June 25, 2021, marked a 5-4 U.S. Supreme Court decision, which struck a blow to consumers in a virtual world.
Plaintiffs brought suit under the Fair Credit Reporting Act (FCRA) regarding the inaccuracy of TransUnion’s credit files. Though the FCRA codifies a private cause of action and statutory penalty for violators, actual harm must first be established. While lower courts found such harm, the Supreme Court found none. This decision may seem obvious to scholars of legal standing cases to date. However, it also begs the question of what exactly ‘concrete harm’ means in a digital world.
Name Screen Alert
The Office of Foreign Assets Control (OFAC) maintains a list of individuals prohibited from doing business in or with the U.S. This is an initiative of the U.S. Department of the Treasury to curb funding terrorist activities. This list comprises of “Specially Designated Nationals” (SDNs), who are individuals deemed potential terrorists or otherwise a threat to national security.
When requesting credit reports from TransUnion, businesses can opt into an “OFAC Name Screen Alert Service.” This compares the first and last names of the report subject with those on the OFAC list. If there is a match, the service flags it on the credit report. This is exactly what happened to Sergio Ramirez when attempting to buy a car. Thousands of others joined Ramirez via class action—some with injuries similar to Ramirez, others not as clear.
TransUnion v. Ramirez Class Action
In February 2012, Ramirez initiated a class action suit against TransUnion Credit Services under the FCRA. Over 8,000 individuals joined him in the endeavor. Of this plaintiff class, 1,853 plaintiffs were the subject of a misleading credit report with an OFAC alert provided to a third party. Plaintiffs claimed the company failed “to use reasonable procedures to ensure the accuracy of their credit files.” The filing also charged TransUnion with incomplete disclosures to consumers regarding any errors resulting from the alert. Therefore, consumers are denied their statutory right to challenge incorrect information.
In response, TransUnion argued no actual damage had taken place. In Ramirez’s case, his wife was able to purchase the car in her name instead. For the majority of the class, TransUnion insisted, there was even less chance of an imagined injury. Even though the reports may have been misleading, no one was hurt. No harm, no foul.
Five years later, the jury dismissed these arguments. They awarded the entire class the largest FCRA verdict known at that time. This consisted of roughly $8 million in statutory damages and $52 million in punitive damages across the class. Upon appeal in 2020, the court upheld the jury’s decision, although it did reduce punitive damages to $32 million.
The Supreme Court, however, reversed and remanded the lower court’s decisions in the TransUnion class action. There was an injury for the fraction of class members like Mr. Ramirez. However, for over 6,000 of them, there was none. “An asserted informational injury that causes no adverse effects” does not satisfy standing.
A Question of Standing in TransUnion Class Action
Legal standing refers to a legally protectable interest entitling one to bring a dispute before a court for relief. However, an individual must meet three factors before they can act on that right. First, the plaintiff must have actually suffered an injury. Next, there must be a causal connection between said injury and the defendant’s conduct. Finally, the court must be able to remedy the injury.
Though these requirements have long been in effect, how to define them is a constant legal struggle. This is particularly the case with defining ‘injury,’ especially in a digital age. As always, technology has forced another look at old definitions in light of changing circumstances. It is easier to point out a physical injury, damage to property, or loss of fortune. It is much harder to determine whether and when the use of personal data constitutes an injury.
In true form, district courts have been torn on the misuse of digital information. Some have determined the mere misuse or illegal collection of such data to be a qualifying injury. This is the case in Washington, D.C. and the sixth, seventh, and ninth district courts. Other jurisdictions, such as the second, third fourth, and eighth district courts, have required a much more tangible injury.
Enter the TransUnion class action, where the Supreme Court ended up reversing the lower court’s previous findings. An actual, tangible injury must indeed be apparent. No harm, no foul. One must first wait to experience the damage before attempting to stop it.
What This Means for Future Data Breaches
The TransUnion class action solidifies the need for a concrete, obvious harm. Although the standard is long, it is willfully ignorant of the current digital climate where ‘concrete’ is not so firm. Furthermore, it adds fodder for the data privacy debate at large. Are we okay with having stockpiles of our data ripe for the taking? What can be done to protect it? Do we really have a choice?
