The U.S. Supreme Court’s recent decision in TransUnion LLC v. Ramirez1 will make it far more difficult for class action plaintiffs to demonstrate the requisite harm to satisfy Article III standing. Although involving a different consumer protection statute, this decision has major repercussions for federal court class actions alleging violations of California Consumer Privacy Act (“CCPA”), the Illinois Biometric Information Privacy Act (“BIPA”) as well as other consumer protection laws.

The Court has now clarified that it is insufficient for a plaintiff to allege that a defendant violated a law or regulation applicable to a class of plaintiffs, even if the plaintiff is entitled to statutory damages; only those putative class members who suffered concrete harm have standing to assert claims.

Article III Standing

Article III of the Constitution limits the jurisdiction of federal courts to “cases” or controversies.”  To establish Article III standing, a plaintiff must show that they suffered an “injury in fact” – an invasion of a legally protected interest that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.2

Prior to TransUnion, the most important decision in recent years on standing requirements for consumer class actions was Spokeo, Inc. v. Robins in which the Court discussed which injuries are considered sufficiently “concrete”.3 There, the Court addressed whether a plaintiff’s assertion of a private right to sue for an alleged willful violation of the Fair Credit Reporting Act (“FCRA”), absent a claim of damages or actual harm, creates sufficient injury to satisfy Article III standing requirements. In vacating a Ninth Circuit decision, the Supreme Court held that Article III standing requires a concrete injury “even in the context of a statutory violation,” and thus a plaintiff could not “allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement.”4 Further, while the Court acknowledged that intangible injuries can be concrete, it cautioned that a plaintiff does not “automatically satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.”5

The Spokeo standard requires the plaintiff to show an injury that has a close relationship with the type of harm traditionally providing a basis for a lawsuit. But courts have disagreed on how this standard applies. The TranUnion court has now clarified that, while “Spokeo does not require an exact duplicate in American history and tradition [it] is not an open-ended invitation for federal courts to loosen Article III based on contemporary, evolving beliefs about what kinds of suits should be heard in federal courts.”6

TransUnion’s Clarification of “Concrete” Harm for Statutory Violations

These concepts are best understood by the facts in TransUnion. The class was comprised of 8,185 consumers whose names were incorrectly flagged as being individuals deemed potential threats to America’s national security; in fact, however, the flags were false positives because the individual happened to share a first and last name with another individual on the terrorist watch list. Among other claims, Plaintiffs alleged that TransUnion’s failure to use reasonable procedures to ensure the accuracy of credit files caused damages to all 8,185 flagged individuals. Discovery revealed, however, that of the 1,853 of the 8,185 actually had incorrect credit reports provided to a third party. The District Court determined all class members had standing on all claims, and a jury returned a $40 million verdict, which the Ninth Circuit affirmed.

The Supreme Court reversed. While conceding that consumers whose credit reports were actually provided to third parties did suffer an injury sufficient to confer standing, those whose information was not communicated lacked standing. Simply put, “No concrete harm no standing.”7

The Court rejected the notion that a statutory cause of action creating a private for a violation is sufficient to create standing:

For standing purposes, therefore, an important difference exists between (i) a plaintiff’s statutory cause of action to sue a defendant over the defendant’s violation of federal law, and (ii) a plaintiff’s suffering concrete harm because of the defendant’s violation of federal law. Congress may create causes of action for plaintiffs to sue defendants who violate those legal prohibitions or obligations. But under Article III, an injury in law is not an injury in fact. Only those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court.

(emphasis in original). The Court further emphasized that, in assessing concreteness, courts must decide whether the asserted harm has a “close relationship” to a harm traditionally recognized as providing a basis for a lawsuit in American courts, such as physical harm, monetary harm, or intangible harms including reputational harm.

Based on this holding, the Court concluded that as to the class member’s FCRA reasonable-procedures claim: (a) 1,853 class members suffered a concrete harm that qualifies as an injury in fact when TransUnion provided third parties with credit reports containing U.S. Treasury Department Office of Foreign Assets Control alerts for these class members; and, (b) the mere existence of inaccurate information for the remaining 6,332 class members without dissemination of the credit reports constituted only a mere theoretical risk of future harm not sufficiently concrete for purposes of Article III standing.

Post-TransUnion Federal Court Standing Requirements for CCPA Data Breach and BIPA Class Actions

The impact of the TransUnion decision will be far reaching, influencing all types of class actions, not the least of which are data breach cases and lawsuits alleging other consumer privacy rights. Like the lead class members in TransUnion, CCPA data breach and BIPA claims are often based on consumers who have varying degrees of supposed harm from an alleged violation of a statutorily-created right. A lead plaintiff may state a claim that involves actual harm such as identity theft flowing from a data breach, while seeking to represent a class millions of individuals whose information may have been accessed but who, suffering no harm, nonetheless seek to recover statutory damages. 

Earlier this year, we discussed federal court standing requirements for CCPA claims arising from a data breach. To bring a CCPA claim arising from a data breach,8 a plaintiff must show that their unencrypted or nonredacted personal information (as defined in the statute) was accessed, stolen, or disclosed because of a company’s failure to implement and maintain reasonable security procedures and practices. A plaintiff is entitled to recover statutory damages ranging from a minimum of $100 to a maximum of $750 per violation, or actual damages, whichever is greater.9

Likewise, to bring a BIPA claim arising from a breach of biometric information, a plaintiff must show that private entities in possession of biometric data failed to obtain written consent, failed to disclose how they use, store, and destroy data, or did not store, transmit, and protect from disclosure biometric data using the reasonable standard of case in the private entity’s industry. A plaintiff is entitled to recover liquidated damages of $1,000, or actual damages, whichever is greater.10 For private entities that intentionally or recklessly violate BIPA, a plaintiff is entitled to recover liquidate damages of $5,000, or actual damages, whichever is greater.11

For those claims brought in federal courts, the TransUnion holding means that the standing requirement is not satisfied by the mere fact that there has been a violation of the CCPA which provides for a statutory penalty. Likewise, the TransUnion decision affirms the reasoning espoused in many lower courts’ decisions to dismiss or remand to state court federal suits alleging violations of BIPA’s notice and consent requirements without actual, concrete harm. As Justice Kavanaugh explained, “only those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court.” No concrete harm, no standing.

TransUnion severely curtails Federal court jurisdiction for CCPA and BIPA cases, and will likely create procedural challenges for multi-state class actions that lack allegations of commonly suffered concrete harm.

Your Dorsey privacy and trial counsel are available to provide any further assistance you may need when evaluating federal and state court CCPA and BIPA class action defense strategies.

1 594 U.S. __ (2021).
2 Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992).
3 136 S. Ct. 1540 (2016). 
4 Id. at 1549.
5 Id.
6 594 U.S. __, __ (2021) (slip op., at 9).
7 Id., at __, __ (slip. op., at 1).
8 Cal. Civil Code § 1798.100.
9 Cal. Civ. Code § 1798.150(a).
10 740 ILCS 14/20.
11 Id.