On November 18, 2020, the United States District Court for the Central District of California (the “Central District”) dismissed the First Amended Complaint of putative class representatives asserting a FCRA claim against Experian in connection with a data breach in October 2017. Tailford v. Experian Info. Sols., 2020 WL 6867157 (C.D. Cal. Nov. 18, 2020). This was not the first case filed by the Plaintiffs and not the first time their class action claims have been dismissed.
On October 6, 2017, a data breach of Experian’s October 2013 ConsumerView database file was discovered that was purportedly caused by data analytics company Alteryx, Inc. The data allegedly contained “thousands of attributes on more than 300 million consumers and 126 million households including age, gender, marital status, the presence of children, homeowner status, education and occupation” as well as Behavioral Data such as purchase history and household income. Tailford, 2020 WL 6867157, *1. In response to this breach, the Plaintiffs requested from Experian a disclosure of the information Experian maintained on them, pursuant to FCRA Section 1681g(a).
Plaintiffs claimed that the disclosures Experian provided in response to their requests were deficient. Section 1681g(a) provides that “[e]very consumer reporting agency shall, upon request, and subject to section 1681h(a)(1) of this title, clearly and accurately disclose to the consumer: (1) All information in the consumer’s file at the time of the request [except the complete social security number of the consumer in certain instances and credit scores or other risk sources relating to the consumer], … (3) identification of each person … that procured a consumer report … [and] (5) A record of all inquiries received by the agency during the 1-year period preceding the request that identified the consumer in connection with a credit or insurance transaction that was not initiated by the consumer….” 15 U.S.C. § 1681g(a). Here, the Plaintiffs contended that Experian violated this section 1681g(a)(1) by failing to disclose the Behavioral Data, soft credit inquiries, and the dates on which employers reported the Plaintiffs’ dates of employment.
In its opinion, the Central District explained that under FCRA Section 1681g(a), only information which “might be furnished, or has been furnished, in a consumer report on that consumer” is required to be disclosed, despite the broad definition of consumer file in FCRA. 2020 WL 6867157, *2 (C.D. Cal. Nov. 18, 2020) (quoting Shaw v. Experian Info. Sols. Inc., 891 F.3d 749, 759 (9th Cir. 2018). The Court noted that the allegations of the First Amended Complaint admitted that the Behavioral Data was not used to determine a consumer’s eligibility for credit, insurance or employment, and failed to allege that the Behavioral Data had been furnished in a consumer report or was intended to be furnished in the future. As such, the Central District granted Experian’s Motion to Dismiss the claim for alleged violations of 1681g(a)(1).
The Central District also dismissed the Plaintiffs’ claim that Experian violated Section 1681g(a)(3) by failing to disclose the identity of the end-users of the consumer report. The Central District found that FCRA does not require the identity of the end-users, but rather only those persons or entities which procure a consumer report. Although the Plaintiffs alleged that Experian failed to disclose that Alteryx, the data analytics company, obtained Behavioral Data, the Central District rejected this theory finding that the Plaintiffs did not allege that Alteryx procured the data or that the Behavioral Data was a consumer report.
The Central District finally rejected the Plaintiffs’ second attempt at an amended claim for violations of Section 1681g(a)(5) holding that the Plaintiffs failed to do more the speculate or offer hypothetical averments to support their allegations that Experian omitted “inquiries were made in connection with credit or insurance transactions that Plaintiffs did not initiate.” Tailford¸ supra, 2020 WL 6867157, *5. The Central District ruled that “Plaintiffs know whether they initiated a credit or insurance transaction with the relevant entities. Their failure to allege that they did not do so is fatal to their 1681g(a)(5) claims.” Id.
For similar reasons, the Central District also dismissed the Plaintiffs’ claim that Experian allegedly violated Section 1681(b) which provides that Experian may furnish a consumer report when there is a permissible purpose to do so. The Central District found that again, the Plaintiffs had failed to plausibly allege that the entities to which Experian furnished consumer reports did not have a permissible purpose for obtaining said reports or that “Experian lacked any reason to believe that the credit information disclosed would be used for a proper purpose.” Id. at *6.
While the dismissal of the Plaintiffs’ First Amended Complaint largely turned on a failure to adequately and plausibly plead their claims, the Central District’s ruling makes clear, however, that not all data collected and maintained by a consumer reporting agency like Experian is subject to disclosure under Section 1681g.