The Court of Appeals for the Third Circuit has reversed the dismissal of a Fair Debt Collection Practices Act case, ruling that the disclosure of an individual’s Internal Reference Number — which included the first 10 characters of the individual’s street address — is sufficient for the individual to have suffered a concrete injury and have standing to sue in federal court.
A copy of the unpublished opinion in the case of Morales v. Healthcare Recovery Revenue Group can be accessed by clicking here.
The plaintiff received a collection letter from the defendant. On the outside of the envelope was a barcode, which, when scanned revealed an Internal Reference Number that included the first 10 characters of the plaintiff’s street address. The plaintiff filed suit, alleging the disclosure violated Section 1692f(8) of the FDCPA, which prohibits the use of any language or symbol, other than the debt collector’s address on an envelope. So the mere placement of the barcode was enough to constitute a violation of the FDCPA. But the District Court judge ruled that the inclusion of the barcode on the envelope did not reveal enough protected information to rise to the level of a concrete injury, because multiple individuals could share the same Internal Reference Number.
The defendant argued it used the barcode when scanning mail that had been returned as undeliverable, in order to confirm that it could no longer reach the individual at that address. But because the IRN could be used — with a second piece of information, such as a birthdate or email address — to gain access to an individual’s account, the barcode was capable of identifying the plaintiff as a debtor. The defendant also argued that the IRN was not an account number, that the plaintiff did not know how to use the IRN to unlock personal information, and that there was no material risk of harm, but the panel of Third Circuit judges saw it differently.
“Account numbers are but one type of protected information,” the panel wrote in its ruling. “And Morales did not need to know how to use IRNs to access accounts. Nor did he need to show an increased risk of harm. Just as disclosing the “meaningless string of numbers and letters” in Douglass was a concrete harm, so too here.”
