Supreme Court Extends Spokeo's Article III Standing Requirements

In TransUnion LLC v. Ramirez, the U.S. Supreme Court upended a class damages award of $40 million under the Fair Credit Reporting Act (FCRA) against TransUnion, one of the "Big Three" credit reporting agencies. The 5-4 decision, issued on June 25, 2021, has broad potential implications on class certification and FCRA litigation going forward. While not arising from a data breach or ransomware event, the Court's decision seems likely to reverberate in cyberattack class actions brought without an actual harm (such as identity theft or financial loss).

Background

The lead plaintiff, Sergio Ramirez, represented a certified class of 8,185 consumers who appeared on TransUnion's "OFAC Name Screen Alert" List (OFAC List). This database identifies a consumer's name as a "potential match" to a name on a list of terrorists, drug traffickers, and other serious criminals maintained by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC). Ramirez learned of the OFAC List when a salesman at a car dealership informed him he could not purchase a vehicle because his name was on a "terrorist list."

A jury returned a verdict in favor of Ramirez and a class of consumers whose names were included on the OFAC List and who had also received two letters from TransUnion, one of which failed to include information about the OFAC List and another that included the OFAC information but omitted a summary-of-rights required by the FCRA. The U.S. Court of Appeals for the Ninth Circuit upheld the award, in relevant part.

Supreme Court Decision

Reversing the Ninth Circuit, the Supreme Court held that 6,332 of the 8,185 certified class members lack Article III standing despite their inclusion on TransUnion's OFAC List, because TransUnion did not disseminate their credit reports to third-party businesses during the relevant time period. In reaching this result, the Court relied on Spokeo, Inc. v. Robins, 578 U. S. 330, 340, and concluded that these class members did not suffer harm that was sufficiently "concrete" to confer Article III standing. Under this analysis of Article III standing, a plaintiff must identify a close historical or common-law analogue for their asserted injury. Physical, monetary and reputation harms readily qualify as concrete injuries under Article III. Analogizing to the tort of defamation, which requires "publication" of the defamatory statement, the Court held that because TransUnion did not disseminate the credit reports of 6,332 class members to third-party businesses during the relevant time period, these class members did not demonstrate the concrete harm required for Article III standing.

As to the FCRA claims based on TransUnion's letters to class members, the Court held that all 8,185 class members lacked Article III standing, because the plaintiffs presented no evidence that a single class member, other than Ramirez, opened the mailings or were confused, distressed or relied on the information in any way. The Court held that even if the letters constituted technical violations of the FCRA, these bare procedural violations could not proceed absent a showing of concrete harm.

Potential Implications

The Supreme Court's decision will have broad implications going forward both for FCRA litigation, in particular, and for class action litigation, more generally.

As a possible boon to businesses facing class action litigation in the future, federal courts could more closely scrutinize whether class members have identified a historical or common-law an­alogue for the injury that they assert. While this inquiry does not require "an exact duplicate in American history and tradition," it is not an "open-ended invitation for federal courts to loosen Article III based on contemporary, evolving beliefs about what kinds of suits should be heard in federal courts." If class members fail to demonstrate the sort of physical, monetary or reputational harm traditionally associated with common-law torts, businesses should consider a standing challenge under Article III. Application of TransUnion seems especially likely in cases arising from data breaches and ransomware events. These class actions are frequently brought simply because the company attacked sends a notice required under state data breach notification laws. Courts have been split over what counts as cognizable injury in that circumstance. TransUnion gives support to those courts that have said simply getting a data breach notification letter is not enough to open the doors to a federal courtroom, absent identity theft or economic harm.

On the other hand, as Justice Clarence Thomas suggests in his dissent, successful challenges to Article III standing could simply relocate class actions to state courts that have no standing requirements comparable to Article III, such as California and Michigan. In this regard, Justice Thomas notes that the majority's opinion could be a hollow victory for TransUnion, because it ensures that state courts will exercise exclusive jurisdiction over these types of class actions. Although Justice Thomas expresses a valid concern, such a result raises the question as to whether Congress can create a cause of action that must be litigated outside of Article III courts because the cause of action protects plaintiffs who lack Article III standing. Class action defendants faced with federal claims in state court should consider whether this argument offers a helpful defense.

As to FCRA litigation, in particular, the Court's decision is an open invitation for defendants to assert a standing challenge in cases where the plaintiff's credit report was not disseminated to potential creditors. Indeed, the Court even rejected the plaintiffs' argument that the inaccurate OFAC information was "published" internally at TransUnion and to the vendors that printed and sent the mailings that the class members received sufficient to confer standing.

However, the Court also offered plaintiffs a fig leaf by raising the possibility (without deciding the issue) that a consumer might suffer concrete injury in the form of emotional or psychological harm by simply viewing inaccuracies on his/her own credit report. This sort of psychological harm, as the argument goes, is analogous to that suffered by victims of intentional infliction of emotional distress.

Because the defendant in this case was a credit reporting agency, the implications of the Court's ruling for furnishers of credit information, such as creditors, is less clear. For example, the Court did not have reason to address whether furnishing credit information about consumers to credit reporting agencies constitutes publication of the information in a manner that is sufficient to confer standing. Even so, the Court suggests that furnishing information to credit reporting agencies might not be enough, noting that defamation has historically required evidence the defendant "actually brought an idea to the perception of another" and thus "that the document was actually read and not merely processed." It's not clear that information furnished to credit reporting agencies is actually read by anyone unless and until it is published as a credit report and disseminated at the consumer's or a potential creditor's request.

In sum, the Supreme Court's decision in TransUnion LLC v. Ramirez provides additional fodder to challenge standing and defeat class certification. But it remains to be seen whether this will simply shift class action litigation to state courts with lower standing requirements.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.