Today, the Supreme Court issued its opinion in TransUnion LLC v. Ramirez, holding that a concrete injury requires more than the existence of a risk of harm that never materializes. Accordingly, the vast majority of the absent class members who could not prove that allegedly inaccurate credit reports were disseminated to any third party did not have standing to assert a claim under the Fair Credit Reporting Act (FCRA).
This case arose from a product offered by TransUnion that attached a “potential match” alert to the credit files of individuals with names matching a name designated by the Department of the Treasury’s Office of Assets Control (OFAC) as individuals restricted from certain transactions for national security reasons (e.g., terrorists, drug traffickers, etc.). The named plaintiff, Sergio Ramirez, alleged TransUnion transmitted his consumer report with the OFAC alert attached to a car dealership when Ramirez attempted to finance a car purchase. He alleged he suffered actual injury in the form of denied credit, embarrassment in front of his family, and a resulting vacation cancellation.
Ramirez contacted TransUnion and requested a copy of his credit file. In response, TransUnion mailed him a file disclosure that did not contain the OFAC alert, but contemporaneously mailed Ramirez a separate letter referencing the file disclosure letter, and explaining that his name was a “potential match” to a name on the OFAC list. Ramirez received the file disclosure first, a few days before receiving the OFAC-alert letter.
Ramirez filed a class action suit in California under the FCRA. The suit alleged two types of claims under the FCRA. First, it alleged TransUnion failed to maintain reasonable procedures to assure the maximum possible accuracy of the information in its consumer reports (the “reasonable procedures” claim). Second, it alleged TransUnion violated the FCRA’s requirement to provide consumers, upon request, with all information in their files by providing the OFAC potential match information in a separate mailing, and that TransUnion violated the FCRA’s requirement to provide consumers with a summary of their rights with each file disclosure by not including a summary of rights in the OFAC-alert mailing (the “disclosure” and “summary-of-rights” claims).
Ramirez filed the suit on behalf of a class of over 8,000 individuals to whom TransUnion sent a similar OFAC-alert letter. Although the “potential match” alert was attached to the credit files of all class members and stored in TransUnion’s internal files, only the files of 1,853 of the class members were disseminated to third parties; the remaining 6,332 could not prove a consumer report with the OFAC alert was disseminated. Further, even among the 1,853 class members for whom a consumer report with an OFAC alert was disseminated, only Ramirez alleged he was denied credit as a result. The suit also alleged each class member was injured by receiving the nonconforming file disclosure mailings, but only Ramirez alleged he even read the letters, let alone was confused by them.
The district court certified a national class for the FCRA claims, and after trial, a jury awarded the class $8 million in statutory damages and $52 million in punitive damages. On appeal, the Ninth Circuit affirmed certification and the statutory damages award, but reduced the punitive damages award to $32 million. Regarding the reasonable procedures claim, even though most of the class members could not allege their credit file with an OFAC alert was ever transmitted to a third party, a divided Ninth Circuit panel held a “material risk of harm” existed sufficient to establish Article III standing simply because TransUnion had compiled the allegedly false information in its database and could have disseminated it upon request. The Ninth Circuit further held every class member suffered an injury by receiving the nonconforming mailings since the separate credit file and OFAC-alert mailings were “inherently shocking and confusing.”
The Supreme Court granted TransUnion’s petition for certiorari, and heard oral argument on March 30.
The Court’s decision was 5-4, resulting in reversal and remand. The Court’s majority opinion both opens and closes with a simple, straightforward statement: “No concrete harm, no standing.” The rest of the opinion, however, grapples with trickier questions: what makes an injury concrete, and who gets to decide?
The opinion, authored by Justice Kavanaugh and joined by Chief Justice Roberts and Justices Alito, Gorsuch, and Barrett, is notably far-reaching, even beyond the immediate context of the FCRA claims involved in this case. The opinion’s discussion of the concrete injury requirements of standing has substantial implications for a large swath of statutes, like the FCRA, that purport to create private causes of action for enforcement of regulatory violations. These statutes necessarily raise the question of whether a violation of the statute creates a concrete injury sufficient to confer standing.
The opinion begins with an in-depth discussion of standing requirements, invoking fundamental principles of separation of powers and historical tradition, and indicating that it is the courts, not Congress, that decide whether a plaintiff’s claimed injury is sufficiently concrete to confer standing.
To determine whether an alleged injury is concrete, the courts must consider whether the alleged harm bears a “close relationship” to a harm traditionally and historically recognized as providing a basis for a lawsuit in American courts. Congress’s views on what constitutes a harm — expressed through the creation of private causes of action — may be “instructive” as to whether a harm is sufficiently concrete, but Congress cannot simply “enact an injury into existence” by creating a private cause of action for something that is not remotely harmful.
With its historical and traditional standard in hand, the Court then turned to analyzing the FCRA claims at issue in this case to determine whether they amounted to concrete injuries.
The Court began with the plaintiffs’ main claim: that TransUnion failed to follow reasonable procedures by including allegedly inaccurate or misleading OFAC alerts in the plaintiffs’ credit files, in violation of 15 U.S.C. § 1681e(b). The Court immediately drew a distinction between the 1,853 class members whose consumer reports with the OFAC alert were disseminated to third parties and the 6,332 class members whose reports were not disseminated. Even if they were only labeled as a “potential terrorist,” the Court held that the former category of consumers had asserted a concrete injury sufficient to confer standing; the latter had not.
Regarding the 1,853 class members, the Court held they had suffered a “reputational harm” through the publication of false or misleading information that bore a close relationship to a harm associated with a traditionally recognized cause of action: the tort of defamation. TransUnion argued that even these individuals had not suffered an injury, because the information included in the OFAC alert was not technically false; it merely identified a consumer as a potential match on the OFAC list, not a guaranteed match. The Court rejected this argument: although the common law analogue must be close, the harm asserted need not be an “exact duplicate” of the traditional cause of action. Thus, even though defamation requires falsity, the publication of misleading information was, to the Court, close enough.
For the remaining 6,332 class members, the Court held that the mere existence of the OFAC alert in their credit files, without proof of dissemination, did not constitute a concrete injury. The Court analogized this to a defamatory letter stashed away in a desk drawer. Defamation requires publication; otherwise, the reputational harm does not materialize.
The Court also rejected the plaintiffs’ argument that a material risk that TransUnion could have disseminated the information upon the request of a third party constituted a concrete injury. Instead, the Court held that a mere risk of future harm that never materializes, standing alone, does not constitute a concrete injury. These plaintiffs had also failed to factually establish a sufficient risk of harm to begin with: their allegations that their consumer reports with an OFAC alert could have been disseminated if requested by a third party were too speculative.
Finally, since there was no evidence that these plaintiffs even knew the OFAC alerts were in their internal credit files, the Court noted it was “difficult to see how a risk of future harm could supply standing when the plaintiff did not even know that there was a risk of future harm.”
The Court lastly turned its attention to the disclosure and summary-of-rights claims, noting these dual claims involving the format of TransUnion’s mailings were “intertwined.” On these claims, the Court held that none of the plaintiffs other than Ramirez had suffered a concrete injury. Once again looking to history and tradition, the Court held that the allegedly noncompliant format of the mailings had not caused the class members an injury with a close relationship to a traditionally recognized harm. In fact, the plaintiffs had demonstrated no harm at all, as there was no evidence that any class member other than Ramirez had opened the mailings, suffered confusion or distress, or that they would have tried to correct their files if they had received the mailings in the proper format. As such, the Court held that these claims asserted nothing more than “bare procedural violation[s], divorced from any concrete harm,” insufficient to confer standing. See Spokeo v. Robins, 136 S. Ct. 1540, 1549 (2016).
The Court also rejected the argument of the United States as amicus curiae that the plaintiffs suffered an informational injury by receiving the allegedly noncompliant mailings, because the plaintiffs failed to allege that they did not receive required information as a result of the mailings.
Justice Thomas authored the lead dissent, which Justices Kagan, Breyer, and Sotomayor joined. In it, he takes the majority to task for holding that the mere violation of a personal right could never be an injury sufficient to establish standing. Picking up where his concurring opinion in Spokeo, Inc. v. Robins left off, Justice Thomas states that courts have traditionally held that injury based on a statutorily created private right is enough to create a case or controversy under Article III, even without any showing of loss. Because the judicial power extends to “all Cases,” courts are therefore obliged to hear cases in which a plaintiff plausibly alleges a violation of a private statutory right. He also noted “the principle that the violation of an individual right gives rise to an actional harm” was widespread both at the country’s founding and in modern cases, which “accords proper respect” for the power of legislatures to define legal rights. Because each class member in Ramirez established a violation of his or her private rights created under the FCRA, Justice Thomas reasoned, they have a sufficient injury to sue in federal court.
Justice Thomas also warned that Ramirez may be a “pyrrhic victory” for TransUnion because it does not prohibit Congress from creating statutory rights, but only holds that federal courts lack jurisdiction to enforce them absent a concrete harm. In other words, state courts, unbounded by Article III, may now be the “sole forum” for such cases.
Justice Kagan, joined by Justices Breyer and Sotomayor, dissented separately to note her disagreement with Justice Thomas’s suggestion that a violation of any individual right Congress creates is enough to confer standing. She reiterates Spokeo‘s holding that statutory violations are not enough to confer standing absent a “concrete injury,” but emphasizes that the issue will only arise “in . . . highly unusual cases.” This is because Congress, not the Court, is best suited to determine when a harm or risk of harm exists. Justice Kagan would limit the Court’s authority to override a statutory authorization to sue to those cases in which Congress “could not reasonably have thought that a suit will contribute to compensating or preventing the harm at issue.”
Ramirez is a potentially far-reaching opinion, with impact well-beyond the FCRA, the implications of which are sure to be debated in the coming months in the lower courts.
It is clear plaintiffs need more than a statutorily created right (public or private) and cause of action to make their way into federal court. Whether that statutory right can find a sufficient common law foundation to give to a concrete injury, or whether an informational or other form of concrete injury can be established, will be debated by litigants by reference to Ramirez and the Supreme Court’s many other standing decisions. The impact of the Ramirez decision will be widely debated across numerous substantive areas of the law, including consumer protection claims, data breach cases, and privacy matters. Going forward, however, it is also clear that it is the judiciary, not Congress, that is charged with determining whether a concrete harm exists, based on a historical inquiry. In other words, given the facts relevant to the larger class in Ramirez, which fall short of the “concrete harm” standard, Congress could not rewrite the FCRA in such a way that would confer standing. The opinion clearly shifts power from Congress to the judiciary; the extent of that shift is still to be seen.