Readers of CPW are already familiar with Ramirez v. TransUnion, which is poised to have a major impact on data privacy litigations.  The much anticipated oral argument before the Supreme Court is scheduled for tomorrow at 10 AM EST and Kristin Bryan will be live blogging this not to be missed event.  If you want to check out the parties’ briefing in advance, see here, here and here.

A recap for why Ramirez is so important:  Article III limits federal court jurisdiction to actual “cases or controversies.”  U.S. Const. Art. III, § 2.  As the Supreme Court has stated, standing “is an essential and unchanging part of the case-or-controversy requirement of Article III.”  This includes the following three elements, which constitute the “irreducible constitutional minimum of standing”:

First, the plaintiff must have suffered an “injury in fact”—an invasion of a legally protected interest which is (a) concrete and particularized … and (b) actual or imminent not conjectural or hypothetical … Second, there must be a causal connection between the injury and the conduct complained of … Third, it must be likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision.

In 2016, the Supreme Court decided Spokeo, Inc. v. Robins, 136 S. Ct. 1540.  In Spokeo, the Court affirmed that a plaintiff cannot “allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III.”  The Supreme Court’s analysis emphasized the requirement that an injury-in-fact sufficient for purposes of Article III standing must be “concrete and particularized.”  Id. at 1548 (emphasis in original).  As the Court explained, “[a] ‘concrete’ injury must be ‘de facto’; that is, it must actually exist.”  Id. (emphasis in original).

Which brings us to Ramirez.  The plaintiff alleged that he had difficulty obtaining credit, was embarrassed in front of family members, and canceled a vacation after a car dealer received a credit report indicating that his name matched a name on a government “terrorist list” of persons with whom U.S. businesses may not transact.  In response, Ramirez filed a class action alleging three violations of the Fair Credit Reporting Act (“FCRA”), two concerning the mode of providing consumers with a copy of their own credit file and one concerning the procedural requirements for furnishing an accurate credit report.

Ramirez sought to represent a class of thousands of individuals, the vast majority of whom (more than 75%) never had a credit report disseminated to any third party, let alone suffered a denial of credit or other injury anything like what he experienced.  The trial court nonetheless let the class proceed on the theory that the absent class members all suffered an Article III injury and that the vast differences between the experiences of the named plaintiff and the class he purported to represent were immaterial.  Ramirez ultimately obtained a multi-million dollar jury verdict against the credit reporting agency TransUnion for falsely flagging him and more than 8,100 other people as terrorists.

The Supreme Court granted cert for the question: “Whether either Article III or Rule 23 permits a damages class action where the vast majority of the class suffered no actual injury, let alone an injury anything like what the class representative suffered.”  TransUnion argued in its opening brief that Ramirez’s class definition includes individuals who suffered no injury because they never had a credit report disseminated to a third party with incorrect or misleading information.  TransUnion further asserted that simply alleging an FCRA violation and claiming statutory damages does not itself confer Article III standing.

Depending on how the Court rules, the case could have a significant impact on litigations brought under various federal and state data privacy statutes (FCRA, the Telephone Consumer Protection Act, the Illinois Biometric Information Privacy Act, etc.) and for data breaches.  To see how this all shakes out and what it means for data privacy litigations going forward, stay tuned (and check out CPW’s live coverage starting tomorrow at 10 am EST).