1 of the test that the CINO Court articulated, and it doesn't take into account Part 2. And that test, even as articulated in CINO, is not necessarily dispositive of one or the other, because if you have no concrete injury, there is no standing regardless of the elements of that test. So how do we decide whether it's just a mere procedural technical situation or a concrete injury? I think there's guidance in the cases. In particular, I would look first at Spokio itself, where you had an unequivocal statutory violation because Mr. Robbins had information that was published about himself on the Spokio website that was factually incorrect, and that's what the statute at issue in that case prohibited. And the Supreme Court said, well, that may be true, but there still might not be a concrete injury, and they gave the example of an incorrect zip code where you could have an incorrect statement that was published about somebody, but still, so it would be a statutory violation, a technical statutory violation, or what they call a procedural statutory violation that was not accompanied by any concrete injury. And this case is really no different from that, because not only because the first six digits do not contain any individually identifying information, and that's undisputed, but also because Mr. Kamau kept his receipts and they were never seen by anyone else, and that is also undisputed. And that brings us exactly within the Myers decision from the Seventh Circuit, where the exact same circumstance of the person receiving the receipt and keeping it to his or herself was addressed by the court there. And that was also the case in the Krupa-Wyman case from the Second Circuit and in the Katz case from the Second Circuit, which was also the first six digits. But what if the printing, I mean, so often, you know, the vendor will say, do you want your receipt? Hand it to me, and I say no. Okay, that person, that salesperson, could easily pocket it. He or she could, but that salesperson, remember, has access to your entire credit card information. Remember, to process the transaction, the sales clerk is not just looking at a truncated number and expiration date printed on a receipt. The salesperson actually has information to all of the data that the credit card conveys. How about your opponent's view that there's an English study that says you could quickly, with this information, get the identity? Thank you for reminding me. Because I saw a study that I could hardly understand, but it certainly didn't say that. Well, here's what that study actually says. It says 1-2000th or something. The study was from 2017, and it actually relates to online credit card payments, not paper receipts. And remember that FACTA does not address online receipts. There's no truncation requirement in FACTA for online receipts. But that case also said that what you can do when you have the first six digits, and that's what Mr. Frank was talking about. You have the first six digits. He said it's a matter of seconds. That report actually said to do that, to use the first six digits and extrapolate from that to get personally identifying information, you need to use what's called NFC skimming. NFC skimming. NFC stands for near field communication, which has nothing whatsoever to do with the circumstances of this case. That is when you have, for example, Apple Pay on your phone or some other app on your phone that allows you to put it near the machine at the cashier. And from near field communication between the phone and the receiver, there is data that is exchanged about the person's credit card. An NFC skimmer is what that study is talking about, and that is how you conceal it. It has nothing whatsoever to do with paper receipts. So there is no methodology disclosed in that report at all that has to do with printing the first six digits on a paper receipt. And you're saying that with those digits, with what is on what Jay Crew produces, there's been shown no link to identity retrieval? Exactly. There's no recorded instance in the history of that. And I guess we'll ask Mr. Frank to address that. I'd like to draw the Court's attention actually to the receipts, if I can, for just a moment. I'm looking at page 869 of the record, but they're actually included as exhibits to the original complaint and to the amended complaint. And it's important to see what's actually on here to talk about whether there's any incremental additional harm, because if you see just above where Mr. Kamal or his attorney has redacted out his credit card number is the word discover. And that means that Mr. Kamal used a discover card to make these purchases. And, in fact, in his complaint, he also alleges that he used his discover card to make these purchases. And that's not unlawful. That's not unlawful to say that. It's not unlawful to disclose that information. And that's what the first six digits in numerical code convey. They convey nothing about Mr. Kamal at all. No personal information. What about, you know, you want us to adopt something that says, that gauges the degree of risk or whether there's a material risk. So it seems to me we're going to get appellate decisions all over the map on these, and you may, you know, the Ninth Circuit may define material risk, or the Second Circuit may talk about a degree of risk, and you could have the same fact situation and come to different results depending on which circuit you're in. So why isn't Kamal right? Well, if Kamal is right, you're still going to have a circuit split, because you're going to split with the Second Circuit and Katz. But, and you're right, the Nobel case is pending and has been argued in the Ninth Circuit, and that also has to do with the beginning of the credit card number as well as the end. So it's the credit card, what's called the issuer identifying information, the card issuer, as opposed to the card holder. So the Ninth Circuit is going to address that. The Second Circuit has addressed it and has gone in a way that we believe you should go. I think if you look at your own precedents in this card, we believe that Jay Krug's position is perfectly consistent with the decisions of this court. When you look at Horizon and Susanna and the tests they laid out, when you look at the Riley decision. But there's a lot of different tests. The language is a little sloppy. I mean, even in Spokio they say material risk of harm, then they say a degree of risk sufficient to meet concreteness, and I think in our case we've used different terms. What is the test? Are you saying we don't need to announce it because whatever it is, it's not met? I think Your Honor just hit it on the head. I think it's exactly that because if you look at Riley, which is sort of the image. That was a long time ago. It was, but it's a test that has withstood the test of time. And in fact, it's not really different from what's going on. That was actual misuse. Riley was misuse. Yes. And here, and I've got to think that in this day and age, we're going to be talking about risk, not actual misuse. But, Your Honor, this case is far less than that. This case is nothing happened in this case. No one was hurt. Mr. Kamal is in the same condition today. But he says he's at a risk. And you're saying because the digits do nothing but tell you it's a Discover card, there's no risk. That's part of it. And the other part is that he kept the receipts in his pocket just like the Myers plaintiff did. But what if he hadn't? Let's say they'd been discovered in a dumpster. What could they then have done with them? Nothing. Nothing on there would lead to any information that allows to disclose his identity. No, and that's undisputed. In this case, Mr. Kamal concedes that the first six digits only go to the issuer identification. And the Cass court explains that that doesn't give you any ability to know any information about the card holder as opposed to the card issuer. So there is no possibility. It's metaphysically impossible for him to be harmed in the sense that the statute was intended to protect him. In other words, he can't be the victim of identity theft because of this receipt. Can you run by just one thing I was a little confused about? You have a cross appeal. Yes. The original complaint, you moved to dismiss it, and then the district court denied it, right? Yes, mostly. He did amend in the middle of that motion. That's what I'm talking about. There's been two amendments since. Yes. But you didn't file a motion as to the most recent complaint, right? So how is it that's properly before us? Because the motion actually went against the first amended complaint. Now we're all working off two amended complaints down the road from that. Yes, but that was the law of the case, which was that what Judge Martini held below was that by alleging that there was knowledge of FACTA and then a subsequent violation was sufficient in Judge Martini's view to meet the willfulness requirement for statutory damages under FACTA. We don't think that's correct because of the TWA case, which explored the idea of when you have a statute with a two-tiered remedy scheme that you can't read out of existence the negligence on the statute. If we're to write an opinion, which complaint are we supposed to look at? Wouldn't we normally look at the most recent one? Sure, but there's no difference. Okay. There's no difference, and we were bound by the law of the case at that point. But Judge Martini said there is a wealth of violation in this case. We had to come to you. Anything more, counsel? No. Okay. Anything more? I don't think I'm entitled to any rebuttal on my cross-appeal. You're not. Thank you. Oh, well, well. I don't think we need it. I don't think we need it. Thank you. Thank you, counsel. If it comes up, I'm available. All right. Thank you. Thank you, Your Honor. Oh, well, hold on now. One thing. At the end, I would like to get supplemental briefing on the Long v. SEPTA case. Okay. Yeah, could you take a look at the briefs are all on record and all. Maybe you could just give us your reaction. Do you think about five pages maximum? If you could supply that to us, maybe the next ten days or so. Okay? Thank you, Your Honor. Yeah, you get that, Marina? Okay. Thank you. Just to give you the punchline, there's no opinion yet in that case. You want five pages from me also, Your Honor? Yes, both of you. Simultaneously, so you don't have to respond to each other. Where do you want to wait? That's up to you. All right, let's scotch that right now. We haven't decided which way we're going to go. That might be something that's not necessary, depending upon how we want to do it. And we can always issue an order later asking you to do that. So that would be my suggestion, that we not muddy the waters. I think that's right. I think that's right. Okay, good. Sorry about that. But if you see it, you're free to put in a letter. We'll ask you for it if you don't. If the opinion comes out. If the opinion comes out. When have you ever heard a lawyer not win? Sorry about that. Okay, so we'll hear from him now in rebuttal. Okay. There's been a lot of discussion, of course, as to the value of the first six days. Yeah, can you comment on that? There's been a constitutional issue, of course, as to whether or not there's a harm. One thing I would hope we could refer to Congress on is their extensive evaluation and meeting with credit card industry people and computer scientists and the Department of Justice and others as to the value of the credit card numbers and the expiration date, which is not an issue here. But the issue here really is the first six digits. Well, they certainly did an evaluation in Congress, their own evaluation, as to the value of that, and put it in the statute that you have to redact it. But they also mentioned in the Clarification Act. Now, the Clarification Act didn't change FACTA itself. It was sort of a get-out-of-jail-free card for those merchants who couldn't comply within the three-year period. Didn't it also make the point that there's never actually been, that maybe this is a little overblown, there was never actually a stealing of identity based on? Well, it actually says that, and I found that very interesting because I think there's a lot of confusion as to what the findings and the purpose of the Clarification Act are. If you look at what the findings are, it says specifically that there's never been, that none of the hundreds of cases that were out there at the time of the passage of the Clarification Act alleged that. Well, it would have been a very simple thing for Congress to do to just say, there has to be actual harm. They didn't do that. All they did was, as I said, it's a metaphor, a get-out-of-jail-free card, but a no liability card. They didn't change it. They accepted the fact that there would be no harm. They anticipated it. That was, I think, finding number five or six. I don't remember anymore. In finding number one, it talks about the importance of the redaction of the entire credit card number except for the last few digits. That includes the first six that were not redacted here. But you agree that the first six have to do with issuer identity. Well, not only issuer identity, it's card type, card brand, and issuing bank name. Right. So the fact that there is, in fact, that's in the study that we presented to the court, and so while it does say discover card, it doesn't give the other two pieces of information that's out there. Does it make any difference that the card is identified on some receipts? Well, the card is identified on quite a few receipts, but the first six digits provides other information other than the main discover card. It doesn't tell you if it's a Visa or a MasterCard. All banks issue all sorts of cards. All right. Thank you, counsel. No, I'm done. That was so much fun. Thank you. We'll take the case under advisement. I want to thank counsel for excellent argument and briefing on this case, and we'd like to reach it sidebar. That's amenable to you.