Opinion ID: 4246971
Heading Depth: 2
Heading Rank: 3

Heading: bassett’s statutory theories of injury

Text: On remand from the Supreme Court in Spokeo, we acknowledged that “while [plaintiffs] may not show an injury-in-fact merely by pointing to a statutory cause of action, the Supreme Court also recognized that some statutory violations, alone, do establish concrete harm.” Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017). Bassett offers two alternative statutory theories of injury regarding the FCRA’s expiration date requirement. At maximum, Bassett asserts, the FCRA creates a “substantive right,” the invasion of which is an injury that confers BASSETT V. ABM PARKING SERVICES 13 standing. See Eichenberger v. ESPN, Inc., 876 F.3d 979, 982–84 (9th Cir. 2017). At minimum, the law establishes a procedural right, the violation of which creates a material risk of harm sufficient to confer standing. See Robins, 867 F.3d at 1114–17. 2 Neither theory is persuasive in this context. Bassett’s argument that Congress “created a substantive right that is invaded by a statutory violation” is unconvincing because it depends entirely on the framing of the right. One could fairly characterize the “right” granted to Bassett by the FCRA (from most abstract to most specific) as “the right to be free from identity theft,” “the right to be free from disclosure to others of his full credit card information,” or “the right to be free from receiving a receipt showing his credit card expiration date.” 3 Only the last “right” was violated in this case. Such a framing-dependent exercise is 2 We note that the distinction between a “substantive” statutory violation that alone creates standing, and a “procedural” statutory violation that may cause harm or a material risk of harm sufficient for standing, can be a murky one. In assessing constitutional standing, we must always analyze whether the alleged harm is concrete, with an eye toward history and congressional judgment (as we explained in Section II). The “substantive” and “procedural” analyses that have appeared in our case law are variations on that calculus. 3 A line of cases recognizes that a violation of a substantive statutory right to obtain truthful information is a sufficiently concrete injury to confer standing. See FEC v. Akins, 524 U.S. 11, 21 (1998); Havens Realty Corp. v. Coleman, 455 U.S. 363, 374–75 (1982); Syed, 853 F.3d at 499. Nevertheless, the FCRA provision challenged in this case does not confer a substantive right to obtain a receipt. See 15 U.S.C. § 1681c(g). And, in any event, Bassett’s receipt contains truthful information. 14 BASSETT V. ABM PARKING SERVICES arbitrary, and thus bears minimally on whether Bassett suffered a concrete injury in fact. To the extent the FCRA arguably creates a “substantive right,” it rests on nondisclosure of a consumer’s private financial information to identity thieves. See Bateman, 623 F.3d at 717 (describing the FCRA’s card number redaction requirements as “an effort to combat identity theft”). We recently held, for example, that a statute barring video service providers from disclosing knowingly and without consent a consumer’s “personally identifiable information” to third parties establishes a “substantive right to privacy.” See Eichenberger, 876 F.3d at 982–84. But here, Bassett’s private information was not disclosed to anyone but himself, and therefore no such substantive right was invaded. See id. at 983–84 (noting that whereas “the FCRA outlines procedural obligations that sometimes protect individual interests, the [Video Privacy Protection Act] identifies a substantive right to privacy that suffers any time a video service provider discloses otherwise private information” to a third party). Bassett’s allegations of FCRA procedural violations also do not “entail a degree of risk sufficient to meet the concreteness requirement.” Spokeo, 136 S. Ct. at 1550. In assessing violations of procedural statutory rights, we consider whether “the specific procedural violations alleged . . . actually harm, or present a material risk of harm to [Bassett’s] interests.” Robins, 867 F.3d at 1113. Bassett did not allege that another copy of the receipt existed, that his receipt was lost or stolen, that he was the victim of identity theft, or even that another person apart from his lawyers viewed the receipt. See Meyers, 843 F.3d at 727. Nor did he allege that any risk of harm is real, “not conjectural or hypothetical,” given that he could shred the BASSETT V. ABM PARKING SERVICES 15 offending receipt along with any remaining risk of disclosure. Lujan, 504 U.S. at 560. Like the dissemination of an incorrect zip code, it is difficult to see how issuing a receipt to only the card owner and with only the expiration date, “without more, could work any concrete harm.” Spokeo, 136 S. Ct. at 1550. Indeed, Congress found that receipts like Bassett’s that truncate the credit card number but reveal the expiration date “prevent[] a potential fraudster from perpetrating identity theft or credit card fraud.” 122 Stat. at 1565. Bassett’s theory of “exposure” to identity theft is therefore “too speculative for Article III purposes.” See Missouri ex rel. Koster v. Harris, 847 F.3d 646, 654 (9th Cir. 2017) (quoting Lujan, 504 U.S. at 564 n.2); see also Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013) (a “threatened injury must be certainly impending to constitute injury in fact” (quoting Whitmore v. Arkansas, 495 U.S. 149, 158 (1990)). 4 We need not answer whether a tree falling in the forest makes a sound when no one is there to hear it. But when this receipt fell into Bassett’s hands in a parking garage and no identity thief was there to snatch it, it did not make an injury. AFFIRMED. 4 It is no help to Bassett that some courts have found injuries sufficiently concrete where plaintiffs alleged theft of their private information, even when that information had not yet been used against them (e.g., no fraudulent charges had been made). See Galaria v. Nationwide Mut. Ins. Co., 663 F. App’x 384, 387–89 (6th Cir. 2016); Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 693 (7th Cir. 2015); Krottner v. Starbucks Corp., 628 F.3d 1139, 1142–43 (9th Cir. 2010). Bassett alleged no such theft.