The right of plaintiffs to sue for technical violations of the Fair Credit Reporting Act (FCRA) and other federal privacy laws has been the subject of much class litigation in recent years. The U.S. Supreme Court addressed this increasingly salient issue in Spokeo, Inc. v. Robins, 578 U. S. 330 (2016). “‘Article III standing requires a concrete injury even in the context of a statutory violation,’” the Spokeo Court explained.

Now, the Court has held in a sharply divided 5-4 decision that consumers whose inaccurate credit files were released to third parties by a credit reporting agency suffered a concrete reputational injury and, therefore, had standing to bring claims that the credit reporting agency failed to ensure the accuracy of its credit records. TransUnion LLC v. Ramirez, No. 20-297 (June 25, 2021). However, consumers whose inaccurate credit reports were not disseminated to third parties did not suffer cognizable harm and lacked standing to sue.

Background

TransUnion’s “OFAC Name Screen Alert” informed credit providers if a consumer’s name matched a name on a list of individuals deemed a national security risk by the Treasury Department’s Office of Foreign Assets Control (OFAC). The OFAC list identifies drug traffickers, terrorists, and persons engaged in other serious crimes. A match results in an alert placed on the consumer’s credit report indicating a “potential match.”

Plaintiff Sergio Ramirez attempted to purchase a car from a dealership in 2011. After he applied for credit, the dealership submitted Ramirez’s credit information to TransUnion and learned that Ramirez was a “potential match” on the OFAC list. Ramirez’s wife ultimately purchased the car in his name.

When Ramirez requested a copy of his credit file from TransUnion, TransUnion sent him two letters: the first contained his credit file without mention of the OFAC designation and the summary of rights required by law. The second, which arrived the next day, provided information that he was on the OFAC list, but did not contain the summary of rights letter.

Ramirez brought suit on behalf of himself and all other individuals (a class of 8,185 consumers) who had the OFAC designation on their credit file, whether or not the file was disseminated to any third parties. The class alleged three violations: (1) TransUnion failed to use reasonable procedures to ensure the accuracy of their credit reports; (2) the first correspondence Ramirez received did not contain all the information in his file; and (3) the second correspondence did not contain a summary of rights.

The parties stipulated in the lower court that 1,853 class members had inaccurate credit information that was sent to third parties and the remaining 6,332 members did not have their inaccurate credit reports released to potential creditors. After a six-day trial, the jury returned a verdict for the plaintiffs and awarded each member statutory and punitive damages for a total of $60 million, which the U.S. Court of Appeals for the Ninth Circuit reduced to $40 million.

The Ninth Circuit rejected TransUnion’s arguments that the class members who did not have information disseminated to third parties lacked standing. It noted that the “reckless handling of OFAC information exposed every class member to a real risk of harm to their concrete privacy, reputational, and informational interests protected by the FCRA.” It also rejected TransUnion’s contention that the entire class lacked standing to assert bare statutory violations related to the form of the disclosures.

Article III Standing Requirement

The Supreme Court ruled that only individuals whose inaccurate credit information was disseminated to third parties suffered concrete injury and, thus, had Article III standing to seek damages. The remaining class members lacked standing because, although TransUnion may have violated a statutory requirement to ensure it follow reasonable procedures to assure maximum accuracy, that violation did not harm the 6,332 class members who stipulated that their reports were never published to any third party. The risk of publication was not sufficient, the Court stressed.

Justice Brett Kavanaugh authored the majority opinion. He was joined by Chief Justice John Roberts and Associate Justices Samuel Alito, Neil Gorsuch, and Amy Coney Barrett.

Justice Kavanaugh relied heavily on the constitutional underpinnings of standing and the rationale behind the requirement that a plaintiff’s injury be “concrete,” especially where the harm allegedly suffered is “intangible.” He observed that, for purposes of Article III standing:

an important difference exists between (i) a plaintiff’s statutory cause of action to sue a defendant over the defendant’s violation of federal law, and (ii) a plaintiff’s suffering concrete harm because of the defendant’s violation of federal law. Congress may enact legal prohibitions and obligations. And Congress may create causes of action for plaintiffs to sue defendants who violate those legal prohibitions or obligations. But under Article III, an injury in law is not an injury in fact. Only those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court.

The burden is on the plaintiff to establish standing, the Court stated, “for each claim that they press and for each form of relief that they seek (for example, injunctive relief and damages).”

What Is a Concrete Injury?

“‘If inaccurate information falls into’ a consumer’s credit file, ‘does it make a sound?’” Justice Kavanaugh asked, citing an opinion of the District of Columbia Circuit Court applying Spokeo. The D.C. Circuit answered “no,” and the Supreme Court endorsed that answer here, explaining: “The mere presence of an inaccuracy in an internal credit file, if it is not disclosed to a third party, causes no concrete harm.”

But what about the risk of future harm? The plaintiffs whose credit files had not been disseminated argued that the inaccurate and defamatory alerts on their credit reports might yet be released to a third party. The Court majority suggested that the proper approach would be to cross that injury bridge when they get to it. At any rate, the plaintiffs failed to show, as a factual matter, that a sufficient risk of future harm existed, at least for purposes of standing. In fact, the Court pointed out, there was no evidence these plaintiffs even know about the OFAC alerts in their credit files. “It is difficult to see how a risk of future harm could supply the basis for a plaintiff’s standing when the plaintiff did not even know that there was a risk of future harm,” the Court noted. The Court found it ironic that of some class members first learned about the OFAC designation upon receipt of an award check.

The majority opinion also addressed claims that the forms of the disclosures were not compliant, a claim many employers face in expensive and burdensome class actions. The plaintiffs alleged that, although they received the information requested, they did not receive it in the proper form. They alleged that the mailings were “formatted incorrectly” and “deprived them of their right to receive information in the format required by statute.” Justice Kavanaugh concluded, “[T]he plaintiffs have not demonstrated that the format of TransUnion’s mailings caused them a harm with a close relationship to a harm traditionally recognized as providing a basis for a lawsuit in American Courts.” Ramirez had not presented any evidence at trial that any of the class members even opened the mailings, were confused, or relied on the information at all, the Court noted. If there was no evidence of harm, there would be no standing and a “bare procedural violation” without more would not suffice to establish Article III standing under the Constitution.

“No concrete harm, no standing,” the Court majority emphatically concluded. Because only 1,853 members of the 8,185-member class had standing to sue for damages, the Court reversed the Ninth Circuit decision affirming a district court’s order allowing the entire class to proceed with their FCRA claims and had condoned a (trimmed-down) $40 million class damages award.

Dissenting opinions

Dissenting, Justice Clarence Thomas (joined by Justices Stephen Breyer, Elena Kagan, and Sonia Sotomayor) argued that each class member “established a violation of his or her private rights” and “suffered a sufficient injury to sue in federal court.” The majority’s “no concrete harm, no standing” takeaway was a “pithy catchphrase,” he said, but he wondered why “concrete” injury was the only inquiry that mattered. He noted that, historically, injury in fact merely served “as an additional way to get into federal court.” Injury in fact “has now displaced the traditional gateway into federal courts,” Thomas lamented, adding: “Never before has this Court declared that legal injury is inherently insufficient to support standing.”

Justice Kagan (joined by Justices Breyer and Sotomayor) challenged the majority’s conclusion that the risk to the remaining class members was “too speculative” to confer Article III standing. “[W]hy is it so speculative that a company in the business of selling credit reports to third parties will in fact sell a credit report to a third party?” In her view, the Court’s decision “definitively proves [that] Congress is better suited than courts to determine when something causes a harm or risk of harm in the real world. For that reason, courts should give deference to those congressional judgments. Overriding an authorization to sue is appropriate when but only when Congress could not reasonably have thought that a suit will contribute to compensating or preventing the harm at issue.”

The sharply divided decision reflects that the contours of “concrete harm” and Article III standing continue to spark disagreement and will be the source of ongoing Supreme Court scrutiny.

Court Punts on Critical Class Action Question

In general, a plaintiff need not prove that all putative class members have standing in order to move for certification under Rule 23 of the Federal Rules of Civil Procedure. TransUnion argued in the case below that most of the class certified by the district court did not have standing. The district court and the Ninth Circuit had concluded that the named plaintiff’s claims were typical of the class members’ claims for purposes of Rule 23 and that standing of the class was not required at the class certification stage and could be met at trial.

In its petition for review, TransUnion urged the Supreme Court to address an important question related to class certification:

Whether either Article III or Rule 23 permits a damages class action where the vast majority of the class suffered no actual injury, let alone an injury anything like what the class representative suffered.

While the Supreme Court ruled that every class member must show standing to recover individual damages in federal court, Justice Kavanagh punted the question of whether Article III standing was required at the class certification stage.

Takeaway

A statutory violation, without more, will not allow an individual entrance to federal court. TransUnion should strengthen arguments regarding standing in certain employment cases and class actions. In recent years, many employment class actions have been premised on technical statutory violations. Examples include actions alleging defective FCRA notices issued when conducting preemployment background checks, defective COBRA election notices, and violations of state privacy laws. Employers defending such actions may be able to show that some or all of the employees alleging these mere technical violations have not suffered any concrete harm and, therefore, their claims should be dismissed.

However, many questions remain, including whether a plaintiff must establish standing of the putative class at the class certification stage and what evidence will suffice to transform a “bare procedural violation of the statute” into a concrete injury.