Supreme Court Argument Analysis: TransUnion LLC v. Ramirez

On March 30, the U.S. Supreme Court heard oral arguments in TransUnion LLC v. Ramirez, a case in which the Court is revisiting the issue of what constitutes an “injury-in-fact” to satisfy Article III standing under the Fair Credit Reporting Act (FCRA or Act), with implications for privacy cases more generally.  The Court’s decision could greatly affect whether consumer privacy and data breach class action cases can ultimately succeed in federal court.

In TransUnion LLC, the Court is presented with the issue of whether Article III or Federal Rule of Civil Procedure 23 permit a damages class action when the vast majority of the class suffered no actual injury.  The Supreme Court has been hesitant to allow lawsuits to proceed on the basis of potential privacy harms.  In Clapper v. Amnesty International, the Supreme Court held that plaintiffs, who were attorneys and activists that engaged with likely targets of U.S. government surveillance of communications, could not demonstrate standing because it was “highly speculative” that any injury was “certainly impending.”  More recently, the Court in Spokeo v. Robins considered Article III standing in a FCRA case where the plaintiff alleged statutory privacy harms.  The Spokeo Court held that plaintiffs must allege concrete injuries that are not “conjectural or hypothetical.”  Moreover, the Court held that litigants can’t rely solely on non-compliance with legislative provisions to prop up statutory privacy claims.

The Court nonetheless left open the question of whether standing may exist in cases arising from the distribution of erroneous information about a plaintiff.  In the years since Spokeo, some federal courts have adhered closely to the Court’s “concrete” and “particularized” injury standard, while others have taken a more expansive view of standing in data security and privacy cases.  On one side of this circuit split, the Sixth, Seventh, Ninth, and D.C. Circuits have held that the increased risk of future harm may constitute injury-in-fact under Article III.  The Second, Fourth, Eighth, and Eleventh Circuits, however, have taken the opposite approach.

Background

The FCRA[1] imposes requirements on consumer reporting agencies (CRAs), entities that regularly compile and disseminate personal information about individual consumers.  In particular, the FCRA requires that, “[w]henever a [CRA] prepares a consumer report,” the CRA “shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.”[2]  The FCRA also provides that, upon a consumer’s request, a CRA must disclose all information in the consumer’s file[3] and provide the consumer with a written summary of rights containing specified information.[4]  A consumer may sue to recover actual or statutory damages for certain violations of the Act.[5]

The case under review was brought by Sergio Ramirez, on behalf of himself and others similarly situated, in federal court against TransUnion, LLC, alleging willful violations of the FCRA and seeking statutory damages and injunctive relief.  Ramirez claimed that TransUnion placed “terrorist alerts” on the front page of consumers’ credit reports that erroneously designated the class members as included in the Treasury Department’s Office of Foreign Assets Control (OFAC) list, a list of people who are barred from engaging in transactions in the United States.  The complaint asserted that TransUnion willfully violated the FCRA by (a) producing erroneous consumer reports without using reasonable procedures to ensure the accuracy of those designations; (b) failing to disclose upon request all information in each class member’s consumer file; and (c) failing to provide each class member with a summary of rights.

The district court certified an 8,185-member class who had received a letter from TransUnion indicating that their name was a “potential match” for one on the OFAC list, despite only 1,853 class members having their credit reports sent to a third-party.  The jury awarded each class member nearly $1,000 in statutory damages and over $6,000 in punitive damages, for a total verdict of over $60 million. 

On appeal, TransUnion argued that the verdict should be overturned because only Sergio Ramirez, the representative plaintiff, suffered a concrete and particularized injury as a result of TransUnion’s unlawful practice.  Specifically, Ramirez was prevented from buying a car in 2011 because TransUnion informed lenders that he potentially matched entries on the OFAC list.  According to TransUnion, “the other thousands of class members whose credit reports contained the inaccurate terrorist alerts and received the confusing and incomplete mailings did not suffer the irreducible constitutional minimum showing of harm that Article III standing requires.”[6]

The U.S. Court of Appeals for the Ninth Circuit held that “every member of a class action certified under Rule 23 must demonstrate Article III standing at the final state of a money damages suit when class members are to be awarded individual monetary damages.”[7]  However, the Ninth Circuit held that TransUnion’s failure to comply with the law was not merely procedural, and that each class member had standing because the defendant’s “reckless handling” of information “exposed every class member to a real risk of harm to their concrete privacy, reputational, and informational interests protected by the FCRA.”[8]  The Ninth Circuit also upheld the statutory damages as “clearly justified” but reduced the punitive damages award.

The Supreme Court granted TransUnion’s petition for certiorari.  In a sign of the stakes, the case attracted 13 amicus briefs supporting TransUnion, 14 amicus briefs supporting Respondent Ramirez and two amicus briefs supporting neither side, including the United States.

Oral Argument Analysis

During Petitioner TransUnion’s argument, Chief Justice Roberts, and Justices Alito, Kagan, Gorsuch, Kavanaugh, and Barrett were particularly focused on whether the entire 8,185-member class met the injury-in-fact prong for Article III standing.  The Chief Justice and Justice Kagan appeared more skeptical of Petitioner’s argument that the class members did not meet the standing requirements.  Petitioner argued that there was no standing because none of the class members, aside from Mr. Ramirez, knew that their name was a potential “match” on the OFAC list, and thus the risk of harm never materialized.  Justice Kagan disputed this argument, noting that Spokeo’s material risk of harm did not turn on whether plaintiffs had knowledge of the risk of injury.  Justices Alito, Gorsuch, and Kavanaugh appeared to be more receptive to the argument that the majority of the class – the 6,332 whose information was not disseminated – did not possess Article III standing because their information was ultimately not provided to any third parties.

Justices Breyer and Sotomayor appeared unconvinced by Petitioner’s separate argument that the class did not meet the typicality requirement under Rule 23 because Ramirez was an “atypical” named plaintiff.  Justice Sotomayor reasoned that Ramirez’s claims actually were typical because the statutory claims were not subject to any unique defenses and were identical to every class member’s claims.

Respondent Ramirez focused heavily on Congress’ authority to create protections for credit information, and the damaging nature of receiving an OFAC designation on one’s record.  As anticipated, Respondent seemed to face resistance to the argument that the entire class met the Article III standing bar.  Chief Justice Roberts, and Justices Alito, Gorsuch, Kavanaugh, and Barrett expressed reservations with Respondent’s argument that the plaintiffs whose information was not disseminated possessed standing.  Justices Alito and Gorsuch likened it to a scenario where a newspaper internally circulated a potentially defamatory article, but never published it.  Justice Kavanaugh, meanwhile, posited that the facts of Spokeo actually presented a stronger argument for finding standing than the facts in TransUnion.  In Spokeo, the Supreme Court found that the plaintiff did not have standing to bring a FCRA suit against a website that published false information about his income level.  Justice Kavanaugh reasoned that because 6,332 members of the Ramirez class never had their information disseminated to a third party, they may have a weaker case than the Spokeo plaintiff.

Justices Breyer and Kagan seemed more focused on whether the class met the typicality test under Rule 23, and both appeared receptive to Respondent’s argument that they did.  Justice Breyer appeared convinced that Ramirez’s uniquely severe harms did not make his claims atypical.

Conclusion

Although attempting to predict the outcome of a case based on the content of the oral arguments is a risky exercise, a majority of the justices expressed doubts about whether the entire Ramirez class meets the injury-in-fact prong for Article III standing, noting that the majority of class members had not had their information provided to third parties.  The Court’s ultimate decision could greatly impact data security and privacy class action litigation at the federal level, by providing defendants with a more powerful defense in cases where alleged privacy and security violations do not result in a disclosure of information resulting in any tangible harm.  A decision is anticipated in the coming months.

Tawanna Lee, a Law Clerk at Wiley Rein LLP, contributed to this blog post.

[1] 15 U.S.C. 1681 et seq.

[2] 15 U.S.C. 1681e(b).

[3] 15 U.S.C. 1681g(a)(1).

[4] 15 U.S.C. 1681g(c)(2)(A).

[5] 15 U.S.C. 1681n, 1681o.

[6] Ramirez v. TransUnion LLC, 951 F.3d 1008, 1017 (9th Cir. 2020).

[7] Id. at 1037.

[8] Id.