On June 25, 2021, the Supreme Court issued a landmark decision in TransUnion v. Ramirez. The Court ruled that class members whose inaccurate credit reports were not shared with third parties lacked standing to sue TransUnion for violating certain provisions of the Fair Credit Reporting Act (FCRA). In contrast, the Court found the class members whose inaccurate credit reports had been shared with third parties did have standing.

Justice Kavanaugh wrote for the 5-4 majority, including Justices Roberts, Alito, Gorsuch and Barrett. This outcome tracks Justice Kavanaugh’s questioning at oral argument. “I think you have a good argument with respect to the 1,853 [class members whose credit reports were disseminated] in terms of the reasonable procedures, but I’m more concerned about the 6,332, whose information was not, in essence, published,” he said to Ramirez’s counsel, Samuel Issacharoff. 

This ruling expands on the rule set out in Spokeo v. Robins. In Spokeo, the Court held that a procedural violation alone could not establish standing for a suit for statutory privacy claims. The Court said that plaintiffs must allege some “concrete” harm, such as monetary losses or reputational damage. But the Court gave lower courts little guidance on what meets the “concreteness” standard, leading to an inconsistent application by lower courts in deciding what plaintiffs must allege to show standing in suits for violation of statutes such as the FCRA, Telephone Consumer Protection Act (TCPA), and state privacy claims, as well as in class action suits arising from consumer data breaches.

In Ramirez, the Court has resolved much of this uncertainty, clarifying that to satisfy the “concreteness” test, plaintiffs must allege they were “personally harmed” by the conduct. The Court reasoned that “if the law of Article III did not require plaintiffs to demonstrate a ‘concrete harm,’ Congress could authorize virtually any citizen to bring a statutory damages suit against virtually any defendant who violated virtually any federal law.” Justice Kavanaugh analogized to illustrate the Court’s holding

"Suppose first that a Maine citizen’s land is polluted by a nearby factory. She sues the company, alleging that it violated a federal environmental law and damaged her property. Suppose also that a second plaintiff in Hawaii files a federal lawsuit alleging that the same company in Maine violated that same environmental law by polluting land in Maine. The violation did not personally harm the plaintiff in Hawaii. Even if Congress affords both hypothetical plaintiffs a cause of action (with statutory damages available) to sue over the defendant’s legal violation, Article III standing doctrine sharply distinguishes between those two scenarios. The first lawsuit may of course proceed in federal court because the plaintiff has suffered concrete harm to her property. But the second lawsuit may not proceed because that plaintiff has not suffered any physical, monetary, or cognizable intangible harm traditionally recognized as providing a basis for a lawsuit in American courts."

The Court also clarified that allegations of a risk of future harm are insufficient to support standing for a claim seeking damages (unlike injunctive relief to prevent the harm from occurring). Justice Kavanaugh alluded to a person driving home a quarter mile ahead of a reckless driver but who never personally encounters the reckless driver. The person was at risk of harm, but that harm never actually occurred. This aspect of the Court’s ruling is likely to significantly impact consumer data breach cases in which plaintiffs allege their data was exposed but do not allege the data was used improperly. But the Court left a definitive answer on the standing question in such cases for another day, expressly leaving open whether emotional distress or psychological harm resulting from a risk of future injury is a “concrete harm” for standing purposes. 

The decision is also likely to lead to narrower class definitions in class actions, as potential class members who were not “personally harmed” will lack Article III standing. It may also lead to more suits for statutory and privacy violations being filed in state courts, which often have less stringent requirements for standing than Article III’s requirements for federal courts. But even in state courts, arguments that plaintiffs were not “personally harmed” or that plaintiffs allege only a risk of future harm may be persuasive. 

Because the Court found the class members here lacked standing, it did not reach the typicality questions posed by the parties and discussed at oral argument. 

Justice Thomas filed a dissenting opinion, joined by Justices Breyer, Sotomayor and Kagan. Justice Kagan also filed a dissenting opinion in which Justices Breyer and Sotomayor joined.