In its recent TransUnion LLC v. Ramirez decision, the U.S. Supreme Court clarified that consumer plaintiffs must be able to demonstrate concrete harm from a defendant’s statutory violation to have standing to seek monetary damages against that defendant in federal court. Without this Article III standing, a claimant does not have a “case” or “controversy” under the U.S. Constitution, and a federal court does not have the authority to adjudicate or order any remedy. Consequently, this case provides consumer product companies and finance firms with a shield against frivolous claims under federal law where the plaintiff cannot show that they suffered a harm. Furthermore, this case also provides consumer product companies and finance firms with even greater incentives to effectively address their customers’ complaints on an individual basis prior to litigation, as doing so may significantly reduce the risk of having to pay vast amounts in class action settlements.
In TransUnion v. Ramirez, a class of 8,185 individuals with Office of Foreign Asset Control (OFAC) alerts in their credit files sued TransUnion under the Fair Credit Reporting Act (FCRA) for failing to use reasonable procedures to ensure the accuracy of their credit files. The plaintiffs also complained about formatting defects in certain mailings sent to them by TransUnion. The parties stipulated prior to trial that only 1,853 class members had their misleading credit reports containing OFAC alerts provided to third parties. The question in the TransUnion case, therefore, was whether the class members whose incorrect reports didn’t get disseminated were entitled to bring a claim for damages.
In an earlier case that limited claims to only harmed persons, Spokeo, Inc. v. Robins, 578 U. S. 330, 340 (2016), the Supreme Court directed that Article III standing requires a concrete injury even in the context of a statutory violation. The court had rejected the proposition that “a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.”
The TransUnion case went further than Spokeo and drew a solid line between the remedies available when plaintiffs allege a material risk of future harm. The court has recognized that a material risk of future harm can satisfy the concrete-harm requirement in the context of a claim for injunctive relief to prevent the harm from occurring, at least so long as the risk of harm is sufficiently imminent and substantial. See Spokeo, 578 U. S., at 341–342 (citing Clapper v. Amnesty Int’l USA, 568 U. S. 398). Thus, material risk of harm may allow a court to enjoin activities or force companies to change practices. The TransUnion court clearly laid out the converse; it held that the mere risk of future harm, without more, cannot qualify as a concrete harm in a suit for monetary damages.
The TransUnion decision is helpful for industries targeted by class action attorneys, as it should reduce the potential for large settlements based on the risk of future harm. However, regulatory risk and state class action risks are somewhat increased by this decision. Unlike plaintiffs’ attorneys, state and federal regulators’ incentive to bring cases is untouched by the lack of personal financial gain from speculative damages claims. Indeed, the regulators may see the diminishment of private class actions as a reason to step up government oversight. But with the potential for increased attention under FCRA (and similar statutes like the Fair Debt Collection Practices Act), the government also will be limited in the amount of damages they can claim. While we may see an increase in activity in these areas, the size of the damages awards may be more closely tied to harm that consumers actually suffered.
Similarly, class actions under state laws may increase, as many states have consumer protection laws that provide for standing under a broader range of circumstances than what is provided by Article III in federal court. For example, the California Consumer Privacy Act gives standing to a claim arising from a data breach where the plaintiff shows that their unencrypted or nonredacted personal information (as defined in the statute) was accessed, stolen or disclosed due to a company’s failure to implement and maintain reasonable security procedures and practices. A plaintiff does not need to show that they were actually harmed. Under that statute, a plaintiff is entitled to recover statutory damages ranging from a minimum of $100 to a maximum of $750 per violation, or actual damages, whichever is greater.
This case is a good reminder to revisit your firm’s consumer complaint response practices. After the TransUnion decision, programs to redress consumer harm on an individual basis may inoculate you against expensive class actions. It is also a good reminder to know and understand the statutes in the jurisdictions where you are doing business. We’ve helped a number of companies develop policies and procedures to identify and redress consumer harm and can consult with you about best practices and implementation strategies.
This document is intended to provide you with general information regarding the U.S. Supreme Court's decision in TransUnion LLC v. Ramirez. The contents of this document are not intended to provide specific legal advice. If you have any questions about the contents of this document or if you need legal advice as to an issue, please contact the attorneys listed or your regular Brownstein Hyatt Farber Schreck, LLP attorney. This communication may be considered advertising in some jurisdictions.