On June 25, the U.S. Supreme Court handed down a 5-4 decision in TransUnion v. Ramirez that clarified the injury-in-fact plaintiffs must show to have standing to assert statutory privacy rights in federal court. This follows the Court's 2016 decision in Spokeo v. Robins, in which it held "concrete harm" was required to pursue claims under the Fair Credit Reporting Act and other privacy statutes in federal court, but left open how to determine if a harm was sufficiently concrete.


The TransUnion plaintiffs were a class of 8,185 individuals in whose credit files TransUnion placed an alert for a "potential match" with names on a terrorist watch list. The parties stipulated that only 1,853 class members had their potentially misleading credit reports disseminated to third parties, while the remaining 6,332 individuals' reports were wrongly flagged but not disseminated.

The entire class was certified and a jury in the Northern District of California awarded the plaintiffs $60 million in statutory and punitive damages. The Ninth Circuit reduced the damages award to $40 million, but affirmed that both categories of class members had Article III standing.


Justice Kavanaugh wrote for the majority that Article III standing, a prerequisite for federal court jurisdiction, is rooted in the separation of powers doctrine, "woven into" the Constitution. Without an individual injury, the Court held, it is within the Executive Branch's discretion to decide how aggressively to pursue legal actions against regulatory defendants. "Private plaintiffs are not accountable to the people and are not charged with pursuing the public interest in enforcing a defendant's general compliance with regulatory law." In Spokeo, the Court made clear that mere procedural violations are not enough to support statutory privacy claims, and Article III requires a "concrete and particularized injury" that is not satisfied "whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right."

Five years after Spokeo, the TransUnion decision clarified that a concrete injury necessary for standing is one with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts. The Court recognized that Congress's views "may be instructive" on this question of fact, when Congress decides to elevate de facto harms that were not previously cognizable at law into legal harms, but Congress cannot simply "enact an injury into existence" that did not exist in fact prior to the law. Finally, the Court held that a concrete injury need not be identical to a harm traditionally recognized as providing a basis for a lawsuit, only that it bear a close resemblance to one.

On that basis, the Court concluded that only those 1,853 class members whose credit reports were actually disseminated to third parties had standing, as they were the only ones to suffer a concrete harm - in this case, a reputational one. The Court explained that dissemination has always been a key component of reputational legal harms, and that information without dissemination is as harmless as a libelous letter that is written but kept in a desk drawer. Though TransUnion had marked the remaining 6,332 individuals as potential security risks, it never actually damaged their reputation by sharing that erroneous information with third parties.

The Court went on to dismiss the plaintiffs' second argument that all class members were entitled to standing by virtue of their exposure to the risk of reputational harm. While risk of future harm can provide standing for injunctive relief, it is insufficient in a case for damages under Article III. Finally, the Court held that all class members lacked standing to pursue two separate claims based on formatting defects in certain mailings from TransUnion, finding the plaintiffs failed to show that they suffered any injury from the mailings and the risk of injury was too speculative.

Justice Thomas dissented, arguing federal courts had long recognized that the violation of an individual's statutory right gives rise to Article III standing, in contrast to the violation of a statute that protects the broader public. The dissent also argued that Spokeo left open the possibility that "the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact," while TransUnion breaks new ground by stating for the first time that "legal injury is inherently insufficient to support standing." 


TransUnion raises the bar for plaintiffs to establish standing in federal court for violations of statutory privacy rights. Plaintiffs must be able to show concrete harm in the form of monetary, reputational or emotional injury, and cannot rely on the mere violation of a statutory right nor the risk of future harm created by such a violation. This test may make class certification more difficult for plaintiffs seeking damages under privacy or data protection statutes.

Justice Thomas, however, observed that TransUnion may lead to potentially perverse results. Defendants could succeed in having federal cases dismissed on standing, but still be left litigating parallel actions in state courts that address the same federal statutes, since state courts may not be bound by Article III and its jurisdictional standing strictures.

Summer associate Nick Tonckens assisted in the preparation of this alert. 

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.