Grokking the Supreme Court’s TransUnion Decision
A class of plaintiffs sued the credit bureau TransUnion, alleging that they were improperly placed on a “watch list” that TransUnion offered to supplement credit reports. TransUnion’s watch list was designed to help businesses avoid transacting with people who were on the restricted list run by Treasury Department’s Office of Foreign Assets (OFAC). TransUnion implemented this service in a clumsy way by not disambiguating people who shared the same name. If “Joe Smith” was on the OFAC list, TransUnion flagged the credit reports of all Joe Smiths. Ramirez, the named plaintiff, shared the same name as a restricted person. A car dealer refused to sell him a vehicle because, in the words of the salesperson, he was “on a terrorist list.”
Ramirez brought Fair Credit Reporting Act claims against TransUnion on behalf of a class. The class consisted of approximately 8,000 members. Before trial, the class stipulated that only 1,853 of the class members had their flagged credit reports disseminated by TransUnion during the class period. The suit alleged both improper disclosures and inaccurate information, and also that TransUnion did not properly respond when plaintiffs tried to correct their credit information with TransUnion.
TransUnion challenged standing, which the district court said was present as to all class members. A jury returned a verdict in favor of the class. The Ninth Circuit affirmed as to standing, although it reduced the total award by the jury, from about $60 million to $40 million. Judge McKeown dissented, finding that only those who had their flagged credit reports actually disseminated by TransUnion had Article III standing.
The Majority: Justice Kavanaugh, writing for the majority (which included Justices Roberts, Alito, Gorsuch, and Barrett), agreed with Judge McKeown that only those who had their flagged credit reports actually disseminated had Article III standing. The key question is whether the plaintiffs had suffered “concrete harm,” which is informed by history and tradition. Congress can create statutory rights, but federal courts should not defer to Congress and simply rubber-stamp Congressional decisions. In Justice Kavanaugh’s view, federal courts bear a responsibility to closely scrutinize the pronouncements of Congress regarding standing.
Applying those principles to the claims of the class members:
- The mere failure to follow internal procedures and ensure that credit reports are reasonably accurate does not enter the Court’s calculus. The key question is what TransUnion actually did with the credit reports in question.
- The class members who had their flagged reports “disseminated” have standing. Defamation is a well-worn tort at common law, and the dissemination of false information in a credit report is closely analogous to defamation. Therefore, these allegations satisfy Article III standing.
- The remaining class members—who did not have their flagged credit reports disseminated—do not satisfy Article III injury. The “mere existence” of information in someone’s credit file does not constitute concrete injury. “Intra-company” disclosures or disclosures to the plaintiffs themselves are insufficient.
The plaintiffs also pointed to the risk of future harm that the inaccurately flagged credit reports would be disseminated. The Court says that a risk of future harm may support standing to seek injunctive relief, but a risk of future harm is not sufficient to satisfy standing in a suit for damages. The Court comes back to the defamation analogy and notes that publication is critical to damages.
In addition to wrongful disclosure, plaintiffs also brought claims for procedural violations of the FCRA based on the fact that TransUnion did not comply with its obligations as to disclosure and providing affected individuals with a summary of their rights. The Court says these violations do not generate standing. The Court rejects the argument advanced by the United States, as amicus, that this amounted to “informational injury” that was sufficient to confer standing.
The Dissents: Justice Thomas dissented (joined by Justices Breyer, Sotomayor, and Kagan). In the dissent’s view, violations of statutory rights are historically sufficient to confer standing, provided that the person is asserting rights that are personal to them. Indeed, the idea of “concrete injury in fact” is a relatively recent invention. If the guidepost for standing is what rights were historically recognized in American courts, we shouldn’t even be worrying about “injury in fact”. The modern standing inquiry started with cases dealing with rights under the Administrative Procedures Act, and evolved into a standing analysis under Article III. In Justice Thomas’s view, the key question is whether the plaintiffs asserted their own rights under the FCRA, and the jury found that they did and those rights were violated. In any event, he notes, even if courts were adequately positioned to second-guess Congressional judgment regarding what is a private right sufficient to confer access to courts, this is a “rather odd” case to say Congress went too far.
Turning to the claims in this case, Justice Thomas notes that:
- A jury found that TransUnion willfully violated the FCRA in failing to disclosure the information in question to class members;
- TransUnion ascribed financial value to the reports themselves, and withholding this information to class members amounts to economic harm;
- There is no dispute with the majority that those who had their information disclosed have standing.
However, he thinks that the majority incorrectly sweeps aside the risk of future harm. Even Spokeo recognized this as plausible harm.
In his view, the jockeying between the majority and dissent reflects that this is a policy choice. It’s really difficult to sort through the various categories of harm and come up with a coherent theory of classification.
Justice Kagan wrote separately to ask “why is it so speculative that a company in the business of selling credit reports to third parties will in fact sell a credit report to a third party?” She agreed with Justice Thomas that common sense dictates that the practices at issue were harmful. She noted a slight disagreement with Justice Thomas on the scope of standing: in her view, concrete injury is required, even in the context of a statutory violation. Courts should defer to the judgment of Congress, but in the end, in Justice Kagan’s view, some sort of concrete harm is required.
__
In TransUnion, the Supreme Court takes a step beyond Spokeo and authorizes federal courts to scrutinize allegations of harm in all cases, even those involving statutory violations. This could have an effect on a wide range of cases beyond FCRA cases. Consider what happens when the majority’s standing scrutiny is focused on concrete harm in cases brought under the TCPA, CAN-SPAM, VPPA, and so on. This is a defense lawyer bonanza in terms of briefing opportunities in privacy and other cases.
Justice Thomas notes in a footnote that this may be a “pyrrhic” victory for TransUnion because plaintiffs may end up turning to state courts (which are typically a more favorable forum). If the plaintiff does not have standing, this means that federal courts lack jurisdiction entirely, so defendants may be unable to avail themselves of their preferred forum. (We have seen a few cases in the context of removal where the positions of the plaintiff and defendant were flipped as to standing, with the removing defendants arguing that a proposed class of plaintiffs had standing and the plaintiffs arguing they did not have sufficient standing to be in federal court.)
An unresolved question: how TransUnion affects claims brought under state law in federal court. Do the same standards apply, or do federal courts owe increased deference to state legislatures?
Also unresolved: what this ruling means for data breach plaintiffs. The majority’s approach seems to leave room for them to seek injunctive relief in federal court, but there are likely other tools at a defendant’s disposal to undermine those claims. While not directly on point, the Second Circuit recently looked at standing in a data breach case and found that a group of plaintiffs who had their personal information disseminated in an errant mass email lacked standing. The court did not close the door on standing based on the increased risk of identity theft or fraud, but said it is not present when an employee mistakenly emails personal information within the company. The court relied primarily on Clapper, not Spokeo.
Eric’s Comments
This opinion is more understandable than the Spokeo ruling, but I’m still confused about what this opinion does to privacy litigation (and maybe other areas of the law).
As Venkat notes, the ruling may only affect standing when plaintiffs request damages, not equitable relief. However, I’m confused about this. Does it mean that in cases involving the exact same plaintiff alleging the exact same claims against the exact same defendants, there could be different standing depending solely on what requested remedies they plead? This opens the door to some weird results, like parallel lawsuits in federal court seeking an injunction and state court seeking damages. The redirection of cases from federal to state court also has some cost implications that the Supreme Court doesn’t have to worry about, but someone’s budget got hit by this ruling.
The opinion also arguably equates a plaintiff’s substantive doctrinal harm with Article III harm. If TransUnion’s sloppy practices didn’t actually harm to consumers, then a court can’t award damages because they are too speculative. (Legislatures can bridge this gap by enabling statutory damages even where there’s no actual damage or damages would otherwise be too speculative). On the plus side Article III accelerates this inevitable result. On the minus side, when the Supreme Court imposes Article III limits, the legislature lacks any power to manage this issue over time.
As for the applicability of the doctrine to non-privacy areas, one example came to my mind: copyright law deems it a 106 “distribution” when an third-party copyrighted work is “made available” (such as stored in a shared directory in a P2P network), even if no one ever downloads the work. If the copyright owner can’t show that any downloads occurred, how did the copyright owner suffer an Article III injury? Note that the copyright owner can’t fall back on state court because federal courts have exclusive jurisdiction over federal copyright claims.
Case citation: TransUnion LLC v. Ramirez, 594 U.S. __ (2021)
Related posts:
‘365 for Business’ Users’ Privacy Lawsuit Dismissed–Russo v. Microsoft
CCPA Data Breach Lawsuit Against Walmart Fails–Gardiner v. Walmart
One Minute Spent Reviewing a Junk Fax Received via Email is Not Injury for Article III Purposes
On Remand, Ninth Circuit Says Robins Satisfied Article III Standing
Spokeo Wipes Out FCRA Lawsuit Over “Improper” Mandatory Disclosures–Nokchan v. Lyft
Will the Spokeo v. Robins Supreme Court Ruling Favor Plaintiffs Or Defendants? Uh…