On September 30, 2015, in Galper v. JP Morgan Chase Bank, N.A., the US Court of Appeals for the Second Circuit reversed the US District Court for the Southern District of New York's judgment granting, on the basis of federal preemption, defendant JP Morgan Chase Bank, N.A.'s (Chase) motion to dismiss Galper's identity theft claims under New York’s Fair Credit Reporting Act (No. 14–0867–cv, (2d Cir. Sept. 30, 2015)). In vacating the district court's judgment, the Second Circuit ruled that Galper's complaint could be read to state a claim of Chase's vicarious liability for its employees' acts that is not preempted by the federal Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.).

The plaintiff consumer, Yelena Galper, brought suit against Chase in the district court, in which she alleged that she was the victim of an identity theft scheme perpetrated by Chase's employees and sought to hold Chase liable for this identity theft under the New York Fair Credit Reporting Act (N.Y. Gen. Bus. Law §§ 380-l, 380-s). This New York statute both:

Chase moved to dismiss Galper's claims, arguing that these claims were preempted by the federal Fair Credit Reporting Act (FCRA). The district court granted Chase's motion, ruling that Galper’s New York law claims were preempted by the FCRA, which expressly preempts state law claims for identity theft if they are "with respect to" subject matter regulated by a statute that "relat[es] to the responsibilities of persons who furnish information to consumer reporting agencies" (15 U.S.C. § 1681t(b)(1)(F)).

The Second Circuit vacated the lower court's judgment dismissing Galper's complaint, ruling that the FCRA does not preempt all of Galper’s claims under the New York law. Viewing the complaint in the light most favorable to Galper, the court noted that the allegations of the complaint plausibly give rise to claims of identity theft and aiding and abetting identity theft that are not preempted by the FCRA. These claims escape the reach of the FCRA's federal preemption provisions to the extent that they allege Chase’s vicarious liability for its employees’ theft of Galper’s identity, as distinct from any direct actions by Chase itself in providing information to consumer reporting agencies. Specifically, the complaint alleges that in participating in, aiding, abetting, and facilitating a money laundering scheme certain Chase employees acted within the scope of their employment and for the benefit and profit of Chase, and that Chase is therefore liable for the theft of Galper’s identity by its employees.

Turning to the statutory language, the court observed that the FCRA's preemption provisions:

(See 15 U.S.C. § 1681t(b)(1)(F).)

Viewing the allegations of the complaint in the light of the statute's plain language, the Second Circuit concluded that Galper's state law claims were outside the scope of the FCRA's preemption provisions because they were not "with respect to" Chase's responsibilities as a provider of credit information, but rather, concerned its liability for its employees' actions under a theory of respondeat superior. Addressing the merits of these state claims, the court reasoned that the identity theft Galper complained of could be actionable under the New York statute because it eventually resulted in the transmission to a consumer reporting agency of information about Galper that would otherwise not have been transmitted (citing N.Y. Gen. Bus. Law § 380-l). Noting that there is scant case law interpreting this state statute, the court construed its wording as not requiring that the defendant who is sued for identity theft be the party that actually furnishes damaging credit information to a consumer reporting agency. Therefore, Galper was not required to allege or prove that Chase was the party that provided this information to a consumer reporting agency because the law requires only that the theft have resulted in someone's ― anyone's — doing so.

The Second Circuit concluded, therefore, that because Chase could face vicarious liability under the New York law for its employees' theft of Galper’s identity without any later act of reporting adverse information about Galper to a consumer reporting agency, its identity theft claims both satisfied the requirements of the New York statute and escaped preemption under the FCRA.

The court therefore vacated the district court's judgment dismissing Galper's complaint and remanded the case for further proceedings in the district court.