Key Points:

• The U.S. Supreme Court held that all members of a certified class must demonstrate that they suffered a concrete harm—such as physical injury or monetary loss—to have Article III standing to recover damages in federal court. 
• Notwithstanding that all class members had alleged violations of the FCRA, the Court held that such allegations “do not relieve courts of their responsibility to independently decide whether a plaintiff has suffered a concrete harm.”
• The Court also held that, for class members seeking retrospective damages, “the mere risk of future harm, without more, cannot qualify as a concrete harm” under Article III.
• The Court’s decision will likely have a significant impact in a variety of contexts where an alleged statutory violation does not necessarily result in concrete harm.

Since the U.S. Supreme Court’s 2016 decision in Spokeo v. Robins, which held that a procedural violation does not give rise to Article III standing for claims under the Fair Credit Reporting Act (FCRA), lower courts have grappled with what types of real-world scenarios confer such standing as to claims under the FCRA and other privacy statutes. Last Friday, the Court held in TransUnion v. Ramirez that “[o]nly plaintiffs concretely harmed by a defendant’s statutory violation have Article III standing to seek damages against that private defendant in federal court.” As the Court put it, “[n]o concrete harm, no standing.” The TransUnion decision is likely to further limit the ability of putative class action plaintiffs to sue in federal court for statutory violations that do not result in concrete and particularized harm.

Background

As we detailed in prior client alerts (here and here), the underlying litigation arises from allegations that TransUnion placed inaccurate alerts on credit reports of plaintiff Sergio Ramirez and over 8,000 class members. The alerts incorrectly matched the names of class members with individuals on the U.S. Department of the Treasury’s Office of Foreign Asset Control (OFAC) list of terrorists, drug traffickers, and other individuals prohibited from conducting business in the U.S. for national security reasons. Although Ramirez claimed that he experienced difficulty obtaining a loan because of the inaccurate alert on his credit file, the parties stipulated that more than 75 percent of the class did not have their credit reports disseminated to a third party. After the district court certified the class, a jury awarded Ramirez and the class $60 million in statutory and punitive damages. On appeal, the 9th Circuit held that even though the majority of class members did not have their credit reports disseminated to third parties, the mere fact that the credit reports were available to potential creditors and employers upon request showed a “material risk of harm” sufficient to confer standing to the entire class.

The Supreme Court’s Opinion

In a majority opinion authored by Justice Kavanaugh, the Supreme Court held that the 6,332 class members whose incorrect credit reports were not disseminated to third parties lacked standing to sue for failure to use reasonable procedures to protect the accuracy of their credit files. Notwithstanding that all class members alleged a statutory violation of the FCRA, that statutory prohibition does not “relieve courts of their responsibility to independently decide whether a plaintiff has suffered a concrete harm under Article III.” As the Court explained, “[a]n injury in law is not an injury in fact.” Instead, “[o]nly those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court.” Ramirez and the other 1,852 class members whose incorrect credit reports were provided to third parties satisfied this standard by demonstrating concrete reputational injuries. But the 6,332 class members who only alleged errors in reports that were never disseminated did not suffer such a concrete harm. As the Court explained, “[t]he mere presence of an inaccuracy in an internal credit file, if it is not disclosed to a third party, causes no concrete harm.”

The Court also rejected the argument that these 6,332 class members suffered a concrete injury “based on an asserted risk of future harm.” Relying on Spokeo, where the Court found a material risk of harm can sometimes “satisfy the requirement of concreteness,” the plaintiffs in TransUnion argued they had suffered a material risk that the incorrect information would be disseminated to third parties in the future. Applying the principle that plaintiffs must demonstrate standing for each form of relief sought, the Court explained that such risk of future harm might support standing to pursue injunctive relief. However, for plaintiffs seeking retrospective damages, “the mere risk of future harm, without more, cannot qualify as a concrete harm” under Article III. The Court thus concluded that the 6,332 class members lacked the requisite standing under Article III. Because “Article III does not give federal courts the power to order relief to any uninjured plaintiff, class action or not[,]” these class members’ lack of standing required reversal of the judgment below, and a remand for further proceedings at the 9th Circuit.

The main dissenting opinion, authored by Justice Thomas, argued that Spokeo foreclosed the majority’s “theory that risk of harm matters only for injunctive relief.” The dissent identified several scenarios where the risk of harm would be accompanied by concrete, albeit intangible, harms, and challenged the majority’s focus on the harms alleged and remedies sought as implicating policy judgments better left to the legislatures and juries.

Takeaways

The Supreme Court’s decision in TransUnion provides much-needed clarity as to the scope of federal court standing in the wake of Spokeo. Going forward, plaintiffs—whether in individual or putative class actions—will be prohibited from asserting claims arising from statutory violations, absent allegations of concrete harm resulting from the alleged violation. While an alleged increased risk of harm due to the statutory violation may support standing to pursue injunctive relief, such allegations should not suffice to support claims for damages on an individual or classwide basis.

The TransUnion holding thus will likely have significant impact in a variety of contexts where an alleged statutory violation does not necessarily result in concrete harm—including claims for violation of federal and state data privacy statutes, data breach claims and claims seeking prospective public injunctive relief. While that impact remains to be seen, there is hope for consistent outcomes across the circuits, given the bright-line rule established in TransUnion that absent concrete harm, an alleged statutory violation is not enough to confer Article III standing to sue for damages.