On June 25, 2021, the Supreme Court issued its much-anticipated 5-4 ruling in TransUnion LLC v. Ramirez. In a 27-page decision by Justice Kavanaugh, the Court reversed the Ninth Circuit’s decision upholding the certification of a class of 8,185 consumers whom the credit reporting agency TransUnion had  mistakenly labeled as potential terrorists and drug traffickers. Of this consumer class, only 1,853 class members’ misleading credit reports had been provided to third-parties. The District Court had ruled that all class members had Article III standing to pursue their Fair Credit Reporting Act (FCRA) claims against TransUnion to recover statutory damages. A federal jury awarded the class $8.1 million in statutory damages and $52 million in punitive damages. On appeal, TransUnion challenged the award on the basis that the entire class lacked constitutional standing to recover. A divided panel of the Ninth Circuit affirmed in part.

The Court’s Decision

Taking up the question, the Court clarified its prior holdings concerning the concrete harm that is required to establish Article III standing. Article III defines the scope of constitutional power of federal courts to hear “cases and controversies” in which a plaintiff has a “personal stake.” To fall within the ambit of the federal courts’ constitutional authority, plaintiffs must show they have suffered a concrete injury in fact. See Lujan v. Defenders of Wildlife, 504 U. S. 555, 560–561 (1992). In its recent and often-discussed ruling also concerning the FCRA, Spokeo, Inc. v. Robins, the Court noted that “Article III standing requires a concrete injury even in the context of a statutory violation,” and the concrete harm must be one “traditionally” recognized as providing a basis for a lawsuit in American courts. 578 U. S. 330, 340 (2016). Physical or monetary harms readily qualify as concrete injuries under Article III, and intangible harms—like reputational harms—can also be concrete.

Examining the facts of the case at hand, the Court noted that the mere existence of inaccurate information, absent dissemination, traditionally has not provided the basis for recovery in American courts. However, the Court concluded, the 1,853 class members whose inaccurate credit reports were provided to third-parties suffered a harm that was akin to the harm suffered by victims of the traditional tort of defamation. The Court had “no trouble” concluding that these 1,853 class members suffered “a concrete harm that qualifies as an injury in fact” when they were labeled as terrorists in information TransUnion provided to third parties.

However, the Court also concluded that the 6,332 plaintiffs whose reports were not provided to third-parties could not demonstrate concrete harm. The Court acknowledged the risk of dissemination could satisfy the concrete-harm requirement in the context of a claim for injunctive relief to prevent release when the risk is imminent and substantial. See Spokeo, 578 U. S., at 341–342 (citing Clapper v. Amnesty Int’l USA, 568 U. S. 398 (2013)). But the Court was persuaded by TransUnion that the mere risk of future harm, without more, could not qualify for standing in a suit for damages. The Court also rejected arguments that the entire class had standing to assert claims that TransUnion’s mailings were formatted incorrectly and thus violated applicable law, because only lead plaintiff Ramirez was shown to have even opened the mailings, much less to have suffered concrete harm as a result.

The Dissenting Opinions

Justices Breyer, Sotomayor, and Kagan joined Justice Thomas in a dissent that criticized the majority for depriving consumers of a remedy that Congress expressly provided to them. (If Justice Ginsburg were still with us today, this dissent might well have been the majority opinion.) Justice Thomas disputed the majority view that violation of a statutory right could not in and of itself inflict a concrete harm, whether by current or traditional standards. He wrote, “[t]he principle that the violation of an individual right gives rise to an actionable harm was widespread at the founding, in early American history, and in many modern cases.” Invoking an 1813 opinion of Justice Story, Justice Thomas countered that “’[W]here the law gives an action for a particular act, the doing of that act imports of itself a damage to the party’ because ‘[e]very violation of a right imports some damage.’” Whittemore v. Cutter. The three dissenting Justices indicate they would have joined Justice Thomas to hold that “injury in law to a private right was enough to create a case or controversy.” Justice Kagan wrote a short additional dissent, joined by Justice Breyer and Sotomayor, to emphasize the risk of harm to the class members with inaccurate credit reports that had not been communicated to third parties. She also criticized the majority’s holding as one that “transforms standing law from a doctrine of judicial modesty into a tool of judicial aggrandizement” by denying a specific class of plaintiffs their right to bring a suit that was directly provided by Congress, a body that is “better suited than courts to determine when something causes a harm or risk of harm in the real world.”

The Impact

This case parsed critical questions that will shape the future of class action litigation because, as major technology companies who submitted amicus briefs argued, privacy and informational rights lawsuits have proliferated in recent years and tested the bounds of what may constitute concrete harm. The amici urged the Court to clarify that a statutory violation or informational injury alone could not establish standing without a demonstration that concrete, cognizable harm to the class has already occurred, and the Court obliged. Data breach lawsuits are often premised on the imminent risk of identity theft or other potential future or intangible harm, and thus the Court’s decision may well limit the ability of data breach victims to assert similar claims in federal court. Plaintiffs will likely respond by reframing their suits as redressing a concrete harm that has already transpired, describing intangible harm as related to a traditionally recognized injury, or seeking injunctive relief to prevent imminent future harm. These plaintiffs and their counsel may also turn to state law remedies in state courts as an alternative to grappling with standing challenges based on the TransUnion ruling in federal court.  This decision may also affect any federal data breach legislation, if such legislation is enacted and provides a private right of action, and result in state legislatures and courts continuing to lead in the development of privacy law in this country, filling the void left by Congress and the federal courts.

In his closing paragraph of the majority opinion, Justice Kavanaugh distilled centuries of Article III jurisprudence into five words: “No concrete harm, no standing.” This decision will not end the growing number of disputes concerning constitutional standing in the federal courts, but it will stand as an obstacle to those who would advocate for expanding our understanding of concrete harm, especially to the substantial risk of imminent future harm. One key debate that we know will survive this opinion concerns whether every class member must demonstrate standing before a court certifies a class, which the majority stated in a footnote it was not addressing. A second ongoing debate is the question of whether a punitive damages award may exceed already substantial statutory damages and actual proven injury by an order of magnitude without violating due process. TransUnion raised this question in its certiorari petition, but the Court granted the petition on the standing issue alone. Thus, both questions survive for another day. The majority and dissenting opinions reveal the central fault line in the modern debate over Article III standing. These are sharp divisions that, given the narrow 5-4 ruling, are far from resolution and will continue to reverberate in federal courts for years to come.