The U.S. Court of Appeals for the Sixth Circuit recently clarified the scope of conduct that could potentially expose any consumer business to immense liability. In Thomas v. TOMS King (Ohio), LLC, No. 20-3977 (6th Cir. May 11, 2021), a consumer sued a defendant business alleging a violation of the Fair and Accurate Credit Transactions Act of 2003 (FACTA). The plaintiff alleged the defendant had violated the “truncation requirement” of FACTA and exposed her to an increased risk of identity theft by issuing a credit card that included the first six and last four digits of her credit card number. In an effort to thwart identify theft, the truncation requirement prohibits businesses from printing more than the last five digits of a customer’s credit or debit card number on a receipt. Violations of FACTA can expose businesses to actual and statutory damages, punitive damages, and attorneys’ fees.

The Sixth Circuit’s decision did not turn on the merits of the plaintiff’s allegation — it was accepted as true that the defendant had violated FACTA by issuing the alleged receipt. Rather, the court’s decision turned on whether the plaintiff had standing to bring her FACTA claim at all. Under Article III of the U.S. Constitution, federal courts may only decide “cases” and “controversies.” Courts have interpreted that language to mean that, in order for a court to have jurisdiction over a matter, the plaintiff must show (1) she suffered an injury in fact, (2) caused by the defendant, that (3) is redressable by the court.

In Thomas, the Sixth Circuit determined that even though the plaintiff had alleged a statutory violation of FACTA — the printing of credit card numbers in excess of those allowed — the violation did not create a concrete injury. The court concluded that the plaintiff could not demonstrate how printing the first six numbers, which merely identify the card issuer, and the last four digits created an increased risk of identity theft. The case might have come out differently if, for example, the receipt had listed all 16 digits of the plaintiff’s credit card number. But because the defendant’s technical FACTA violation did not actually increase the plaintiff’s risk of identity theft, there was no injury for standing purposes. Through its decision in Thomas, the Sixth Circuit joins several other circuits in holding that not every violation of FACTA’s truncation requirement creates a concrete injury or risk of identity theft.

There are several lessons businesses can draw from the court’s decision in Thomas and its reminder that plaintiffs must satisfy Article III’s standing requirement. First, don’t forget the little things. Although data breaches, phishing scams, and other electronic means pose a greater identity theft threat, businesses must remain diligent when it comes to simple things like the humble credit card receipt. Even these small matters can still expose businesses to headaches and liability if handled improperly. Second, injury still matters. The risks businesses face in handling consumer information are substantial. But businesses can take some comfort in knowing courts are still very attuned to the requirement that, to bring a claim, a customer-turned-plaintiff must still allege a concrete injury caused by the business’s actions.

While issues regarding standing and identity theft can be complex, Taft is here to help. Taft’s Appellate group is well versed in navigating the nuances of Article III standing jurisprudence both in the Sixth Circuit and around the country, and Taft’s Privacy and Data Security group can help your business avoid many of these problems from arising in the first place.