Opinion ID: 4510978
Heading Depth: 3
Heading Rank: 2

Heading: Merits of the Standing Inquiry

Text: Having concluded that each class member must have standing to recover damages, we turn to the dispositive and more difficult question in this case: Did each of the 8,185 class members have standing? TransUnion challenges only the first standing requirement—injury in fact. Because a “plaintiff must demonstrate standing for each claim he seeks to press,” DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 335 (2006), we address standing for each of the class’s three claims. Plaintiffs bore the burden of proving standing through evidence at trial. See Lujan, 504 U.S. at 561.
Under § 1681e(b) of the FCRA, “[w]henever a [CRA] prepares a consumer report it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.” 15 U.S.C. § 1681e(b). The class’s first claim is that TransUnion willfully failed to follow reasonable procedures to assure maximum possible accuracy when it collected OFAC information using rudimentary name-only searches and placed the inaccurate information on the class members’ credit reports without further verification. 22 RAMIREZ V. TRANSUNION TransUnion argues that, to have suffered a concrete injury from the § 1681e(b) violation, each class member must show that TransUnion disclosed his or her credit report to a third party. In other words, TransUnion argues no injury results from a false OFAC alert until someone other than TransUnion and the consumer sees it. For support, TransUnion relies on the Supreme Court’s decision in Spokeo, Inc. v. Robins (Spokeo II), 136 S. Ct. 1540 (2016). Prior to Spokeo II, we held that the violation of a “statutory right”—including an FCRA violation—“is usually a sufficient injury in fact to confer standing” without any showing of actual harm. See Robins v. Spokeo, Inc. (Spokeo I), 742 F.3d 409, 412 (9th Cir. 2014), vacated and remanded, 136 S. Ct. 1540 (2016). The Supreme Court granted certiorari and reversed, explaining that “Congress cannot erase Article III’s standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.” Spokeo II, 136 S. Ct. at 1547– 48 (quoting Raines v. Byrd, 521 U.S. 811, 820 n.3 (1997)). Rather, “Article III standing requires a concrete injury even in the context of a statutory violation.” Id. at 1549. The Supreme Court recognized, however, that an injury may still be concrete even if intangible. Id. And there is sufficient injury in fact when a defendant’s statutory violation creates a “risk of real harm” to a plaintiff’s concrete interest. Id. In determining whether an intangible harm constitutes an injury in fact, we look to historically recognized injuries and Congress’s judgment. Id. We look to history to determine “whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Id. And we are guided by Congress’s judgment because “Congress is well positioned to identify RAMIREZ V. TRANSUNION 23 intangible harms that meet minimum Article III requirements[.]” Id. Spokeo also involved a consumer’s claim against a CRA under § 1681e(b). Robins, a consumer, alleged that Spokeo, a CRA that operated a people-search website, published a profile about him on its website that contained inaccurate information regarding his age, marital status, wealth, employment, and education. Robins v. Spokeo, Inc. (Spokeo III), 867 F.3d 1108, 1111 (9th Cir. 2017). With respect to injury in fact, Robins alleged that the presence of the false information on Spokeo’s website “harmed his employment prospects at a time when he was out of work” and caused him emotional distress. Id. The Supreme Court declined to decide whether Robins sufficiently alleged a concrete injury, but it provided the following guidance: On the one hand, Congress plainly sought to curb the dissemination of false information by adopting procedures designed to decrease that risk. On the other hand, Robins cannot satisfy the demands of Article III by alleging a bare procedural violation. A violation of one of the FCRA’s procedural requirements may result in no harm. For example, even if a [CRA] fails to provide the required notice to a user of the agency’s consumer information, that information regardless may be entirely accurate. In addition, not all inaccuracies cause harm or present any material risk of harm. An example that comes readily to mind is an incorrect zip code. It is difficult to imagine how the 24 RAMIREZ V. TRANSUNION dissemination of an incorrect zip code, without more, could work any concrete harm. Spokeo II, 136 S. Ct. at 1550. On remand, we held that Robins alleged a material risk of harm to his concrete interests sufficient to satisfy Article III standing. Spokeo III, 867 F.3d at 1118. We adopted a two-part inquiry for determining whether the violation of a statutory right constitutes a concrete injury: “(1) whether the statutory provisions at issue were established to protect [the plaintiff’s] concrete interests (as opposed to purely procedural rights), and if so, (2) whether the specific procedural violations alleged . . . actually harm, or present a material risk of harm to, such interests.” Id. at 1113. In Robins’s case, we held at step one that § 1681e(b) was enacted to protect consumers’ concrete interests in avoiding the very real-world harms that result from inaccurate credit reporting—such as the inability to obtain credit and employment and “the uncertainty and stress” that consumers experience when they discover inaccurate information in their credit reports. Id. at 1114. We noted that “the interests that [the] FCRA protects also resemble other reputational and privacy interests that have long been protected in the law.” Id. At step two, we concluded that Robins had been exposed to a material risk of harm to that concrete interest because Spokeo published inaccurate information on its website that was far more material than a mere incorrect zip code. Id. at 1116–17. Applying the test to the facts of this case, we conclude that all 8,185 class members suffered a material risk of harm to their concrete interests protected by § 1681e(b) as a result of TransUnion’s failure to follow reasonable procedures to assure maximum possible accuracy of OFAC information. RAMIREZ V. TRANSUNION 25 Step one is clear. Congress enacted the FCRA, including § 1681e(b), “to protect consumers’ concrete interests.” Id. at 1113. “[G]iven the ubiquity and importance of consumer reports in modern life—in employment decisions, in loan applications, in home purchases, and much more—the realworld implications of material inaccuracies in those reports seem patent on their face.” Id. at 1114. The FCRA’s reasonable procedures requirement is particularly important because the “threat to a consumer’s livelihood is caused by the very existence of inaccurate information in his credit report and the likelihood that such information will be important to one of the many entities who make use of such reports[.]” Id. at 1114; see also 15 U.S.C. § 1681(a)(4) (explaining that Congress enacted the FCRA “to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer’s right to privacy”). “Courts have long entertained causes of action to vindicate intangible harms caused by certain untruthful disclosures about individuals, and we respect Congress’s judgment that a similar harm would result from inaccurate credit reporting.” Spokeo III, 867 F.3d at 1115. At step two, standing is also clear for all class members for a number of reasons. First, the nature of the inaccuracy is severe. TransUnion inaccurately identified and labeled all class members as potential terrorists, drug traffickers, and other threats to national security; it did not inaccurately report a zip code or a minor discrepancy. As a result of its careless procedures for identifying OFAC “matches,” TransUnion sent all class members a letter informing them that they were considered potential SDNs. This practice ran a real risk of causing the uncertainty and stress that Congress aimed to prevent in enacting the FCRA. See Drew v. Equifax Info. Servs., LLC, 690 F.3d 1100, 1109 (9th Cir. 2012) (“The 26 RAMIREZ V. TRANSUNION FCRA permits ‘recovery for emotional distress and humiliation.’” (quoting Guimond v. Trans Union Credit Info. Co., 45 F.3d 1329, 1333 (9th Cir. 1995)). In Spokeo III, we stated that it was “clear” that the plaintiff was exposed to a material risk of harm because a CRA made inaccurate information about his age, marital status, education, and wealth available to third parties. 867 F.3d at 1117. The risk here was far graver. The OFAC labels are the type of information that risks triggering significant concern, confusion, and even potential contact with a federal intelligence agency. And the record here shows this risk is far from hypothetical; indeed, the Department of the Treasury informed TransUnion that it “continue[d]” to hear from a number of concerned individuals who had been inaccurately labeled as OFAC matches by TransUnion, and that TransUnion’s practice was “creating unnecessary confusion” among affected consumers. As Ramirez testified at trial: “[I]if somebody tells you you’re on a terrorist list, what are you going to do?” Second, TransUnion engaged a third-party vendor— Accuity, Inc.—to develop the software and database containing the underlying information for the OFAC alerts. As a result, TransUnion and Accuity communicated about the database information and OFAC matches. And TransUnion concedes that OFAC matches were not housed by TransUnion; the OFAC list was stored in a separate database operated and maintained by Accuity. It is precisely for this reason that TransUnion purportedly determined that the OFAC alerts were not governed by the FCRA. 7 This 7 In an effort to avoid the FCRA’s reach to its unlawful conduct, TransUnion similarly argued in Cortez that the OFAC information was maintained and stored by Accuity and, therefore, the information was not RAMIREZ V. TRANSUNION 27 type of access to and information sharing with a third party certainly compounds the risk of harm to all class members’ privacy and reputational interests. The practice created a significant risk that third parties other than the affected consumers would learn about the inaccurate and highly embarrassing OFAC matches. Finally, TransUnion—one of the nation’s largest consumer reporting agencies—made all class members’ reports available to potential creditors or employers at a moment’s notice, even without the consumers’ knowledge in some instances. See 15 U.S.C. §§ 1681b(b)(2)(A) (requiring notice to the consumer only when a credit report is requested for employment purposes), 1681b(c)(1)(B) (allowing credit reports to be furnished before the consumer has initiated a transaction in certain circumstances). Credit reports exist for the very purpose of being disseminated to third parties. Like in Spokeo, where false information was made available to third parties on the Internet, TransUnion created a risk of harm to all class members by allowing third parties to readily access the reports. Indeed, the 1,853 class members whose reports were disseminated to potential creditors have shown even greater injuries because we know those third parties, which are in part of consumers’ “file[s]” in TransUnion’s control. See Cortez, 617 F.3d at 711. The Third Circuit unequivocally rejected that argument. Id. at 711 (“We do not believe that Congress intended to allow credit reporting companies to escape the disclosure requirement in § 1681a(g) by simply contracting with a third party to store and maintain information that would otherwise clearly be part of the consumer’s file and is included in a credit report.”) (emphasis added); see also id. at 703 (noting that “TransUnion decided not to include the underlying information for its OFAC product in TransUnion’s own database” and “decided to use Accuity rather than maintain the information itself.”). 28 RAMIREZ V. TRANSUNION the business of denying or approving credit-related requests, actually accessed those class members’ reports containing the false OFAC alerts. It is difficult to conceive of information on a credit report that is more damaging to a consumer than a statement that the consumer is potentially prohibited from transacting business in the United States because the consumer is a criminal or a threat to national security. This is not to mention the reputational harm that inevitably results from disseminating this information to a potential creditor. As to the remaining 6,332 class members, TransUnion argues these class members cannot show any injury because their reports were not disseminated to third parties. However, this reading of the injury-in-fact requirement is too narrow. True, Spokeo III did not “consider whether a plaintiff would allege a concrete harm if he alleged only that a materially inaccurate report about him was prepared but never published.” 867 F.3d at 1116 n.3 (emphases omitted). But that situation is not this case. Here, the fact that TransUnion made the reports available to numerous potential creditors and employers—coupled with the highly sensitive and distressing nature of the OFAC alerts disclosed to the consumers, the risk of third-party access TransUnion created through its dealings with Accuity, and the federal government’s awareness of the alerts—is sufficient to show a material risk of harm to the concrete interests of all class members. 8 8 Our dissenting colleague argues that the risk of harm to class members other than Ramirez is too speculative. According to the dissent, “counsel presented no evidence about the consequences of dissemination of the reports for any class member other than Ramirez” and could have offered “expert testimony, representative class members, RAMIREZ V. TRANSUNION 29 This case is distinguishable from Owner-Operator Independent Drivers Ass’n, Inc., et al., v. United States Department of Transportation et al., 879 F.3d 339 (D.C. Cir. 2018), a case relied on heavily by the dissent. There, the plaintiffs argued that they were injured “by the mere existence of inaccurate information” in a database operated by the Federal Motor Carrier Safety Administration, but they conceded that their information was not at risk of dissemination, and the record showed that any risk of future disclosure of inaccurate information was “virtually eliminated by the Department’s adoption of an interpretive rule.” Id. at 343, 346. The court held that, although “it is possible that the mere existence of inaccurate information in a government database could cause concrete harm depending on how that information is to be used,” no such harm or risk of future harm existed because the record showed there was no risk of disclosure for the absent class members. Id. at 347. Here, by contrast, the class’s claim of injury does not simply rest on TransUnion’s maintenance of and credit agency protocol to fill this gap.” To the extent the dissent suggests that there is no evidence about dissemination of any of the class members’ reports other than Ramirez’s, that is inaccurate; indeed, as the dissent recognizes, the parties stipulated that at least a portion of the class had their credit reports requested by a potential credit grantor. As noted above, this evidence coupled with other evidence shows that the remainder of the class members were subject to a material risk of harm. To the extent the dissent suggests that class counsel had to show that all class members suffered adverse consequences as a result of dissemination of their reports, this is also incorrect. See Spokeo III, 867 F.3d at 1118 (“[I]n the context of [the] FCRA, [an] intangible injury is itself sufficiently concrete. It is of no consequence how likely [the plaintiff] is to suffer additional concrete harm as well (such as the loss of a specific job opportunity).”). The dissent offers no support for the proposition that counsel was required to introduce expert testimony and the other type of evidence that the dissent identifies, precisely because none exists. 30 RAMIREZ V. TRANSUNION an inaccurate database, with conclusive evidence that there is no risk of dissemination. 9 We are not faced with a mere technical or procedural FCRA violation here. There may be a case where the nature of the inaccurate information is such that no risk of harm arises until the credit report information of all class members 9 The other out-of-circuit cases cited by the dissent are similarly distinguishable. See Gubala v. Time Warner Cable, Inc., 846 F.3d 909, 912 (7th Cir. 2017) (“Had [plaintiff] reason to believe the company intends to release any of that information or cannot be trusted to retain it, he would have grounds for obtaining injunctive relief; but he doesn’t even argue that there is a risk of such leakage.”); Braitberg v. Charter Commc’ns, Inc., 836 F.3d 925, 930 (8th Cir. 2016) (holding that plaintiff had no standing to sue under the Cable Communications Policy Act, where he merely alleged that defendant failed to destroy plaintiff’s personally identifiable information and retained certain information longer than the company should have kept it). This case is also distinguishable from Bassett v. ABM Parking Servs., Inc., 883 F.3d 776 (9th Cir. 2018). Bassett involved a vendor that printed the expiration date of the plaintiff’s credit card on the plaintiff’s receipt for a one-time transaction, in violation of another FCRA provision. Id. at 777. There was no material risk of harm because only the cardholder himself ever saw the receipt. Id. at 783. This case involves credit reports, not receipts. Credit reports, unlike receipts, exist for the purpose of being disseminated to third parties. Moreover, the risk of harm is much more direct here. An OFAC alert placed on a credit report runs an almost inevitable risk of reputational harm, emotional distress, and/or denial of credit or employment if disclosed to a third party—real-world harms. In contrast, printing the expiration date of a credit card does not pose such inevitable risk; rather, harm would only materialize if a number of other contingencies occurred. Bassett also did not involve a third-party vendor with access to the inaccurate information or evidence that the defendant’s practice created confusion and interaction with an intelligence agency among consumers receiving the inaccurate information. This case is more analogous to Spokeo III, 867 F.3d 1108, and Pedro v. Equifax, Inc., 868 F.3d 1275 (11th Cir. 2017) (holding that the plaintiff had standing where credit reporting agency included a debt the plaintiff did not owe in the plaintiff’s consumer report). RAMIREZ V. TRANSUNION 31 is actually disseminated to a third party, but this is not it. On the facts of this case, we hold that a real risk of harm arose when TransUnion prepared the inaccurate reports and made them readily available to third parties, and certainly once TransUnion sent the inaccurate information to the class members and some class members’ reports were disseminated to third parties. This risk of harm was directly caused by TransUnion’s failure to follow reasonable procedures to ensure maximum possible accuracy of its OFAC information, and an award of damages would redress the harm caused by the risk.
The class’s second and third claims were that TransUnion failed to: (a) disclose that the class members had been identified as potential OFAC matches when the consumers requested their credit reports, in violation of § 1681g(a); and (b) include a summary-of-rights form when TransUnion mailed the separate OFAC Letters, in violation of § 1681g(c)(2). Although we must analyze standing on a claim-by-claim basis, the injuries produced by these two violations are closely intertwined. Subsections (a) and (c)(2) work together to protect consumers’ interests in having access to the information in their credit reports upon request and understanding how to correct inaccurate information in their credit reports upon receipt. 15 U.S.C. §§ 1681g(a), (c)(2). These interests can only be fulfilled together; one without the other is meaningless. And they go to the core of Congress’s purpose in enacting the FCRA: “to protect consumers from the transmission of inaccurate information about them[.]” Guimond, 45 F.3d at 1333; see also Gillespie v. Equifax Info. Servs., LLC, 484 F.3d 938, 941 (7th Cir. 2007) (“A primary purpose of the statutory scheme provided by the disclosure 32 RAMIREZ V. TRANSUNION in § 1681g(a)(1) is to allow consumers to identify inaccurate information in their credit files and correct this information via the grievance procedure established under § 1681i. . . . In writing § 1681g(a)(1), Congress requires disclosure that is both ‘clearly and accurately’ made. An accurate disclosure of unclear information defeats the consumer’s ability to review the credit file, eliminating a consumer protection procedure established by Congress under the FCRA.”). We have previously acknowledged that the rights created by the FCRA to accomplish this purpose “resemble other reputational and privacy interests that have long been protected in the law.” Spokeo III, 867 F.3d at 1114. These are not mere procedural or technical requirements. They protect consumers’ concrete interest in accessing important information about themselves and understanding how to dispute inaccurate information before it reaches potential creditors. Cf. Syed v. M-I, LLC, 853 F.3d 492, 499– 500 (9th Cir. 2017) (holding that the FCRA provision requiring prospective employers to obtain a consumer’s consent before obtaining a credit report in a standalone document protected a concrete informational and privacy interest); Nayab v. Capital One Bank (USA), N.A., 942 F.3d 480, 490–93 (9th Cir. 2019) (holding that every violation of the FCRA provision that prohibits obtaining a credit report for an unauthorized purpose violates the consumer’s substantive privacy interest, and the consumer has standing “regardless whether the credit report is published or otherwise used by [a] third-party” and “need not allege any further harm” (quoting Eichenberger v. ESPN, Inc., 876 F.3d 979, 983–84 (9th Cir. 2017))). And although the FCRA’s disclosure requirements may seem “procedural” in nature, Congress enacted them because they are the only practical way to protect consumers’ interests in fair and accurate credit reporting. See Spokeo III, 867 F.3d at 1113. RAMIREZ V. TRANSUNION 33 Therefore, step one of the Spokeo III framework is satisfied for both claims. At step two, we have no trouble concluding that TransUnion’s disclosure violations exposed all class members to a material risk of harm to their concrete informational interests. TransUnion sent the class members a document that purported to be their entire credit report, containing no mention of OFAC. This put every class member at a risk of real harm: not knowing that they were falsely being labeled as terrorists, drug dealers, and threats to national security. Then, TransUnion sent the class members the separate OFAC Letter without a summary-ofrights form. This conduct posed a serious risk that consumers not only would be unaware that this damaging label was on their credit reports, but also would be left completely in the dark about how they could get the label off their reports. 10 TransUnion’s conduct therefore exposed 10 The dissent suggests that, to establish standing for these two claims under Section 1681g, every class member must have shown evidence of shock or confusion. However, all members of the class were falsely labeled by TransUnion as terrorists and national security threats and requested a copy of their credit reports, and TransUnion sent the confusing mailings to all class members. The mailings that TransUnion provided to class members were inherently shocking and confusing, and Ramirez, as the class representative, testified to that effect. To require further individualized evidence of shock or confusion would defeat the purpose of class actions. And while there may exist a case where additional evidence would be required to ascertain whether the absent class members were indeed shocked or confused, this case is not it. See also Fed. Election Comm’n v. Akins, 524 U.S. 11, 21 (1998) (“[T]his Court has previously held that a plaintiff suffers an ‘injury in fact’ when the plaintiff fails to obtain information which must be publicly disclosed pursuant to a statute.”); Pub. Citizen v. U.S. Dep’t of Justice, 491 U.S. 440, 449 (1989) (holding that failure to obtain information subject to disclosure under Federal Advisory Committee Act was sufficient injury to confer standing); Havens Realty Corp. v. Coleman, 455 U.S. 363, 374 34 RAMIREZ V. TRANSUNION every class member to a material risk of harm to the core interests the FCRA was designed to protect—their interests in being able to monitor their credit reports and promptly correct inaccuracies. 11