
    Doris JEFFRIES, Plaintiff, v. VOLUME SERVICES AMERICA, INC., et al., Defendants.
    Civil Action No. 17-1788 (CKK)
    United States District Court, District of Columbia.
    Signed August 3, 2018
    Chant Yedalian, Pro Hac Vice, Chant & Company A Professional Law Corporation, Glendale, CA, Katherine Warren Van Dyck, Cuneo, Gilbert & Laduca, LLP, Washington, DC, for Plaintiff.
    Devin J. Stone, Scott Neal Godes, Barnes & Thornburg LLP, Washington, DC, Mark Bayer, Pro Hac Vice Barnes & Thornburg, LLP, Dallas, TX, for Defendants.
    MEMORANDUM OPINION
   COLLEEN KOLLAR-KOTELLY, United States District Judge

Defendant Volume Services America, Inc. (d/b/a Centerplate and Centerplate/NBSE) ("Centerplate") presently moves to dismiss Plaintiff's [1] Complaint under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). Because the Court finds that Plaintiff lacks standing, and consequently that the Court lacks subject-matter jurisdiction, the Court need not reach the sufficiency of Plaintiff's claim. Upon consideration of the briefing, the relevant legal authorities, and the record as a whole, the Court shall GRANT Defendant Centerplate's Motion to Dismiss contained in its [9] Notice of Motion, and shall DISMISS this case.

I. BACKGROUND

The alleged facts in this case are few and readily stated. Plaintiff used a credit card to make a purchase from Defendant Centerplate and, in some fashion, ten Doe defendants. Compl., ECF No. 1, ¶¶ 16, 37. To memorialize the transaction, Defendants provided Plaintiff with one or more electronically printed receipts that contained the following pieces of information from Plaintiff's credit card: the full sixteen-digit card number, the expiration date, and the brand. Id.

Plaintiff brought a putative class action against Defendant Centerplate and the ten Doe defendants for allegedly violating the Fair and Accurate Credit Transactions Act of 2003 ("FACTA"). Compl., ECF No. 1, ¶ 1. As amended by FACTA, Title 15 of the U.S. Code provides in pertinent part that "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction." 15 U.S.C. § 1681c(g)(1). The transaction allegedly occurred after the effective date of this amendment. See id. § 1681c(g)(3) (identifying effective date as either "3 years after December 4, 2003," or "1 year after December 4, 2003," depending on the machine used to print the receipt); Compl., ECF No. 1, ¶ 37 (alleging transaction "[a]fter December 3, 2006, and within two years from the date of filing of this action" on September 1, 2017).

Defendant Centerplate seeks dismissal of this action under Rules 12(b)(1) and 12(b)(6) for lack of subject-matter jurisdiction and failure to state a claim upon which relief can be granted. Now that briefing has concluded, this motion is ripe for resolution. Because the Court shall resolve this case on the grounds of Plaintiff's inability to establish standing, the fact that the Doe defendants are presently unidentified has no bearing. But for ease of reference, the Court shall refer in the remainder of this Memorandum Opinion to the actions of Defendants as attributable only to Defendant Centerplate.

II. LEGAL STANDARDS

A. Subject Matter Jurisdiction under Rule 12(b)(1)

A court must dismiss a case pursuant to Federal Rule 12(b)(1) when it lacks subject matter jurisdiction. In determining whether there is jurisdiction, the Court may "consider the complaint supplemented by undisputed facts evidenced in the record, or the complaint supplemented by undisputed facts plus the court's resolution of disputed facts." Coalition for Underground Expansion v. Mineta , 333 F.3d 193, 198 (D.C. Cir. 2003) (citations omitted). "At the motion to dismiss stage, counseled complaints, as well as pro se complaints, are to be construed with sufficient liberality to afford all possible inferences favorable to the pleader on allegations of fact." Settles v. U.S. Parole Comm'n , 429 F.3d 1098, 1106 (D.C. Cir. 2005). In spite of the favorable inferences that a plaintiff receives on a motion to dismiss, still that "[p]laintiff bears the burden of proving subject matter jurisdiction by a preponderance of the evidence." Am. Farm Bureau v. Envtl. Prot. Agency , 121 F.Supp.2d 84, 90 (D.D.C. 2000). "Although a court must accept as true all factual allegations contained in the complaint when reviewing a motion to dismiss pursuant to Rule 12(b)(1), [a] plaintiff['s] factual allegations in the complaint ... will bear closer scrutiny in resolving a 12(b)(1) motion than in resolving a 12(b)(6) motion for failure to state a claim." Wright v. Foreign Serv. Grievance Bd. , 503 F.Supp.2d 163, 170 (D.D.C. 2007) (internal citations and quotation marks omitted).

B. Failure to State a Claim under Rule 12(b)(6)

Pursuant to Federal Rule 12(b)(6), a party may move to dismiss a complaint on the grounds that it "fail[s] to state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b)(6). "[A] complaint [does not] suffice if it tenders 'naked assertion[s]' devoid of 'further factual enhancement.' " Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly , 550 U.S. 544, 557, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). Rather, a complaint must contain sufficient factual allegations that, if accepted as true, "state a claim to relief that is plausible on its face." Twombly , 550 U.S. at 570, 127 S.Ct. 1955. "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Iqbal , 556 U.S. at 678, 129 S.Ct. 1937.

III. DISCUSSION

The Court must satisfy itself of subject-matter jurisdiction over this case before it can reach the merits of Plaintiff's claim. The jurisdictional hurdle raised by Defendant is Plaintiff's standing. Plaintiff must meet the "irreducible constitutional minimum" requirements for standing to pursue her claim in this Court. Spokeo, Inc. v. Robins , --- U.S. ----, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016) (quoting Lujan v. Defs. of Wildlife , 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ) (internal quotation marks omitted). Absent such a showing here, the Court need not-and cannot-proceed further.

Requiring that a plaintiff demonstrate standing ensures that she has "a personal stake in the outcome of the controversy." Warth v. Seldin , 422 U.S. 490, 498, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975). To establish standing under Article III of the Constitution, Plaintiff has the burden as to each of three elements: "The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. , 136 S.Ct. at 1547 (citing Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc. , 528 U.S. 167, 180-81, 120 S.Ct. 693, 145 L.Ed.2d 610 (2000) ; Lujan , 504 U.S. at 560-61, 112 S.Ct. 2130 ; FW/PBS, Inc. v. Dallas , 493 U.S. 215, 231, 110 S.Ct. 596, 107 L.Ed.2d 603 (1990) ). As the named plaintiff in a putative class action, Plaintiff must carry the burden on her own behalf, irrespective of any arguments that a would-be class member could make. See id. at 1547 n.6 (citing Simon v. E. Ky. Welfare Rights Org. , 426 U.S. 26, 40 n.20, 96 S.Ct. 1917, 48 L.Ed.2d 450 (1976) ).

Pleading a sufficient injury in fact requires that the alleged harm be both "concrete and particularized." Spokeo, Inc. , 136 S.Ct. at 1545 (quoting Friends of the Earth, Inc. , 528 U.S. at 180-81, 120 S.Ct. 693 ) ) (emphasis added by Spokeo ). In Spokeo, Inc. v. Robins , the Supreme Court evaluated whether the allegedly false information contained in an online people-search database constituted an injury in fact for Article III standing purposes. Id. at 1544. An individual whose information appeared in this database had adequately pled a particularized harm. For this proposition, the Supreme Court recognized the Ninth Circuit's finding that the information allegedly "violated his [i.e., the plaintiff's] statutory rights" under the Fair Credit Reporting Act ("FCRA"), as amended, 15 U.S.C. § 1681, et seq. Id. at 1545-46, 1548 (citing Robins v. Spokeo, Inc. , 742 F.3d 409, 413 (9th Cir. 2014) ) (internal quotation marks omitted). The Ninth Circuit also had found that the plaintiff had "individualized" "personal interests in the handling of his credit information." Id. (citing Robins , 742 F.3d at 413 ) (internal quotation marks omitted). But it was less clear from the Ninth Circuit's analysis whether the court had specifically determined as well that the harm was "concrete," in that "it must actually exist." Id. at 1548 ; see also id. (observing that Ninth Circuit had "elided" concreteness requirement in reaching conclusions limited to particularity). While an intangible harm could still qualify as concrete for standing purposes, "both history and the judgment of Congress play important roles" in making such a determination. Id. at 1549. More than an ipse dixit of Congress is required, however, to achieve standing.

Congress' role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right. Article III standing requires a concrete injury even in the context of a statutory violation. For that reason, Robins could not, for example, allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III.

Id. In the event of a statutory violation, "the risk of real harm" could be concrete enough for standing. Id. The court remanded for a determination of "whether the particular procedural violations alleged in [that] case entail[ed] a degree of risk sufficient to meet the concreteness requirement." Id. at 1550.

As in Spokeo , Plaintiff in this case easily satisfies the particularity aspect of a sufficient injury in fact. FACTA is an amendment to the FCRA, the statute at issue in Spokeo . The credit card information that FACTA prohibits printing on a receipt was Plaintiff's own. The receipt was generated by a transaction between Defendant and Plaintiff herself.

The issue in this case, like Spokeo , is whether printing and providing this receipt to Plaintiff caused a concrete injury. Plaintiff alleges one or two harms. First is the "expos[ure] to, at a minimum, an increased risk of identity theft and credit and or [sic] debit card fraud." Compl., ECF No. 1, ¶ 7. Second, or perhaps best understood together with that first harm, is the "additional inconvenience" of needing to "review [a receipt] to assess what was printed, hold on to it [if it contained information prohibited by FACTA], and perhaps shred or cut it up later." Id. ¶ 8. Plaintiff evidently would rather "simply crumple the receipt and throw it into a nearby trash can," but for the need to take this further precaution. Id. Whether understood separately or together, the increased risk and additional inconvenience are arguably one or more "intangible harms," for which Spokeo urges a consideration of "history and the judgment of Congress." 136 S.Ct. at 1549.

Beginning with the history prong, the Court should consider "whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Id. Plaintiff argues that privacy rights created by FACTA are analogous to common law torts for invasion of privacy. See Pl.'s Opp'n at 10-12. That may be true in the abstract, but Plaintiff's Complaint never asserts any invasion of her privacy. The receipt containing prohibited information allegedly was provided to Plaintiff, and she does not allege any further disclosure of that receipt to anyone else. Nor does Plaintiff cite any history to support any notion that additional inconvenience associated with review and disposal of an infringing receipt rises to the level of a concrete harm.

The judgment of Congress, on the other hand, is pertinent to one of the alleged harms. While Plaintiff offers no evidence that the additional inconvenience of dealing with that receipt was considered by Congress, evidently Congress foresaw the risk that a receipt containing the information that it ended up prohibiting could fall into the wrong hands. See Pl.'s Opp'n at 12-13 (citing various congressional and judicial pronouncements regarding FACTA). At least a theoretical risk of identity theft may be amplified by the receipt's very printing. It was at a similar point of finding a "procedural violation" that Spokeo remanded for consideration of the "degree of risk" associated with the violation, and whether that risk represented a concrete harm. 136 S.Ct. at 1550.

The parties attempt to fill the gap left by Spokeo by citing a number of out-of-circuit authorities. Some of these decisions deal specifically with standing in the growing raft of FACTA lawsuits. See, e.g., Crupar-Weinmann v. Paris Baguette Am., Inc. , 861 F.3d 76, 81 (2d Cir. 2017) (citing Credit and Debit Card Receipt Clarification Act of 2007, Pub. L. No. 110-241, 122 Stat. 1565 (2008) ) (affirming dismissal of FACTA suit for printing receipt with credit card expiration date and noting post-FACTA legislation in which "Congress expressly observed that the inclusion of expiration dates did not raise a material risk of identity theft"); Everett v. Memphis Light Gas & Water Div. , No. 16-cv-2810-SHL-tmp, 2017 WL 1830165, at *3 (W.D. Tenn. Apr. 18, 2017) (finding no concrete harm for alleged FACTA violation of printing receipt with excess credit card digits); Deschaaf v. Am. Valet & Limousine Inc. , 234 F.Supp.3d 964, 970 (D. Ariz. 2017) (finding concrete harm for alleged FACTA violation of printing receipt with credit card expiration date). The Court has determined, however, that the few post- Spokeo decisions in this Circuit-the last of which post-dates the parties' briefing-provide sufficient controlling authority to resolve this issue.

In Hancock v. Urban Outfitters, Inc. , several merchants requested zip codes from consumers at check out and proceeded to record those zip codes in their registers. 830 F.3d 511, 512 (D.C. Cir. 2016). The plaintiff consumers alleged that one District of Columbia statute prohibited both the requests for, and recordation of, these zip codes, while another prohibited the misrepresentation that providing this information was necessary. Id. at 512-13 (citing D.C. Code §§ 28-3901 et seq. , 47-3151 et seq. ). But the Court of Appeals for the District of Columbia Circuit ("D.C. Circuit") found that asking for and entering these zip codes was a statutory violation that did not result in a "risk of real harm" within the scope of Spokeo . Id. at 514 (quoting Spokeo, Inc. , 136 S.Ct. at 1549 ) (internal quotation marks omitted). The consumers had not alleged, for example, that the merchants' action constituted an "invasion of privacy [or] increased [the] risk of fraud or identity theft." Id. Without such a threat of real harm, the intangible harm alleged by consumers could not amount to a concrete injury in fact.

Plaintiff in this case argues that Defendant's action resulted in "an increased risk of identity theft." Compl., ECF No. 1, ¶ 7. But that argument is specious. The receipt-like the zip codes in Hancock -was exchanged exclusively between Defendant and Plaintiff. And, whereas the zip codes provided by the Hancock consumers ended up in a store database, which could be subject to some data breach, the receipt given to Plaintiff ended up with Plaintiff herself. She could have lost the receipt, or it could have been stolen from wherever she kept it, but she alleges neither of these occurrences nor any particular facts suggesting a substantial risk thereof. Nor is there any allegation that the receipt also contained Plaintiff's name, which presumably would be necessary to make any use of a credit card number.

The D.C. Circuit's next case discussing Spokeo only reinforces that the theoretical risk raised by Plaintiff cannot amount to a concrete injury in fact. In Attias v. CareFirst, Inc. , a hacker of some sort evidently accessed personal information, including customer names and credit card numbers, found on a health insurance provider's servers. 865 F.3d 620, 622-23, 627 (D.C. Cir. 2017), cert. denied , --- U.S. ----, 138 S.Ct. 981, 200 L.Ed.2d 248 (2018). Attias clarified this Circuit's approach to concreteness when the only alleged injury is an increased risk of harm:

Under our precedent, "the proper way to analyze an increased-risk-of-harm claim is to consider the ultimate alleged harm," which in this case would be identity theft, "as the concrete and particularized injury and then to determine whether the increased risk of such harm makes injury to an individual citizen sufficiently 'imminent' for standing purposes."

Id. at 627 (quoting Food & Water Watch, Inc. v. Vilsack , 808 F.3d 905, 915 (D.C. Cir. 2015) ). The D.C. Circuit found that "a substantial risk of identity theft" is involved if, as alleged, the customers' "social security and credit card numbers were accessed by a network intruder." Id. at 628. The plaintiffs in Attias accordingly established a concrete injury in fact for Article III purposes. Id. at 629.

The alleged harm in this case comes nowhere near the level of sufficient imminence that constituted concrete injury in Attias . Plaintiff has not alleged that anyone other than herself (and her counsel) has accessed her receipt containing the information prohibited by FACTA. And nothing else in the Complaint otherwise suggests that the risk of identity theft using Plaintiff's receipt is sufficiently imminent. To forestall any risks of identity theft that could be created if Plaintiff's receipt were accessed by a potential thief, Plaintiff could shred it, as she suggests. But the failure to undertake that additional inconvenience would not render the remote risk of identity theft appreciably more likely. The absence of any allegation that her name is also contained on this receipt likewise distinguishes Plaintiff's case from Attias . Any risk of identity theft would be lower without information to link the credit card receipt to Plaintiff herself, which presumably would be lacking if she had in fact chosen to simply discard her receipt in a public trash can.

Most recently, the D.C. Circuit found that inaccurate safety information about certain commercial truck drivers contained in a federal database that was not accessed by any prospective employers did not inflict on the drivers a concrete injury in fact, despite violating a federal statute. Owner-Operator Indep. Drivers Ass'n, Inc. v. U.S. Dep't of Transp. , 879 F.3d 339, 340, 345 (D.C. Cir. 2018) (" Owner-Operator "). The Owner-Operator Court recognized that the database contained "information that could easily harm a driver were it shared with prospective employers," unlike the "potentially harmless information" (consumer zip codes) at issue in Hancock. Id. at 343 (citing Hancock , 830 F.3d at 514 ). Yet, the drivers were not able to prove under Spokeo 's "history and the judgment of Congress" test that the risk of employers' accessing the information constituted a sufficiently concrete injury in fact. Id. at 344-45. Unlike the complaint in Attias , "nothing in the record [at the motion for summary-judgment stage in Owner-Operator ] indicates that anyone has recently accessed or used the information at issue or intends to do so in the future. The prospect of future injury is thus purely 'speculative.' " Id. at 347 (quoting Attias , 865 F.3d at 626 ). So too in this case it is purely speculative that an identity thief would somehow access Plaintiff's hard-copy receipt. Plaintiff has not discharged her burden to prove by a preponderance of the evidence that the risk created by Defendant's alleged action qualifies as a concrete injury sufficient to establish standing under Article III.

Plaintiff tries to swim upstream against D.C. Circuit authority-even authority pre-dating Owner-Operator -in part by relying heavily on the Third Circuit's decision in In re Horizon Healthcare Servs. Inc. Data Breach Litig. , 846 F.3d 625 (3d Cir. 2017) (" Horizon "). See Pl.'s Opp'n at 11, 12, 16, 18; Def.'s Reply at 10-11. Plaintiffs in that case alleged a violation of the FCRA when a health insurance company's laptops containing customers' sensitive personal information were stolen. Horizon , 846 F.3d at 629-30. Even though several plaintiffs in that case made no allegation that the information was then used to steal their identities, the Third Circuit held that they had standing because of the "unauthorized dissemination of their own private information-the very injury that FCRA is intended to prevent." Id. at 630, 640 (footnote omitted). This is consistent with D.C. Circuit precedent. The Owner-Operator Court expressly interpreted Horizon in support of the D.C. Circuit's rule, namely that "plaintiffs must show de facto injury even in the presence of a statutory violation." Owner-Operator , 879 F.3d at 344 (citing Horizon , 846 F.3d at 640 ). That de facto injury was readily observable in Horizon , much like Attias , where sensitive personal data had been obtained by a third party, substantially increasing the risk of identity theft. As the Court has discussed in this Memorandum Opinion, no risk of real harm is present in this case, unlike Attias and Horizon . Plaintiff makes no claim that anyone unauthorized has obtained or otherwise accessed her receipt, nor does she proffer any factual support for any particular risk that someone will do so.

One further argument deserves attention. Plaintiff urges that the inclusion of statutory damages in Title 15 means that Congress contemplated that Plaintiff could recover under the present circumstances. See Pl.'s Opp'n at 13-14 (citing 15 U.S.C. § 1681n ). Congress does appear to provide for statutory damages even where actual damages are not proven:

Any person who willfully fails to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer in an amount equal to the sum of--
(1)(A) any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000 ; or ...
(2) such amount of punitive damages as the court may allow; and
(3) in the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney's fees as determined by the court.

15 U.S.C. § 1681n(a) (emphasis added). But Plaintiff cannot escape her obligation to establish standing under Article III simply by pointing to the potential availability of relief on the merits. The Court has found under Attias that Plaintiff has not alleged a sufficiently imminent risk of harm such that she experienced a concrete injury in fact. Rather, in light of Owner-Operator , she has merely speculated as to a potential future injury. Only if Plaintiff had experienced a concrete injury in fact, even without any actual damage, could the Court proceed to consider Plaintiff's entitlement to statutory damages. "In a future case, the plaintiff may be able to show that a violation of the FACTA (or another provision of the FCRA) has caused [her] concrete harm," in which instance she "may still seek statutory damages if the actual damages are small or difficult to ascertain." Meyers v. Nicolet Rest. of De Pere, LLC , 843 F.3d 724, 729 n.5 (7th Cir. 2016). That case is not before this Court.

Because the Court shall dismiss this case on Rule 12(b)(1) grounds, the Court need not reach Defendant's Rule 12(b)(6) grounds. The Court relatedly denies Plaintiff's request for leave to amend the complaint. See Pl.'s Opp'n at 22-23. Plaintiff makes that proposal in the context of responding to Defendant's objection that she had not included a copy of the receipt with her Complaint, nor had she otherwise offered many details about the transaction. See Def.'s Mem. at 7; Pl.'s Opp'n at 22-23; Def.'s Reply at 11-12. But Plaintiff gives no indication that such details would remedy the lack of concrete harm that this Court has identified. See Pl.'s Opp'n at 23 (stating that amendment would "set forth allegations detailing the content of the receipts she has produced to Defendant as well as any other facts discussed herein that this Court deems beyond the scope of judicial notice"). Because such an amendment would not establish standing, amending the Complaint would be futile and is thus unwarranted. See Foman v. Davis , 371 U.S. 178, 182, 83 S.Ct. 227, 9 L.Ed.2d 222 (1962) (identifying futility among factors in decision whether to permit amendment).

IV. CONCLUSION

For all of the foregoing reasons, the Court finds that Plaintiff lacks standing under Article III to pursue the relief that she seeks in this case. The Court does not have subject-matter jurisdiction to proceed further. Accordingly, the Court shall GRANT Defendant's Motion to Dismiss contained in its [9] Notice of Motion and shall DISMISS this case.

An appropriate Order accompanies this Memorandum Opinion. 
      
      The Court's consideration has focused on the following pleadings:
      • Def.'s Mem. in Supp. of Mot. to Dismiss, ECF No. 9-1 ("Def.'s Mem.");
      • Pl.'s Mem. in Opp'n to Def.'s Mot. to Dismiss, ECF No. 14 ("Pl.'s Opp'n"); and
      • Def.'s Reply in Supp. of Mot. to Dismiss, ECF No. 15 ("Def.'s Reply").
     
      
      While the Complaint hedges by stating that "one or more" receipts were involved, Plaintiff's Opposition attaches two, which appear to derive from the same transaction. Compl., ECF No. 1, ¶ 37; Pl.'s Opp'n Ex. 1, ECF No. 14-1. For ease of discussion and consistency with the Complaint, the Court shall refer to a singular "receipt." However, the number of receipts is immaterial. The Court need not rely on this evidence outside of the Complaint in order to dispose of the pending motion.
     
      
      The receipt attached to Plaintiff's Opposition identifies the date of the transaction as September 5, 2015. Pl.'s Opp'n Ex. 1, ECF No. 14-1, at 5. The Court refers to the ECF page numbering of this document in the absence of other pagination. Again, however, the Court need not rely on this evidence external to the Complaint in light of allegations in the latter.
     
      
      A look at the receipt attached to Plaintiff's Opposition confirms that it lacks Plaintiff's name. Pl.'s Opp'n Ex. 1, ECF No. 14-1, at 5.
     
      
      The two drivers whose information was released to prospective employers were found to have suffered concrete harm for standing purposes. Owner-Operator , 879 F.3d at 345.
     