Fair Credit Reporting Act Litigation Developments on Standing
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Fair Credit Reporting Act Litigation Developments
on Standing
By Joseph F. Yenouskas and Tierney E. Smith*
INTRODUCTION
This survey summarizes recent cases examining whether plaintiffs have Article
III standing to maintain Fair Credit Reporting Act (“FCRA”)1 claims after the U.S.
Supreme Court’s seminal decision in Spokeo, Inc. v. Robins.2 This past year, the
Ninth Circuit decided Ramirez v. TransUnion LLC,3 concluding that class members
whose information had not been shared had standing because each was exposed
to a risk of harm to their concrete privacy, reputational, and informational inter-
ests. However, in so deciding, the court failed to tether its decision to Supreme
Court precedent or a coherent notion of what “risk” means. Separately, federal
court decisions from this past year establish a potentially conflicting understand-
ing of whether violations of FCRA provisions designed to protect a consumer’s
concrete privacy interests are sufficient to confer standing. Together, these deci-
sions show the need for further clarity from the Supreme Court about the requi-
site degree of harm needed to establish standing for FCRA cases in federal court.
RAMIREZ V. TRANSUNION LLC
In Ramirez v. TransUnion LLC, the named plaintiff brought three FCRA claims
against TransUnion on behalf of a class of approximately 8,000 individuals. The
plaintiff alleged that TransUnion failed to follow reasonable procedures to assure
the accuracy of information that TransUnion collected from the U.S. Department
of Treasury’s Office of Foreign Assets Control (“OFAC”) list of specially desig-
nated nationals, and it reported the information as OFAC alerts on the class
members’ credit reports, if applicable.4 The OFAC list consists of individuals
* Joseph F. Yenouskas is partner in the Washington, D.C. office of Goodwin Procter LLP who spe-
cializes in consumer financial services litigation. Tierney E. Smith is an associate in the Washington,
D.C. office of Goodwin Procter LLP.
1. Fair Credit Reporting Act, Pub. L. No. 91-508, tit. VI, 84 Stat. 1114, 1127–36 (1970) (codified
as amended at 15 U.S.C. §§ 1681–1681x (2018)).
2. 136 S. Ct. 1540 (2016) [hereinafter Spokeo II]. In Spokeo II, the United States Supreme Court
held that “Article III standing requires a concrete injury even in the context of a statutory violation.”
Id. at 1549.
3. 951 F.3d 1008 (9th Cir. 2020).
4. Id. at 1024, 1029.
713714 The Business Lawyer; Vol. 76, Spring 2021
who are prohibited from transacting business in the United States for national
security reasons, and TransUnion would add OFAC alerts to consumers’ credit
reports if, after its vendor conducted basic first-and-last-name searches, the con-
sumers’ names matched a name on the OFAC list.5 The plaintiffs alleged that
they suffered a concrete injury as a result of the OFAC information being re-
ported on their credit reports because the information inaccurately labeled
them as being persons on the OFAC list, and because they received confusing
and incomplete mailings from TransUnion regarding the OFAC information.6
In its decision, the Ninth Circuit first addressed the question of who must show
standing in a class action at the final stage of a damages suit in federal court and
held that each member of a class certified under Rule 23 must satisfy the “bare
minimum” of Article III standing in order to recover monetary damages.7 Next,
the court asked whether each of the class members had standing for each of
the three claims they asserted, holding that a plaintiff must demonstrate standing
for each claim he or she seeks to press.8 The court applied the two-part inquiry
established in Spokeo for determining whether the violation of a statutory right
constitutes concrete inquiry: (1) whether the statutory provisions at issue were
established to protect the plaintiff ’s concrete interests (as opposed to purely pro-
cedural rights), and if so, (2) whether the specific procedural violations alleged
actually harm or present a material risk of harm to such interests.9
As to the class members’ reasonable procedures claim under FCRA section
1681e(b) and the first prong of the Spokeo test,10 the Ramirez court held that
it was “clear” that Congress enacted the FCRA to protect consumers’ concrete
interests, and that the reasonable procedures requirement is “particularly impor-
tant” because “the threat to a consumer’s livelihood is caused by the very exis-
tence of inaccurate information in his credit report.”11 On the second prong
of the test, the court found that standing was also clear for all class members
for several reasons: (1) “the nature of the inaccuracy is severe,” because
“OFAC labels are the type of information that risks triggering significant concern,
confusion, and even potential contact with a federal intelligence agency”; (2)
TransUnion shared the OFAC information with a third-party vendor, which
“certainly compounds the risk of harm to all class members’ privacy and repu-
tational interests”; and (3) TransUnion made class members’ reports available
to potential creditors or employers.12 Even though approximately 6,000 class
members’ reports were not disseminated to third parties, and instead were
5. Id. at 1016.
6. Id. at 1017.
7. Id. at 1017, 1023.
8. Id. at 1024.
9. Id. at 1025 (citing Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017) [hereinafter
Spokeo III]).
10. Under section 1681e(b) of the FCRA, “[w]henever a [CRA] prepares a consumer report it shall
follow reasonable procedures to assure maximum possible accuracy of the information concerning
the individual about whom the report relates.” 15 U.S.C. § 1681e(b) (2018).
11. Ramirez, 951 F.3d at 1025 (citing Spokeo III, 867 F.3d at 1113–14).
12. Id. at 1026–27.Fair Credit Reporting Act Litigation Developments on Standing 715 sent solely to the class members themselves, the Ninth Circuit found that those individuals still had an injury-in-fact. TransUnion “ma[king] the reports avail- able” alongside other factors contributing to the severity of the inaccuracy were together sufficient to create “a material risk of harm.”13 Although the Ramirez court’s analysis of the class members’ standing as to their reasonable procedures claim relied primarily on Spokeo,14 it conceded that Spokeo “did not consider whether a plaintiff would allege a concrete harm if he alleged only that a materially inaccurate report about him was prepared but never published.”15 Indeed, that issue was not salient to Spokeo because there, the defendant consumer reporting agency (“CRA”) published inaccurate information about the named plaintiff on its website.16 The Ramirez court cited to no other precedent to support its finding that a real risk of harm arose for all class members when TransUnion merely prepared reports about them that could be disseminated to third parties.17 Instead, the court seemed to find support for its holding by distinguishing the facts of the case from other cases in which a finding of concrete harm was not found. For example, the Ninth Circuit distinguished a D.C. Circuit case, Owner- Operator Independent Drivers Association, Inc. v. United States Department of Trans- portation,18 where the plaintiffs argued that they were injured by inaccurate information about them that was maintained in a database operated by the Federal Motor Carrier Safety Administration.19 The Ramirez court explained that, whereas in Owner-Operator the court found that the record showed that any risk of future disclosure of the information was “virtually eliminated,”20 “[h]ere, by contrast, the class’s claim of injury does not simply rest on TransUnion’s maintenance of an inaccurate database, with conclusive evidence that there is no risk of dissemination.”21 The Ninth Circuit also found that other out-of-circuit cases were distinguish- able because, for instance, they involved printing private financial information on credit card receipts, which, unlike credit reports, do not “exist for the pur- pose of being disseminated to third parties.”22 Moreover, the risk of harm in Ramirez was “much more direct” because “[a]n OFAC alert placed on a credit report runs an almost inevitable risk of reputational harm, emotional distress, and/or denial of credit or employment if disclosed to a third party.”23 The court held that this was not like the risk of harm from printing the expiration 13. Id. at 1027 (emphasis added). 14. The Ninth Circuit relied on both the Supreme Court’s decision in Spokeo II and the Ninth Cir- cuit’s decision on remand, Spokeo III. 15. Ramirez, 951 F.3d at 1027 (citing Spokeo III, 867 F.3d at 1116 n.3) (emphases omitted). 16. Id. at 1024–25 (citing Spokeo III, 867 F.3d at 1111). 17. Id. at 1028. 18. 879 F.3d 339 (D.C. Cir. 2018). 19. Ramirez, 951 F.3d at 1028 (citing Owner-Operator, 879 F.3d at 343). 20. Id. 21. Id. at 1028. 22. Id. at 1028 n.9. 23. Id.
716 The Business Lawyer; Vol. 76, Spring 2021
date of a credit card on a credit card receipt because there, it said, without ex-
planation, that “harm would only materialize if a number of other contingencies
occurred.”24
With respect to the claimed violations of FCRA sections 1681g(a) and
1681g(c)(2),25 the Ninth Circuit held that those provisions protect consumers’
interests in having access to the information in their credit reports, and “they
go to the core of Congress’s purpose in enacting the FCRA: to protect consumers
from the transmission of inaccurate information about them.”26 It elaborated:
“These are not mere procedural or technical requirements. They protect consum-
ers’ concrete interest in accessing important information about themselves and
understanding how to dispute inaccurate information before it reaches potential
creditors.”27 Accordingly, it found that step one of the Spokeo framework was
satisfied for both claims.28 On step two, the Ramirez court summarily found
that “TransUnion’s disclosure violations exposed all class members to a material
risk of harm to their concrete informational interests” where it sent class mem-
bers a “document that purported to be their entire credit report, containing no
mention of OFAC,” and then “sent the class members the separate OFAC Letter
without a summary-of-rights form.”29 That conduct put class members at risk of
not knowing what information was actually on their credit reports, or how to get
information off their reports.30
As with the class members’ reasonable procedures claim, the Ninth Circuit
rejected the notion that, to establish standing, all class members must have
shown evidence that they were actually harmed.31 Instead, the court found
that all members of the class had standing on their section 1681g claims because
they were all “falsely labeled by TransUnion as terrorists and national security
threats,” and TransUnion sent them mailings that “were inherently shocking
and confusing.”32 In so finding, the court did not address the possibility that
some class members may not have ever read those mailings, and thus could
not have been shocked or confused by them, however inherently shocking
and confusing they were.
24. Id.
25. Section 1681g(a) requires CRAs to “clearly and accurately disclose to the consumer,” upon re-
quest, “[a]ll information in the consumer’s file at the time of the request,” with limited exceptions. 15
U.S.C. § 1681g(a) (2018). Section 1681g(c)(2) requires CRAs to provide to a consumer, with each
written disclosure, a “summary of rights” prepared by the Consumer Financial Protection Bureau.
Id. § 1681g(c)(2).
26. Ramirez, 951 F.3d at 1029 (citing Guimond v. TransUnion Credit Info. Co., 45 F.3d 1329,
1333 (9th Cir. 1995) (internal quotation marks omitted)). The court explained that “[a]lthough
we must analyze standing on a claim-by-claim basis, the injuries produced by these two violations
are closely intertwined,” such that a combined discussion of standing for the claims could follow. Id.
27. Id.
28. Id.
29. Id. at 1030.
30. Id.
31. Id. at 1030 n.10.
32. Id.Fair Credit Reporting Act Litigation Developments on Standing 717 “MATERIAL RISK OF HARM” FOLLOWING RAMIREZ Two Ninth Circuit decisions following Ramirez illustrate how that court mea- sures the sufficiency of a plaintiff ’s alleged “material risk of harm” within the context of the Spokeo two-part test. First, in April 2020, the Ninth Circuit deter- mined in Foskaris v. Experian Information Solutions, Inc.33 that the plaintiff had standing on his claim brought under FCRA section 1681g(a)(1) that Experian failed to include in its consumer disclosures to him the “permissible purpose” behind each soft credit inquiry listed on the disclosures.34 Applying the two- part Spokeo test, the court found that section 1681g(a)(1), which requires CRAs to disclose all information in a consumer’s file upon request, protects the plaintiff ’s concrete interest in accessing important information about his credit, and the plaintiff sufficiently pleaded that he suffered a material risk of harm to that interest because he was confused and unable to monitor Experian’s disclosure of his credit information to third parties without the information.35 However, one month later, the Ninth Circuit affirmed the district court’s dis- missal of the plaintiff ’s claims brought under FCRA section 1681s-2(b) in Hogue v. Silver State Schools Credit Union.36 The plaintiff alleged that the defendant vi- olated section 1681s-2(b) by failing to adequately investigate credit information about the plaintiff ’s auto loan, which was discharged through bankruptcy but which the defendant nevertheless included on a report about the plaintiff to Ex- perian.37 The Hogue court found that the first prong of the two-prong Spokeo test was satisfied, i.e., whether the statutory provision at issue was established to pro- tect the plaintiff ’s concrete interests, because “the FCRA was established to pro- tect consumers’ concrete interests.”38 However, the court found that the plaintiff had not satisfied the second prong of the test, i.e., whether the specific proce- dural violations actually harmed or presented a material risk of harm to the pro- tected interests.39 It found that the plaintiff had not shown “actual harm to his concrete interests” where no third party had ever made an adverse credit deci- sion as to the plaintiff based on the disputed information on the report to Experian, and when the disputed account came up on the plaintiff ’s work back- ground check, there was no harm: his job was not affected.40 Further, the Hogue court found that the plaintiff had not established a material risk of harm because the plaintiff “must show a risk that the disputed information could be dissemi- nated and that such dissemination would present a material risk of harm,” and here, there was no risk that the disputed information would be disseminated to 33. 808 F. App’x 436 (9th Cir. 2020). 34. Id. at 438–39. 35. Id. 36. 814 F. App’x 230, 233 (9th Cir. 2020). 37. Id. at 231; see also Hogue v. Allied Collection Serv., Inc., No. 2:16-CV-1620 JCM (VCF), 2018 U.S. Dist. LEXIS 19995, at *2 (D. Nev. Feb. 7, 2018) (“The instant dispute involves allegations that Silver State erroneously reported plaintiff ’s derogatory credit information to Experian in violation of the Fair Credit Reporting Act.”). 38. Hogue, 814 F. App’x at 232. 39. Id. 40. Id.
718 The Business Lawyer; Vol. 76, Spring 2021 third parties because it was not published in a consumer report, viewable by third parties.41 Moreover, the plaintiff had not alleged a material risk that disse- mination would harm him.42 RECENT FCRA DECISIONS REVEAL A POTENTIALLY CONFLICTING PERSPECTIVE ABOUT THE IMPORTANCE OF CONSUMERS’ PRIVACY INTERESTS Consistent with the Ninth Circuit’s willingness to find that class members were harmed because reports were prepared about them that could expose them to reputational injury in Ramirez, the Ninth Circuit held in another deci- sion that a violation of a provision of the FCRA designed to protect consumers’ privacy interests, without more, was sufficient to confer standing. In Nayab v. Capital One Bank (USA), N.A.,43 the Ninth Circuit held that “a con- sumer suffers a concrete injury in fact when a third-party obtains her credit re- port for a purpose not authorized by the FCRA.”44 It found that the plaintiff had standing to pursue her FCRA claim based on the defendant’s alleged violation of section 1681b(f )(1), which prohibits obtaining a credit report for a purpose not otherwise authorized, because that provision “protects the consumer’s substantive privacy interest.”45 The Nayab court distinguished between section 1681b(f )(1) and other unidentified statutory provisions, holding that “[t]he section does not merely ‘describe a procedure’ that one must follow.”46 Instead, it held that be- cause “every violation of § 1681b(f )(1) offends the interest that the statute pro- tects,” the plaintiff “need not allege any further harm to have standing.”47 The Nayab court explained that its prior decisions, historical practice, and the judgment of Congress also supported a finding of standing for the plaintiff on her section 1681b(f )(1) claim. For example, in Syed v. M-I, LLC,48 the Ninth Cir- cuit found the right to privacy in one’s consumer report confers standing.49 Fur- ther, “[t]he harm attending a violation of § 1681b(f )(1)” is closely related to or the same as “a harm that has traditionally been regarded as providing a basis for a lawsuit: intrusion upon seclusion (one form of the tort of invasion of privacy).”50 The Syed court explained that it has recognized that privacy torts including the tort of intrusion upon seclusion “do not always require additional consequences 41. Id. 42. Id. 43. 942 F.3d 480 (9th Cir. 2019). 44. Id. at 487. 45. Id. at 490. 46. Id. 47. Id. (citing Eichenberger v. ESPN, Inc., 876 F.3d 979, 983–84 (9th Cir. 2017) (internal quo- tation marks omitted)). 48. 853 F.3d 492 (9th Cir. 2017), cert. denied, 138 S. Ct. 447 (2017). 49. Nayab, 942 F.3d at 491 (citing Syed, 853 F.3d at 499) (plaintiff ’s allegations that his prospec- tive employer procured his consumer report based on an illegal disclosure and authorization form was sufficient to infer that he was deprived of the right to privacy guaranteed by the FCRA). 50. Id.
Fair Credit Reporting Act Litigation Developments on Standing 719 to be actionable.”51 Finally, Congress recognized in passing the FCRA “the need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer’s right to privacy.”52 The Ninth Circuit noted that Congress’ concern for privacy in one’s consumer report is made clear within the FCRA’s general prohibition against obtaining a consumer report except in limited circumstances; its provision of civil liability for violations of the FCRA, including statutory damages for willful violations; and its provision of criminal and civil liability for those obtaining a credit report under false pretenses.53 By contrast, the Seventh Circuit affirmed the district court’s finding in Crabtree v. Experian Information Solutions, Inc.54 that the plaintiff failed to show an injury- in-fact despite his allegations that he suffered an invasion of privacy because “any injury was exceedingly remote and speculative.”55 The plaintiff brought his suit under section 1681(b), which allows CRAs to provide prospective lenders with a list of consumers that meet their criteria, i.e., a “prescreen list,” if it results in a “firm offer of credit or insurance” to every consumer on the list.56 The plaintiff alleged that Experian released his credit information without authorization when a prescreen list with his information was erroneously shared with a lender with whom Experian had terminated its information-sharing agreement several days earlier as a result of a miscommunication.57 The plaintiff only learned of this dis- closure of his credit information from his attorney five years after his name was included on Experian’s prescreen list,58 and he subsequently filed a lawsuit al- leging that he suffered both an invasion of privacy and emotional distress as a result of his inclusion on the prescreen list.59 In assessing the plaintiff ’s standing, the Crabtree court found that where the plaintiff testified that he was unable to say that he did not receive a firm offer of credit from the lender, “the privacy interest in credit information embodied in FCRA was permissibly exchanged for the promise of a firm offer.”60 Accord- ingly, as the plaintiff likely received the exchanged-for benefit, “any potential in- jury based on the possibility that he did not receive a firm offer is too speculative and remote to satisfy Article III’s injury-in-fact requirement.”61 Further, the court found that the plaintiff identified “no harm of any kind,” as he admitted in sworn testimony that he “would have thrown any firm offer from [the defendant] in the trash,” and if his attorney had not contacted him to inform him about these events five years later, the plaintiff “would have gone on completely unaware 51. Id. (citing Eichenberger, 876 F.3d at 983) (internal quotation marks omitted). 52. Id. at 492 (citing 15 U.S.C. § 1681). 53. Id. (citing 15 U.S.C. §§ 1681b(f ), 1681n & 1681q)). 54. 948 F.3d 872 (7th Cir. 2020). 55. Id. at 875. 56. Id. (citing 15 U.S.C. § 1681b(c)(1)(B)(i)). 57. Id. at 875–76. 58. Id. at 879. 59. Id. at 876. 60. Id. at 876, 879. 61. Id. at 879.
720 The Business Lawyer; Vol. 76, Spring 2021
of and unaffected by any prescreen list.”62 The Seventh Circuit found that “[t]his
all falls well short of the concreteness mandated by Article III,” but noted that its
conclusion does not mean that a claim like the plaintiff ’s would fail as a matter of
course.63 It held that “[t]he disclosure of consumer credit information, absent
any exchanged-for consumer benefit contemplated by FCRA, can constitute an
injury-in-fact for the purpose of Article III standing. . . . The plaintiff just
needs to plead or otherwise come forward with some evidence showing that is
what happened and thus is the source of the alleged injury giving rise to the
FCRA claim.”64 For example, the plaintiff had to come forward with something
showing that he did not receive a firm offer, that the defendant would not have
honored a firm offer, that the plaintiff was affected by the lack of the firm offer,
“or that he suffered any actual emotional damages.”65
CONCLUSION
The requisite degree of harm needed to establish standing in FCRA cases is
unclear. The Ninth Circuit’s conclusion in Ramirez that class members whose
credit reports had not been disseminated to third parties nonetheless had Article
III standing was not supported by any meaningful analysis and is inconsistent
with the Supreme Court’s admonition in Spokeo that harm must be “concrete”
to satisfy constitutional strictures. It placed no limits on what “material risk”
of harm could mean, and the Ramirez holding threatens to expand the scope
of Article III standing well beyond the limits imposed by the Supreme Court.
Nayab and Crabtree paint a confusing picture about whether it is enough for
purposes of standing for a plaintiff to allege that her privacy interests were in-
jured by a violation of FCRA alone. The Crabtree decision, that a plaintiff has
no grounds for claiming that she was injured by an FCRA violation when she
admits that she did not know about the purported violation for years and con-
tinued to live her life with no consequence despite it, seems faithful to Spokeo,
while the Nayab result was driven by the expansive approach taken in Ramirez.
The Ninth Circuit’s departure from Spokeo in Ramirez opens the door to lawsuits
where the claimants lack the type of real, concrete, and particularized harm that
Article III mandates. Further Supreme Court guidance is needed.66
62. Id.
63. Id.
64. Id. at 880.
65. Id. at 879.
66. TransUnion has appealed the Ramirez decision to the U.S. Supreme Court. Ramirez v. Trans-
Union, LLC, 951 F.3d 1008 (9th Cir.), cert. filed, No. 20-297 (U.S. Sept. 2, 2020).You can also read
