Introduction

The Supreme Court decision in TransUnion LLC v. Ramirez created a dichotomy for when the publication of consumer data creates injury in fact: internal dissemination of information does not result in harm that gives rise to Article III standing while dissemination of information to a third party does. In today’s information economy–where data is maintained, repurposed, and transferred in digital systems such as generative artificial intelligence tools–this line the Supreme Court drew in TransUnion may be deficient when applied to emerging technologies that alter data accessibility and threaten to compromise consumer protection.

Case Background

On February 27, 2011, Sergio L. Ramirez and his wife visited a Nissan dealership in Dublin, California to purchase a Nissan Maxima. After Ramirez selected a car and negotiated the price, the dealership ran a joint credit check on him. This credit check–produced by TransUnion–outputted that Ramirez was on a list maintained by the Treasury Department’s Office of Foreign Assets Control (OFAC) of individuals who were terrorists, drug traffickers, and other serious criminals. The Nissan salesman refused to sell the car to Ramirez, citing that his name was on a “terrorist list,”1 and it is generally unlawful to transact business with a person on the list.2  The report contained the statement “***OFAC ADVISORY ALERT – INPUT NAME MATCHES NAME ON THE OFAC DATABASE” along with two other possible matches that did not match Ramirez’s middle initial or date of birth.

When contacted by Ramirez, TransUnion initially denied that an OFAC alert was on his credit report. Upon receiving his requested copy of his credit file, the report did not contain the OFAC alert. The following day, Ramirez received a separate letter from TransUnion stating that his credit file name was considered a potential match to information on the OFAC database and would be provided to authorized parties. TransUnion’s OFAC letter did not advise Ramirez of his rights to dispute the information or how to go about doing so.

The first consumer financial privacy statute of the United States was enacted in 1970: the Fair Credit Reporting Act (FCRA). Its purpose is to ensure “fair and accurate credit reporting” through the regulation of agencies that compile and disseminate consumer information.3 TransUnion, along with Equifax and Experian, compose the “Big Three” credit reporting agencies of the United States. TransUnion sells reports amassed from personal and financial consumer information to entities such as landlords, banks, and car dealerships. In 2002, TransUnion developed and marketed OFAC Advisor, an add-on product that used software to compare a consumer’s name against the OFAC list. If an individual’s full name matched with a “Specially Designated Person” on the OFAC list, TransUnion added an alert on the credit report indicating a “potential match.”

OFAC Advisor relied on data supplied by TransUnion’s third-party vendor, Accuity, Inc. Accuity’s software conducted a “name only” search.4 TransUnion surmised that because OFAC alerts were not stored in its database, the OFAC alerts were not governed by the FCRA; thus, TransUnion believed it did not need to follow its normal procedures to ensure accuracy.5 TransUnion also adopted a policy of not disclosing OFAC matches to affected consumers when the consumers requested a copy of their credit reports, which it continued to do even after receiving consumer complaints.6 TransUnion only began disclosing OFAC Alerts to consumers after losing this argument in the Third Circuit in 2005.7 It was not until November 2010 that TransUnion changed the language of its alert from “match” to “potential match.”8 Prior to July 2011, TransUnion redacted the OFAC Alert on copies sent to consumers.2

In February 2012, Ramirez brought a class action suit against TransUnion for violating the FCRA. Ramirez posited that TransUnion violated the FCRA by (among other things) failing to prepare credit reports that follow “reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.”9 He represented a class of 8,185 individuals whose reports were erroneously flagged by TransUnion and to whom TransUnion sent the same separate OFAC letters between January 1, 2011, and July 26, 2011. 1,853 of these class members had their credit reports disseminated by TransUnion to potential creditors during that time. The other 6,632 members did not have their erroneous credit files provided to a third-party business.

Supreme Court finds only class members whose erroneous consumer data was “published” to a third party have Article III standing.

The U.S. District Court for the Northern District of California certified the class and ruled that all 8,185 members had Article III standing to sue TransUnion. The U.S. Court of Appeals for the Ninth Circuit affirmed the standing of all plaintiffs. In 2021, TransUnion reached the Supreme Court, which overturned the lower courts’ Article III rulings.

Justice Brett Kavanaugh authored the 5-4 majority opinion, finding that only class members whose misleading credit reports were provided to a third party satisfied Article III standing to seek statutory and punitive damages against TransUnion. Justice Kavanaugh’s determination of standing relied on a traditional interpretation of individualized harm and a particular definition of the “publication” of consumer information that gives rise to Article III standing.

In the majority opinion, the Court ruled in favor of TransUnion by employing a traditional interpretation of injury in fact. Justice Kavanaugh relied on the “concrete harm” principle, stipulating that “history and tradition offer a meaningful guide to the types of cases that Article III empowers federal courts to consider.”10. )) He turned to the Supreme Court’s opinion in Spokeo, Inc. v. Robins, which found that the standing of a plaintiff should be assessed based on whether the alleged harm has a “close relationship” to a harm “traditionally” recognized as providing a basis for a lawsuit in American courts.11 Justice Kavanaugh emphasized that utilizing Spokeo for the determination of standing prohibits federal courts from “loosen[ing] Article III based on contemporary, evolving beliefs,”12 and thus Congress could not create Article III standing by legislative dictate for injuries that lack a basis in tradition.

Justice Kavanaugh, recognizing that “Spokeo does not require an exact duplicate in American history and tradition,”13 did find that 1,853 of the class members in TransUnion suffered a sufficiently concrete harm qualifying as injury in fact. The harm of these 1,853 class members having their erroneous credit reports disseminated by TransUnion to potential creditors constituted a harm substantially similar to “reputational harms, disclosure of private information, and intrusion upon seclusion.”14 Thus, Justice Kavanaugh ruled that these 1,853 individuals each suffered a harm with a “close relationship” to the harm associated with the tort of defamation.15 To further support this, he stated that “Under longstanding American law, a person is injured when a defamatory statement ‘that would subject him to hatred, contempt, or ridicule’ is published to a third party.”16  When the erroneous consumer data was provided to a third-party business, the harm arose from the fact that this inaccurate information would subject a consumer to hatred, contempt, and ridicule. Justice Kavanaugh quickly dispatched TransUnion’s argument that even if publication to a third party gave Ramirez standing, the statement identifying Ramirez as a “potential terrorist” was not defamatory because it was not technically false. He concluded that TransUnion misleadingly labeling a consumer a “potential terrorist” was sufficiently close to the harms of being labeled an actual “terrorist.”

For the other 6,332 class members–those who also had credit files containing inaccurate OFAC alerts–the absence of dissemination of that information to a third party meant they failed to qualify for Article III standing. Under Justice Kavanaugh’s interpretation, “the mere existence of inaccurate information…traditionally has not provided the basis for a lawsuit in the American courts.”17 Thus, the attribute that distinguished the class members who suffered an injury in fact was whether such consumer information was “published”–it was not enough for TransUnion merely to have inaccurately ascribed their consumer information. The traditional harm associated with the tort of defamation does not simply necessitate the presence of material that would subject one person to hatred, contempt, or ridicule, but also that material’s dissemination to a third party.

In sum, under this standard any material, regardless of how conclusively it subjects a consumer to hatred, contempt, or ridicule, does not qualify as a harm associated with the tort of defamation unless such material was disseminated to a third party. The TransUnion Court thus held that because the erroneous consumer information produced by TransUnion’s digital system had not been provided to a third party or caused a denial of credit for 6,332 class members, those class members had not suffered an injury in fact.

TransUnion LLC v. Ramirez addressed whether “publication” internal to an entity and its vendors is a cognizable Article III harm. Specifically, the plaintiffs argued that TransUnion published the erroneous consumer information internally between TransUnion employees and when sending the data to vendors who printed and sent mail to class members. Under this definition of “publication” presented by the plaintiffs, all 8,185 class members qualify for Article III standing. However, Justice Kavanaugh dismissed this definition, stating that “Many American courts did not traditionally recognize intra-company disclosures as actionable publications….”18 Justice Kavanaugh affirmed that dissemination of information to an external third party is a fundamental tenet of “publication.”

Challenges to the majority opinion’s definition of “publication”

Justice Clarence Thomas, with whom Justice Breyer, Justice Sotomayor, and Justice Kagan joined, dissented. Justice Thomas, in particular, challenged the majority opinion’s definition of “publication.” He detailed how the file request system TransUnion utilized to print credit reports and mail them to consumers was executed through a print vendor: this process provided consumer information to a third party, thus qualifying the conduct as publication. Justice Thomas wrote that as a traditional matter, “publication to even a single other party could be enough to give rise to suit. This was true, even where the third party was a telegraph company, an attorney, or a stenographer who merely writes the information down.”19 Justice Thomas applied a more expansive interpretation of “the third party” and resolved that if the consumer information is provided to “the third party,” the conduct is considered dissemination, meaning that such information has been published.

The dichotomy between internal and external dissemination of information applied to today’s information economy

Justice Kavanaugh’s traditional lens for interpreting the publication of information relies heavily on the dichotomy between internal and external dissemination of information—and where a third party accesses consumer information. Today’s information economy yields a perplexing circumstance: what if even the internal sources of consumer data enable dissemination to an external third party? The dissent of Justice Thomas underscores how the third party can be broadly defined, from the vendor who is commissioned to print and mail information to any ordinary person consuming information online. Justice Thomas maintained that any instance where a third party obtains access to consumer data qualifies as dissemination—and such consumer information is thus considered “published.”

TransUnion’s software relayed a consumer’s name to a third-party, which compared the name to Treasury Department’s OFAC list and created an alert when there was “match” (later labeled a “potential match”). Once the system erroneously labeled a class member, how could it ensure that this information did not fall to a third party? As Justice Thomas identified, TransUnion forgot to properly account for the vendor commissioned to print and send the information. Today, digital tools have transformed the manner in which a third party can access a company’s internal data—in other words, it is now easier for internal information to be disseminated to a third party. Consider the artificial intelligence tools embedded into company software: these systems process the information a company inputs and use that data to provide generative responses. It is well known that many artificial intelligence systems store and maintain previous inputs to better train itself and generate enhanced responses to future inquiries.

The Supreme Court’s line between internal and external dissemination of information is also complicated by how a third party may use the consumer data. Justice Kavanaugh’s dichotomy does not regard, notably, the amount of data used by a third party and how that impacts a harm. For example, and borrowing from Justice Thomas’ dissent once more, if the commissioned vendor, a third party, had instead opened the mail and read the information, stored it personally, and misused it for personal gain at the consumer’s expense, does this conduct raise a different degree of harm than if this vendor simply handled the mail containing consumer information? If improper utilization of consumer data is distinct from mere exposure, how much more improper use is necessary for Article III standing?

Justice Kavanaugh’s binary line of either strictly internal or external dissemination omits this nuance. This concern is especially relevant for cases today, given the prevalence of digital tools that execute varying functions, whether storing data, using data to train an algorithm, transmitting data, or making consequential decisions based on extracted data.

Justice Kavanaugh’s traditional interpretation of “publication,” which requires disseminating data to a third party, is complicated by digital systems today, which, even in internal settings, store and maintain information for usage by a third party. Whether that third party is another company aspiring to datamine customer information or an everyday individual using ChatGPT to generate responses that are informed by previous consumer data, it is the conduct of dissemination of information to a third party that qualifies the data as published. The nature of internally stored and maintained consumer data, however, has transformed in today’s information economy, altering consumer protection on the basis of how and where a third party reaches consumer data. Unfortunately, Ramirez’s failure to raise the internal publication argument below and fortify his claim with evidence in the record until the Supreme Court briefing kept the Court from fully considering this argument.20

More and more cases regarding emerging technologies have involved consumer protection claims. Justice Kavanaugh’s attempt to draw a line between external and internal dissemination of information creates the challenge of discerning whether an external party has accessed consumer data—and this question has only intensified given rapidly advancing digital tools. Indeed, this pertinent issue underscores the difficulty that the bright line test creates in an evolving information economy. Imagine a publicly available AI that mines publicly available data producing a publicly available social credit score that identifies false matches. Is the fact that false matches exist sufficient to give a plaintiff Article III standing to sue the AI for injunctive relief or must a consumer wait until a credit reporting agency sends it to a creditor who relies upon the false match? Thus, it may be worth it for regulators and courts to now better understand how consumer data is interfaced with digital tools and where a third party can access internal information. For today’s information economy, there must be greater care taken to apply this deeper understanding to existing frameworks for the sake of consumer protection.

Endnotes

  1. TransUnion LLC v. Ramirez, 594 U.S. 413, 420 (2021). [↩]
  2. Id. [↩][↩]
  3. Fair Credit Reporting Act, 15 U.S.C. § 1681 (2022). [↩]
  4. Ramirez v. TransUnion, 951 F.3d 1008, 10019-1020 (9th Cir. 2020). [↩]
  5. Id.at 119. [↩]
  6. Id. at 120. [↩]
  7. Cortez v. Trans Union, LLC, 617 F.3d 688, 696-706 (3d Cir. 2010). [↩]
  8. Ramirez at 1021. [↩]
  9. 15 U.S.C. § 1681e (2022). [↩]
  10. TransUnion, 594 U.S. at 424 (quoting Sprint Communications Co. v. APCC Services, Inc., 554 U.S. 269 (2008[↩]
  11. Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016). [↩]
  12.  TransUnion, 594 U.S. at 425. [↩]
  13. Id. at 424. [↩]
  14. Id. at 425. [↩]
  15. Id. at 424 (citing Spokeo, 578 U.S. at 341). [↩]
  16. Id. at 432 (citation omitted). [↩]
  17. Id. at 433. [↩]
  18.  Id. at 434 n.6. [↩]
  19. Id. at. 442 (Thomas, J., dissenting). [↩]
  20. Id. at 434 and n. 6. [↩]

Related Posts