Alston & Bird Consumer Finance Blog

Archives for November 2, 2020

Eleventh Circuit Is Not So Sweet To Consumer Plaintiffs Alleging FACTA Violations

Supreme Court

A&B Abstract:

The Eleventh Circuit’s recent decision in Muransky v. Godiva Chocolatier, Inc., No. 16-16486 (11th Cir. Oct 28, 2020) marks a shift in the court’s position regarding what a consumer plaintiff must allege in order to demonstrate Article III standing under Spokeo, Inc. v. Robins.  Although a three-judge panel of the court previously held that a procedural violation of the Fair and Accurate Credit Transactions Act was sufficient to confer Article III standing, a split en banc Eleventh Circuit recently found that a plaintiff must allege more than a “bare procedural violation, divorced from any concrete harm.”  Through its ruling, the Eleventh Circuit is now aligned with the Second, Third, Seventh, and Ninth Circuits in requiring concrete harm as a necessary prerequisite for Article III standing.


In a 7 to 3 decision, the Eleventh Circuit vacated a previous ruling affirming a $6.3 million settlement between Godiva Chocolatier and a class represented by Dr. David Muransky on the ground that Muransky lacked Article III standing under Spokeo, Inc. v. Robins to sue Godiva for a violation of FACTA.

Muransky brought suit alleging that a Godiva cashier gave him a receipt showing his credit card’s first six and last four digits—too many digits under FACTA. FACTA prohibits retailers from printing “more than the last 5 digits of the credit card number or the expiration date” on the consumer’s receipt.  Retailers can face a statutory penalty of between $100 and $1,000 for each receipt featuring more than the permitted five digits, with the size of the penalty dependent on whether consumers can prove the retailer was willfully negligent.

Muransky claimed that Godiva’s failure to fully truncate his credit card digits led to an increased risk of identify theft.  Godiva ultimately agreed to pay $6.3 million to settle the suit.  During the approval process, a class member objected to the settlement on the basis that Muransky lacked Article III standing because he failed to allege a “concrete injury” and the alleged FACTA violation—an increased risk of harm—did not present a “material risk” of harm. After the district court approved the settlement, the objector appealed.  A three-judge panel of the Eleventh Circuit subsequently upheld the settlement after finding that an increased risk of identity theft was enough to bring FACTA claims.

In a ruling last week, the full court reconsidered the standing issue and changed course.  The Eleventh Circuit held that Muransky did not have standing under FACTA to either settle with Godiva or pursue a class action because he had not suffered any harm when Godiva printed 10 of his credit card digits.  The Eleventh Circuit began by rejecting Muransky’s argument that a bare procedural violation of FACTA—the printing of 10 digits on his credit card receipt—was enough to confer Article III standing.  Instead, the Supreme Court’s Spokeo decision requires a plaintiff to also allege concrete harm, something Muransky failed to do.

The Eleventh Circuit then addressed Muransky’s argument that Godiva’s FACTA violation exposed Muransky and the class members to an elevated risk of identity theft.  According to the court, Muransky’s “naked assertion” that he faced an increased risk of identity theft is the “kind of conclusory allegation” that is simply not enough to demonstrate concrete harm and therefore not enough to confer Article III standing.

Three of the judges—two of whom made up the original Eleventh Circuit panel that affirmed the settlement—dissented from the majority.  Judge Wilson believed that Muransky had plausibly alleged that Godiva’s FACTA violation elevated his risk of identity theft—something that was sufficient to demonstrate concrete harm.  Judge Martin dissented on the ground that the Supreme Court’s Spokeo decision held that “not all statutory violations result in concrete injury.”  According to Judge Martin, “a plaintiff need not allege anything more than a violation of the statute itself” and therefore she believed that Muransky “was not required to allege any additional harm beyond the statutory violation alleged in his complaint.”  Judge Jordan also dissented, agreeing with the points made by both Judge Wilson and Judge Martin.

The majority’s holding is consistent with prior decisions from the Second Circuit (Crupar-Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76 (2d Cir. 2017)), Third Circuit (Kamal v. J. Crew Group, Inc., 918, F.3d 102 (3d Cir. 2019), Seventh Circuit (Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 724 (7th Cir. 2016)), and Ninth Circuit (Bassett v. ABM Parking Services, Inc., 883 F.3d 776 (9th Cir. 2018)). Each of those cases involved a violation of the FACTA truncation requirement involving the printing of the credit card expiration date on the receipt.  In each case, the court held that the plaintiff lacked standing to sue.

Following the Eleventh Circuit’s ruling, the D.C. Circuit is currently the only federal appeals court to have concluded that a bare procedural violation of FACTA’s truncation requirement is sufficient to confer Article III standing. But, as the Eleventh Circuit recognized, that conclusion was based “on significantly different facts.”  In Jeffries v. Volume Services of America, 2019 WL 2750856 (D.C. Cir. July 2, 2019), the retailer printed all 16 digits of the plaintiff’s credit card number and the expiration date of the card on the receipt.  The D.C. Circuit held that the “egregious” FACTA violation of printing all 16 digits and the expiration date created a real risk of harm to the plaintiff because it created “the nightmare scenario FACTA was enacted to prevent” and provided “sufficient information for a criminal to defraud her.”


The decision in Muransky solidifies the existing circuit court precedent holding that plaintiffs asserting FACTA claims will lack Article III standing if they allege nothing more than the simple procedural harm without any actual concrete harm.  The prior decision in Muransky provided plaintiffs with some authority for allowing a class action to proceed based on just the procedural violation, but that decision is no longer good law.

Therefore, in order to bring FACTA class actions, plaintiffs will need to allege facts sufficient to show something more than an increased risk of harm.  Given the nature of the underlying violation, it will remain difficult for plaintiffs to allege some identifiable harm as a result of the FACTA violation.

California Enacts Debt Collector Licensure Law

A&B Abstract:

On September 25, California Governor Gavin Newsom signed into law Senate Bill 908, which, in part, enacts the California Debt Collection Licensing Act (“Act”). Effective January 1, 2022, the Act will require the licensure of persons that engage in debt collection in California with California residents.   Notably, the Act also applies to entities collecting debt on their own behalf.  The Act’s requirements are in addition to those arising under the California Rosenthal Fair Debt Collection Practices Act (the “Rosenthal Act”), which regulates the practices of debt collectors.

A New Licensing Obligation

The Act provides that “[n]o person shall engage in the business of debt collection in this state without first obtaining a license [from the California Department of Financial Protection and Innovation (“DFPI”), which succeeds the Department of Business Oversight effective January 1, 2021].”

What is debt collection and who is a debt collector?

The Act defines “debt collection” as “any act or practice in connection with the collection of consumer debt.”

“Consumer debt” is defined as “money, property, or their equivalent, due or owning, or alleged to be due or owing, or alleged to be due or owing, from a natural person by reason of a consumer credit transaction,” and specifically includes mortgage debt and “charged-off consumer debt” as defined in Section 1788.50 of the California Civil Code.

“Debt collector” means any person who, “in the ordinary course of business, regularly, on the person’s own behalf or on behalf of others, engages in debt collection.” The term includes any person, “who composes and sells, or offers to compose and sell, forms, letters and other collection media used or intended to be used for debt collection.” The term also includes a “debt buyer” as defined in Section 1788.50 of the California Civil Code.


The Act contains several exclusions from both its licensing obligation and the Act’s substantive provisions. Notably, the Act excludes from its scope, depository institutions, which is defined to include FDIC-insured out-of-state state-chartered banks, licensees under the California Financing Law, licensees under the California Residential Mortgage Lending Act, licensees under the California Real Estate Law, and a trustee performing acts in connection with a nonjudicial foreclosure, among others. Additionally, the Act does not apply to debt collection regulated by California’s Student Loan Servicing Act (Cal. Fin. Code §§ 28000 et seq.).

However, it should be noted that the Act authorizes the Commissioner of the DFPI to take action against those exempt from the Act, for violations of the Rosenthal Act (Cal. Civ. Code §§ 1788 et seq.) or the California Fair Debt Buying Practices Act (Cal. Civ. Code §§ 1788.50 et seq.).  Such actions may include, after notice and an opportunity for a hearing, ordering the person to (1) desist and refrain from engaging in the business of further continuing the violation, or (2) pay ancillary relief, which may include refunds, restitution, disgorgement, and payment of damages, as appropriate, on behalf of a person injured by the conduct or practice that constitutes the subject matter of the assessment.

California Debt Collector Application

Persons wishing to obtain a California Debt Collector License must submit an application to the DFPI. Among other requirements under the Act, applicants must submit:

  • A completed license application signed under the penalty of perjury;
  • An application and an investigation fee; and
  • A sample of the initial consumer debt validation letter required by 15 U.S.C. § 1692g that the licensee will use in correspondence with California consumers.

The DFPI has not yet released an application for this license. However, the Act authorizes the DFPI to require that applications be submitted through the NMLS.  We anticipate the DFPI will require that applications be submitted and processed through the NMLS.

Duties of Debt Collector Licensees

The Act imposes express duties on licensed debt collectors. Specifically, all licensed debt collectors must: (1) develop policies and procedures reasonably intended to promote compliance with the Act; (2) file any required reports with the Commissioner; (3) comply with the provisions of the Act and any regulation or order of the Commissioner; and (4) submit to periodic examination by the DFPI as required by the Act and any regulations promulgated thereunder.

Licensees must also maintain a surety bond in a minimum amount of $25,000.  The Commissioner is authorized to require licensees to submit bonds, riders, and endorsements electronically through the NMLS’s electronic surety bond function.

Additionally, each licensee will be required to pay an annual fee, representing the debt collector’s “pro rata share of all costs and expenses reasonably incurred in the administration of [the Act], as estimated by the commissioner, for the ensuing year and any deficit actually incurred or anticipated in the administration of [the Act] in the year in which the annual fee is levied.”

Licensees are also required to file an annual report with the Commissioner, on or before March 15, that contains all relevant information that the Commissioner reasonably requires concerning the business and operations conducted by the licensee in California during the preceding calendar year, including information regarding collection activity. The report must, at minimum, require disclosure of all of the following:

  • The total number of California debtor accounts purchased or collected on in the preceding year;
  • The total dollar amount of California debtor accounts purchased in the preceding year;
  • The face value dollar amount of California debtor accounts in the licensee’s portfolio in the preceding year;
  • The total dollar amount of California debtor accounts collected in the preceding year, and the total dollar amount of outstanding debt that remains uncollected;
  • The total dollar amount of net proceeds generated by California debtor accounts in the preceding year;
  • Whether or not the licensee is acting as a debt collector, debt buyer, or both; and
  • The case number of any action in which the licensee was held liable by final judgment under the Rosenthal Act (Cal. Civ. Code §§ 1788 et seq.) or the California Fair Debt Buying Practices Act (Cal. Civ. Code §§ 1788.50 et seq.).

Notably, these individual annual reports will be made available to the public for inspection.

DFPI Authority Under the Act

As noted above, the Act grants the Commissioner with broad authority to administer the Act, through investigations and examinations, and to adopt rules and regulations consistent with that authority.

If the Commissioner determines that a person who is required to be licensed under the Act is engaged in business as a debt collector without a license, or a person or licensee has violated any provision of the Act, the Commissioner may, after notice and an opportunity for a hearing, order such person to (1) desist and refrain from engaging in the business of further continuing the violation, or (2) pay ancillary relief, which may include refunds, restitution, disgorgement, and payment of damages, as appropriate, on behalf of a person injured by the conduct or practice that constitutes the subject matter of the assessment.  In addition, the Commissioner has the authority to suspend or revoke licenses issued under the Act.


Effective January 1, 2022, California will require “debt collectors” engaged in the business of debt collection in the state to obtain a debt collection license.  The Act also authorizes the DFPI to enforce the provisions of the Rosenthal Act against “debt collectors,” which the Act defines consistent with the Rosenthal Act.

The Act should be of particular note for persons that service and collect on their own debt, as California joins a growing list of states that require a license for first-party collection activity.  Unlike other state debt collection laws, certain licensees in California may avail themselves of an exemption from the Act’s licensing obligation. Those currently acting as debt collectors in California that do not qualify for an exemption should closely monitor DFPI guidance for the release of application procedures.