Predicting the Future of Privacy Class Actions After Oral Argument in TransUnion v. Ramirez

Last week, the U.S. Supreme Court heard oral argument on whether and to what extent class members' injuries and standing are relevant to class certification in TransUnion v. Ramirez. The complaint in the district court alleged that TransUnion violated requirements imposed on credit reporting agencies (CRAs) by the Fair Credit Reporting Act (FCRA) in failing to provide consumers with accurate and complete information and a summary of consumer rights.

The question presented to the Court was whether federal courts may certify classes in which the class members may have suffered injuries atypical of the class representative, and whether those injuries independently would be insufficient for Article III standing. Should the Court ultimately rule that injuries and standing must be considered at the class certification stage, it would have wide implications for plaintiffs bringing class actions under a host of consumer protection statutes, including the FCRA, as well as the Telephone Consumer Protection Act, and the Illinois Biometric Information Privacy Act.

Background

Plaintiff Ramirez filed his class action complaint in federal district court after he was unable to buy a car because his credit report, prepared by TransUnion, erroneously stated that his name was a potential match with a name on the terrorist list maintained by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC). For national security reasons, businesses are prohibited from transacting with individuals whose name matches those on the list (OFAC alert). Thousands of OFAC alerts were incorrectly placed on the credit reports of persons whose names were the same as or similar to the names of different individuals who were on the OFAC list.

When Ramirez first obtained a copy of his credit report from TransUnion, it did not show the OFAC alert. The alert was, however, included in the second report that TransUnion sent the next day. But the second report did not include the required summary-of-rights form, which is required to accompany credit reports informing consumers how to exercise their rights, including challenging inaccuracies in credit reports.

Ramirez testified that he was confused by these separate credit report mailings and was unsure how to have the OFAC alert removed. Thereafter, he filed a putative class action against TransUnion, alleging that TransUnion:

• Failed to maintain reasonable procedures to assure maximum possible accuracy of the information about him when preparing a consumer report;
• Violated its obligation to provide consumers, upon request, with all the information in their files, because it provided the OFAC alert information only in a separate contemporaneous mailing; and
• Violated its obligation to provide consumers with a summary of their rights, because it included the summary in the credit-report mailing but not in the separate, contemporaneous OFAC alert mailing.

Ramirez also alleged that all three violations were willful, entitling him to statutory and punitive damages.

TransUnion objected to class certification, arguing that of the 8,185 individuals labeled as potential OFAC matches, only 1,853 had their credit reports sold to third parties, and there was no evidence that any class member other than Ramirez had been denied credit because of the inaccurate OFAC alert. The district court rejected TransUnion's argument and certified the class. At trial, the jury returned a verdict in favor of the class on the three FCRA claims, and awarded the class $8.1 million in statutory damages and $52 million in punitive damages.

On appeal, a divided panel of the Ninth Circuit affirmed the verdict and damages award, holding that each class member satisfied Article III standing requirements. According to the court, Congress enacted the FCRA to protect consumers' concrete interests. The reasonable procedures, disclosure, and summary-of-rights requirements worked together to protect consumers' interests in providing them access to their credit reports, and informing them how to correct inaccurate information.

The court also found that there was a "material risk of harm" for all 8,185 class members due to the severe consequences that OFAC matches can cause upon their dissemination to third parties, regardless of whether or not a particular class member's OFAC alert was actually sent to a third party. Additionally, the court rejected TransUnion's atypicality claim, holding that the typicality inquiry focuses on the nature of the class representative's claim and not the specific facts from which the claim arose.

In the court's view, Ramirez's injuries arose from the same conduct that gave rise to the claims of the absent class members, and his claims were based on the same legal theory, even if Ramirez's injuries might have been more severe than those of other class members. Judge McKeown dissented on that issue, finding that there was no evidence that the absent class members "were in the same boat" as Ramirez.

Precedents: Spokeo and Gaos

Ramirez raises the same standing issue the U.S. Supreme Court addressed in Spokeo v. Robins, which DWT has written about previously. Spokeo held that plaintiffs must establish a concrete injury even in the context of a statutory violation. The named plaintiff in that case alleged that Spokeo had violated the FCRA by publishing incorrect information about him on the internet and harming his employment prospects.

While the Ninth Circuit had found the violation of a statutory right sufficient to confer standing, the U.S. Supreme Court disagreed, holding that a bare procedural violation, such as an incorrect zip code,¹ could not qualify as a concrete injury. In making this determination, the Court considered Congress's intent to elevate an injury to a concrete harm, and whether the alleged injury bears a close relationship to a harm that has traditionally been recognized in common law.

Standing was also an issue in Gaos v. Google, in which plaintiffs argued that Google violated the Stored Communications Act (SCA) by sharing users' internet search terms with third parties without their knowledge or consent. There, the U.S. Supreme Court faulted the Ninth Circuit for not addressing the standing issue:

[N]o court in this case has analyzed whether any named plaintiff has alleged SCA violations that are sufficiently concrete and particularized to support standing … We are a court of review, not of first view.

U.S. Supreme Court Hearing

Standing

At argument, TransUnion emphasized that the class members lacked standing and that Ramirez's claim was atypical (discussed below). Paul Clement, representing TransUnion, argued that inaccurate information lying dormant in a file that has neither been disseminated to third parties nor resulted in a denial of credit simply cannot pose a "material risk of harm."

According to Clement, the fact that the risk did not materialize was "a cause to break out the champagne," not a lawsuit, alluding to Justice Barrett's "no harm, no foul" holding in Casillas v. Madison Avenue Associates,² an opinion Justice Barrett authored while she was on the Seventh Circuit, affirming the dismissal of a Fair Debt Collection Practices Act class action for failing to satisfy Spokeo.

But the Court's conservative justices seemed to agree that there was harm with respect to the 1,853 class members whose inaccurate credit reports were furnished to third parties. Justice Alito questioned Clement whether there could be harm in the form of a psychological injury for those who had the inaccurate credit report disseminated to third parties, hinting that there might be a potential remedy if the case is remanded for a certification of a much smaller class.

Clement responded that knowledge alone cannot constitute an injury-in-fact, and even if it can, "only 25 percent of the class" suffered such injury. Justice Gorsuch continued this line of questioning by asking whether TransUnion's position is that the class members faced no material risk of harm or simply that they had no knowledge of it. Clement responded that it is a combination of both, and if the claim is one of emotional distress, the person has to have "knowledge of the thing that would cause the emotional distress[.]"

The federal government, arguing as amicus curiae, asserted that all class members have standing to bring reasonable procedures claims because they were wrongly labeled as potential matches to names on a terrorist list, which is "precisely the type of harm that Congress sought to prevent by adopting the reasonable procedures provision," and because defamation provides a common law analogue. The government also argued that all class members have standing to bring disclosure and summary-of-rights claims based on informational standing.

Chief Justice Roberts pointed out that a "potential" match is not the same as an actual match. Viewed from that perspective, one could argue that TransUnion had in fact accurately labeled the class members as potential matches. To this, the government responded that the FCRA does not require a showing of actual falsity, only that the CRAs follow reasonable procedures to assure maximum possible accuracy.

On rebuttal, Clement challenged the federal government's argument on this point, stating, "if you go to the OFAC website today and type in [Ramirez's] name, you will get a hit." If this is "good enough for the government," he said, then it is questionable why TransUnion would be held to a higher standard.

Clement also argued that if material risk is enough to confer standing, federal courts would be "open to all sorts of trivial injuries," and plaintiffs might bring a case simply because a defendant's conduct posed a risk of harm, even if there was no actual injury. What's more, "there are people in our system of government," called prosecutors, "who do get to pursue violations of federal statutes without suffering injuries in fact," he said. Federal courts, in essence, are an inappropriate forum in light of other avenues that exist to remedy statutory violations.

Samuel Issacharoff, representing the class, focused his argument on the concrete harm established at trial. He contended that every class member had standing because "[b]eing labeled a potential OFAC match is not a misreported ZIP code. It is the scarlet letter of our time." However, the justices seemed skeptical about the concreteness of the absent class members' injury when there was no knowledge of the risk at all.

Chief Justice Roberts posed a hypothetical on the knowledge issue, asking Issacharoff whether a person, who later finds out that he has a cause of action for a risk that he was previously exposed to, but did not know about, would have standing. Issacharoff responded that there would be standing, pointing out that "Spokeo runs the inquiry about the risk of harm together with the scope of the congressional interest."

Chief Justice Roberts remained skeptical, however, that there is any concrete injury in his hypothetical. Issacharoff responded that "Spokeo addresses the question of material risk and does not do so in terms of one's subjective knowledge." The right question, he continued, is whether there was a material risk of harm and whether Congress sought to deter parties from engaging in a behavior that creates such a risk by providing a cause of action in the FCRA.

Justice Alito posed another hypothetical in which a computer program would flag individuals whose first and last name corresponded to those on the terrorist list. "Do you think that everybody would have suffered an injury-in-fact," he asked, "even if there never was an inquiry regarding that person?" Continuing this line of questioning, Justice Alito asked Issacharoff to provide a common law analogue "where a suit could be brought to recover for having been subjected to a risk in the past even though the person had no knowledge" of it.

Issacharoff responded that there would be an injury-in-fact in Justice Alito's hypothetical because TransUnion's business is heavily dependent on selling consumer information to third parties. "No dissemination, no profit," he stated. Issacharoff also noted that in common law, defamation per se presumes injury, and given that "[m]ost Americans have no idea when their credit files are being accessed," common law would not have required knowledge in this case.

Justice Gorsuch seemed to agree with Issacharoff on the common law defamation argument, but Justice Kavanaugh was skeptical, telling Issacharoff, "I think you have a good argument with respect to the 1,853 in terms of the reasonable procedures, but I'm more concerned about the 6,332, whose information was not, in essence, published."

Justice Barrett seemed to agree on this point, asking Issacharoff whether it would be possible to have a bare procedural violation at all "with respect to any of [the] consumer protection statutes like [the] FCRA." She also expressed skepticism of the Ninth Circuit's finding of concrete injury on the grounds that TransUnion's two-part correspondence was "inherently shocking and confusing," which, in her view, is a factor that bears "on how egregious TransUnion's behavior was," not on the concreteness of the injury.

Justice Alito, who authored the majority opinion in Spokeo, acknowledged that "Spokeo's discussion of harm is quite clipped and [is] potentially subject to different interpretations." This statement, along with the justices' questions during the oral argument, suggests that the Court could take a strict view of Article III standing and remand the case so that the class certification would be limited to a narrower class, and potentially issue a ruling that would clarify the meaning of Spokeo.

Typicality

As for the typicality argument, Clement argued that the vast majority of absent class members did not know about the violation, never had a credit report sold to a third party, and did not suffer a denial of credit or similar injuries like Ramirez. Justice Breyer questioned why TransUnion failed to raise this issue at trial. Specifically, TransUnion could have "objected to the introduction of … separate and special information about Ramirez" on the ground that it had nothing to do with the injury suffered by the class and was prejudicial.

Justice Sotomayor pressed further, stating that the Federal Rules of Civil Procedure 23(a)(3) require "typical claims and defenses." Ramirez's claims were not subject to any unique defenses, and were identical to every class member's claims. "Is TransUnion suggesting," she asked, "that Rule 23(a)(3) require typical damages?"

Justice Sotomayor also appeared to agree with Justice Breyer that there was "a very reasonable way to handle" the typicality issue. Namely, TransUnion had the opportunity to use a verdict form that would have allowed the jury to award different statutory damages for class members who experienced different harms, but it did not ask for the form. Therefore, Justice Sotomayor expressed the view that she sees TransUnion's argument on typicality "as a trial error, not as an error in certifying the class."

As a note, the record reflects that before trial, TransUnion did challenge typicality in a motion to decertify the class, which the district court denied. In addition, the federal government, in its amicus brief, suggested that atypicality of the class representative's claims justified a remand here, and that the Court "should vacate the judgment below and remand the case to permit the court of appeals to reconsider whether respondent's particularly severe injuries defeat typicality."

The federal government argued that the lower court assessed TransUnion's typicality argument under the wrong legal framework, which may or may not have resulted in an improper certification of the class, but it refused to take the position that the error constituted an abuse of discretion. Justice Thomas followed up, asking what the government thinks is atypical about Ramirez's claim.

The federal government responded that a dictionary definition of a "claim" includes the relief that is requested. Therefore, courts should consider the injuries that result from an individual's experience, and while TransUnion's actions may have been the same as to all class members, Ramirez's experience "might have some impact on what is and what is not relevant for the purpose of proving a claim."

Further, the federal government argued that in the statutory damages context where the jury is charged with setting the amount of damages within a range upon hearing an extensive testimony by the class representative, there is a typicality problem because the class representative's specific experience is not indicative of what happened to the absent class members, who "might benefit from that in a way that they really shouldn't." Considering a class representative's injury in comparison to other class members' injuries may be a significant change in evaluating typicality at the class certification stage.

Implications

The Ramirez lawsuit is an example where the class certification is based solely on a statutory violation without any concrete injury. Although Spokeo has clearly barred claims that are based on a bare procedural violation of a statute, courts have struggled to interpret state and federal statutes that impose statutory damages for technical violations.

Should the Court rule that absent class member standing must be considered at the class certification stage, plaintiffs looking to bring class actions under a host of consumer protection statutes, such as the FCRA, TCPA, and Illinois BIPA, would be at a significant disadvantage. This is good news for businesses that may now challenge a class for failing to satisfy Article III standing early on, instead of being able to only challenge standing of the class representative.

The issue of what constitutes a material risk of harm sufficient for Article III standing also allows the U.S. Supreme Court to clarify its standing requirement established in Spokeo and Clapper v. Amnesty International,³ which, in a case where the allegation is based on a future injury that has not materialized, requires plaintiffs to demonstrate that the harm is "certainly impending."

While the plaintiffs in Ramirez are seeking retrospective relief for the defendant's past conduct, injury-in-fact has been a key issue in data breach cases, where plaintiffs often allege that their personal information has been improperly disclosed even if not misused. A further guidance on what constitutes a sufficient risk of harm would allow businesses to seek early dismissal of cases that are based on an innovative but speculative theory of harm, which constitutes, at most, a technical violation.

If the Court holds that even if the defendant's past conduct posed a significant risk of harm, and there is no injury-in-fact if that harm never materializes, the Spokeo decision would be strengthened to bar any claim that the mere risk of having a credit report disseminated constitutes a concrete injury. The Court could even go further to find that the dissemination must result in an adverse action to properly allege an injury-in-fact.

The number of hypotheticals posed by the justices on the issue of harm, and the skepticism expressed by the justices, provide some indication that the Court is reluctant to open the floodgate of litigation by recognizing Ramirez's argument that simply maintaining inaccurate information about consumers constitutes a material risk of harm, as recognized by the Ninth Circuit.

While the issue of typicality received less attention during the oral argument, the question still remains: If the plaintiff's injury is not characteristic of that of other class members, does that defeat typicality in a damages class action?

Justice Breyer and Justice Sotomayor appeared receptive to Ramirez's argument that the severity of the injury did not make his claim atypical, and even if it did, TransUnion should have addressed it by raising a timely objection at trial. Going forward, companies should heed this instruction and move to exclude any information that is specific to the class representative but inapplicable to absent class members at the trial level, or consider adding provisions to a verdict form requesting different statutory damages for different harms.

Despite the comparative lack of discussion on typicality, it is important to note that the federal government sided with TransUnion on this issue, arguing that courts must evaluate the class representative's injury when determining whether the typicality requirement is met. The federal government further argued, in its amicus brief, that:

If a plaintiff who suffered atypical injuries is permitted to represent a class, a jury might over- or under-value the impact that a defendant's conduct had on other class members, and accordingly set statutory damages at too high or low an amount.

There is no doubt this case will significantly influence strategies in opposing class certification the way Spokeo influenced challenges to standing. A decision is expected by the end of the term in June. DWT will provide a further update on the outcome.

FOOTNOTES

1  Another example of a bare procedural violation includes printing ten digits of a consumer's credit card on a receipt (FCRA requires companies to print only the last four digits). See Kamal v. J. Crew Group, 918 F.3d 102 (3d Cir. 2019).
2  926 F.3d 329, 331 (7th Cir. 2019).
3  568 U.S. 398 (2013).