Insight Center: Publications

Third Circuit Finds That No Real Risk of Harm Means No Article III Standing

Client Alert

Authors: Jan P. Levine, Angelo A. Stio III and Matthew A. Chiachetti

Third Circuit Finds That No Real Risk of Harm Means No Article III Standing

The U.S. Court of Appeals for the Third Circuit recently held, for the first time, that a mere procedural violation of a statute does not present the material risk of harm that a plaintiff must allege to establish Article III standing. In Kamal v. J. Crew Group, Inc., Nos. 17-2345 and 17-2453, the Third Circuit applied the analysis of concrete injury articulated by the U.S. Supreme Court in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), to conclude that a plaintiff lacked standing to pursue a claim under the Fair and Accurate Credit Transaction Act (FACTA) when only a procedural violation of the statute was alleged without a concrete injury or material risk of harm being pleaded.


The plaintiff in Kamal alleged that he purchased goods at J. Crew retail stores on three separate occasions. On each of those occasions, J. Crew issued receipts that contained the first six digits of his credit card number. The plaintiff alleged these disclosures violated FACTA, which prohibits printing more than the last five digits of a consumer’s credit card number on a receipt. The plaintiff alleged two harms caused by this disclosure: first, the harm caused by printing the information and, second, the increased risk of identity theft. The district court held that neither of these harms was concrete under Spokeo and dismissed the complaint for lack of standing. The Third Circuit affirmed.

Third Circuit Opinion

Relying on the Supreme Court’s analysis in Spokeo, the Third Circuit recognized that “Congress cannot statutorily manufacture Article III standing in the case of ‘a bare procedural violation, divorced from any concrete harm.’” The Third Circuit reasoned that, to establish Article III standing, a procedural violation of a statute must “yield or risk actual harm.” The Third Circuit noted that it applied this principle in four prior cases where the underlying harm that the statute was intended to protect already had materialized or failed to materialize. See In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625 (3d Cir. 2017); Susinno v. Work Out World Inc., 862 F.3d 346 (3d Cir. 2017); St. Pierre v. Retrieval-Masters Creditors Bureau, 898 F.3d 351 (3d Cir. 2018); Long v. Se. Pa. Transp. Auth., 903 F.3d 312 (3d Cir. 2018). In Kamal, however, the Third Circuit was forced to determine whether the procedural violation presented a “material risk of harm.”

The Third Circuit analyzed the plaintiff’s alleged injury as an intangible harm and followed the direction in Spokeo to “consider whether [the] harm has a close relationship to a harm that has traditionally been regarded as providing a basis” for an action under common law. The Third Circuit concluded that the harm arising from similar common law claims is based on unauthorized access to personal information. The plaintiff in Kamal did not allege unauthorized access. Accordingly, the Third Circuit refused to find a concrete injury on the facts alleged by the plaintiff.

Having determined that the plaintiff did not allege a concrete injury specifically, the Third Circuit then considered whether a “risk of real harm” was present to satisfy the concrete injury requirement for Article III standing. The Third Circuit noted that the plaintiff alleged the procedural violation of FACTA increased his risk of being subject to identity theft. The plaintiff, however, did not allege that any third party accessed his un-truncated credit card information on his receipts or that the information on his receipts was sufficient to enable identity theft to occur. Absent these types of allegations, the Third Circuit held that the plaintiff failed to establish a sufficient degree of risk of real harm. The Third Circuit, therefore, held that the violation of FACTA was “‘a bare procedural violation’ that does not create Article III standing.”

The Third Circuit noted that its decision on this issue is consistent with the majority of courts that have grappled with standing issues related to procedural violations of statutes. Notably, in Katz v. Donna Karan Company, 872 F.3d 114 (2d Cir. 2017), the Second Circuit held that printing the first six digits of a credit card number on a receipt was a bare procedural violation that did not establish standing. Likewise, the Seventh Circuit, in Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 724 (7th Cir. 2016), and the Ninth Circuit, in Bassett v. ABM Parking Services, 883 F.3d 776 (9th Cir. 2018), also held that similar violations of FACTA did not establish standing.

Pepper Points

The Third Circuit’s analysis in Kamal provides defendants with a basis for a motion to dismiss when faced with a putative class action premised on a procedural violation of a statute. Kamal makes clear that a mere procedural violation is insufficient to confer standing in the absence of a concrete injury or genuine risk of harm. It also provides further support for the proposition that Congress cannot invent Article III standing where there is no concrete harm.

The authors are members of Pepper Hamilton’s Privacy, Security and Data Protection Group, which is composed of attorneys who have litigated consumer privacy issues in jurisdictions throughout the United States. The Privacy, Security and Data Protection Group is a multidisciplinary group of attorneys that have the skill and experience to assist in addressing your organization’s most pressing privacy and security issues.

The material in this publication was created as of the date set forth above and is based on laws, court decisions, administrative rulings and congressional materials that existed at that time, and should not be construed as legal advice or legal opinions on specific facts. The information in this publication is not intended to create, and the transmission and receipt of it does not constitute, a lawyer-client relationship.

Data protection laws have changed, so we have revised our Privacy Policy.