Galper v. JP Morgan Chase Bank, N.A.

This is a case about identity theft, and it requires us to consider the relationship between a New York state law providing remedies for victims of identity theft and the federal Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (FCRA). An identity theft occurs when someone misappropriates another person’s name or other personal information in order to engage in fraud or other crimes. Predictably enough, this criminal activity will often result in adverse alerts to credit reporting agencies and significant damage to the victim’s credit worthiness. Like many other states, New York has created by statute a private civil cause of action for victims of this crime to recover damages from identity thieves.1 See N.Y. Gen. Bus. L. §§ 380-1, 380-s.

Plaintiff Yelena Galper alleges that she was the victim of an identity theft scheme perpetrated by employees of defendant JP Morgan Chase Bank, N.A. (“Chase”), and she seeks to hold Chase liable for this identity theft under the New York Fair Credit Reporting Act. This state law creates a cause of action for a victim to sue any person who engages in identity theft if, in turn, the theft results in the transmission of certain information about the consumer to a consumer reporting agency a credit bureau). See id.

The question here is whether Gal-per’s lawsuit is preempted by the federal FCRA, which preempts state law claims for identity theft if they are “with respect to” subject matter regulated by 15 U.S.C. § 1681s-2, a statute that “relat[es] to the responsibilities of persons who furnish information to consumer reporting agencies.” 15 U.S.C. § 1681t(b)(l)(F). In its ruling on Chase’s motion to dismiss, the district court concluded that Galper’s claims under the New York law are preempted by the FCRA.

We conclude that the FCRA does not preempt all of Galper’s claims under the New York law. Viewed in the light' most favorable to plaintiff, the operative complaint advances claims of identity theft and aiding and abetting identity theft based on Chase’s vicarious liability for its employees’ theft of Galper’s identity, as distinct from any erroneous or otherwise wrongful actions by Chase in furnishing information to consumer reporting agencies. Such claims of identity theft are not “with respect to” the responsibilities of persons who furnish information- to consumer reporting agencies and are therefore not preempted by the FCRA. Because Gal-*442per’s complaint plausibly raises state law claims that are not preempted by federal law, we vacate the judgment of the district court and remand for further proceedings consistent with this decision.

Background

Galper’s amended complaint alleges the following facts, which we accept as true for purposes of reviewing the district court’s grant of Chase’s motion to dismiss. For about three years, various Chase bank employees allegedly aided and abetted the money laundering activities of certain persons who were engaged in a scheme to defraud the Medicare program. In return for cash bribes and other gratuities, these Chase employees assisted the money launderers in the fraudulent use of Galper’s name as a signatory for Chase accounts set up in the name of phony corporations. These accounts were used to deposit and pay out proceeds of the Medicare fraud scheme. With the approval and knowledge of complicit Chase employees, the members of the money laundering scheme also operated and controlled Galper’s previously dormant personal checking account, and they used an ATM card associated with that account. The Chase employees falsified Chase’s records to enable the members of the money laundering scheme to make withdrawals from these accounts in Galper’s name, including for extravagant luxury purchases. Galper was not aware of any of these transactions or money laundering activities.

This fraudulent activity benefitted Chase because it increased Chase’s business. Indeed, Galper alleges in her complaint that the Chase employees actually “acted within the scope of their employment and for the benefit and profit of Chase” when they “facilitate[d] the unlawful use of [her] identifying information.” Compl. ¶ 5.

During the course of the conspiracy, the members of the money laundering scheme frequently overdrew the various fraudulent accounts in Galper’s name, causing many bounced checks. The Government eventually discovered what was happening, and the fraudulent accounts were closed. Gal-per told investigators that she did not know anything about the activity, but she was arrested, indicted, and tried on charges of money laundering conspiracy. Eventually, after a seven-week trial, a jury acquitted Galper of all charges.

Galper sued Chase in New York state court, asserting claims for identity theft and aiding and abetting identity theft, both in violation of New York’s Fair Credit Reporting Act, N.Y. Gen. Bus. L. §§ 380-1 and 380-s. The New York law generally prohibits actual or attempted identity theft, defined in relevant part to include the knowing and intentional fraudulent use of something of value in the name of another person without that person’s consent.2 But not all identity theft is actionable under the New York law. The law authorizes a civil action only if the identity theft “resulted in the transmission or provision to a consumer reporting agency of information that would otherwise not have been transmitted or provided.” N.Y. Gen. Bus. L. § 380-1.3

*443According to Galper’s complaint, the bounced checks, the closed accounts, and the government investigation and prosecution of her resulted in adverse reports being made to certain consumer reporting agencies. The complaint does not specify who transmitted these adverse reports to the consumer reporting agencies. Instead, it alleges that the consumer reporting agencies that received adverse information about Galper in turn provided that information to various financial institutions. Galper was harmed when these financial institutions — including Chase — then caused legitimate accounts that Galper controlled to be closed and prevented her from opening new accounts.

Chase removed Galper’s action from New York state court to federal court and then moved for dismissal pursuant to Fed. R.Civ.P. 12(b)(6), contending in part that the federal FCRA preempted Galper’s claims for identity theft under the New York law. The district court agreed and granted Chase’s motion. See Galper v. JPMorgan Chase, N.A., No. 13 CIV. 3449, 2014 WL 1089061 (S.D.N.Y. Mar. 17, 2014). This timely appeal followed.

Discussion

We begin with an overview of the preemption principles that guide our consideration of Galper’s appeal. The Constitution’s Supremacy Clause provides that “the Laws of the United States ... shall be the supreme Law of the Land ... any Thing in the Constitution or Laws of any State to the Contrary notwithstanding.” U.S. Const, art. VI, cl. 2. It follows that Congress may preempt (or invalidate) a state law by means of a federal statute. It may preempt state law expressly or it may preempt state law implicitly in circumstances where it is clear that Congress intended to occupy the entire regulatory field, where state law stands as an obstacle to the objectives of Congress, or where compliance with both federal and state law is impossible. See Oneok, Inc. v. Learjet, Inc., — U.S. -, 135 S.Ct. 1591, 1595, 191 L.Ed.2d 511 (2015); Madden v. Midland Funding, LLC, 786 F.3d 246, 249 (2d Cir.2015).

For any preemption inquiry, the ultimate touchstone for our analysis is the intent of Congress. See Wyeth v. Levine, 555 U.S. 555, 565, 129 S.Ct. 1187, 173 L.Ed.2d 51 (2009). And in cases such as this one that involve a claim of express preemption, we focus on the plain wording of the statute, which is necessarily the best evidence of the scope of Congress’s preemptive intent. See Chamber of Commerce of United States v. Whiting, 563 U.S. 582, 131 S.Ct. 1968, 1977, 179 L.Ed.2d 1031 (2011). The structure and purpose of the federal statute is also a guide to Congress’s intent. See Ingersoll-Rand Co. v. McClendon, 498 U.S. 133, 138, 111 S.Ct. 478, 112 L.Ed.2d 474 (1990).

We review de novo the district court’s application of preemption principles. See Entergy Nuclear Vermont Yankee, LLC v. Shumlin, 733 F.3d 393, 408 (2d Cir.2013). We are also mindful of the procedural context in which we conduct this preemption inquiry. When considering a motion to dismiss pursuant to Rule 12(b)(6), the district court (as well as this Court) is required to accept as true the facts alleged in the complaint, consider those facts in the light most favorable to the plaintiff, and determine whether the complaint sets forth a plausible basis for relief. See Ashcroft v. Iqbal, 556 U.S. 662, *444678-80, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009); Tsirelman v. Daines, 794 F.3d 310, 312 (2d Cir.2015).

It follows that when considering a preemption argument in the context of a motion to dismiss, the factual allegations relevant to preemption must be viewed in the light most favorable to the plaintiff. A district court may find a claim preempted only if the facts alleged in the complaint do not plausibly give rise to a claim that is not preempted. See Darcangelo v. Verizon Commc’ns, Inc., 292 F.3d 181, 188-89 (4th Cir.2002); cf. King v. Am. Airlines, Inc., 284 F.3d 352, 356 (2d Cir.2002) (construing facts in light most favorable to non-moving party in preemption context for purposes of motion for judgment on the pleadings pursuant to Rule 12(c)).

With these general principles in mind, we now turn to the particular preemption argument raised in this case. The preemption provisions at issue here are part of the federal FCRA, a complex statute passed by Congress “to ensure fair and- accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy.” Safeco Ins. Co. of Am. v. Burr, 551 U.S. 47, 52, 127 S.Ct. 2201, 167 L.Ed.2d 1045 (2007). The FCRA was enacted in 1970 amidst concerns about the accuracy of information- disseminated by credit reporting agencies (known in the Act as “consumer reporting agencies”). See 15 U.S.C. § 1681. Congress’s purpose was “to require that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information” in accordance with law. Id. § 1681(b). Over the years, the FCRA has been subject to multiple amendments, including to impose regulatory requirements on actors other than consumer reporting agencies and also to help consumers and businesses combat identity theft.4 Significantly, the FCRA itself does not create a federal cause of action for victims against perpetrators of identity theft.

As relevant to this case, the FCRA’s applicable preemption provisions are somewhat intricate and require consideration of multiple cross-referencing statutory provisions. To begin with, Congress set forth a general rule that it did not wish the FCRA to preempt state laws concerning identity theft unless they were inconsistent with the FCRA. Thus, the FCRA provides in relevant part that it does “not annul, alter, affect, or exempt any person ... from complying with the laws of any State with respect to ... the prevention or mitigation of identity theft, except to the extent that those laws are inconsistent with any provision of [the Act], and then only to the extent of the inconsistency.” 15 U.S.C. § 1681t(a).

*445Congress, however, provided for certain exceptions to this general rule. See 15 U.S.C. § 1681t(b) (listing multiple exceptions). One of these exceptions provides in relevant part as follows: “No requirement or prohibition may be imposed under the-laws of any State — (1) with respect to any subject matter regulated under — ... (F) section 1681s-2 of this title, relating to the responsibilities of persons who furnish information to consumer reporting agencies. ...” 15 U.S.C. § 1681t(b)(l)(F).5

Section 1681s-2, in turn, details specific responsibilities and duties that are imposed on furnishers of informa-: tion to consumer reporting agencies, including that “[a] person shall not furnish any information relating to a consumer to any consumer reporting agency if the person knows or has reasonable cause to believe that the information is inaccurate.” 15 U.S.C. § 1681s-2(a)(l)(A). In addition, § 1681s — 2(a)(6) imposes duties on furnish-ers who receive notice of identity-theft related information, such as the duty to have reasonable procedures in place to respond to a notice of identity theft. See also Longman v. Wachovia Bank, N.A., 702 F.3d 148, 150-51 (2d Cir.2012) (per curiam) (discussing scope of § 1681s — 2); Chiang v. Verizon New England Inc., 595 F.3d 26, 35 (1st Cir.2010) (discussing enactment and purpose of § 1681s-2 to regulate duties of furnishers). Violations of these provisions under 15 U.S.C. § 1681s-2(a) — prohibiting a furnisher from reporting inaccurate information to a consumer report agency and requiring protective procedures for responding to notices of identity theft — are not enforceable by means of a federal or state cause of action for damages. See Longman, 702 F.3d at 151 (citing 15 U.S.C. §§ 1681s-2(a)(l) & 1681s-2(d)).6

Chase does not contend that the New York law is inconsistent with the FCRA, such that it is preempted by the FCRA’s general provision that preserves state identity theft laws to the extent that they are not inconsistent with the FCRA. See 15 U.S.C. § 1681t(a). Instead, Chase more narrowly contends — and the district court agreed — that plaintiff’s claims under the New York law fall within the scope of the express exception to non-preemption that is set forth in § 1681t(b)(l)(F).

We do not think that the federal preemption provision supports this broad contention. As with any preemption provision, we construe § 1681t(b)(l)(F) fairly but narrowly, mindful in the appropriate case that “each phrase within [the provision] limits the universe of [state action] pre-empted by the statute.” See Lorillard Tobacco Co. v. Reilly, 533 U.S. 525, 551, 121 S.Ct. 2404, 150 L.Ed.2d 532 (2001) (alterations in original) (quoting Cipollone v. Liggett Grp., Inc., 505 U.S. 504, 524, 112 5.Ct. 2608, 120 L.Ed.2d 407 (1992)). Here, the language of the provision expresses Congress’s intent to preempt claims which are “with respect to any subject matter regulated under ... section 1681s-2 of this title, relating to the 'responsibilities of persons who furnish information to consumer reporting agencies.” 15 U.S.C. § 1681t(b)(l)(F). This provision, there*446fore, must be read to preempt only those claims against furnishers that are “with respect to” the subject matter regulated under § 1681s-2.

What does the phrase “with respect to” mean in this context? In a recent case involving the preemptive scope of a provision in the Federal Aviation Administration Authorization Act (“FAAAA”), the Supreme Court suggested that a claim is “with respect to” a preempted subject matter when it concerns that subject matter. See Dan’s City Used Cars, Inc. v. Pelkey, — U.S. -, 133 S.Ct. 1769, 1778-79, 185 L.Ed.2d 909 (2013) (stating that FAAAA provision preempting state laws “with respect to [a motor carrier’s] transportation of property” preempts those laws that “concern a motor carrier’s ‘transportation of property’” (quoting 49 U.S.C. § 14501(c)(1))). While the preemption provision at issue here arises in a different federal statute, “we discern no basis for concluding that the meaning of the language in each provision was not intended to be the same.” Metro. Taxicab Bd. of Trade v. City of New York, 615 F.3d 152, 157 (2d Cir.2010) (finding that the phrase “relate[s] to” had the same meaning when used in separate preemption provisions).

Accordingly, we hold that § 1681t(b)(l)(F) preempts only those claims that concern a furnisher’s responsibilities. Put differently, § 1681t(b)(l)(F) does not preempt state law claims against a defendant who happens to be a furnisher of information to a consumer reporting agency within the meaning of the FCRA if the claims against the defendant do not also concern that defendant’s legal responsibilities as a furnisher of information under the FCRA.

The question, then, is this: do Galper’s claims against Chase concern Chase’s responsibilities as a furnisher of information under the FCRA? We. conclude that, when viewed in the light most favorable to Galper, the complaint plausibly alleges identity theft claims that do not concern Chase’s responsibilities as a fur-nisher. Instead, the complaint advances a theory that Chase is vicariously liable— presumably under a respondeat superior theory — for the identity theft allegedly perpetrated by its employees. See Compl. ¶ 5 (alleging that “[i]n participating in, aiding, abetting, and facilitating the Money Laundering Scheme ... [the] Chase employees acted within the scope of their employment and for the benefit and profit of Chase,” and that Chase is therefore “liable for the theft of Galper’s identity perpetrated by” its employees).7

And this theft could be actionable under the New York statute because it eventually resulted in an alert by someone to consumer reporting agencies. The New York law requires only that the theft have “resulted in the transmission or provision to a consumer reporting agency of information that would otherwise not have been transmitted or provided.” N.Y. Gen. Bus. L. § 380-1 (emphasis added). There is scant case law interpreting the New York law, but — as we understand the wording of *447the statute — it does not matter if the defendant who is sued for identity theft is also the furnisher of information to a consumer reporting agency.

Indeed, Galper’s complaint does not specify who eventually reported adverse information about Galper to consumer reporting agencies. Whether it was Chase— or government investigators or another bank or some other person or entity — that eventually reported the adverse information to consumer reporting agencies is irrelevant because the law requires only that the theft have resulted in the transmission of the information by someone to a consumer reporting agency. Nor does the New York law require any showing that the transmission of information to a consumer reporting agency was proper or improper, and Galper’s complaint does not make any explicit allegations concerning the propriety or impropriety of the transmission here.

In short, Chase could face vicarious liability under the New York law for its employees’ theft of Galper’s identity, not for any later act by Chase or anyone else — proper or improper — -of reporting adverse information about Galper to a consumer reporting agency. Under this theory of the complaint, it cannot be said that all of Galper’s claims against Chase concern or are “with respect to any subject matter regulated under ... section 1681s-2 of this title, relating to the responsibilities of persons who furnish information to consumer reporting agencies.” 15 U.S.C. § 1681t(b)(l)(F).

We are not persuaded by Chase’s argument that § 1681t(b)(l)(F) preempts all claims “relating to the responsibilities” of furnishers in any way, and regardless of the capacity in which the furnisher is acting. This broad argument overlooks the language of the statute. In this statutory context, the phrase “relating to” is not used to describe the scope of preemption. Instead, the phrase exists as a shorthand reference to describe the subject matter governed by § 1681s-2.8 If Congress had intended to preempt claims that relate in any way to someone furnishing information to a consumer reporting agency, it could easily have drafted the statute to say that state laws “relating to the furnishing of information to consumer reporting agencies are preempted.”

But this it did not do. Congress opted instead to use language that focuses more narrowly on the preemption of laws that regulate the responsibilities of persons who furnish information to consumer reporting agencies. Cf. Macpherson v. JPMorgan Chase Bank, N.A., 665 F.3d 45, 47-48 (2d Cir.2011) (per curiam) (conclud*448ing that § 1681t(b)(l)(F) preempted state common law claims for defamation and intentional infliction of emotional distress that were based on allegations that the defendant willfully and maliciously provided false information about plaintiffs finances to ■ a consumer reporting agency).

Although we do not find the text of § 1681t(b)(l)(F) to be ambiguous, we would interpret the statute in the same manner if it were. That is “[bjecause the States are independent sovereigns in our federal system,” and we “assum[e] that the historic police powers of the States were not to be superseded by the Federal Act unless that was the clear and manifest purpose of Congress.” CTS Corp. v. Waldburger, — U.S. -, 134 S.Ct. 2175, 2188, 189 L.Ed.2d 62 (2014) (quoting Medtronic, Inc. v. Lohr, 518 U.S. 470, 485, 116 S.Ct. 2240, 135 L.Ed.2d 700 (1996)). “In our federal system, there is no question that States possess the traditional authority to provide tort remedies to their citizens as they see fit.” Id. at 2189 (quoting Wos v. E.M.A., — U.S. -, 133 S.Ct. 1391, 1400, 185 L.Ed.2d 471 (2013)).

It follows — as the Supreme Court has made clear — that “we ‘presume federal statutes do not ... preempt state law.’ ” Eades v. Kennedy, PC Law Offices, 799 F.3d 161, 171 (2d Cir.2015) (quoting Bond v. United States, — U.S. -, 134 S.Ct. 2077, 2088, 189 L.Ed.2d 1 (2014)). This means that “when the text of a preemption clause is susceptible of more than one plausible reading, courts ordinarily accept the reading that disfavors pre-emption.” CTS Corp., 134 S.Ct. at 2188 (quoting Altria Grp., Inc. v. Good, 555 U.S. 70, 77, 129 S.Ct. 538, 172 L.Ed.2d 398 (2008)). And so we do here.

Our interpretation also avoids consequences that Congress could not plausibly have intended. Suppose, for example, that professional identity thieves had fraudulently opened accounts in Galper’s name at an unwitting bank and that, once the bank learned of checks bouncing and other irregularities with the account, the bank reported these irregularities to a credit reporting agency. Under the district court’s broad interpretation of the preemptive scope of the FCRA, Galper could not sue the professional identity thieves under the New York law; her state law remedy against the thieves would be preempted by the FCRA solely because her cause of action depended upon a showing that some third party like a bank eventually transmitted information to a consumer reporting agency. That is contrary to what Congress plausibly intended when it sought to preserve state law remedies for identity theft. Nor is there any indication that Congress would have intended that the result be any different where a victim of identity theft seeks to hold an employer vicariously liable for its employees’ identity theft.

All that said, we do not conclude that § 1681t(b)(l)(F) is altogether inapplicable to this case in view of the somewhat confusing nature of the complaint. While the theory of liability we have set forth above strikes us as the most natural reading of Galper’s complaint, there are other possible interpretations. After all, the paragraphs of the complaint setting forth the identity theft claims (¶¶ 29-36) do not actually mention the concept of vicarious liability or respondeat superior, and they could arguably be read to include the theory that Chase is liable for damages (at least in part) because it furnished false information. To the extent that such claims would even be viable under the New York law, they are. preempted under the FCRA because they plainly concern Chase’s legal responsibilities as a furnish-er.

And in her “prayer for relief,” Galper seeks punitive damages to “punish *449Chase for its wanton, reckless, and malicious acts.” Compl., Prayer for Relief ¶ B. Galper cannot base any punitive damages recovery on wrongdoing that Chase may have committed when furnishing information to consumer reporting agencies. This is so because § 1681t(b)(l)(F) preempts any recovery for damages based on allegations of erroneous or otherwise improper furnishing — regardless of the particular statute or common law theory that plaintiff utilizes to advance her claim. See Macpherson, 665 F.3d at 47-48.

Conclusion

To summarize: we hold that 15 U.S.C. § 1681t(b)(l)(F) preempts only those claims that concern a defendant’s responsibilities as a furnisher of information under the FCRA. Viewed in the light most favorable to Galper, the complaint advances claims against Chase for identity theft under N.Y. Gen. Bus. L. §§ 380-1 and 380-s based on acts of identity theft perpetrated by Chase employees, as distinct from any erroneous or otherwise wrongful actions by Chase in furnishing information to consumer reporting agencies. These identity theft claims are not preempted because they do not concern Chase’s responsibilities as a furnisher. To the extent that Galper’s complaint seeks relief based on Chase’s erroneous or otherwise improper furnishing of information to consumer reporting agencies, those claims are preempted.

The district court’s judgment is VACATED and this case is REMANDED for further proceedings consistent with this decision.