Bultemeyer v. CenturyLink, Inc., No. CV-14-02530-PHX-SPL, 2017 WL 634516, at *1–4 (D. Ariz. Feb. 15, 2017)
Postby Administrator » Mon Feb 25, 2019 11:57 pm
Honorable Steven P. Logan, United States District Judge
*1 Before the Court are the parties' motions for partial summary judgment. (Docs. 64, 72.) Additionally, Defendant alleges Plaintiff lacks Article III standing to bring this action.
The facts in this case are largely undisputed.
Plaintiff Lydia Bultemeyer brings this putative class action against Defendant CenturyLink, Inc. for a violation of the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. § 1681b(f), by using or obtaining Plaintiff's consumer report without a permissible purpose. (Doc. 1.) On April 6, 2014, Plaintiff alleges she visited Defendant's website (the "Website") to determine if she could get a better price for high-speed internet services. The process involved five steps.1 (Docs. 65 ¶ 5; 79 ¶ 5.) In order to reach step one, the consumer must enter his or her address in order for the Website to display the options available to that address. (Docs. 65 ¶¶ 7-8; 79 ¶¶ 7-8.) In the first step, the consumer chooses which options best suits his or her needs and price range. (Docs. 65 ¶ 9; 79 ¶ 9; 65-5 at 2.) In the second step, the consumer further customizes the order based on the previous selections, such as modem and installation choices. (Docs. 65 ¶¶ 10-13; 79 ¶¶ 10-13; 65-5 at 3.) The screen also shows a shopping cart itemizing monthly and one-time fees. Step three is the shopping cart with the itemized charges. (Docs. 65 ¶ 15; 79 ¶ 15; 65-5 at 4.) In step four, the consumer must enter his or her name, email address, phone number, and date of birth. (Docs. 65 ¶ 17; 79 ¶ 17; 65-5 at 5.) The consumer must also click on the checkbox next to the words, "I've read these terms and conditions and I accept them" and click on the "Next" button to proceed to step five. (Docs. 65 ¶ 20; 79 ¶ 20.) If the consumer does not complete all of these actions at step four, he or she cannot progress to step five. (Docs. 65 ¶ 21; 79 ¶ 21.) Between steps four and five, CenturyLink runs a credit report on the consumer. (Docs. 65 ¶ 30; 79 ¶ 30.) Step five asks for payment information for the one-time charges and submits the order for processing. (Docs. 65 ¶ 42; 79 ¶ 42.)
Plaintiff admits she reached the fifth step, but then "changed her mind and decided not to place an order." (Doc. 1 ¶ 22.) Plaintiff argues that, because she did not place the order, she did not initiate a business transaction with CenturyLink. (Doc. 1 ¶ 25.)
Plaintiff further alleges that CenturyLink obtained her credit report without a permissible purpose as described in the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. § 1681b(f). (Doc. 1 ¶¶ 27, 48.) Defendant asserts that Plaintiff initiated a business transaction and that it had a permissible business purpose to obtain her credit report. (Doc. 64.) The parties filed motions for summary judgment. (Docs. 64, 72.) Pursuant to the Court's Order, the parties' motions are limited to liability and do not address damages, willfulness, or the class action. (Doc. 29.) The motions have been fully briefed and are ready for decision.
II. Legal Standard for Standing
*2 Defendant raises the issue of standing. (Doc. 64.) Before the Court can reach the merits of this action, it must first determine whether Plaintiff has standing. See DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 342 (2006); Thomas v. Mundell, 572 F.3d 756, 760 (9th Cir. 2009). "[T]he irreducible constitutional minimum of standing consists of three elements." Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). "The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins, ––– U.S. ––––, 136 S. Ct. 1540, 1547 (2016). The plaintiff bears the burden of proving these elements. Id. To prevail on standing at summary judgment, Plaintiff must make "a factual showing of perceptible harm." Lujan, 504 U.S. at 566.
Injury in fact requires "an invasion of a legally protected interest which is (a) concrete and particularized, ... and (b) 'actual or imminent, not conjectural or hypothetical.' " Lujan, 504 U.S. at 560 (internal citations omitted). "For an injury to be 'particularized,' it 'must affect plaintiff in a personal and individual way.' " Spokeo, 136 S. Ct. at 1548 (citing Lujan, 504 U.S. at 560 n.1). While particularization is necessary, it is not sufficient to establish injury in fact. The injury "must also be 'concrete.' " Id. A concrete injury "must actually exist." Id. However, concrete is not necessarily synonymous with tangible. Id. at 1549.
"In determining whether an intangible harm constitutes injury in fact, both history and the judgment of Congress play important roles." Id. "Congress may 'elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate at law.' " Id. (citing Lujan, 504 U.S. at 578) (brackets in original). "[T]he violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. In other words, a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified." Id. However, "Congress' role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right. Article III standing requires a concrete injury even in the context of a statutory violation." Id.; see also Raines v. Byrd, 521 U.S. 811, 820 n.3 (1997) ("Congress cannot erase Article III's standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing."). Indeed, "[a] violation of one of the FCRA's procedural requirements may result in no harm." Id. at 1550.
The law permits recovery by certain victims that face the risk of real harm, even where the harm may be difficult to prove or measure. Id. at 1549. But, "[a] plaintiff who alleges a 'bare procedural violation' of the FCRA, 'divorced from any concrete harm,' fails to satisfy Article III's injury-in-fact requirement." Syed v. M-I, LLC, ––– F.3d ––––, 2017 WL 242559, at *4 (9th Cir. Jan. 20, 2017) (citing Spokeo, 136 S. Ct. at 1549). In essence, a statutory violation may or may not constitute an injury in fact, but the determination must be made based on an analysis of the statute at issue.
III. Analysis
Plaintiff must show that she suffered a concrete injury in fact, either tangible or intangible. Plaintiff alleges that Defendant violated a provision of the FCRA. She does not claim any damages other than the statutory violation—that Defendant obtained her credit report without a permissible business purpose. She does not allege that the pulling of the credit report injured her credit score, nor does she allege that Defendant disseminated any information in her credit report to a third party. However, Plaintiff alleges that Defendant violated a substantive privacy right rather than a bare procedural violation. (Doc. 80 at 2.) The issue is whether this particular violation of the FCRA is a bare procedural violation that does not rise to the level of a de facto injury in fact, or whether a violation of § 1681b itself constitutes an injury in fact.
*3 Congress enacted the FCRA "to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy." Safeco Ins. Co. of Am. v. Burr, 551 U.S. 47, 52 (2007). Section 1681b of the FCRA governs when a credit report may be obtained. A consumer reporting agency may furnish a credit report to "a person which it has reason to believe ... has a legitimate business need for the information [ ] in connection with a business transaction that is initiated by the consumer ..." 15 U.S.C. § 1681b(a)(3)(F)(i).
Section 1681b further states that a "person shall not use or obtain a consumer report for any purpose unless (1) the consumer report is obtained for a purpose for which the consumer report is authorized to be furnished under this section; and (2) the purpose is certified in accordance with section 607 [§ 1681e] by a prospective user of the report through a general or specific certification." 15 U.S.C. § 1681b(f) (brackets in original). For purposes of analyzing standing only, the Court assumes that Defendant violated § 1681b.
Plaintiff argues that she is not claiming "a bare procedural violation," but rather is alleging a "violation of a substantive privacy right created by Congress[.]" (Doc. 80 at 2.)2 She asserts that, although the harm is intangible, the substantive privacy right gives her standing. However, characterizing the harm as procedural or substantive is not dispositive of the standing issue; the violation must be accompanied by an injury in fact. Gubala v. Time Warner Cable, Inc., ––– F.3d ––––, 2017 WL 243343, *3 (7th Cir. 2017) ("a failure to comply with a statutory requirement to destroy information is substantive, yet need not ... cause a concrete injury"); Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 n.2 (7th Cir. 2016) (The plaintiff "staked his entire standing argument on the statute's grant of a substantive right to receive a compliant receipt. But whether the right is characterized as 'substantive' or 'procedural,' its violation must be accompanied by an injury-in-fact. A violation of a statute that causes no harm does not trigger a federal case.").
To the extent Plaintiff argues a privacy violation, her claim fails. In Braitberg v. Charter Commc'n, Inc., 836 F.3d 925 (8th Cir. 2016), the plaintiff brought a putative class action alleging that his former television cable provider retained his personally identifiable information in violation of the Cable Communications Policy Act. He alleged that this was a "direct invasion of [his] federally protected privacy rights." Id. at 927. Braitberg contended that the statutory violation constituted an injury in fact sufficient to establish Article III standing. Id. at 929-30. Braitberg did not allege that the information was disclosed to a third party, that any outside party accessed the data, or that the information was used during the disputed period. Id. at 930. The Court found that the plaintiff "identifie[d] no material risk of harm from the retention; [and determined that] a speculative or hypothetical risk is insufficient." Id. The Eighth Circuit found that Braitberg lacked Article III standing. Id. at 931. See also Gubala, 2017 WL 243343 at *2 (court held that cable company retaining personally identifiable information in violation of the Cable Communications Policy Act, without more, such as the information being disseminated to third parties, did not provide the plaintiff with a concrete injury).3 In Smith v. Ohio State Univ., 191 F. Supp.3d 750 (S.D. Ohio 2016), the district court found that prospective employees' privacy rights were not invaded when the university pulled credit reports on the prospective employees. The job-seeking individuals alleged that the university provided extraneous information in the authorizations they signed. Even though the University technically violated the FCRA, the court found that the plaintiffs' privacy rights were not violated. Here, the same analysis applies. Assuming Defendant violated the FCRA by running her credit report without a permissible business purpose, Defendant did nothing with the information that would harm Plaintiff.
*4 To the extent Plaintiff alleges her claim is not a bare procedural violation, her claim also fails. In Hancock v. Urban Outfitters, Inc., 830 F.3d 511 (D.C. Cir. 2016), a retailer asked credit card customers for their zip code at the point of sale in violation of Washington, D.C., law. As here, the plaintiff did not allege any harm other than the violation of a statute. Id. at 514. The appellate court held that the customers did not suffer a cognizable injury as a result of the "bare violation." Id. at 514. In Meyers, the Seventh Circuit held that the printing of the full expiration date of the customer's credit card on a receipt in violation of the Fair and Accurate Credit Transactions Act ("FACTA")4, without the showing of an injury, was insufficient to confer standing. Meyers, 843 F.3d at 728-29. As here, Meyers did not allege any harm other than the "substantive right to receive a compliant receipt." Id. at 727, n.2. In California, in facts similar to the instant case, the court dismissed an action for lack of standing where the plaintiff filed a putative class action seeking statutory and punitive damages for violations of the FCRA without any allegations of actual harm or damages. Larroque v. First Advantage LNS Screening Solutions, Inc., 2016 WL 4577257 (N.D. Cal. Sept. 2, 2016). In this district, the court held that a creditor reporting a charge off on a monthly basis instead of one time failed to allege a concrete harm. Dominguez v. Macy's Retail Holdings Inc., CV-16-03242-PHX-JAT, 2016 WL 7440791 (D. Ariz. Dec. 27, 2016). Here, Plaintiff alleges a bare procedural violation without identifying any concrete harm.
Plaintiff next relies on In re Nickelodeon Consumer Privacy Litig. for the proposition that "unlawful disclosure of legally protected information" is "a clear de facto injury[.]" 827 F.3d 262, 274 (3d Cir. 2016). However, Plaintiff misstates the holding. In Nickelodeon, the plaintiffs alleged that the defendants tracked minor children's personal information, including internet usage and viewing history, in violation of the Video Privacy Protection Act. Id. at 267. The plaintiffs further allege that the defendants then sold that information. Id. at 274. It was the disclosure of the protected information that the court found constituted a de facto injury.5 Here, Plaintiff has not alleged that Defendant disclosed her information to any third party, which was the de facto injury in Nickelodeon.
Plaintiff attempts to distinguish her allegations by claiming that the improper dissemination occurred when Defendant ran her credit report without a permissible purpose. (Doc. 80 at 4-5.) She alleges that no further dissemination need occur. However, Plaintiff provides no authority for such a proposition. The post-Spokeo cases from around the country have uniformly found that, absent disclosure to a third party or an identifiable harm from the statutory violation, there is no privacy violation. Additionally, the Supreme Court has long held that Congress's power to statutorily grant standing is not unlimited. Spokeo, 136 S. Ct. at 1549; Raines, 521 U.S. at 820 n.3. Here, Plaintiff alleges Defendant violated a statutory procedure by accessing her credit report without a permissible purpose, without identifying any concrete injury in fact. Plaintiff has failed to make "a factual showing of perceptible harm." Lujan, 504 U.S. at 566. She lacks standing. Accordingly,
IT IS ORDERED:
1. That Plaintiff lacks Article III standing to bring this action, thereby depriving this Court of subject-matter jurisdiction, and the action is dismissed;
2. That the parties' motions for summary judgment (Docs. 64, 72) are denied as moot; and
3. That the Clerk of Court shall terminate this action and enter judgment accordingly.
Not Reported in Fed. Supp., 2017 WL 634516
The online ordering process is constantly evolving, but the parties strive to describe the five-step process as it was on April 6, 2014.
Plaintiff, in part, relies on Burke v. Fed. Nat'l Mortg. Ass'n, 2016 WL 4249496 (E.D. Va. Aug. 9, 2016), in which the district court found that a violation of privacy was a concrete harm. However, after the completion of briefing here, the parties in Burke stipulated that the court lacked subject-matter jurisdiction; thereby causing the court to vacate its opinion as it had no authority to issue an opinion. Burke v. Fed. Nat'l Mortg. Ass'n, 2016 WL 7451624 (E.D. Va. Dec. 6, 2016).
Recently, the Ninth Circuit held that an automated text sent in violation of the Telephone Consumer Protection Act ("TCPA") was an invasion of privacy and a nuisance sufficient to find standing. Van Patten v. Vertical Fitness Grp., 2017 WL 460663, *4 (9th Cir. 2017). The Court found that "[u]nsolicited telemarketing phone calls or text messages, by their nature, invade the privacy and disturb the solitude of their recipients." Id. The Ninth Circuit reasoned that the harm that Congress sought to prevent—harassment of consumers by unwanted phone calls—was exactly the harm suffered. Id. Although one of the purposes of the FCRA is to protect consumer privacy, unlike the TCPA, that is not the primary goal. See Safeco, 551 U.S. at 52 (Congress enacted the FCRA "to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy.").
FACTA was a 2003 amendment to the FCRA. Meyers, 843 F.3d at 725.
The Third Circuit likewise held that "the unauthorized dissemination of [the plaintiffs'] private information" satisfies the concreteness requirement. In re Horizon Healthcare Serv., Inc. Data Breach Litig., 2017 WL 242554, *11 (3d Cir. 2017). Again, the reasoning relies on the unauthorized dissemination of the information, not the mere possession of the information.