The Fair Credit Reporting Act (FCRA) regulates consumer reporting entities, requiring them to “follow reasonable procedures to assure maximum possible accuracy” in their consumer reports. In Spokeo, Inc. v. Robins (2016), plaintiff Thomas Robins alleged that Spokeo, a website that aggregates personal data on individuals and sells them to subscribers, violated the FCRA by publishing incorrect information about him. The erroneous information, Robins claimed, made it hard for him to find employment. The U.S. Supreme Court, however, ruled that to have standing to sue, a claimant must allege a “concrete and particularized” injury.
The Supreme Court concluded that “alleging a bare procedural violation” of the FCRA was not enough and remanded the case to the Ninth Circuit Court of Appeals to determine whether Robins had claimed a sufficiently concrete injury.
In TransUnion LLC v. Ramirez (2021), the Supreme Court expanded on the principles conveyed in Spokeo. This time, lead plaintiff Sergio Ramirez claimed that TransUnion had placed an alert on his credit report indicating that his name had been detected on a terrorist watch list. TransUnion had made this assessment using software that simply compared a consumer’s first and last name, but no other information, with the names on the terrorist watch list. Ramirez discovered that TransUnion had erroneously linked him to the list when a car dealership ran his credentials through TransUnion’s “Name Screen Alert” tool and refused to sell him a car. Other plaintiffs joined the suit, and the parties stipulated that the class contained 8,185 claimants. The district court ruled that all 8,185 claimants had standing, and a jury awarded the class a total of more than $60 million.
On appeal, however, the Supreme Court—concerned that a contrary ruling would be seen as an “open-ended invitation” to loosen standing requirements that would result in “freewheeling power” of federal courts—succinctly summarized its requirement: “No concrete harm, no standing.” The Supreme Court recognized that harm need not be tangible to be “concrete,” noting that “reputational harms, disclosure of private information, and intrusion upon seclusion” would suffice. But the Supreme Court held that only Ramirez and the 1,852 other class members whose credit reports TransUnion sent to third-party businesses—like Ramirez’s car dealership—could show concrete injury. The other 6,332 members of the class, who had not specifically shown that their files had been distributed, could not demonstrate concrete injury. As it had in Spokeo, the Supreme Court distinguished violation of the statute from concrete injury to a claimant, saying that “an injury in law is not an injury in fact.”
In cases where personal information is accessed, disclosed, or incorrect in violation of the law, the alleged harm is often difficult to grapple with. The harm is spread across many individuals, can be intangible, and presents a risk of potential future consequences. Nevertheless, the harms can be real and consequential. In addition to the physical, economic, and reputational harms that courts find easier to address, data breaches, publication of erroneous information, and other privacy violations can result in anxiety and frustration. They can result in loss of trust, unwillingness to share or search for information for fear of exposure, and resistance to collaboration. When aggregated across many people, even small injuries can be significant. Failure to account for such harm impedes courts’ ability to compensate victims, hold violators accountable, and ensure a digitally secure future for all.
