FOR PUBLICATION UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT STEVEN BASSETT, No. 16-35933 Plaintiff-Appellant, D.C. No. v. 2:16-cv-00947- TSZ ABM PARKING SERVICES, INC., DBA ABM Onsite Services - West, DBA AMPCO System Parking; ABM OPINION ONSITE SERVICES - WEST, INC.; ABM INDUSTRIES, INC., Defendants-Appellees. Appeal from the United States District Court for the Western District of Washington Thomas S. Zilly, Senior District Judge, Presiding Submitted December 5, 2017* Seattle, Washington Filed February 21, 2018 Before: Michael Daly Hawkins, M. Margaret McKeown, and Morgan Christen, Circuit Judges. Opinion by Judge McKeown * The panel unanimously concludes this case is suitable for decision without oral argument. See Fed. R. App. P. 34(a)(2). 2 BASSETT V. ABM PARKING SERVICES SUMMARY** Standing / Fair Credit Reporting Act The panel affirmed the district court’s dismissal due to lack of standing in a putative class action alleging a violation of the Fair Credit Reporting Act when the plaintiff received a credit card receipt displaying the card’s full expiration date. In Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), the Supreme Court held that to have Article III standing when alleging only a statutory violation, a plaintiff must allege a concrete injury in fact. The panel joined the Second and Seventh Circuits in affirming dismissal under identical circumstances, and held that the plaintiff failed to allege a concrete injury in fact sufficient to give him standing. The panel held that when the plaintiff received the credit card receipt and there was no identity thief there to snatch it, there was no injury. ** This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader. BASSETT V. ABM PARKING SERVICES 3 COUNSEL Darrell L. Cochran and Christopher E. Love, Pfau Cochran Vertetis Amala PLLC, Tacoma, Washington, for Plaintiff- Appellant. Ryan P. McBride, Abraham K. Lorber, and Randall P. Beighle, Lane Powell PC, Seattle, Washington, for Defendants-Appellees. OPINION McKEOWN, Circuit Judge: Today we answer a question that would certainly sound exotic to our nation’s founders: Is receiving an overly revealing credit card receipt—unseen by others and unused by identity thieves—a sufficient injury to confer Article III standing? In response to growing credit card fraud and identity theft, Congress enacted a series of protective laws. When Steven Bassett used his credit card at an ABM parking garage, he received a receipt displaying the card’s full expiration date—a violation of the requirement that businesses redact certain credit card information on printed receipts. 15 U.S.C. § 1681c(g). Bassett sued but alleged only a statutory violation and a potential for exposure to actual injury. Like the district court, we conclude that Bassett failed to allege a concrete injury sufficient to give him standing. In doing so, we join the Second and Seventh Circuits in affirming dismissal under identical circumstances. See Crupar-Weinmann v. Paris Baguette 4 BASSETT V. ABM PARKING SERVICES Am., Inc., 861 F.3d 76 (2d Cir. 2017); Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724 (7th Cir. 2016). Background The legislative backdrop for this case centers on FACTA and FCRA. The Fair and Accurate Credit Transactions Act of 2003 (“FACTA”), Pub. L. No. 108-159, 117 Stat. 1952, amended the Fair Credit Reporting Act (“FCRA”) to limit the information printed on receipts: “[N]o person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.”1 15 U.S.C. § 1681c(g). The statute provides that “[a]ny person who willfully fails to comply with [that requirement] with respect to any consumer is liable to that consumer” for statutory damages of between $100 and $1,000 per violation or “any actual damages sustained by the consumer,” costs and attorney’s fees, and potential punitive damages. Id. § 1681n. Following the passage of FACTA, consumers filed a spate of lawsuits against merchants who printed receipts showing credit card expiration dates. In response, Congress enacted the Credit and Debit Card Receipt Clarification Act (the “Clarification Act”), Pub. L. No. 110-241, 122 Stat. 1565 (2008). The Clarification Act reiterated that the FCRA prohibits the printing of receipts bearing a card’s expiration date. Id. at 1566. But the congressional findings also noted that “hundreds of lawsuits were filed alleging that the failure to remove the expiration date was a willful violation of the 1 We use “FCRA” where “FCRA” or “FACTA” could be used interchangeably. BASSETT V. ABM PARKING SERVICES 5 [FCRA] even where the account number was properly truncated,” and “[n]one of these lawsuits contained an allegation of harm to any consumer’s identity.” Id. at 1565. Congress went on to find that “[e]xperts in the field agree that proper truncation of the card number, by itself as required by the [FCRA], regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud.” Id. To “ensure that consumers suffering from any actual harm to their credit or identity are protected while simultaneously limiting abusive lawsuits,” the Clarification Act granted a temporary reprieve for merchants: “[A]ny person who printed an expiration date on any receipt . . . between December 4, 2004, and [June 3, 2008],” but otherwise complied with the card number truncation requirements, did not willfully violate the FCRA. Id. at 1566. The Act left the FCRA untouched for receipts printed after June 3, 2008. Id. When Bassett paid for parking at an ABM garage in 2016, he was issued a receipt bearing his credit card expiration date. Bassett filed a putative class action lawsuit against ABM Services, Inc.; ABM Onsite Services – West; and ABM Industries, Inc. (collectively “ABM”) alleging willful violations of the FCRA. Bassett’s claimed injury was “exposure . . . to identity theft and credit/debit fraud,” because he was at “imminent risk” that his “property would be stolen and/or misused by identity thieves.” He did not allege that a second receipt existed, that his receipt was lost or stolen, or that he was the victim of identity theft. Rather, he claimed that “the risk of harm created in printing the expiration date on the receipt” was a “sufficiently concrete” injury to confer Article III standing. 6 BASSETT V. ABM PARKING SERVICES The district court granted ABM’s motion to dismiss the complaint because Bassett failed to allege a sufficiently concrete injury. In dismissing the case with prejudice, the court concluded that Bassett alleged nothing more than a “possible risk of [identity] theft.” Citing the Supreme Court’s watershed decision on standing, Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), the district court emphasized that “[s]omething more is necessary” to allege a concrete injury in fact, because “not every procedural violation gives rise to standing.” Analysis I. SPOKEO AND DECISIONS OF OUR SISTER CIRCUITS At its core, standing is “an essential and unchanging part of the case-or-controversy requirement of Article III.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). Our analysis of this threshold issue begins with Spokeo. 136 S. Ct. 1540. To have standing, Bassett must allege that he “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of [ABM], and (3) that is likely to be redressed by a favorable judicial decision.” Id. at 1547. An injury in fact is “‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Id. at 1548 (quoting Lujan, 504 U.S. at 560). This appeal turns on whether Bassett alleged a concrete injury in fact. Spokeo, like this case, involved a putative consumer class action alleging willful violations of the FCRA. Robins claimed that Spokeo, a consumer reporting agency, published inaccurate credit report information about him, in violation of the FCRA. Id. at 1545–46. The district court dismissed the complaint for lack of standing, but we reversed. Id. at 1546. Because Robins alleged that “Spokeo BASSETT V. ABM PARKING SERVICES 7 violated his statutory rights, not just the statutory rights of other people,” and Robins’s “personal interests in the handling of his credit information are individualized rather than collective,” we concluded that Robins’s “alleged violations of [his] statutory rights [were] sufficient to satisfy the injury-in-fact requirement of Article III.” Id. (quoting 742 F.3d 409, 413–14 (9th Cir. 2014)). Finding this analysis “incomplete,” the Supreme Court vacated and remanded to consider whether Robins alleged a concrete injury in fact. Id. at 1545. The Court emphasized that “Article III standing requires a concrete injury even in the context of a statutory violation.” Id. at 1549. A plaintiff must show that a concrete injury “actually exist[s]”; in other words, it is “real, and not abstract.” Id. at 1548 (internal quotation marks omitted). Intangible harms and a “risk of real harm” can be sufficiently concrete. Id. at 1549–50. But “a bare procedural violation, divorced from any concrete harm,” cannot “satisfy the injury-in-fact requirement of Article III.” Id. at 1549. Importantly, the Court noted that “[a] violation of one of the FCRA’s procedural requirements may result in no harm”— for example, “[i]t is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.” Id. at 1550. The Court remanded to determine “whether the particular procedural violations alleged . . . entail a degree of risk sufficient to meet the concreteness requirement.” Id. Following Spokeo, two of our sister circuits dismissed for lack of standing identical consumer class actions to the one presented in this appeal—alleged violations of the FCRA’s credit card expiration date redaction requirement. In Meyers v. Nicolet Restaurant of De Pere, the Seventh Circuit held that “Spokeo compels the conclusion that Meyers’[s] 8 BASSETT V. ABM PARKING SERVICES allegations are insufficient to satisfy the injury-in-fact requirement for Article III standing”: The allegations demonstrate that Meyers did not suffer any harm because of Nicolet’s printing of the expiration date on his receipt. Nor has the violation created any appreciable risk of harm. After all, Meyers discovered the violation immediately and nobody else ever saw the non-compliant receipt. In these circumstances, it is hard to imagine how the expiration date’s presence could have increased the risk that Meyers’[s] identity would be compromised. 843 F.3d at 727. The court also observed that in the Clarification Act, Congress was “quite concerned” about abusive FCRA lawsuits where a consumer does not suffer actual harm, and “specifically declared that failure to truncate a card’s expiration date, without more, does not heighten the risk of identity theft.” Id. at 727–28. Hence, “without a showing of injury apart from the statutory violation, the failure to truncate a credit card’s expiration date is insufficient to confer Article III standing.” Id. at 728– 29. The Second Circuit reached the same conclusion in Crupar-Weinmann v. Paris Baguette America, Inc. In holding that the alleged “bare procedural violation” did not “present[] a material risk of harm to the underlying concrete interest Congress sought to protect in passing FACTA”— preventing identity theft and credit card fraud—the court viewed as “dispositive” Congress’s findings in the Clarification Act. 861 F.3d at 81. Specifically, the court pointed to Congress’s finding that “[e]xperts in the field BASSETT V. ABM PARKING SERVICES 9 agree that proper truncation of the card number, . . . regardless of the inclusion of the expiration date, prevents a potential fraudster from perpetrating identity theft or credit card fraud.” Id. (alteration in original) (quoting 122 Stat. at 1565). That statement “ma[de] clear that Congress did not think that the inclusion of a credit card expiration date on a receipt increases the risk of material harm of identity theft,” particularly in light of Congress’s concern about “abusive” FCRA lawsuits. Id. II. BASSETT’S ABSENCE OF INJURY We think our sister circuits are correct. History and congressional judgment “play important roles” in our analysis of whether an injury is concrete. See Van Patten v. Vertical Fitness Grp., LLC, 847 F.3d 1037, 1042–43 (9th Cir. 2017) (quoting Spokeo, 136 S. Ct. at 1549). Both factors counsel that Bassett did not allege a concrete injury. A. NO HISTORICAL PREDICATE We look to history because “the doctrine of standing derives from the case-or-controversy requirement, and because that requirement in turn is grounded in historical practice.” Spokeo, 136 S. Ct. at 1549. Bassett’s theory of injury is not supported by historical practice. Indeed, his claimed “exposure” to identity theft—caused by ABM’s printing of his credit card expiration date on a receipt that he alone viewed—does not have “a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Id. Bassett urges us to look to the “close” historical relationship between his alleged injury and privacy-based torts centered on wrongful disclosures of information. But even assuming that “unauthorized disclosures of 10 BASSETT V. ABM PARKING SERVICES information” are legally cognizable, ABM did not disclose Bassett’s information to anyone but Bassett. See In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 636 (3d Cir. 2017). Without disclosure of private information to a third party, it hardly matters that “[a]ctions to remedy . . . invasions of privacy, intrusion upon seclusion, and nuisance have long been heard by American courts, and the right of privacy is recognized by most states.” Van Patten, 847 F.3d at 1043. It is important to distinguish the alleged harm here from cases where we have recognized a privacy-based injury, such as Van Patten. There, we held that a consumer who received unsolicited text messages in violation of the Telephone Consumer Protection Act alleged a sufficiently concrete injury because “unrestricted telemarketing can be an intrusive invasion of privacy and [is] a nuisance.” Id. (quoting Pub. L. 102-243, § 2, 105 Stat. 2394 (1991)). Bassett’s case is likewise dissimilar from Syed v. M-I, LLC, in which we determined that an employee sufficiently alleged a concrete injury where a prospective employer unlawfully obtained a consumer report about him without his consent, in violation of the employee’s “right to information” and “right to privacy” secured by the FCRA. 853 F.3d 492, 499–500 (9th Cir. 2017). Whereas an undisclosed receipt may not “cause harm or present any material risk of harm,” Spokeo, 136 S. Ct. at 1550, unconsented text messages and consumer reports divulged to one’s employer necessarily infringe privacy interests and present harm. Van Patten, 847 F.3d at 1043; Syed, 853 F.3d at 499. B. CONGRESSIONAL JUDGMENT In adopting the FCRA’s credit card expiration date requirement, Congress did not “elevat[e] to the status of