Overview
On June 25, 2021, the U.S. Supreme Court decided TransUnion v. Ramirez, which held that even when a statute has been violated, and that statute provided a private right of action, plaintiffs still need a concrete injury in fact to have standing to bring a lawsuit in federal court. In this case, the statutory framework at issue is the Fair Credit Reporting Act (FCRA). Though this case arises in the context of the FCRA, its outcome is likely to have a sweeping impact on many areas of class action litigation where the concreteness of injury is at issue, such as data breach litigation.
Background
In 2002, TransUnion began offering a product that screened individuals' names against the U.S. Department of Treasury's Office of Foreign Assets Control database (OFAC list), which tracks known terrorists, drug traffickers, and others who pose a threat to national security. It is generally unlawful to do business with those on the list.1 When TransUnion's product found a matching first and last name, it would automatically add an alert to individuals' credit files, yielding many false positives. "Thousands of law-abiding Americans happen to share a first and last name with one of the terrorists, drug traffickers, or serious criminals on OFAC's list."2 In 2011, Sergio Ramirez was among those affected when a dealership refused to sell him a car. When he requested his credit file from TransUnion, the company first mailed him his file and a summary of rights, but no information on the OFAC alert. TransUnion then sent a second mailing about the OFAC alert but did not include a summary of rights.
Mr. Ramirez brought a class action lawsuit against TransUnion seeking statutory and punitive damages, alleging three violations of the FCRA: 1) TransUnion, in deploying the OFAC screening product, failed to follow reasonable procedures to ensure the accuracy of his credit file;3 2) TransUnion failed to provide all of the information in his credit file;4 and 3) TransUnion failed to provide a summary of rights "with each written disclosure."5 Of the 8,185 class members who had misleading credit files, Mr. Ramirez was the only one to be refused credit because of the OFAC alert. He, along with 1,852 class members had his credit report disclosed to third parties while the remaining 6,332 did not. All class members received similar mailings.
At trial, TransUnion opposed class certification on the basis of standing, but the U.S. District Court for the Northern District of California certified the class and the jury returned a verdict awarding around $60 million in statutory and punitive damages to the class. On appeal, the U.S. Court of Appeals for the Ninth Circuit affirmed, but reduced punitive damages, bringing the overall award to around $40 million. The Supreme Court granted certiorari on the issue of standing to answer whether "either Article III or Rule 23 permits a damages class action where the vast majority of the class suffered no actual injury, let alone an injury anything like what the class representative suffered."6
Opinion
On the reasonable procedures claim, the Court held that only class members who had their information disclosed to third parties had standing. As to the two mailing related claims, the Court held that only Mr. Ramirez had standing.
Over time, the Court has crafted limits on Article III standing, requiring an examination of whether the plaintiff has suffered a concrete injury, among other things. No concrete injury, no standing. To determine whether the alleged injuries were concrete, the Court relied on its prior decision in Spokeo v. Robins, focusing the analysis on whether the "alleged injury has a close relationship to a harm traditionally recognized as providing a basis for a lawsuit in American courts"7—a common-law analogue. Concrete injury can include physical and monetary harms, as well as intangible harms like reputational harm.
With respect to the reasonable procedures claim, the plaintiffs argued that the 1,853 class members who had their information disclosed to third parties suffered harm from the dissemination of misleading credit reports which bears a close relationship to the harm from defamation. TransUnion countered that the harm was dissimilar to defamation because the credit reports were "only misleading and not literally false,"8 as required in defamation cases. The Court noted that the close relationship test does not require an exact duplicate and thus the harm from misleading information "bears a sufficiently close relationship"9 to harm from false information.
For the remaining 6,332 class members, the Court could not find a common-law analogue for misleading information without publication. It considered defamation, libel, and slander, but these did not suffice as the harm from these torts arise from publication and none of the remaining class members had their information shared with a third party. The plaintiffs also argued that the remaining class members suffered a material risk of future harm, relying on Spokeo. However, the Court rejected that argument, holding that while the risk of future harm might be enough to have standing for a suit seeking injunctive relief, an unmaterialized risk is insufficient injury for damages. With respect to the 6,332 class members, the misleading OFAC alerts were not disclosed and did not cause a denial of credit.10 Thus, the Court found that the 1,853 class members who had their information disclosed to third parties had standing for the reasonable procedures claim while the remaining 6,332 did not.
Similarly, the Court found that the majority of the class did not have standing with respect to the two FCRA claims for improper mail format because they failed to allege that they suffered any harm from the statutory violation. Because risk alone is not enough for standing in a suit for damages, the Court held that Mr. Ramirez was the only class member who demonstrated harm from the improper mail format.
In so holding, the Court confirmed that Congress's ability to provide a private right of action does not equate to a concrete injury required for constitutional standing in federal court. In other words, a statute cannot obviate the need for an inquiry into standing. "Article III does not give federal courts the power to order relief to uninjured plaintiffs," thus a concrete injury is necessary for all plaintiffs, "class action or not."11
These developments show that the inquiry into whether standing exists will be a crucial and fact intensive determination. While the Court's decision may limit potential exposure in federal court, it may also spur state legislators to expand private rights of action. Wilson Sonsini Goodrich & Rosati routinely helps companies navigate such complex data-related issues and will monitor the impact of this case in order to assist clients with calibrating litigation risk at the state and federal level. For more information or advice concerning your regulatory compliance efforts, please contact Allison Bender, Eddie Holman, or any member of the firm's privacy and cybersecurity practice.
[1]31 C.F.R. pt. 501, App. A (2020).
[6]TransUnion Petition for a Writ of Certiorari.
[7]Spokeo v. Robins, 578 U.S. 330, 341 (2016).
[10]Notably, the plaintiffs did not provide evidence that these class members knew about the misleading OFAC alerts (eliminating any claim that the risk created a separate injury akin to emotional distress).
[11]Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442, 466 (2016).
