The U.S. Supreme Court will hear arguments on March 30, 2021, in a case that will help clarify when an intangible, nonmonetary injury is sufficiently “concrete and particularized” to give rise to Article III standing.1 The Supreme Court’s decision will likely provide guidance for class-action plaintiffs seeking to bring (and class-action defendants looking to defend against) claims for civil penalties in the wake of the Supreme Court’s 2016 decision in Spokeo, Inc. v. Robins.2 The case could have profound consequences for any company that is potentially subject to a claim for statutory civil penalties in a federal class action lawsuit.
The Ninth Circuit’s Decision in Ramirez v. TransUnion LLC
Sergio Ramirez tried to buy a car with his wife. The dealership obtained a credit report, which incorrectly identified Ramirez as appearing on a list of Specially Designated Nationals (“SDNs”)–that is, people prohibited from doing business in the United States for national security reasons. It is essentially a terrorist watch list.
Ramirez contacted the credit reporting agency, TransUnion, to fix the error. In response, he received two letters. The first letter contained his ordinary credit report with a summary-of-rights form and instructions on how to submit proposed corrections. The second letter (“SDN Letter”) disclosed that Ramirez’s name was a “potential match” for names on the Treasury Department’s SDN list, but it lacked a summary-of-rights form or instructions on corrections. As it turns out, TransUnion included SDN references in credit reports based on information supplied by a third-party vendor that used software dependent on comparing first and last names. The assessment thus did not consider addresses, Social Security numbers, or any other identifying information.
Ramirez sued, alleging that TransUnion violated the Fair Credit Reporting Act (“FCRA”) when it willfully failed to follow reasonable procedures to ensure accuracy of the alerts, willfully failed to disclose full credit reports by sending the SDN Letter separately from the balance of the credit report, and willfully failed to provide a summary of rights with the SDN Letter.
Ramirez’s suit was brought individually and also on behalf of all 8,185 individuals who received the SDN Letter in a seven-month period. The trial court certified that class, and the jury returned a verdict of $60 million in favor of the class, including $8 million in statutory civil penalties and $52 million in punitive damages. (The Ninth Circuit later reduced the punitive damages to $32 million.)
In a 2-1 decision, the Ninth Circuit affirmed class certification and the verdict.3 The majority opinion, written by Judge Murguia and joined by Judge Fletcher, applied a two-part test to determine “whether the violation of a statutory right constitutes a concrete injury.” The court first asked “whether the statutory provisions at issue were established to protect [the plaintiff’s] concrete interests (as opposed to purely procedural rights).” And then, if they were, “whether the specific procedural violations alleged actually harm, or present a material risk of harm to, such interests.”
The majority had little difficulty finding the answer to both questions to be yes, since the protective purposes of FCRA are clear, as is the risk of harm from a false accusation that a person is an SDN. In her dissent, Judge McKeown explained that the class consisted of anyone who received the SDN Letter rather than anyone who had the false SDN accusation distributed to third parties. There was therefore no guarantee that every class member even opened the mailing, let alone that the incorrect credit report confused, distressed, or otherwise affected the absent class members.
The Ramirez argument comes one month after a similar case in which the Eleventh Circuit held that data breach victims must show more than a heightened risk of future injury or costs incurred to mitigate potential harm in order to establish Article III standing.
The Upcoming Argument
The question before the Supreme Court is whether the absent class members in Ramirez sustained a concrete injury sustaining Article III standing.
TransUnion’s argument focuses on the record at trial, which definitively established only that a quarter of the absent class members had the incorrect information distributed to third parties. As a result, as much as three-quarters of the class never suffered any harm as a result of the incorrect information. TransUnion argues that the trial court therefore should have never certified the class because its membership (all persons who received the SDN Letter in a seven-month period) is untethered from the alleged harm–that is, dissemination of the false SDN identification.
Ramirez turns this on its head and points out that there is no dispute that a quarter of the class suffered a concrete injury through dissemination of the SDN Letters. As for the rest, Ramirez argues that TransUnion must have also disseminated the incorrect SDN allegation of the third-party vendor that printed the SDN Letters, which suffices for an FCRA violation. And in any event, under Spokeo, there need only be a “risk of real harm,” which Ramirez argues is present when TransUnion prepares an incorrect credit report that exists solely so that TransUnion can distribute it to its customers on demand.
The Supreme Court’s decision will likely turn on how speculative or inference-driven a predicate for Article III standing can be. The outcome will affect not only FCRA litigation but also virtually any claim in which a plaintiff sues only for civil penalties because of a statutory violation. Such claims are ubiquitous in consumer fraud statutes, such as the Fair and Accurate Credit Transactions Act, the Stored Communications Act, and the Telephone Consumer Protection Act.
1 TransUnion LLC v. Ramirez, No. 20-297.
2 578 U.S. 330.
3 Ramirez v. TransUnion LLC, 951 F.3d 1008 (9th Cir. 2020), reh’g denied (Apr. 8, 2020).