Standing and Privacy Harms: A Critique of TransUnion v. Ramirez
Daniel J. Solove & Danielle Keats Citron
Standing and Privacy Harms: A Critique of TransUnion v. Ramirez
101 B.U. L. Rev. Online 62 (2021)
PDF
In this term, the U.S. Supreme Court has significantly undermined the effectiveness of many privacy laws. Through the standing doctrine, the U.S. Supreme Court essentially nullified a key enforcement component of many privacy laws—private rights of action. The decision in TransUnion LLC v. Ramirez[1] revisits the issue of standing and privacy harms under the Fair Credit Reporting Act (the “FCRA”) that began with Spokeo, Inc. v. Robins[2] in 2016.[3] This case arguably strikes a major blow to the enforcement of privacy laws in the federal courts. While state courts do not have the same restrictive rules to hearing cases and controversies, federal standing rules have a way of leaching into judicial thinking. So TransUnion may have reverberations beyond just the federal courts.
TransUnion has special relevance for our forthcoming article Privacy Harms in the Boston University Law Review.[4] We write separately here to discuss the TransUnion case and its potential impact. We contend that TransUnion is wrong and troubling on many levels. At the broadest level, we argue that the Court’s current standing doctrine is wrong as a matter of history and policy. Even accepting current standing doctrine, we contend that the Court’s test for recognizing concrete injuries is severely flawed. The Court’s application of its test is also marred by an inadequate understanding of privacy harms. Finally, the Court’s rejection of legislative recognition of harm in statutes is a profound usurpation of legislative power.
TransUnion, FCRA, and Standing
In TransUnion, a class of 8,185 plaintiffs sued TransUnion for falsely labeling them as potential terrorists in their credit reports.[5] The plaintiffs initiated a class action under the FCRA, which provides a private right of action for “[a]ny person who willfully fails to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer” for actual damages or for statutory damages not less than $100 and not more than $1,000, as well as for punitive damages and attorney’s fees.[6] The plaintiffs alleged that TransUnion violated the FCRA by failing to “follow reasonable procedures to assure maximum possible accuracy” in consumer reports,[7] and to “disclose to the consumer ‘[a]ll information in the consumer’s file at the time of the request.’”[8] The plaintiffs also contended that TransUnion failed to follow the FCRA’s requirement of providing a summary of their rights with each written disclosure to them.[9] Following a trial, the jury concluded that TransUnion had engaged in these violations, providing each class member statutory damages of $984.22 and punitive damages of $6,353.08.[10] The total class damage award was in excess of $60 million.[11]
Writing for the 5-4 majority, Justice Kavanaugh concluded that the only plaintiffs (1,853 individuals of the original 8,185) who had standing to sue in federal court for lack of reasonable procedures were those whose credit reports had been disseminated to third-party businesses.[12] The 6,332 plaintiffs whose credit reports labeled them as suspected national security threats but were not shared with businesses lacked a “concrete” injury necessary for standing.[13] For the claims related to apprising plaintiffs of their rights, the majority found that the plaintiffs (except for class representative Sergio Ramirez) lacked standing to bring them because they had not shown that the errors caused concrete harm.[14] The majority took this view even though Congress had explicitly granted plaintiffs a private right of action to sue for such violations (without a showing of additional injuries beyond the violations) and even though a jury found TransUnion at fault.
Standing Doctrine Has No Standing
To have standing in federal court, there must be an “injury in fact,” which is “an invasion of a legally protected interest” that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.”[15] In Spokeo, the Court held, in a vague, confusing jumble of an opinion by Justice Alito, that courts could reject standing even in cases where Congress granted plaintiffs a private right of action to sue for violations of a statute.[16] Spokeo similarly involved the FCRA, and the Court remanded the case for the Ninth Circuit to determine whether the plaintiffs had suffered a concrete injury that the common law had traditionally recognized as a sufficient basis for a lawsuit in American courts.[17] The Ninth Circuit ultimately concluded that the plaintiffs had standing to sue because they were harmed due to inaccurate information in credit reports that were available on Spokeo’s website.[18] As the Ninth Circuit concluded, the “dissemination of false information in consumer reports can itself constitute a concrete harm.”[19]
The TransUnion Court justifies standing doctrine as essential to separation of powers, as something hearkening back to the Framers of the Constitution and woven into the U.S. Constitution. The Court sums up current standing doctrine with a slogan: “No concrete harm, no standing.”[20]
But current standing doctrine—specifically the injury in fact requirement—is actually a concoction of the Court from the 1970s, with Cass Sunstein calling the requirement a “conceptual mistake.”[21]
As several scholars have argued, before the 1970s, the Court generally looked to whether there was a “legal right” to determine standing.[22] In 1970, the Court appeared to add another basis for standing—injury in fact—not as a replacement for the legal right test, but as an addition to it. Rachel Bayefsky writes:
The injury-in-fact requirement may have initially served to liberalize the law of standing by permitting plaintiffs to allege that a particular course of conduct had injured them “in fact” even if they could not show that they possessed an individual legal right infringed by the challenged conduct. But the injury-in-fact requirement began, in the 1970s, to be interpreted more restrictively.[23]
According to Justice Thomas’s dissent:
Key to the scope of the judicial power, then, is whether an individual asserts his or her own rights. At the time of the founding, whether a court possessed judicial power over an action with no showing of actual damages depended on whether the plaintiff sought to enforce a right held privately by an individual or a duty owed broadly to the community. Where an individual sought to sue someone for a violation of his private rights, such as trespass on his land, the plaintiff needed only to allege the violation.[24]
Justice Thomas further notes:
This distinction mattered not only for traditional common-law rights, but also for newly created statutory ones. The First Congress enacted a law defining copyrights and gave copyright holders the right to sue infringing persons in order to recover statutory damages, even if the holder “could not show monetary loss.”[25]
We doubt that the Court will curtail lawsuits under copyright law for lack of harm, as this would send shockwaves across the media industry. The Court has typically used standing as a tool to help corporations elude lawsuits by individuals. But Justice Thomas’s mention of copyright law demonstrates how the shift in TransUnion could have dramatic implications. As is increasingly common with Supreme Court cases lately, TransUnion purports to be a mere application of current law when, in fact, it works a significant change in the law. Supreme Court opinions often wear this mask, pretending to be routine and concealing their radical departure from precedent. Spokeo made a significant turn, and TransUnion pushes even further into this new territory. If Spokeo and TransUnion are carried to their logical conclusion, common and longstanding private rights of action for countless laws, including copyright law, might no longer be viable in federal court. Of course, the Court could curtail such a result through the selective application of the logic in these cases or by making questionable distinctions so that only laws the justices dislike are affected.
Justice Thomas notes that plaintiffs long “could sue in federal court merely by alleging a violation of a private right.”[26] Justice Thomas then contends that the majority rejects history by holding “that the mere violation of a personal legal right is not—and never can be—an injury sufficient to establish standing.”[27] He further notes that it was not until 1970, nearly two centuries after the drafting of the Constitution, that “this Court even introduced the ‘injury in fact’ (as opposed to injury in law) concept of standing.”[28]
Current standing doctrine appears akin to the classic game of telephone, where a person whispers a sentence to another person who then whispers it to another person and so on down the line. When the game ends, the last person is asked to repeat the sentence, which has inevitably morphed into something entirely different from what was first said. That is what we have here—with stakes for appropriate deference to legislative choices and consumer privacy that could not be higher.
A Non-Concrete Test for Recognizing “Injury in Fact”
In TransUnion, a case with a different set of plaintiffs alleging claims under the FCRA, the Court this time proceeded to make the standing determination itself, purportedly under the Spokeo standard. The Court stated:
That inquiry asks whether plaintiffs have identified a close historical or common-law analogue for their asserted injury. Spokeo does not require an exact duplicate in American history and tradition. But Spokeo is not an open-ended invitation for federal courts to loosen Article III based on contemporary, evolving beliefs about what kinds of suits should be heard in federal courts.[29]
In essence, for the majority in TransUnion, the test for whether an injury is sufficiently “concrete” (and hence sufficient for standing) is how close it approximates injury recognized by courts in the past. Where is the line to be drawn? Instead of a clear test, we get a horseshoe test—close counts. But close to what and how close is close enough? The test appears to be one that only Justice Potter Stewart would love—the “I know it when I see it” test.[30] Ironically, the Court in all its fuss about finding a “concrete” injury cannot even come up with a concrete test.
In addition to the vagueness of the test, another problem is the difficulty in getting a clear read of the common law. The common law is evolving, not static, so it is unclear what the majority means by “traditional.”[31] On the one hand, “traditional” injuries could mean injuries recognized at the time of the founding. On the other hand, “traditional” injuries could mean injuries recognized over the past century. The majority seems to be suggesting as much given its inclusion of the torts of public disclosure of private facts and intrusion of seclusion as illustrations of intangible harms “traditionally recognized as providing a basis for lawsuits.”[32] Both public disclosure of private facts and intrusion on seclusion received recognition as privacy torts recently relative to other torts—only during the mid-twentieth century.
Interestingly, the Court mentions the activities giving rise to privacy torts, which were very heavily influenced by academic ideas. The privacy torts were spawned from a law review article by Samuel Warren and Louis Brandeis in 1890.[33] For more than a decade after the publication of the article, no court recognized any privacy torts, and the first court to take up the issue rejected the invitation to create a tort based on the Warren and Brandeis article.[34] Slowly, in the first half of the twentieth century, courts began to recognize the privacy torts. In the middle of the century, William Prosser, a legal academic, wrote about the torts and codified them in the Restatement (Second) of Torts. Many courts were then spurred to recognize the privacy torts.[35]
The common law is somewhat like a mutt—it is an amalgamation of ideas from various sources, only some of which are judicial decisions. Courts routinely recognize causes of action based even on non-legal sources. Thus, the Court seems to have a view of “traditional” under the common law as involving centuries-old precedents created by robed jurists in stuffy wood-paneled rooms. But, in reality, the common law is cobbled together in a more eclectic and ad hoc manner, almost bric-a-brac in nature.
Moreover, the Court misunderstands another aspect of the nature of the common law—it is far from static. Although the privacy torts are well-recognized today, it was a long process of fits and starts. Change in the common law is messy and inconsistent. New situations are constantly thrown into the cauldron, and it can take a while for the common law to recognize the analogies between new situations and older ones.
The Court’s injury in fact approach looks for clarity in the common law, but such clarity is quite elusive because the common law is far from consistent. In our co-authored scholarship, we have shown that courts have recognized many types of privacy harm and data breach harm, often inconsistently. With most types of harm analyzed, courts have recognized similar types of harm in other contexts but have struggled in the privacy and data breach context.[36]
As we have chronicled rather extensively, the courts are not speaking in a clear “yes” or “no” answer when recognizing harm for privacy violations or data breaches. Instead, the situation is akin to the Tower of Babel—everyone is saying something different.
In short, courts should be reluctant to reify the common law for the purposes of standing. The common law is constantly evolving, and it is doing so quite rapidly in the privacy and data breach contexts.
Also, both the public disclosure and intrusion on seclusion torts involve wrongful activities—the interference with rights—rather than setbacks to interests or harms. Many scholars and Justice Thomas have noted that rights were the original hook for standing, not harms.[37] It is not by accident that Warren and Brandeis’s article was called The Right to Privacy.[38] Thus, ironically, looking to history for a “common-law analogue” shows us that the common law protected against violations to “rights,” the very thing the Court rejects as sufficient for standing. Unfortunately, so much history and understanding of the common law is lost to the majority of the Court.
A Crabbed Understanding of Privacy Harms
In addition to erroneously looking to harm as a basis for standing, the Court is also wrong in how it conceives of privacy harms. Interestingly, the majority recognizes intrusion upon seclusion as a harm. For the privacy tort with that name, no disclosure or dissemination of information is required at all. When Prosser identified court decisions as comprising the tort of intrusion on seclusion in his famous 1960 article, he explained that the harm being redressed was primarily emotional distress.[39] But no matter, the intrusion tort involves a wrong that has nothing to do with dissemination of information. So why is the Court requiring it for the FCRA?
In Privacy Harms, we contend that many types of privacy violations are harmful in ways the courts sometimes fail to recognize.[40] We demonstrate that in many cases, there are other domains of the common law where courts recognize harm that is conceptually similar.
The type of harm involved in TransUnion would be a “data quality harm” under our typology. As we wrote:
Finding specific economic harms for incorrect information in records can be challenging because errors or missions could lead to a variety of consequences at some point in the future, long beyond the statute of limitations for most causes of action. Suppose, for example, that a credit report erroneously states that a person went bankrupt. Whether the error causes any economic harm will depend upon how the report is used. A wise person would likely refrain from seeking a loan while the error remains in the report, as this could result in denial of the loan or a higher interest rate.[41]
With data quality harms, people will lose out on loans or jobs that they might have obtained if their data were accurate. People often need to obtain a loan quickly, so it does not make sense to try to obtain the loan before fixing the errors in their credit reports. Likewise, if a person is going to be listed as a potential terrorist, why bother even applying to a job? By the time the error is fixed, the position will likely be filled. Thus, data quality harms involve the chilling of behavior. People will not bother to apply for loans or jobs until the error is cleaned up.
Further, we wrote: “It can be hard for individuals to find out about errors, and when they do, third parties will ignore requests to correct them without the real risk of litigation costs.”[42] In TransUnion, the plaintiffs were also suing over TransUnion’s failure to notify them of the problem with their records and their failure to inform them about their rights to have the issue redressed.
Additionally, the TransUnion harm could also be an “emotional distress harm,” as a reasonable person would certainly be justified in feeling emotional distress at being labeled a potential terrorist.
As Justice Thomas notes in dissent, “one need only tap into common sense to know that receiving a letter identifying you as a potential drug trafficker or terrorist is harmful. All the more so when the information comes in the context of a credit report, the entire purpose of which is to demonstrate that a person can be trusted.”[43]
A Usurpation of Legislative Power
TransUnion is a usurpation of legislative power. Spokeo danced around the issue, noting that Congress can play a role in defining harm and noting that in certain cases, courts could override Congress’s determination.[44] TransUnion further encroaches on Congress’s power. Normally, it has been the conservatives who have urged judicial restraint and deference to Congress. According to the traditional conservative critique, so-called “activist” judges are purportedly quick to override Congress’s judgment and make law themselves. But that’s just what this conservative majority of the Supreme Court does: It essentially rewrites the FCRA to be more to the Court’s liking.
When the FCRA was enacted by Congress, it had a private right of action for violations of its rights and obligations. That private right of action was included as a trade in exchange for severely limiting state privacy and defamation claims.[45] Congress decided upon the best mechanisms for enforcing the law. President Nixon—a conservative in this bygone era—seemingly accepted the private right of action because he signed the FCRA into law.
Using a private right of action is an important enforcement mechanism for laws. Nearly all regulatory agencies are significantly understaffed and under-resourced, and they cannot enforce in every case. They must be highly selective in enforcement. A private right of action works to deputize “private attorneys general” to help enforce the law. The monetary award works as a kind of bounty, encouraging the private enforcement of the law and easing the burden on regulators.[46] For example, as one article aptly observes, “Private parties have largely been responsible for enforcement of the [Telephone Consumer Protection Act].”[47]
Now, fifty years later, the Supreme Court waltzed in to disapprove of the FCRA’s enforcement mechanisms and allow courts to nullify them. This is akin to rewriting the law.
Ironically, the Court aggrandizes the power of the Judiciary in the name of “separation of powers” and the standing doctrine, which is designed to limit the power of the courts.[48] Standing is a “passive virtue,” a way for courts to sidestep from entering into the political fray.[49] But in TransUnion, standing is not a shield that deflects but a sword that slices away parts of laws the judiciary dislikes. Far from passive, standing now is weaponized, a tool to achieve political ends. Normally, the role of the courts, especially for conservatives, is to defer to Congress.
Let’s call TransUnion for what it is: an activist decision that nullifies Congress’s power to protect consumers and that enables courts to rewrite privacy laws to alter how they are enforced.
[1]TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (2021).
[2]Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).
[3]TransUnion, 141 S. Ct. at 2204 (“[W]ith respect to the concrete-harm requirement in particular, this Court’s opinion in Spokeo v. Robins indicated that courts should assess whether the alleged injury to the plaintiff has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts. . . . Spokeo does not require an exact duplicate in American history and tradition. But Spokeo is not an open-ended invitation for federal courts to loosen Article III based on contemporary, evolving beliefs about what kinds of suits should be heard in federal courts.” (citation omitted)).
[4]See Danielle Keats Citron & Daniel J. Solove, Privacy Harms, 102 B.U. L. Rev. (forthcoming Mar. 2022) (manuscript at 36-37) (on file with authors) [hereinafter Privacy Harms].
[5]See TransUnion, 141 S. Ct. at 2200-01.
[6]Fair Credit Reporting Act, 15 U.S.C. § 1681n(a).
[7]See TransUnion, 141 S. Ct. at 2200 (citing 15 U.S.C. § 1681e(b)).
[8]Id. (citing 15 U.S.C. § 1681g(a)(1)).
[9]Id. at 2200-01 (citing 15 U.S.C. § 1681g(c)(2)).
[15]Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992).
[16]See Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1549 (2016) (“Congress’ role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.”).
[18]Robins v. Spokeo, Inc., 867 F.3d 1108, 1115-17 (9th Cir. 2017).
[20]See TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2200 (2021).
[21]Cass R. Sunstein, What’s Standing After Lujan? Of Citizen Suits, “Injuries,” and Article III, 91 Mich. L. Rev. 163, 167 (1992) (arguing that the requirement uses “highly contestable ideas about political theory to invalidate congressional enactments” despite constitutional text and history not calling for such invalidation).
[22]See, e.g., Richard H. Fallon, Jr., The Fragmentation of Standing, 93 Tex. L. Rev. 1061, 1065-66 (2015) (elaborating on the court’s position that standing, prior to the 1970s, depended on whether the plaintiff had suffered an injury to an interest “within the zone of interests to be protected or regulated by the statute or constitutional guarantee in question” (quoting Ass’n of Data Processing Serv. Orgs., Inc. v. Camp, 397 U.S. 150, 153 (1970))); F. Andrew Hessick, Standing, Injury in Fact, and Private Rights, 93 Cornell L. Rev. 275, 290-99 (2008) (discussing the development of the modern standing doctrine).
[23]Rachel Bayefsky, Constitutional Injury and Tangibility, 59 Wm. & Mary L. Rev. 2285, 2296 (2018).
[24]See TransUnion, 141 S. Ct. at 2217 (Thomas, J., dissenting).
[29]See id. at 2204 (majority opinion).
[30]Jacobellis v. Ohio, 378 U.S. 184, 197 (1964) (Stewart, J., concurring) (“I shall not today attempt further to define the kinds of material I understand to be embraced within that shorthand description [‘hard-core pornography’]; and perhaps I could never succeed in intelligibly doing so. But I know it when I see it, and the motion picture involved in this case is not that.”).
[31]See TransUnion, 141 S. Ct. at 2197 (“Central to assessing concreteness is whether the asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts.”).
[33]See generally Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 Harv. L. Rev. 193 (1890).
[34]Daniel J. Solove, Does Scholarship Really Have an Impact? The Article that Revolutionized Privacy Law, TeachPrivacy (Mar. 30, 2015), https://teachprivacy.com/does-scholarship-really-have-an-impact-the-article-that-revolutionized-privacy-law/ [https://perma.cc/3H3L-5P62].
[35]Neil M. Richards & Daniel J. Solove, Prosser’s Privacy Law: A Mixed Legacy, 98 Calif. L. Rev. 1887, 1891-95 (2010).
[36]See Daniel J. Solove & Danielle Keats Citron, Risk and Anxiety: A Theory of Data-Breach Harms, 96 Tex. L. Rev. 737, 751-54 (2018); Citron & Solove, Privacy Harms, supra note 4 (manuscript at 3).
[37]See TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2219 (2021) (Thomas, J., dissenting).
[38]Warren & Brandeis, supra note 33.
[39]William L. Prosser, Privacy, 48 Calif. L. Rev. 383, 392 (1960) (“It appears obvious that the interest protected by this branch of the tort is primarily a mental one. It has been useful chiefly to fill in the gaps left by trespass, nuisance, the intentional infliction of mental distress, and whatever remedies there may be for the invasion of constitutional rights.”).
[40]Citron & Solove, Privacy Harms, supra note 4 (manuscript at 18).
[43]See TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2223 (2021) (Thomas, J., dissenting).
[44]Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1549 (2016).
[45]The FCRA provides partial immunity from lawsuits in state court based on defamation and invasion of privacy. Plaintiffs can only sue when defendants acted “with malice or willful intent to injure” plaintiff. 15 U.S.C. § 1681h(e).
[46]See Citron & Solove, Privacy Harms, supra note 4 (manuscript at 4).
[47]Spencer Weber Waller, Daniel B. Heidtke & Jessica Stewart, The Telephone Consumer Protection Act of 1991: Adapting Consumer Protection to Changing Technology, 26 Loy. Consumer L. Rev. 343, 375 (2014).
[48]See TransUnion, 141 S. Ct. at 2203.
[49]See Alexander Bickel, The Least Dangerous Branch: The Supreme Court at the Bar of Politics 111-98 (1962).