U.S. Supreme Court Reverses Class Action Award Against TransUnion, Finds Statutory Violation Without Concrete Harm Not Sufficient to Establish Standing

On June 25, 2021, the U.S. Supreme Court reversed a Ninth Circuit decision in TransUnion LLC v. Ramirez, which affirmed a class action award of approximately $40 million in statutory and punitive damages to a class of 8,185 individuals against TransUnion for alleged violations of the Fair Credit Reporting Act (FCRA). In TransUnion, the Court affirmed and strengthened its recent decision in Spokeo, Inc. v. Robins, a case which also involved an alleged violation of the FCRA, in which the Court held that mere procedural violations of a statute do not confer Article III standing.  Applying those principles, the Court held that 6,332 of the putative class members did not have standing to bring a suit for damages against TransUnion because they failed to demonstrate that they suffered a concrete harm as a result of TransUnion’s decision to place an Office of Foreign Assets Control (OFAC) Alert on their credit files indicating that the plaintiffs’ names were a potential match to OFAC’s list of terrorists, drug traffickers, and other serious criminals. Given that the plaintiffs’ claims were largely based on a specific provision of the FCRA requiring consumer reporting agencies to “follow reasonable procedures to assure maximum possible accuracy” in consumer reports, this decision not only creates an additional obstacle for class action plaintiffs attempting to enforce federal statutes, but it also calls into question Congress’s ability to establish causes of action for procedural violations.

At issue in the case was whether the plaintiffs had Article III standing to bring a suit for damages based on TransUnion’s alleged failure to ensure the accuracy of plaintiffs’ credit files. The Supreme Court concluded that 1,853 of the class members adequately demonstrated concrete reputational harm because TransUnion provided misleading credit reports for those individuals to third-party businesses, but reversed the Ninth Circuit’s decision as to the 6,332 class members whose credit files were not provided to third-party businesses.

The Court did so even though Congress had purposefully created a cause of action under the FCRA for consumers to sue “[a]ny person who willfully fails to comply with any requirement imposed under this subchapter” and recover actual damages or statutory damages not less than $100 and not more than $1,000, as well as for punitive damages and attorney’s fees. Drawing heavily from its opinion in Spokeo, Inc. v. Robins, however, the Court explained that Article III injury requirements are necessary to establish standing—even when Congress has enacted legislation suggesting that a procedural violation is sufficient. The Court also rejected the plaintiffs’ argument that TransUnion’s statutory violations could subject them to future harm, holding that the mere risk of future harm, without more, cannot supply the basis for standing.

Notably, this decision provides further ammunition to defendants in data-related class actions and further weakens the ability of class members to establish standing based on a mere procedural violation. In other words, losing the standing fight on a motion to dismiss as to the named plaintiff is not the end of the story—there can still be a path to victory (even if only in part) at the class certification stage by significantly narrowing the class. Another important takeaway is that class action plaintiffs in FCRA cases may no longer be able to rely exclusively on statutory violations in order to establish a valid cause of action against credit reporting agencies. Instead, plaintiffs must now demonstrate (1) that the statute was violated and (2) that the statutory violation gave rise the type of injury or harm which has historically constituted a valid basis for a lawsuit in the United States. In this case, the plaintiffs decided to analogize their alleged injuries to the reputational harm associated with the tort of defamation because the 6,332 class members at issue had not suffered any physical or monetary harms as a result of the alleged inaccuracies in their TransUnion credit files. However, the Court rejected the analogy because the plaintiffs were unable to establish the traditional elements of a defamation claim because TransUnion’s allegedly defamatory statements were never actually communicated or published to a third party.

Given that plaintiffs will be required to identify a close historical or common-law analogue to any alleged statutory injury, the Supreme Court’s decision limits Congress’s ability to create new private rights of action, and this analysis will likely become even more complicated as Congress attempts to address new types of consumer harms, particularly in the data privacy space. Although it is not yet clear how the TransUnion decision will be applied in the context of other federal statutes, the Court’s recent decisions on standing underscore that Article III injury requirements will always apply to claims in federal court—regardless of whether Congress has taken affirmative steps to permit private enforcement of the statute. The Court’s emphasis on separation of powers could also mean that Congress will need to either carefully tailor all future legislation in accordance with traditional common law principles or provide alternative avenues for federal enforcement.