Supreme Court could reshape class actions, privacy litigation through TransUnion case

Privacy litigation in the US has been difficult for plaintiffs. Whether it stays that way could hinge on a case before the Supreme Court involving a Fremont, California, man who a decade ago tried and failed to buy a car.

What went down in the East Bay showroom of Dublin Nissan in February 2011 was, at its heart, a matter of mistaken identity. The implications of that day have been anything but simple, radiating outward and picking up national attention after a federal appeals court in 2020 affirmed a multi-million dollar class action verdict. Now the case is a vehicle for the opposing legal aspirations of corporate attorneys and consumer activists who see in the shopping expedition gone wrong a means to reshape private rights of action and class actions for years to come.

Major online platforms, retailers and privacy advocates alike will be watching when the nine justices convene March 30 to hear oral argument — and in particular whether they draw a distinction favored by Justice Clarence Thomas between “public rights” and “private rights.”

It’s a long haul from the late winter Sunday afternoon when Sergio Ramirez applied for an auto loan and the dealership denied it after credit reporting agency TransUnion incorrectly suggested the commercial painter may have been a terrorist or a drug trafficker blacklisted from doing business in America.

— Standing to sue —

Over the decades, Congress has built up a flotilla of consumer protection laws containing a private right of action. Among them is the Fair Credit Reporting Act, the basis for Ramirez’s lawsuit against TransUnion, which is one of the three largest credit reporting agencies in the US.

Winning such lawsuits isn’t easy. Convincing judges that plaintiffs have suffered enough harm to gain standing to sue can be an uphill battle, especially following a 2016 Supreme Court ruling that emphasized plaintiffs’ duty to prove a “concrete” harm.

Merely alleging that a company is responsible for a procedural violation doesn’t automatically confer standing, wrote Justice Samuel Alito in the majority opinion for Spokeo v. Robins.

Alito allowed that violations of a procedural right can be enough to establish harm, while also writing that a “bare procedural violation, divorced from any concrete harm” doesn’t clear the threshold. That’s the case even when Congress authorizes a private right of action for statutory violations without conditioning lawsuits on a showing of harm, Alito wrote.

Privacy advocates say the court’s reasoning in Spokeo amounts to a quantum paradox whereby procedural violations are simultaneously sufficient yet not sufficient to confer standing. The outcome has been confusion and judicial overreach that ignores how Congress intended to allow individuals to sue for redress when their legal rights are violated, they say.

The paradox can be especially significant in privacy cases, where the harms may be difficult to establish outside of statutory violations, victims having not otherwise lost money or experienced the sort of harms that courts traditionally recognize.

— 'As a courtesy' —

Sergio Ramirez found the experience of being linked with terrorists and drug traffickers an alarming one. The Department of Treasury maintains a list of such “specially designated nationals” banned from doing business with US citizens, with potential criminal and civil penalties awaiting those who do so.

TransUnion in 2002 began selling alerts flagging matches between applicants for financial credit with the Treasury blacklist. In 2011, TransUnion fingered Ramirez as a potential match with two other banned men named Sergio Ramirez despite the fact that the three had different full names and different birthdays.

A Dublin Nissan salesman refused to do further business with Ramirez. After some back-and-forth, he sold a Maxima sedan to Ramirez’s wife, who was present that day along with Ramirez’s father-in-law.

The legal record shows that when Ramirez called TransUnion the next day, the credit reporting agency assured him there was no blacklist alert on his report. When Ramirez asked for a copy of his credit report, he received two mailings. The first contained the report and instructions for contesting inaccurate information. The second was a letter sent the next day, made “as a courtesy to you” that warned Ramirez his name had a potential match on the Treasury blacklist.

Ramirez sued on behalf of the nearly 8,200 individuals who received similar courtesy letters during the approximate first half of 2011. Unusually for such a class action, the matter went to trial, in the Northern District of California, in June 2017. The jury awarded the class $60 million in statutory and punitive damages. The US Court of Appeals for the Ninth Circuit in 2020 reduced the amount to $40 million, but otherwise left the jury’s verdict intact despite the partial dissent of one judge on the three-judge panel.

TransUnion’s position is that Ramirez’s experience was a temporary blip in his ability to get credit. After receiving a written request from Ramirez, it ensured that blacklist alerts wouldn’t anymore be associated with his credit file. And in any case, it had expressly told its commercial customers that an individual’s potential blacklist match was just that — potential, and in need of human review to confirm.

Of particular interest, the company also takes exception to Ramirez acting on behalf of the 8,184 other individuals who received courtesy letters, dubbing them a no-injury class. Their first inkling that they were associated with the Treasury blacklist could come in the form of a nearly $5,000 settlement check, TransUnion asserts. Only about a quarter of class members applied for credit during the covered time period. Ramirez was the sole class member called as a witness during the trial and is the only class member proven to have faced a blacklist obstruction to obtaining a loan. Ramirez’s experience at the Dublin Nissan isn’t representative, the credit reporting agency argues.

Ramirez’s attorneys retort that those seeking the overthrow of two courts’ worth of judgments against TransUnion overlook what unites class members: their wrongful inclusion on a list linking them to terrorism — a list available at a moment’s notice to potential creditors and employers. As the Ninth Circuit concluded, TransUnion also erred by not complying with the Fair Credit Reporting Act when it failed to disclose the potential blacklist match in credit reports (TransUnion instead sent the separate “courtesy” letters). It failed again by not including in the separate mailing a summary of consumers’ rights to contest wrongful information. Ramirez would be typical of his class even if he had never stepped foot into the car dealership that fateful February 2011 day. TransUnion, not Dublin Nissan, caused the injury, the court said.

— Clarence Thomas to the rescue? —

If there is one sector of the economy terrified by an empowered consumer law plaintiffs’ bar, it’s likely the tech industry. Its interactions with consumers are subject to challenges under a clutch of statutes containing private rights of action, including the Wiretap Act, the Stored Communications Act and the Telephone Consumer Protection Act.

Some of the industry’s biggest hitters, including Facebook and Google, filed a joint brief with the Supreme Court urging it to reverse the $40 million TransUnion settlement.

With a fortified majority of six conservatives on a bench that has already recently ruled to limit class actions, businesses are hoping justices agree with their assertion that letting the verdict stand will propel plaintiffs' attorneys into hunting for jury-ready victims like Ramirez to stand in for uninjured consumers in an onslaught of burdensome lawsuits fueled by little more than technical violations of the law — de minimis injuries at best. Also urging justices toward reversal are the US Chamber of Commerce, the National Association of Manufacturers and a joint filing from Home Depot and UnitedHealth Group.

Hoping for affirmation are advocacy organizations including the Electronic Privacy Information Center, the Committee to Support the Antitrust Laws, Public Citizen and the NAACP Legal Defense and Educational Fund.

Ramirez’s supporters hope to find ally in the person of Justice Thomas. The staunch conservative might seem an unlikely supporter of class actions, but advocates see an opening through his support for a two-tiered standard for demonstrating injury. In no less a setting than his concurring opinion in the Spokeo decision, Thomas outlined a modulated theory of harm in lawsuits vindicating “private rights” as opposed to suits launched on behalf of “public rights.”

Plaintiffs’ duty to demonstrate actual, individualized and concrete harm is higher in latter cases than in the former, Thomas wrote. Someone suing to redress a public nuisance or a right owed to the whole community should have a higher bar for showing injury than someone suing over a personal right violated by another private party. The concrete harm requirement does not apply as rigorously to private rights cases, he wrote — and when Congress creates a private right of action for a private harm, a plaintiff need not allege additional harm beyond the invasion of that right.

All sides during oral argument will be on the lookout for other justices taking up Thomas’s reasoning as a barometer for whether it has found additional followers.

The justices could decide not to completely satisfy anybody, of course. One alternative course of action endorsed by the Department of Justice and Consumer Financial Protection Bureau would be to declare that all class members have standing, but that the Ninth Circuit should reconsider its analysis of Ramirez’s typicality.

The district court, federal attorneys say, didn’t consider whether Ramirez’s evidence accurately advances the claims of the class members who didn’t testify. It should have weighed the extent to which the jury’s statutory damages award would depend on individualized proof.

It might even have been appropriate, federal attorneys wrote, to allow class certification but limit Ramirez’s testimony about his Dublin Nissan experience, the day about which Ramirez later told a California jury that he was embarrassed, shocked and scared.

“I mean, if somebody tells you you’re on a terrorist list, what are you going to do?” he testified.