Data privacy continues to be an important issue for legislators at both the state and federal levels, and a frequent consideration for privacy legislation is whether consumers will be able to sue those who violate their privacy rights. The availability of federal courts to hear litigation implicates the constitutional doctrine of standing: the notion that a federal court may only hear a claim that alleges a "case or controversy" between the plaintiff and the defendant. In the Supreme Court's recent decision in TransUnion, LLC v. Ramirez, the Court addressed whether a class of more than 8,000 plaintiffs alleging violations of the Fair Credit Reporting Act (FCRA) had standing given that many of the plaintiffs alleged no harm other than the FCRA violations themselves. The Court's analysis in TransUnion and the outcome of the case—in which the Court determined that only 1,853 class members had standing to sue—may be a blueprint for federal courts addressing questions of standing in future claims involving privacy rights or other statutory violations. This Legal Sidebar briefly outlines the doctrine of standing before turning to a discussion of the Supreme Court's opinion in TransUnion. The Sidebar concludes with considerations for federal privacy legislation in light of TransUnion.
Constitutional Standing
Standing has its roots in Article III of the Constitution, which sets forth the powers of the federal judiciary and limits that power to resolving "Cases" and "Controversies." Constitutional standing is thus often called Article III standing. In some circumstances, federal courts also address non-constitutional (or prudential) issues of standing. While Congress may abrogate prudential standing through legislation, it has no power to alter the standards for Article III standing.
A general principle of Article III standing is that a plaintiff must have a "personal stake" in the outcome of a given case. Courts evaluate a plaintiff's Article III standing by assessing three factors: the plaintiff must have (1) an actual or imminent concrete and particularized injury (2) that was likely caused by the defendant and (3) may likely be redressed through judicial relief. In many cases, standing will turn on whether the plaintiff's alleged injury is sufficiently "concrete" to satisfy the first factor. The Supreme Court has held that an injury must "actually exist" to be considered concrete. In Spokeo, Inc. v. Robins, the Court held that a "bare procedural violation" would not qualify as a concrete harm, but elaborated that an intangible harm may satisfy the concrete harm requirement if it "has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." The Court further observed that Congress has a role in "identify[ing] intangible harms" that support Article III standing when those harms are "concrete, de facto injuries that were previously inadequate in law."
The TransUnion Decision
The issue in TransUnion was whether a class of 8,185 individuals alleging violations of the FCRA had suffered a sufficiently concrete harm to have Article III standing to sue in federal court. A car dealer declined to sell a vehicle to the named plaintiff, Sergio Ramirez, after a credit check flagged him as having a first and last name matching an individual on a list of known criminals maintained by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC). Ramirez contacted TransUnion, the credit reporting agency that reported Ramirez as a "potential match" to the name on the OFAC list, to request a copy of his credit file. After receiving two mailings that he suspected were incomplete, Ramirez sued TransUnion.
Besides suing TransUnion in his individual capacity, Ramirez sought to represent a class of 8,185 individuals who had received mailings from TransUnion about potential matches to the OFAC list. TransUnion had distributed the credit reports of only 1,853 of the putative class members to prospective creditors that included the "potential match" alert. A federal trial court ruled that all 8,185 members of the class had Article III standing, and on appeal, the U.S. Court of Appeals for the Ninth Circuit agreed, concluding that the class members all "suffered a material risk of harm to their concrete interests."
The Supreme Court reversed, holding that only the 1,853 people whose credit reports TransUnion had distributed to prospective creditors had suffered a concrete harm that would support Article III standing. Writing for the majority, Justice Kavanaugh observed that the Court in Spokeo had rejected the notion that an injury is concrete any time a statute creates a private right of action, emphasizing that Congress alone may not "relieve courts of their responsibility to independently decide whether a plaintiff has suffered a concrete harm under Article III." Thus, the FCRA violations alleged by Ramirez and the class—that TransUnion had not ensured the accuracy of credit files and had not provided complete credit files to class members who requested them—would not, by themselves, confer standing on the class members.
The Court recognized that members of the class whose credit reports had been transmitted to potential creditors had suffered an injury akin to "reputational harm" recognized in American courts. However, for the rest of the class, Justice Kavanaugh determined that the mere existence of inaccurate information, without that information being shared with others, would not constitute a concrete harm. Justice Thomas, joined by three other Justices, dissented. He argued that a legally recognized injury should support Article III standing, even if it is not "concrete."
TransUnion builds on the Court's reasoning in Spokeo, which one federal court of appeals judge has described as "more difficult" to apply in practice than in theory. In Spokeo, the Court held that a "bare procedural violation" would not satisfy the concrete harm requirement for Article III standing. Lower courts have sparred over the contours of that threshold: for example, the Eleventh Circuit held that printing 10 digits of a customer's credit card on a receipt was not a concrete harm, while the D.C. Circuit held that printing 16 digits was.
Considerations for Privacy Legislation
TransUnion may provide more direction on how to assess intangible harms for Article III standing, particularly in cases based on alleged harms similar to FCRA violations. Many contemporary privacy laws and proposals create new consumer rights in personal data. Some of these rights echo rights in the FCRA. For example, a consumer's right to view or obtain personal information held by a particular company is similar to an individual's right under the FCRA to request a complete credit file. Thus, these similar rights may be the type of statutorily created "injuries in law" that would not give rise to standing under the Court's TransUnion analysis. Proposed legislation that would allow consumers to sue for violating privacy rights, such as the Online Privacy Act from the 116th Congress, might face standing barriers that could prevent consumers from bringing lawsuits in federal court.
Privacy laws may avoid creating standing obstacles for private plaintiffs in several ways. The California Consumer Privacy Act includes a private right of action, but a consumer may only sue if that consumer's information is accessed or disclosed without authorization. Requirements that a private lawsuit allege an actual misuse or disclosure of an individual's private information also might increase the likelihood that such a lawsuit would clear the "concrete harm" threshold, given that Justice Kavanaugh's analysis in TransUnion distinguishes between information that has and has not been disclosed. Proposals that disallow private rights of action, such as the Consumer Data Privacy and Security Act, also avoid raising issues of standing. Another issue, raised by a footnote in Justice Thomas's dissent, is that Article III constrains only the federal judicial power: an individual who lacks Article III standing may still be able to litigate their claims in a state court. Accordingly, while TransUnion may affect how existing and future privacy legislation will be enforced, it does not entirely foreclose the ability of such legislation to empower individuals to enforce privacy rights through private litigation.