In the

United States Court of Appeals

For the Seventh Circuit ____________________

Nos. 17-1310 & 17-1649

DANIEL RIVERA, et al.,

Plaintiffs-Appellees.

v.

ALLSTATE INSURANCE COMPANY,

Defendant-Appellant.

____________________

Appeals from the United States District Court for the 

Northern District of Illinois, Eastern Division.

No. 10 C 1733 — William T. Hart, Judge.

____________________

ARGUED OCTOBER 25, 2017 — DECIDED OCTOBER 31, 2018

AS AMENDED ON PETITION FOR REHEARING JANUARY 14, 2019

____________________

Before KANNE and SYKES, Circuit Judges, and DARROW, 

District Judge.*

SYKES, Circuit Judge. In 2009 Allstate Insurance Company

launched an internal investigation into suspicious trading on 

its equity desk. The initial inquiry unearthed email evidence 

suggesting that several portfolio managers might be timing 

 

* Of the Central District of Illinois, sitting by designation.
2 Nos. 17-1310 & 17-1649

trades to inflate their bonuses at the expense of their portfolios, which included two pension funds to which Allstate 

owed fiduciary duties. Allstate retained attorneys from 

Steptoe & Johnson to investigate further, and they in turn 

hired an economic consulting firm to calculate potential 

losses. Based on the email evidence, the consulting firm 

found reason to believe that timed trading had potentially 

cost the portfolios $8 million and possibly much more. 

Because actual losses could not be established, the consultants used an algorithm to estimate a potential adverse 

impact of $91 million on the pension funds. Everyone understood that this estimate was wildly unrealistic, but in an 

abundance of caution, Allstate poured $91 million into the 

pension portfolios. 

When the investigation wrapped up, Steptoe lawyers delivered oral findings to Allstate. The company thereafter 

determined that four portfolio managers—Daniel Rivera, 

Stephen Kensinger, Deborah Meacock, and Rebecca

Scheuneman—had violated the company’s conflict-ofinterest policy by timing trades to improve their bonuses. On 

December 3, 2009, Allstate fired them for cause.

On February 25, 2010, Allstate filed its annual Form 10-K

for 2009. The report explained that: (1) in 2009 the company 

had received information about possible timed trading and 

retained counsel to investigate; (2) counsel hired an economic consulting firm to estimate the potential impact on the 

portfolios; and (3) based on this outside investigation, 

Allstate paid $91 million into the two pension funds to cover 

the potential adverse impact. That same day Allstate sent a

memo to employees in its Investment Department describing the information disclosed in the 10-K. Neither document 

mentioned the four fired portfolio managers.
Nos. 17-1310 & 17-1649 3

Three weeks later the four former employees sued Allstate in federal court for defamation based on the 10-K and 

the internal memo. They also alleged that Allstate violated 

15 U.S.C. § 1681a(y)(2), a provision in the Fair Credit Reporting Act (“FCRA or the Act”), by failing to give them a summary of Steptoe’s findings after they were fired. The 

defamation claim was the main event in the litigation; the 

FCRA claim received comparatively little attention. A jury 

returned a verdict in the plaintiffs’ favor, awarding more 

than $27 million in compensatory and punitive damages,

and statutory damages on the FCRA claim (there are no 

actual damages on that claim). The district judge tacked on

additional punitive damages and attorney’s fees under the 

FCRA.

Allstate attacks the defamation awards on multiple

grounds and also argues that the FCRA awards must be 

vacated for lack of standing under Spokeo, Inc. v. Robbins, 

136 S. Ct. 1540 (2016). We agree that the plaintiffs lack a 

concrete injury to support Article III standing on the FCRA 

claim. So that claim must be dismissed on jurisdictional 

grounds. And that ends our review. Because the FCRA claim 

provided the sole basis for federal jurisdiction—and thus the 

only basis for the district court to exercise supplemental 

jurisdiction over the state-law claim under 28 U.S.C. 

§ 1367(a)—the district court was without power to adjudicate the defamation claim, and it too must be dismissed for 

lack of jurisdiction. The parties did not identify the § 1367(a) 

jurisdictional problem in their initial briefing, but that does 

not matter; defects in subject-matter jurisdiction must always be addressed. Accordingly, we vacate the judgment 

and remand with instructions to dismiss the action in its 
4 Nos. 17-1310 & 17-1649

entirety for lack of subject-matter jurisdiction. See FED. R.

CIV. P. 12(h)(3).

I. Background

Plaintiffs Rivera, Kensinger, Meacock, and Scheuneman 

were employed as securities analysts in the Equity Division 

of Allstate’s Investment Department. Rivera was the Division

director, and Kensinger, Meacock, and Scheuneman were 

analysts on the growth team. During their time with the 

company, the Equity Division managed and invested 

$10 billion in assets on behalf of various funds, including 

two defined-benefit pension plans. Because the plaintiffs

helped manage two pension portfolios, they occupied positions of trust and owed a duty of loyalty to plan beneficiaries

under the Employee Retirement Income Security Act. See 

29 U.S.C. § 1104(a)(1). They were also bound by Allstate’s

code of ethics, which required them to avoid conflicts of 

interest.

In addition to their salaries, the plaintiffs were eligible to 

receive bonus compensation under Allstate’s “pay-forperformance” plan. The plan relied on a formula called the 

“Dietz method” to estimate portfolio returns and evaluate 

performance accordingly. The Dietz method assumes that all 

cash flows in a portfolio occur at the same time of day; high 

transaction volume makes it impractical to use actual trade

times. The particular formula in use at Allstate assumed all 

cash flows occurred at midday.

While practical, Allstate’s formula had two drawbacks. 

First, it distorted a portfolio’s actual performance, both 

positive and negative. The midday Dietz method inflated

measured performance for sales on up days and buys on 

down days; conversely, it understated measured perfor-
Nos. 17-1310 & 17-1649 5

mance when sales were made on down days and buys on up 

days. Allstate’s traders referred to this discrepancy as the 

“Dietz effect.” 

Second, the formula could be manipulated. Because it assumed that all cash flows occurred midday, portfolio managers could wait until the end of day to calculate the Dietz 

effect before deciding to execute a trade. The system consequently rewarded portfolio managers who waited to make 

trades even if the portfolio suffered as a result. Moreover, 

Allstate’s bonus structure measured performance relative to 

a daily benchmark; it didn’t consider market movement in 

the preceding days. This feature also pitted the interests of 

the manager against those of the portfolio. A manager could 

improve his performance by delaying a sale over several 

down days before selling on an up day even if the portfolio 

would have been better off if he sold earlier. In sum, under 

Allstate’s pay-for-performance plan, portfolio managers 

could boost their bonus pay by timing trades—potentially at 

the expense of their portfolios.

In mid-2009 Allstate received troubling information that

its portfolio managers were doing just that. Peter Hecht, a

member of Allstate’s Performance Management Group,

reported to Chief Compliance Officer Trond Odegaard that 

members of the Equity Division were delaying trades to 

maximize their bonuses at the expense of their portfolios. 

Odegaard passed these concerns along to Chief Investment 

Officer Judy Greffin, who ordered him to investigate. 

Odegaard and a team of Allstate employees soon discovered signs of timed trading. The team noted several trading 

patterns that suggested portfolio managers had delayed 

trades to take advantage of the Dietz effect. The investiga-
6 Nos. 17-1310 & 17-1649

tion also uncovered emails suggesting that the managers 

were aware of the Dietz effect and actively considered it 

when trading. Though not conclusive, the investigation 

raised concerns that personnel in the Equity Division had

timed trades to increase bonuses at the expense of their 

portfolios; as a result, Allstate may have reported inaccurate 

financial information to the public. 

Allstate accordingly retained the law firm Steptoe & 

Johnson to investigate further. Steptoe attorneys interviewed 

Rivera and Scheuneman regarding their trading practices

and hired NERA Economic Consulting, Inc., an independent 

economic consulting firm, to determine if timed trading had 

harmed the portfolios, especially the pension funds. Beginning with the trades mentioned in the suspicious emails and 

eventually reviewing six years of trading data, NERA preliminarily estimated a potential adverse portfolio impact of 

$8.2 million.

But NERA had reason to believe that the actual impact

may be much higher. Several suspicious emails could not be 

tied to particular trades, and other evidence suggested that 

portfolio managers routinely considered Dietz in the course 

of trading. Based on Allstate’s records, however, it was not 

possible to calculate actual losses with any precision. So 

NERA devised an algorithm that would capture every Dietzfavorable trade from June 2003 to May 2009 that was executed after a series of days where the Dietz effect would have 

harmed the trader’s performance. Based on these parameters, NERA estimated that over the six years surveyed, the

potential adverse impact on the pension plans was 

$91 million and the potential adverse impact on the company’s other portfolios was $116 million. It was clear to everyone that these estimates vastly overstated the potential effect 
Nos. 17-1310 & 17-1649 7

of timed trading. Erring on the side of caution, however, in 

mid-December Allstate paid $91 million into the two pension 

plans to compensate for any potential losses.

While the investigation was ongoing, Allstate disbanded

the Equity Division and outsourced its work to Goldman 

Sachs. On October 6, 2009, Greffin met first with Rivera and 

then the rest of the division and explained that every member, save those who managed convertible portfolios, would 

be let go effective December 31, 2009. The laid-off employees 

would, however, receive severance pay. Later that day 

Steptoe attorneys conducted off-site interviews with Equity

Division managers concerning Dietz trading.

The outside investigation soon wrapped up, and Steptoe

attorneys orally reported the findings to Allstate. Based on 

the internal and external investigations, Allstate concluded

that Rivera, Meacock, Scheuneman, and Kensinger had 

violated the company’s conflict-of-interest policy by timing 

trades. On December 3, 2009, Brett Winchell, the Director of 

Human Resources, informed each of the four analysts that 

they were fired for cause effective immediately. Winchell

delivered the bad news by reading from a short script that 

reminded the four managers of the investigation into timed 

trading, noted that each of them had been interviewed by 

outside counsel, and explained that they were being fired

because they violated Allstate’s conflict-of-interest policy. All 

four asked Winchell for additional explanation; they later 

asked the same questions in writing. No further explanation, 

oral or written, was forthcoming. Allstate immediately 

escorted them off the premises and disconnected their phone 

and email service the next day.
8 Nos. 17-1310 & 17-1649

On December 16 Steptoe attorneys met with regulators in 

the Department of Labor’s Employee Benefits Security 

Administration to discuss the investigation as it related to 

the pension funds. At the Department’s request, Steptoe sent 

a follow-up letter summarizing the allegations of timed 

trading and the subsequent investigation. The letter—dated 

January 29, 2010—advised the Department that the employees in Allstate’s Equity Division had denied that they improperly delayed trades but that several emails “could 

support a contrary conclusion.” The letter further explained 

that NERA’s algorithm “estimate[d] potential disadvantage 

to the plans” but that “there is little question that the algorithm overstate[d] any disadvantages that the plans might 

have suffered.” Finally, the letter explained that “taking into 

account returns recalculated by NERA,” the estimated 

“increase in the aggregate bonuses for the entire group” was 

“approximately $1.2 million.”

Fast-forward to October 14, 2010. On that day Allstate’s 

in-house counsel sent another letter to the Labor Department 

clarifying that the $1.2 million figure “roughly approximate[d] the potential increase in bonuses, ... assum[ing] the 

algorithm used by NERA ... reflected actual trading activity.” This letter emphasized that NERA’s calculations estimated “a possible maximum impact” and explained that “[n]o 

one believed, then or now, that this was an accurate description of the activity on the equity desk, nor that any actual 

impact on the portfolios was anywhere near the result 

produced by using the NERA algorithm.” The October letter 

also stated that if the analysis had been limited to the trades 

mentioned in the suspicious emails, “there would have been 

virtually no effect on bonuses.”
Nos. 17-1310 & 17-1649 9

Returning now to our chronology, on February 25, 2010, 

Allstate filed its annual 10-K report for 2009 in which it 

disclosed the allegations of timed trades and explained in 

general terms the subsequent investigation and the company’s decision to reimburse the two pension plans. As relevant here, the 10-K stated:

In 2009, we became aware of allegations 

that some employees responsible for trading 

equity securities in certain portfolios of two 

[Allstate Insurance Company] defined benefit 

pension plans and certain portfolios of [Allstate Insurance Company] and an [Allstate Insurance Company] subsidiary may have timed 

the execution of certain trades in order to enhance their individual performance under incentive compensation plans, without regard to 

whether such timing adversely impacted the 

actual investment performance of the portfolios.

We retained outside counsel, who in turn 

engaged an independent economic consulting 

firm to conduct a review and assist us in understanding the facts surrounding, and the potential implications of, the alleged timing of 

these trades for the period from June 2003 to 

May 2009. The consulting firm reported that it 

was unable to determine from our records the 

precise amounts by which portfolio performance might have been adversely impacted 

during that period. Accordingly, the economic 

consultant applied economic modeling techniques and assumptions reasonably designed 
10 Nos. 17-1310 & 17-1649

to estimate the potential adverse impact on the 

pension plans and the company accounts, taking into account, among other things, the distinctions between the pension plans and the 

company portfolios.

Based on their work, the economic consultants estimated that the performance of the 

pension plans’ portfolios could have been adversely impacted by approximately $91 million 

(including interest) and that the performance 

of the company portfolios could have been adversely impacted by approximately $116 million (including interest) in the aggregate over 

the six-year period under review. We believe 

that our financial statements and those for the 

pension plans properly reflected the portfolios’

actual investment performance results during 

the entire period that was reviewed.

In December 2009, based on the economic 

consultant’s modeled estimates, we paid an aggregate of $91 million into the two defined 

benefit pension plans. These payments had no 

material impact on our reported earnings or 

shareholders’ equity, but reduced our assets, 

operating cash flows, and unfunded pension 

liability to the plans. ... At all times during this 

period, the plans were adequately funded pursuant to applicable regulatory and actuarial requirements. As a result of these additional 

funds in the plans, our future contributions to 

the plans, based on actuarial analysis, may be 

reduced. Using the economic consultant’s cal-
Nos. 17-1310 & 17-1649 11

culation of the potential adverse impact on the 

portfolios, we currently estimate that the additional compensation paid to all the employees 

working in the affected group was approximately $1.2 million over the six-year period as 

a result of these activities. In late 2009, we retained an independent investment firm to conduct portfolio management and trading 

activity for the specific portfolios impacted by 

these activities. 

That same day Greffin sent a memo to all employees in 

the Investment Department alerting them to the information 

in the 10-K filing. In full, the Greffin memo states:

Allstate released its annual financial report 

on Form 10–K today. Within that filing, we disclosed details around allegations regarding 

trading practices within our equity portfolios 

that came to light in the past year. We took this 

matter very seriously and launched an investigation as soon as we became aware of the allegations.

Outside counsel was retained to assist us in 

understanding the facts surrounding, and the 

potential implications of, these activities. As 

part of their analysis, an independent economic consulting firm was retained to estimate the 

potential adverse impact to the performance of 

our portfolios. The consultant determined that 

the performance on some of our portfolios, as 

well as our two pension plan portfolios, could 

have been adversely impacted by the activities. 
12 Nos. 17-1310 & 17-1649

As a result, Allstate made a contribution to the 

pension plans during the 4th quarter which is 

disclosed in the 10–K.

We believe that our financial statements 

and those of the pension plans properly reflected the portfolios’ actual investment performance and the pension plans were 

adequately funded during this entire period. 

This matter did not affect the plans’ ability to 

continue to provide benefits to plan participants.

Situations like this can be unsettling and 

can reflect poorly on our organization. However, I believe organizations are also defined by 

how they respond to events like this. We were 

transparent in reporting this matter to the 

U.S. Department of Labor and the S.E.C., and 

disclosed it to our investors. We’re taking steps 

to improve our governance, compliance practices and training.

We remain committed to the highest levels 

of ethics and integrity in the stewardship 

of Allstate’s assets.

Three weeks later the four fired portfolio managers sued 

Allstate and Greffin in federal court for defamation based on

the 10-K and Greffin’s internal memo. They also asserted a 

claim against Allstate for violation of § 1681a(y)(2) of the 

FCRA and a claim against Greffin for tortious interference 

with prospective economic advantage. The district judge 

dismissed the tortious-interference claim, and the plaintiffs 

then amended their complaint to add an age-discrimination 
Nos. 17-1310 & 17-1649 13

claim against Allstate. They later dismissed the discrimination claim as well as the defamation claim against Greffin. 

Lengthy discovery ensued and in due course Allstate 

moved for summary judgment. Judge Feinerman ruled that 

the statements in the 10-K and the Greffin memo were not 

defamatory per se. Rivera v. Allstate Ins. Co., 140 F. Supp. 3d 

722, 729–30 (N.D. Ill. 2015). But he permitted the case to go 

forward on a theory of defamation per quod and on the 

FCRA claim. Id. at 730–37.

As narrowed, the case proceeded to a jury trial with 

Judge Hart presiding. The jury found for the plaintiffs across 

the board and awarded more than $27 million in compensatory and punitive damages, broken down roughly as follows:

Rivera:

$7.1 million (defamation compensatory damages)

$4 million (defamation punitive damages)

$1,000 (FCRA statutory damages)

Kensinger:

$2.9 million (defamation compensatory damages)

$2 million (defamation punitive damages)

$1,000 (FCRA statutory damages)

Meacock:

$3.6 million (defamation compensatory damages)

$3 million (defamation punitive damages)

$1,000 (FCRA statutory damages)
14 Nos. 17-1310 & 17-1649

Scheuneman:

$3.4 million (defamation compensatory damages)

$1 million (defamation punitive damages)

$1,000 (FCRA statutory damages)

Allstate moved for judgment as a matter of law, or alternatively, for a new trial. The plaintiffs separately asked the 

judge for an award of punitive damages and attorney’s fees 

under the FCRA. 15 U.S.C. § 1681n(a)(2), (3) (authorizing 

“such amount of punitive damages as the court may allow” 

and attorney’s fees for willful violations of the FCRA).

Judge Hart denied Allstate’s motion and granted the 

plaintiffs’ requests, awarding each plaintiff an additional 

$3,000 in punitive damages under the FCRA and approving 

their request for $357,716.25 in attorney’s fees associated 

with the statutory claim.

II. Discussion

Allstate attacks this large judgment on many grounds. In 

brief, the company argues that the defamation awards must 

be set aside because: (1) the statements in the 10-K and the 

Greffin memo were substantially true; (2) neither the 10-K 

nor the Greffin memo identified the plaintiffs, and no evidence supports a finding that these documents could be

reasonably understood to refer to them; (3) the statements in 

the 10-K and the Greffin memo were privileged; and (4) the 

plaintiffs failed to prove special damages as required for 

recovery for defamation per quod. Regarding the FCRA 

awards, Allstate argues that the plaintiffs lack standing 

under Spokeo, and secondarily, that the record does not 

support the jury’s finding of a willful violation of the statute

as required for statutory and punitive damages. (There are 
Nos. 17-1310 & 17-1649 15

no actual damages.) Finally, Allstate attacks the award of 

FCRA attorney’s fees as excessive and disproportionate 

considering the relative insignificance of the statutory claim 

to this litigation.

The state-law defamation claim predominated over the 

federal claim in this long-running litigation—both in the 

district court and here. The FCRA claim occupied very little 

of the parties’ appellate briefing and received only modest 

attention below. Our initial opinion vacated the defamation 

awards based on the plaintiffs’ failure to prove special

damages. We also vacated the FCRA awards for lack of 

standing under Spokeo and remanded with instructions to 

dismiss the federal claim for lack of jurisdiction.

The plaintiffs petitioned for rehearing, raising for the first 

time a probable jurisdictional defect under § 1367 if we 

found—as we did—that they failed to establish an injury in 

fact sufficient to support Article III standing to litigate the 

FCRA claim. The petition noted that the FCRA claim provided the only jurisdictional basis for litigating this entire 

dispute in federal court. The district court’s jurisdiction 

rested solely on federal-question jurisdiction, see 28 U.S.C. 

§ 1331; the parties are not diverse, so 28 U.S.C. § 1332 does 

not apply. And the court’s supplemental jurisdiction under 

§ 1367(a) to adjudicate the state-law defamation claim evaporates if the claim on which federal jurisdiction rests is 

dismissed on jurisdictional grounds.

We accordingly withdraw our original opinion and in its 

place substitute this amended opinion. Although the parties 

spent most of their energy on the merits of the defamation 

claim, our analysis begins and ends with the jurisdictional 

basis for the FCRA claim.
16 Nos. 17-1310 & 17-1649

Relying on Spokeo, Allstate maintains that the FCRA 

awards must be tossed out for lack of standing. A bit of 

statutory background is required to understand the FCRA 

claim in this case. We note for starters that the case represents an odd application of the Act. The FCRA regulates the 

activities of consumer reporting agencies and the permissible uses of consumer reports by third parties. Among many 

other regulatory requirements, the Act imposes certain 

procedures for the use of consumer reports for employment 

purposes.

For example, the Act prohibits an employer from procuring a consumer report about an employee or job applicant

without first giving that person a stand-alone written notice 

that “clear[ly] and conspicuous[ly]” discloses the employer’s 

request for permission to access the report and the person 

signs a written consent to release the report to the employer. 

See 15 U.S.C. § 1681b(b)(2)(A) (establishing the disclosure 

and consent requirements); see id. § 1681a(d)(1) (defining 

“consumer report” to include reports about a consumer’s 

creditworthiness and personal background compiled by a 

“consumer reporting agency” and “used or expected to be 

used ... for the purpose of serving as a factor in establishing 

the consumer’s eligibility for” credit, insurance, or “employment purposes”).

The Act further requires that before taking any adverse 

action against an employee or job applicant “based in whole 

or in part” on such a report, the employer must give the 

employee or applicant a copy of the report and a written 

description of the person’s rights under the Act. Id. 

§ 1681b(b)(3)(A).
Nos. 17-1310 & 17-1649 17

The FCRA provision at issue here appears in § 1681a, 

which contains the Act’s definitions and rules of construction. (The statutory scheme is reticulated and complex, so 

bear with us.) Subsection (d)(2)(D) of § 1681a excludes from 

the definition of “consumer report” any “communication 

described in subsection (o) or (x).” The reference to “subsection (x)” is an error; it should read “subsection (y).” The

error was introduced in the Dodd–Frank Act of 2010,1 which 

redesignated the former subsection (x) as subsection (y) but 

neglected to update the cross-reference in § 1681a(d)(2)(D). 

See Pub. L. No. 111-203, § 1988(a)(1)(A), 124 Stat. 1376, 2086.

Subsection (y), the cross-referenced provision, was enacted as part of the Fair and Accurate Credit Transactions Act 

of 2003, Pub. L. No. 108-159, § 611, 117 Stat. 1952, 2010. It

reads in pertinent part:

(1) Communications described in this subsection

A communication is described in this subsection if–

(A) but for subsection (d)(2)(D), the communication would be a consumer report;

(B) the communication is made to an employer in connection with an investigation of—

(i) suspected misconduct relating to 

employment; or

 

1 Technically, the Dodd–Frank Wall Street Reform and Consumer 

Protection Act of 2010.
18 Nos. 17-1310 & 17-1649

(ii) compliance with Federal, State, or 

local laws and regulations, the rules of a 

self-regulatory organization, or any preexisting written policies of the employer;

(C) the communication is not made for the 

purpose of investigating a consumer’s credit 

worthiness, credit standing, or credit capacity; 

and

(D) the communication is not provided to 

any person except–

(i) to the employer or an agent of the 

employer;

(ii) to any Federal or State officer, agency, or department, or any officer, agency, or 

department of a unit of general local government;

(iii) to any self-regulatory organization 

with regulatory authority over the activities 

of the employer or employee;

(iv) as otherwise required by law; or

(v) pursuant to section 1681f of this title. 

(2) Subsequent disclosure

After taking any adverse action based in whole 

or in part on a communication described in 

paragraph (1), the employer shall disclose to the 

consumer a summary containing the nature and 

substance of the communication upon which the 

adverse action is based, except that the sources of 

information acquired solely for use in prepar-
Nos. 17-1310 & 17-1649 19

ing what would be but for subsection (d)(2)(D) 

an investigative consumer report need not be 

disclosed.

15 U.S.C. § 1681a(y) (emphasis added).

So in sum, and to radically simplify: By operation of the 

cross-reference in subsection (d)(2)(D) of § 1681a (and adjusting for the Dodd–Frank mistake), the effect of subsection (y) 

is to exclude from the definition of “consumer report”—and 

thus from the myriad regulatory requirements applicable to

consumer reports—any communication that:

(1) otherwise qualifies as a consumer report (but for subsection (d)(2)(D));

(2) was made to an employer in connection with an investigation of employee misconduct;

(3) was not made to the employer for purposes of investigating an employee’s creditworthiness; and

(4) is not disclosed to anyone other than the employer, a 

regulatory agency or authority, or as otherwise required 

by law.

And although § 1681a simply defines statutory terms and 

rules of construction, subsection (y) goes on to say that 

“[a]fter taking any adverse action based in whole or in part 

on” a communication of this type, the employer “shall 

disclose to the consumer a summary containing the nature 

and substance” of the communication. Id. § 1681a(y)(2).

Needless to say, this is an odd place to find a regulatory 

mandate on employer investigations into workplace misconduct. Indeed, the provision is so obscure that in its 

15-year existence, subsection (y)(2) of § 1681a appears in no
20 Nos. 17-1310 & 17-1649

published opinion save the district court’s decision in this 

case.

Still, taking § 1681a(y)(2) at face value, we understand it 

to mean that when an employer procures what would otherwise qualify as a consumer report in connection with an investigation into employee misconduct, the report is not 

considered a consumer report under the Act and thus is not 

subject to either § 1681b(b)(2)(A) (requiring the employer to 

give a stand-alone written notice and obtain written consent

before procuring the report) or § 1681b(b)(3)(A) (requiring 

the employer to give the employee or job applicant a copy of 

the report and a description of his FCRA rights before taking 

an adverse action based on it). Instead, the employer need

only provide a summary—an oral summary apparently 

suffices (subsection (y)(2) does not require anything in 

writing)—and then only after taking an adverse action based 

in whole or in part on the report.

The FCRA claim in this case rests on the premise that 

Allstate was required under subsection (y)(2) to provide a

summary of Steptoe’s investigation after firing the plaintiffs 

but failed to do so. It’s not at all clear, though, that the 

Steptoe investigation would otherwise qualify as a “consumer report” but for the subsection (d)(2)(D) exclusion. 

And if the Steptoe investigation isn’t a “consumer report” in 

the first place, then subsection (y)(2) does not come into play 

and the FCRA simply does not apply.

Here is the Act’s full definition of the term “consumer 

report”:

The term “consumer report” means any 

written, oral, or other communication of any 

information by a consumer reporting agency bear-
Nos. 17-1310 & 17-1649 21

ing on a consumer’s credit worthiness, credit 

standing, credit capacity, character, general 

reputation, personal characteristics, or mode of 

living which is used or expected to be used or 

collected in whole or in part for the purpose of 

serving as a factor in establishing the consumer’s eligibility for—

(A) credit or insurance to be used primarily 

for personal, family, or household purposes;

(B) employment purposes; or

(C) any other purpose authorized under 

section 1681b of this title.

§ 1681a(d)(1) (emphasis added).

The Steptoe investigation thus cannot be a “consumer 

report” unless Steptoe qualifies under the Act as a “consumer reporting agency.” Here, in turn, is how the Act defines a 

“consumer reporting agency”:

The term “consumer reporting agency” 

means any person which, for monetary fees, 

dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice 

of assembling or evaluating consumer credit 

information or other information on consumers 

for the purpose of furnishing consumer reports 

to third parties, and which uses any means or 

facility of interstate commerce for the purpose 

of preparing or furnishing consumer reports.

15 U.S.C. § 1681a(f).
22 Nos. 17-1310 & 17-1649

Steptoe & Johnson is a law firm. Nothing in the record 

suggests that it “regularly engages” in “assembling or 

evaluating consumer credit information” or “furnishing 

consumer reports to third parties.” The parties have not 

explained how Steptoe qualifies as a consumer reporting 

agency or how its investigation into timed trading at Allstate 

qualifies as a consumer report. That’s probably because 

Allstate never disputed these points, choosing instead to 

contest the FCRA claim on other grounds.

As we explain in a moment, the plaintiffs’ FCRA awards 

must be vacated on jurisdictional grounds based on the lack 

of any concrete injury to support Article III standing to sue. 

This opinion should not be construed as endorsing the 

position that a law-firm investigation of this type qualifies as 

a consumer report within the meaning of the Act or that 

subsection (y)(2) applies in a like situation.

With that reservation out of the way, we move to the 

question of the plaintiffs’ standing. In Spokeo the Supreme 

Court reinforced the principle that the “injury in fact” 

element of Article III standing requires an injury that is both

“concrete and particularized,” and that to be “concrete,” the 

injury must be “real” and “not abstract”—“that is, it must 

actually exist.” 136 S. Ct. at 1548. The injury need not be 

tangible; Congress may identify intangible harms and authorize litigants to seek their redress in court. Id. at 1549. But a 

plaintiff does not “automatically satisf[y] the injury-in-fact 

requirement whenever a statute grants a person a statutory 

right and purports to authorize that person to sue to vindicate that right.” Id.

In Spokeo the plaintiff filed a proposed class action alleging violations of the FCRA—specifically, several provisions 
Nos. 17-1310 & 17-1649 23

imposing procedural requirements on consumer reporting 

agencies. Id. at 1545–46. The Court explained that a plaintiff 

“cannot satisfy the demands of Article III by alleging a bare 

procedural violation” of the Act because “[a] violation of one 

of the FCRA’s procedural requirements may result in no 

harm.” Id. at 1550. The Court said that “a bare procedural 

violation [of the Act], divorced from any concrete harm,” is 

not an injury in fact sufficient to confer standing to sue. Id. at 

1549. On the other hand, the Court observed that some 

statutory violations present a risk of real harm to a litigant 

and that “a plaintiff in such a case need not allege any 

additional harm beyond the one Congress has identified.” Id.

So standing questions in cases of this type sometimes require us to identify the particular interest Congress sought 

to protect and to determine if the plaintiff has suffered a 

concrete injury to that interest. Our recent decisions in

Groshek v. Time Warner Cable, Inc., 865 F.3d 884 (7th Cir. 

2017), and Robertson v. Allied Solutions, LLC, 902 F.3d 690 (7th 

Cir. 2018), are illustrative.

The plaintiff in Groshek signed a form authorizing a prospective employer to obtain a consumer report about him in 

connection with his job application; he alleged that the 

disclosure form was not a stand-alone document as required 

by § 1681b(b)(2)(A). 865 F.3d at 885–86. Applying Spokeo, we 

held that this claim rested on “a statutory violation completely removed from any concrete harm or appreciable risk 

of harm.” Id. at 887. We explained that the requirement of a 

stand-alone disclosure “does not seek to protect [the plaintiff] from the kind of harm he claims he has suffered, i.e.,

receipt of a non-compliant disclosure.” Id. at 888. That is, 

“Congress did not enact § 1681b(b)(2)(A)(i) to protect job 

applicants from disclosures that do not satisfy the require-
24 Nos. 17-1310 & 17-1649

ments of that section; it did so to decrease the risk that a job 

applicant would unknowingly consent to allowing a prospective employer to procure a consumer report.” Id. Because the plaintiff acknowledged that he read and signed the 

employer’s disclosure form, he had not suffered an injury to 

any interest protected by the Act. Id. at 888–89.

In Robertson the plaintiff applied for a job with the defendant, and the defendant procured a background check in 

the process of considering her application. The background 

check qualified as a consumer report under the FCRA, and 

the employer asked the plaintiff to sign a consent form

giving it permission to obtain the report. She did so. The 

employer initially offered her a job but then rescinded the 

offer when the background check turned up negative information. 902 F.3d at 693–94. She sued for two FCRA violations: (1) the employer violated § 1681b(b)(2)(A) because the 

consent form was not a stand-alone document and did not 

contain “clear and conspicuous” disclosures, and (2) the 

employer violated § 1681b(b)(3)(A) by failing to give her a 

copy of the report before rescinding the job offer. Id. at 693.

We referred to the first claim as a “notice claim” and the 

second as an “adverse-action claim.” Id.

The district court dismissed the entire case for lack of 

standing, and we affirmed in part and reversed in part. The 

first claim, we said, was squarely controlled by our decision 

in Groshek, which held that “an injury functionally indistinguishable from the one underpinning [the plaintiff’s] notice 

claim was not concrete and did not confer standing.” 

Robertson, 902 F.3d at 694. Our conclusion in Groshek applied 

with equal force in Robertson, so we affirmed the dismissal of 

the plaintiff’s notice claim. Id.
Nos. 17-1310 & 17-1649 25

The adverse-action claim, however, was a different matter. Recall that § 1681b(b)(3)(A) states that when an employer 

procures a consumer report about an employee or job applicant, the employer must disclose a copy of the report to the 

employee or applicant before taking any adverse action 

against him based on it either in whole or in part. In 

Robertson we held that this disclosure obligation protects the 

employee’s (or applicant’s) interest in the information 

needed to correct mistakes and respond to the employer’s 

potential concerns before the adverse action occurs, perhaps 

averting it altogether. Id. at 696–97. Testing the plaintiff’s 

claim against that interest, we held that she suffered a 

concrete injury because she “was denied information that 

could have helped her craft a response to [the defendant’s] 

concerns” about the content of her consumer report before 

the defendant rescinded the job offer. Id. at 697.

The question we confront here is whether subsection (y)(2) is sufficiently similar to § 1681b(b)(3)(A) to require 

the same outcome. The answer is no. Subsection (y)(2)

requires only that the employer disclose a “summary” of 

“the nature and substance” of a “communication” (i.e., a 

consumer report) obtained from a third party in connection 

with an investigation into employee misconduct. The summary need not be in writing, and specificity is not required. 

Finally, the summary is required only after the employer 

takes an adverse action, not before.

A postdecision, summary-only disclosure obligation like 

this one is a far cry from § 1681b(b)(3)(A), which (to repeat) 

requires the employer to give an employee or job applicant a 

complete copy of the consumer report and a written explanation of his FCRA rights before taking any adverse action 

against the employee or job applicant. That robust disclosure 
26 Nos. 17-1310 & 17-1649

requirement, we held in Robertson, provides substantive

protection: it gives the employee or applicant important 

information at a time and in a form that allows him to 

correct errors and address the employer’s concerns before 

any adverse action is taken. And that, we said, brought the 

case within the line of Supreme Court precedents dealing 

with informational injuries. 902 F.3d at 694 (citing Fed. 

Election Comm’n v. Akins, 524 U.S. 11 (1998); Pub. Citizen v. 

U.S. Dep’t of Justice, 491 U.S. 440 (1989)). 

Subsection (y)(2), in contrast, performs a mere post hoc 

notice function; it does little more. In that sense this case is 

closer to Groshek than to Robertson. Indeed, the disclosure 

requirement at issue in Groshek applies before the employer 

may access an employee’s or job applicant’s consumer report 

and thus provides the entire basis for the statutory 

informed-consent procedure. If anything, the disclosure 

requirement in Groshek serves a far stronger notice purpose 

than does subsection (y)(2), which operates entirely after the 

fact.

And the post hoc summary required by subsection (y)(2) 

may be quite generalized. It does not provide information at 

a time or in a form that allows the employee to meaningfully 

respond and possibly avert an adverse employment action.

If the employer’s failure to provide a compliant disclosure in 

Groshek was a bare procedural violation insufficient to confer 

standing, then the plaintiffs here have likewise suffered a 

mere procedural violation unaccompanied by any concrete 

injury.

The plaintiffs insist that Allstate’s failure to comply with 

subsection (y)(2) left them “hampered in defending themselves before Allstate or potential employers.” But subsec-
Nos. 17-1310 & 17-1649 27

tion (y)(2) doesn’t protect a substantive “defense” interest.

At most it serves a minimal notice function. And the plaintiffs have not explained how the modest, post hoc summary 

required by subsection (y)—again, a brief oral summary 

suffices—could possibly have informed a “defense” against 

Allstate after the fact. We note, moreover, that they failed to 

identify any prospective employer that refused to hire them 

based on the 10-K or the Greffin memo, so they have not 

established that they suffered a concrete informational 

injury. Nor have they identified any other tangible or intangible harm arising from Allstate’s failure to comply. 

In short, the FCRA claim rests on a bare procedural violation of subsection (y)(2) unaccompanied by any concrete and 

particularized harm or risk of harm to an interest protected 

by the statute. The FCRA awards must be vacated and the 

claim dismissed for lack of standing.

Our ruling on the plaintiffs’ standing to sue under the 

FCRA has implications for the defamation awards. As we’ve 

explained, the FCRA claim was the sole basis for federal 

jurisdiction. The district court adjudicated the defamation 

claim under the supplemental jurisdiction provision, which 

provides:

[I]n any civil action of which the district courts 

have original jurisdiction, the district courts 

shall have supplemental jurisdiction over all 

other claims that are so related to claims in the 

action within such original jurisdiction that 

they form part of the same case or controversy 

under Article III of the United States Constitution.

28 U.S.C. § 1367(a).
28 Nos. 17-1310 & 17-1649

By its plain terms, § 1367(a) “makes clear that supplemental jurisdiction may only be invoked when the district 

court has a hook of original jurisdiction on which to hang it.” 

Herman Family Revocable Tr. v. Teddy Bear, 254 F.3d 802, 805 

(9th Cir. 2001). Because the plaintiffs lack Article III standing 

to bring the FCRA claim, there is no original jurisdictional 

“hook” to support an assertion of § 1367(a) supplemental 

jurisdiction over the defamation claim, and the district court 

was without power to hear it.

[I]f the federal claim [is] dismissed for lack of 

subject matter jurisdiction, a district court has 

no discretion to retain the supplemental claims 

for adjudication. The dismissal means that 

there never was a valid claim within the court’s 

original jurisdiction to which the state claims 

may be supplemental. Therefore, the district 

court has no discretion to exceed the scope of 

its Article III power and must dismiss the state 

law claims without prejudice.

16 JAMES WM. MOORE, MOORE’S FEDERAL PRACTICE § 106.66[1]

(Daniel R. Coquillette et al. eds., 3d ed. 2018).

In notable contrast, when the court dismisses the federal 

claim on the merits, it has the discretion under § 1367(c)(3) to 

decline to hear related state-law claims or to retain them, 

though there is a general presumption that the court will 

relinquish supplemental jurisdiction and dismiss the statelaw claims without prejudice. RWJ Mgmt. Co. v. BP Prods. N.

Am., Inc., 672 F.3d 476, 479–80 (7th Cir. 2012). But that’s not 

this case. Here the plaintiffs failed to establish Article III 

standing to bring the federal claim that supported the exercise of § 1367(a) jurisdiction. “[W]here there is no underlying 
Nos. 17-1310 & 17-1649 29

original federal subject matter jurisdiction, the court has no 

authority to adjudicate supplemental claims under § 1367.” 

Herman Family Revocable Tr., 254 F.3d at 805; see also Textile 

Prods., Inc. v. Mead Corp., 134 F.3d 1481, 1485–86 (Fed. Cir. 

1998); Saksenasingh v. Sec’y of Educ., 126 F.3d 347, 351 (D.C. 

Cir. 1997); Musson Theatrical, Inc. v. Fed. Express Corp., 89 F.3d 

1244, 1255 (6th Cir. 1996); Nowak v. Ironworkers Local 6 Pension Fund, 81 F.3d 1182, 1187 (2d Cir. 1996).

We are not unmindful of the costs of a jurisdictional dismissal at this late stage, after a full trial on the merits and an 

appeal. Regrettably, the federal courts have sunk considerable resources into resolving the parties’ dispute when the 

case belonged in state court. But the jurisdictional defect 

leaves us with no choice. Accordingly, the judgment is 

vacated and the case is remanded with instructions to dismiss the entire action for lack of subject-matter jurisdiction. 

See FED. R. CIV. P. 12(h)(3) (“If the court determines at any 

time that it lacks subject-matter jurisdiction, the court must 

dismiss the action.”).

VACATED AND REMANDED WITH INSTRUCTIONS.