Data privacy litigators have their eye on the Supreme Court going into the end of the month as we wait for the Court’s opinion in Ramirez v. TransUnion. And when the decision is issued, CPW will be there in real time to fill you in. In the meantime, below is a refresher of the facts and issues raised in Ramirez, and why it is a must-watch decision for the end of the Supreme Court’s current term.
As readers of CPW already know, Article III limits federal court jurisdiction to actual “cases or controversies.” U.S. Const. Art. III, § 2. The Supreme Court has held that standing “is an essential and unchanging part of the case-or-controversy requirement of Article III.” This includes the following three elements, which constitute the “irreducible constitutional minimum of standing”:
First, the plaintiff must have suffered an “injury in fact”—an invasion of a legally protected interest which is (a) concrete and particularized … and (b) actual or imminent not conjectural or hypothetical … Second, there must be a causal connection between the injury and the conduct complained of … Third, it must be likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision.
As relevant for Ramirez, in 2016, the Supreme Court decided Spokeo, Inc. v. Robins, 136 S. Ct. 1540. In Spokeo, the Court affirmed that a plaintiff cannot “allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III.” (emphasis added). The Supreme Court’s analysis emphasized that “[a] ‘concrete’ injury must be ‘de facto’; that is, it must actually exist.” Id. (emphasis in original).
Which brings us to Ramirez. The plaintiff alleged that he had difficulty obtaining credit, was embarrassed in front of family members, and canceled a vacation after a car dealer received a credit report indicating that his name matched a name on a government “terrorist list” of persons with whom U.S. businesses may not transact. In response, Ramirez filed a class action alleging three violations of the Fair Credit Reporting Act (“FCRA”), two concerning the mode of providing consumers with a copy of their own credit file and one concerning the procedural requirements for furnishing an accurate credit report.
Ramirez sought to represent a class of thousands of individuals, the vast majority of whom (more than 75%) never had a credit report disseminated to any third party, let alone suffered a denial of credit or other injury anything like what he experienced. The trial court nonetheless let the class proceed on the theory that the absent class members all suffered an Article III injury and that the vast differences between the experiences of the named plaintiff and the class he purported to represent were immaterial. Ramirez ultimately obtained a multi-million dollar jury verdict against the credit reporting agency TransUnion for falsely flagging him and more than 8,100 other people as terrorists.
The Supreme Court granted cert for the question: “Whether either Article III or Rule 23 permits a damages class action where the vast majority of the class suffered no actual injury, let alone an injury anything like what the class representative suffered.” (emphasis added). TransUnion argued in its opening brief that Ramirez’s class definition includes individuals who suffered no injury because they never had a credit report disseminated to a third party with incorrect or misleading information. TransUnion further asserted that simply alleging an FCRA violation and claiming statutory damages does not itself confer Article III standing.
At oral argument earlier this year, several members of the Court expressed skepticism about Ramirez’s standing argument if carried to its logical conclusion. [For Kristin Bryan’s real time coverage of that oral argument, check it out here]. However, at this point it is an open-ended question as to whether the Court will rule in a way that curtails the availability of Article III standing in data privacy litigations going forward. Suffice to say, depending on how the Court rules, the case could have a major impact on litigations brought under various federal and state data privacy statutes (not only the FCRA but also the Telephone Consumer Protection Act, the Illinois Biometric Information Privacy Act, among others) and for data event litigations where Article III standing is a frequently litigated issue.
