Privacy Law and Private Rights of Action: Standing After TransUnion v. Ramirez




Legal Sidebari

Privacy Law and Private Rights of Action:
Standing After TransUnion v. Ramirez

July 22, 2021
Data privacy continues to be an important issue for legislators at both the state and federal levels, and a
frequent consideration for privacy legislation is whether consumers will be able to sue those who violate
their privacy rights. The availability of federal courts to hear litigation implicates the constitutional
doctrine of standing: the notion that a federal court may only hear a claim that alleges a “case or
controversy”
between the plaintiff and the defendant. In the Supreme Court’s recent decision in
TransUnion, LLC v. Ramirez, the Court addressed whether a class of more than 8,000 plaintiffs alleging
violations of the Fair Credit Reporting Act (FCRA) had standing given that many of the plaintiffs alleged
no harm other than the FCRA violations themselves. The Court’s analysis in TransUnion and the outcome
of the case—in which the Court determined that only 1,853 class members had standing to sue—may be a
blueprint for federal courts addressing questions of standing in future claims involving privacy rights or
other statutory violations. This Legal Sidebar briefly outlines the doctrine of standing before turning to a
discussion of the Supreme Court’s opinion in TransUnion. The Sidebar concludes with considerations for
federal privacy legislation in light of TransUnion.
Constitutional Standing
Standing has its roots in Article III of the Constitution, which sets forth the powers of the federal judiciary
and limits that power to resolving “Cases” and “Controversies.” Constitutional standing is thus often
called Article III standing. In some circumstances, federal courts also address non-constitutional (or
prudential) issues of standing. While Congress may abrogate prudential standing through legislation, it
has no power to alter the standards for Article III standing.
A general principle of Article III standing is that a plaintiff must have a “personal stake” in the outcome
of a given case. Courts evaluate a plaintiff’s Article III standing by assessing three factors: the plaintiff
must have (1) an actual or imminent concrete and particularized injury (2) that was likely caused by the
defendant and (3) may likely be redressed through judicial relief. In many cases, standing will turn on
whether the plaintiff’s alleged injury is sufficiently “concrete” to satisfy the first factor. The Supreme
Court has held that an injury must “actually exist” to be considered concrete. In Spokeo, Inc. v. Robins,
the Court held that a “bare procedural violation” would not qualify as a concrete harm, but elaborated that
an intangible harm may satisfy the concrete harm requirement if it “has a close relationship to a harm that
Congressional Research Service
https://crsreports.congress.gov
LSB10629
CRS Legal Sidebar
Prepared for Members and
Committees of Congress




Congressional Research Service
2
has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” The
Court further observed that Congress has a role in “identify[ing] intangible harms” that support Article III
standing when those harms are “concrete, de facto injuries that were previously inadequate in law.”
The TransUnion Decision
The issue in TransUnion was whether a class of 8,185 individuals alleging violations of the FCRA had
suffered a sufficiently concrete harm to have Article III standing to sue in federal court. A car dealer
declined to sell a vehicle to the named plaintiff, Sergio Ramirez, after a credit check flagged him as
having a first and last name matching an individual on a list of known criminals maintained by the U.S.
Department of the Treasury’s Office of Foreign Assets Control (OFAC). Ramirez contacted TransUnion,
the credit reporting agency that reported Ramirez as a “potential match” to the name on the OFAC list, to
request a copy of his credit file. After receiving two mailings that he suspected were incomplete, Ramirez
sued TransUnion.
Besides suing TransUnion in his individual capacity, Ramirez sought to represent a class of 8,185
individuals who had received mailings from TransUnion about potential matches to the OFAC list.
TransUnion had distributed the credit reports of only 1,853 of the putative class members to prospective
creditors that included the “potential match” alert. A federal trial court ruled that all 8,185 members of the
class had Article III standing, and on appeal, the U.S. Court of Appeals for the Ninth Circuit agreed,
concluding that the class members all “suffered a material risk of harm to their concrete interests.
The Supreme Court reversed, holding that only the 1,853 people whose credit reports TransUnion had
distributed to prospective creditors had suffered a concrete harm that would support Article III standing.
Writing for the majority, Justice Kavanaugh observed that the Court in Spokeo had rejected the notion that
an injury is concrete any time a statute creates a private right of action, emphasizing that Congress alone
may not “relieve courts of their responsibility to independently decide whether a plaintiff has suffered a
concrete harm under Article III.” Thus, the FCRA violations alleged by Ramirez and the class—that
TransUnion had not ensured the accuracy of credit files and had not provided complete credit files to class
members who requested them—would not, by themselves, confer standing on the class members.
The Court recognized that members of the class whose credit reports had been transmitted to potential
creditors had suffered an injury akin to “reputational harm” recognized in American courts. However, for
the rest of the class, Justice Kavanaugh determined that the mere existence of inaccurate information,
without that information being shared with others, would not constitute a concrete harm. Justice Thomas,
joined by three other Justices, dissented. He argued that a legally recognized injury should support Article
III standing, even if it is not “concrete.”
TransUnion builds on the Court’s reasoning in Spokeo, which one federal court of appeals judge has
described as “more difficult” to apply in practice than in theory. In Spokeo, the Court held that a “bare
procedural violation” would not satisfy the concrete harm requirement for Article III standing. Lower
courts have sparred over the contours of that threshold: for example, the Eleventh Circuit held that
printing 10 digits of a customer’s credit card on a receipt was not a concrete harm, while the D.C. Circuit
held that printing 16 digits was.
Considerations for Privacy Legislation
TransUnion may provide more direction on how to assess intangible harms for Article III standing,
particularly in cases based on alleged harms similar to FCRA violations. Many contemporary privacy
laws and proposals create new consumer rights in personal data. Some of these rights echo rights in the
FCRA. For example, a consumer’s right to view or obtain personal information held by a particular
company is similar to an individual’s right under the FCRA to request a complete credit file. Thus, these


Congressional Research Service
3
similar rights may be the type of statutorily created “injuries in law” that would not give rise to standing
under the Court’s TransUnion analysis. Proposed legislation that would allow consumers to sue for
violating privacy rights, such as the Online Privacy Act from the 116th Congress, might face standing
barriers that could prevent consumers from bringing lawsuits in federal court.
Privacy laws may avoid creating standing obstacles for private plaintiffs in several ways. The California
Consumer Privacy Act includes a private right of action, but a consumer may only sue if that consumer’s
information is accessed or disclosed without authorization. Requirements that a private lawsuit allege an
actual misuse or disclosure of an individual’s private information also might increase the likelihood that
such a lawsuit would clear the “concrete harm” threshold, given that Justice Kavanaugh’s analysis in
TransUnion distinguishes between information that has and has not been disclosed. Proposals that
disallow private rights of action, such as the Consumer Data Privacy and Security Act, also avoid raising
issues of standing. Another issue, raised by a footnote in Justice Thomas’s dissent, is that Article III
constrains only the federal judicial power: an individual who lacks Article III standing may still be able to
litigate their claims in a state court. Accordingly, while TransUnion may affect how existing and future
privacy legislation will be enforced, it does not entirely foreclose the ability of such legislation to
empower individuals to enforce privacy rights through private litigation.

Author Information

Eric N. Holmes

Legislative Attorney




Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff
to congressional committees and Members of Congress. It operates solely at the behest of and under the direction of
Congress. Information in a CRS Report should not be relied upon for purposes other than public understanding of
information that has been provided by CRS to Members of Congress in connection with CRS’s institutional role.
CRS Reports, as a work of the United States Government, are not subject to copyright protection in the United
States. Any CRS Report may be reproduced and distributed in its entirety without permission from CRS. However,
as a CRS Report may include copyrighted images or material from a third party, you may need to obtain the
permission of the copyright holder if you wish to copy or otherwise use copyrighted material.

LSB10629 · VERSION 1 · NEW