The TransUnion Case and the Lochnerization of Standing Doctrine
by Matthew Tokson
Privacy Twitter was abuzz on Friday with laments about the effects of TransUnion LLC v. Ramirez. In TransUnion, a class of plaintiffs who'd been erroneously flagged as potential terrorists by a credit reporting agency sued for damages. In a 5-4 decision, the Supreme Court held that plaintiffs who could not prove that their terrorist designation had been reported to third parties could not sue, because they lacked a "concrete" injury under the Court's standing doctrine. That Congress had passed a law permitting individuals to sue credit agencies that fail to use reasonable procedures to ensure the accuracy of their credit reports did not matter. Congress could grant plaintiffs a legal right, and that right had clearly been violated by TransUnion, but the Court would not recognize standing in the absence of a concrete injury.
The TransUnion decision is likely disastrous for privacy plaintiffs in future cases because it sharply limits the ability of plaintiffs to sue based on the risk of future harms. Privacy harms are often difficult to demonstrate concretely, and frequently rely on assertions of future risks. Congressional recognition of privacy and data security harms is likely the best path forward for establishing robust protections for consumer privacy. But the Supreme Court's ever-more-aggressive interpretations of standing doctrine may thwart Congress's ability to protect consumer privacy or meaningfully enforce existing protections.
At first glance, the impact of TransUnion might appear to be limited. The plaintiffs defined their class based on a 7-month period, and stipulated that the terrorist designations of thousands of class members had not been shared with third parties during that 7-month period. But plaintiffs also noted that this information was potentially inaccurate for at least 46 months, and so it was possible that the class members had been flagged as potential terrorists to third parties. Indeed it was likely, because all class members had requested copies of their credit reports, which consumers usually only do when their credit reports are about to be shared with others. The Court noted that this was a "serious argument" but ultimately rejected it, concluding that the plaintiffs had the burden of demonstrating actual harm or at least "a serious likelihood of disclosure." This remarkably high bar to plaintiffs with risk-based harms has the potential to wipe out large swaths of meritorious privacy and other consumer lawsuits. Information technology or consumer data companies may have relatively little to fear if their tortious mishandling of consumer data creates harms that are difficult to trace. And 'difficult to trace' describes many or most data security and privacy harms. For example, in 2013, the Court dismissed a lawsuit seeking an injunction against a government surveillance program in Clapper v. Amnesty International. The majority held that the plaintiffs lacked standing because they couldn't prove they would be spied on--yet there was no realistic way for the plaintiffs to determine who had been spied on after the fact, because that information would likely never be disclosed. The difficulty of documenting privacy harms can be a substantial or even insurmountable obstacle to privacy protection.
The larger tragedy of TransUnion is that it relies on an Article III standing doctrine that has been thoroughly Lochnerized--stretched far beyond any plausible formal foundation and employed to thwart legislatures and protect corporate interests. The standing requirements established in 1992's Lujan v. Defenders of Wildlife have no basis in the Constitution's text, which permits federal courts to hear "all Cases...arising under...the Laws of the United States." As to history, the standard account of the origins of modern standing doctrine characterizes it as a political football, used first by New-Deal progressives and later by conservatives to serve particular policy ends. Justice Thomas's lead dissent notes, by contrast, that there's ample historical pedigree for legislatures creating new individual rights (copyrights, patent rights, statutory property rights, etc.) that provide standing in federal court.
Of course, this is hardly the end of the inquiry. Judge-made, common-law constitutional doctrines are ubiquitous in U.S. law, and the holdings of Lujan and the earlier precedents on which it stands are at least related to coherent prudential standing concepts. The idea that only people with some personal interest in a case or controversy should be able to sue is defensible on policy grounds, even if it's not supported by the constitutional text. But the class plaintiffs in TransUnion had a unique, personal interest in their case, because TransUnion had flagged them as potential terrorists. And in any event Congress passed a law allowing consumers to sue when their credit reports were inaccurate due to the negligence of credit agencies. There was no reason in policy, precedent, history, or text to deny these plaintiffs their day in court. There was only the modern Court's apparent antipathy toward consumer plaintiffs.
The silver lining here, to the extent there is one, is that federal statutory claims barred in federal court under Article III standing doctrine can still be brought in state court. The practical upshot of TransUnion appears to be that suits against credit reporting companies for risk-based harms will be heard in state courts, with defendants unable to seek removal. To what extent state courts will provide an adequate substitute forum for class action suits like the one in TransUnion remains to be seen. Regardless, the strange consequences of Lochnerized federal standing doctrine provide another good reason for the Court to revisit, and ultimately reverse, its recent standing decisions.