The Supreme Court has just issued a major ruling that is a significant win for defendants in data privacy and data breach litigations.  In Ramirez v. TransUnion, the Supreme Court reconsidered the question of what constitutes an “injury in fact” under Article III, five years after its significant holding in Spokeo, Inc. v. Robins, 136 S. Ct. 1540.  In a ruling out this morning, the Supreme Court held that “[o]nly plaintiffs concretely harmed by a defendant’s statutory violation have Article III standing to seek damages against that private defendant in federal court.”  (emphasis added).  The Court reaffirmed that “Article III standing requires a concrete injury even in the context of a statutory violation” and it was not the case that “a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.”  As the Court today explained, “[a]n injury in law is not an injury in fact.”  (emphasis added).

As a reminder, any party wishing to sue in federal court must have Article III standing, which requires that a plaintiff is able to demonstrate: (1) an injury in fact; (2) the injury was caused by defendant’s conduct; and (3) the injury can likely be redressed by a favorable judicial decision. In Spokeo, the Supreme Court affirmed that a plaintiff cannot “allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III.”  Id. at 1549. An injury-in-fact sufficient for purposes of Article III standing must be “concrete and particularized.” Id. at 1548 (emphasis in original).

The question the Supreme Court considered in Ramirez was: “Whether either Article III or Rule 23 permits a damages class action where the vast majority of the class suffered no actual injury, let alone an injury anything like what the class representative suffered.” Plaintiff brought an action on behalf of himself and a class whose credit reports contained erroneous “terrorist alerts,” or designations that those persons were included on the Treasury Department’s Office of Foreign Assets Control (OFAC) list, a list of people who are barred from engaging in transactions in the United States. The Court’s opinion resolved a circuit split on whether increased risk of future harm could constitute an injury in fact sufficient to confer standing.

Justice Kavanaugh’s majority opinion held that the majority of the members in the class Ramirez sought to represent who never had a credit report disseminated to any third party, let alone suffered a denial of credit or other injury anything like what Ramirez himself experienced had not suffered a “concrete harm” sufficient for Article III. (“The credit files of the remaining 6,332 class members also contained misleading OFAC alerts, but the parties stipulated that TransUnion did not provide those plaintiffs’ credit information to any potential creditors during the designated class period. The mere existence of inaccurate information, absent dissemination, traditionally has not provided the basis for a lawsuit in American courts. The plaintiffs cannot demonstrate that the misleading information in the internal credit files itself constitutes a concrete harm.”) (emphasis added).

The Court also rejected another argument advanced by plaintiffs in support of standing “based on their exposure to the risk that the misleading information would be disseminated in
the future to third parties.”  Previously in Clapper v. Amnesty Int’l USA, the Court “recognized that material risk of future harm can satisfy the concrete-harm requirement in the context of a claim for injunctive relief to prevent the harm from occurring, at least so long as the risk of harm is sufficiently imminent and substantial.”  However, in this case, the Court agreed with TransUnion “that the mere risk of future harm, without more, cannot qualify as a concrete harm in a suit for damages.  The 6,332 plaintiffs did not demonstrate that the risk of future harm materialized.  Nor did those plaintiffs present evidence that the class members were independently harmed by their exposure to the risk itself.  The risk of future harm cannot supply the basis for their standing.” (emphasis added).

The decision is going to have a significant impact on data privacy litigations going forward, and the extent to which Plaintiffs alleged aggrieved by violations of various data privacy statutes have standing to sue in federal court. For more on that, stay tuned.  CPW will be providing a forthcoming comprehensive analysis of what it all means.