Supreme Court Limits Article III Standing for Class Action Plaintiffs: Implications for Data Breach Class Actions
On June 25, 2021, the US Supreme Court in TransUnion LLC v. Ramirez narrowed the scope of Article III standing for plaintiffs who allege the violation of a statute but cannot show they otherwise suffered harm. Though decided in the context of a Fair Credit Reporting Act (FCRA) class action, the decision has major implications for parties litigating state and federal statutory claims of all varieties in federal courts. In particular, TransUnion seems poised to limit the viability of class actions arising from data breaches. The decision likely means, for example, that plaintiffs lack Article III standing when their information may have been accessed but was not misused in a manner causing concrete harm—a subject on which the courts of appeals previously had split. The decision also will limit plaintiffs’ ability to assert Article III standing merely based on the violation of privacy statutes alone without any resulting harm.
Defendants litigating data breach class actions can take advantage of this new precedent in federal court to seek dismissal of data breach class actions for lack of Article III standing. But doing so is not without consequence. If federal courts are not available to adjudicate these claims, plaintiffs likely will pursue them in state courts, where standing precedent may be more lenient for plaintiffs. Defendants thus will need to be strategic about how aggressively they pursue TransUnion-based dismissals.
A class of 8,185 individuals sued TransUnion under the FCRA for failing to use reasonable procedures to ensure the accuracy of their credit files. Each of their credit reports contained inaccurate information added by TransUnion that mislabeled them as matches for potential terrorists, drug traffickers, or other serious criminals from a list maintained by the Treasury Department’s Office of Foreign Assets Control (OFAC). The parties stipulated that TransUnion actually provided credit information to potential creditors for just 1,853 of those class members, and maintained in its database but did not share with anyone inaccurate credit file information for the remaining 6,332 class members. The question presented was whether the mere existence of inaccurate information, absent dissemination, constituted sufficient harm to supply the basis for Article III standing.
The Court, with Justice Kavanaugh writing for a five-justice majority, held that the class members whose credit reports were distributed had Article III standing because they demonstrated a concrete harm, but the 6,332 class members whose erroneous credit reports were never distributed lacked standing.
The Court’s decision focused on the requirement for Article III standing that the plaintiff allege an injury-in-fact that is “concrete.” In Spokeo v. Robbins, the Court held that a “bare procedural violation” of a statute was not enough to plead a concrete harm. But recognizing that Congress could “elevate” legally cognizable injuries that were previously inadequate, the Court left open exactly when a statutory violation may reflect the kind of concrete harm necessary to confer standing. As a result, courts remained divided over how to evaluate standing where a plaintiff alleged the violation of a state or federal statute. Some circuits focused on whether the harm alleged was a “bare procedural” violation of the statute or an intrusion on a “substantive” statutory right. Other circuits focused on whether the statutory harm alleged bore a “close relationship” to a harm “traditionally” recognized as providing a basis for a lawsuit in American courts.
In TransUnion, the Court reaffirmed that “Article III standing requires a concrete injury even in the context of a statutory violation” and that a plaintiff does not automatically satisfy the injury-in-fact requirement by pleading the violation of a statute. Then, the Court held that for a harm to be “concrete,” the harm attributable to the claimed statutory violation must bear a “close relationship” to a harm “traditionally” recognized as providing a basis for a lawsuit in American courts. That test narrows the path for Article III standing in those circuits that had previously rejected the “close relationship” test, though lower courts have some room to determine how to apply this test moving forward.
The Court also addressed when a risk of future harm may be sufficiently concrete to supply a plaintiff with Article III standing—another question on which courts remained divided following Spokeo. Although the plaintiffs had urged the Court to hold that a risk of future harm is sufficiently concrete, the Court rejected that theory. In a suit for damages, the Court held that the “mere risk of future harm” does not confer standing unless exposure to the risk of future harm causes a separate concrete harm or the risk of harm materializes into actual harm.
Takeaways for Data Breach Class Actions
While TransUnion addressed standing in the context of the FCRA, its holding on risk of future harm and concrete injury is broadly applicable to data breach class actions. Defendants litigating data breach class actions in federal court regularly move to dismiss for plaintiffs’ lack of Article III standing. In many of those cases, courts face the perennial question of a tree falling in the forest: if a plaintiff’s data is accessed but not misused in a manner causing concrete injury (such as for identity theft), was that person harmed? Courts in different circuits have resolved that question differently, with some accepting broader theories of standing related to risk of future harm than others. Courts deciding those motions now have clear direction from the Supreme Court as to two key issues: a plaintiff’s ability to demonstrate standing based on the mere risk of future harm, and a plaintiff’s ability to demonstrate standing based purely on the violation of a statute.
First, in the context of suits for damages, TransUnion appears to foreclose Article III standing where plaintiffs claim only the risk of future harm from a data breach without actual misuse of their data to cause injury. In TransUnion, the plaintiffs had attempted to demonstrate a risk of future harm, but the Court rejected each of their theories, explaining that they could not plead a “sufficient likelihood” that third parties would request their personal information or that TransUnion would intentionally or accidentally release their information. Those theories are remarkably similar to those pled by plaintiffs in data breach class actions, such as the risk that they will suffer identity theft, or that their information may be sold on the dark web and used to blackmail them. Just as the TransUnion class could not demonstrate standing by theorizing about hypothetical future harms, so too will data breach plaintiffs fail to satisfy Article III by pleading an imaginary parade of horribles yet to befall them.
Second, after TransUnion, plaintiffs may no longer rely on a violation of a statutory right alone to demonstrate Article III standing. In data breach cases, plaintiffs sometimes invoke state privacy statutes to bolster their standing claims, arguing that the violation of a state data breach notification or consumer protection law provides them with standing. Those sorts of arguments are likely to face greater resistance following TransUnion because plaintiffs will have to identify some historical common-law analogue to the statutory violation—a tall task in a data breach suit. Accordingly, TransUnion appears to close the door on several of the more creative arguments plaintiffs have used to assert Article III standing in data breach suits.
What to Look for Now
TransUnion is a clear win for corporate defendants, in particular corporate defendants seeking to dismiss federal class actions arising from data breaches on standing grounds. But the legacy of TransUnion may prove to be more complex, including in data breach cases.
It is important to remember that the Court’s decision places a limit only on the jurisdiction of federal courts. The states remain free to define the parameters for standing to sue in their own courts. At present, roughly half the states do not have lockstep Article III standing rules. And, as Justice Thomas noted in dissent, courts in states with more lenient standing requirements may still adjudicate statutory claims that now cannot proceed in federal courts under TransUnion. As a result, moving to dismiss federal class actions for lack of standing under TransUnion is not a panacea. Instead, in cases where Article III standing may be lacking under TransUnion, plaintiffs may be able to proceed in state court. And if defendants attempt to remove a state court lawsuit to federal court only to dismiss for lack of standing, courts may not only remand the case, but also may force the defendant to pay the plaintiffs’ attorney’s fees.
In short, as the doors to the federal courthouse close, companies can expect plaintiffs to cross the street to state court, at least when companies are subject to the jurisdiction of a state that is not in lockstep with federal Article III standing rules. Companies therefore will want to be strategic about how they advocate for the application of TransUnion, bearing in mind local conditions in the states where they are amenable to suit and local standing rules in those states. As a result, the ultimate consequence for corporate defendants of the Supreme Court’s decision to limit Article III standing remains to be seen.
 TransUnion LLC v. Ramirez, No. 20 - 297, slip op. (U.S. June 25, 2021).
 TransUnion, slip op. at 1.
 Id. at 4.
 Id. at 5 - 6.
 Id. at 6.
 578 U.S. 330 (2016).
 Id. at 341.
 TransUnion, slip op. at 1 (quoting Spokeo, 578 U.S. at 341).
 Id. at 9.
 Id. at 20–22.
 Some courts have accepted broader theories of standing. See, e.g., Attias v. Carefirst, Inc., 865 F.3d 620, 629 (D.C. Cir. 2017); Galaria v. Nationwide Mut. Ins. Co., 663 F. App’x 384, 387–89 (6th Cir. 2016); Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 692, 694–95 (7th Cir. 2015); Krottner v. Starbucks Corp., 628 F.3d 1139, 1142–43 (9th Cir. 2010). Other courts have limited standing more narrowly. See, e.g., Tsao v. Captiva MVP Restaurant Partners, LLC, 986 F.3d 1332 (11th Cir. 2021); Beck v. McDonald, 848 F.3d 262, 273–76 (4th Cir.), cert. denied sub nom. Beck v. Shulkin, ––– U.S. ––––, 137 S. Ct. 2307, 198 L.Ed.2d 728 (2017); Whalen v. Michaels Stores, Inc., 689 F. App’x 89, 90–91 (2d Cir. 2017); In re SuperValu, Inc., 870 F.3d 763, 770–72 (8th Cir. 2017); Reilly v. Ceridian Corp., 664 F.3d 38, 42–44 (3d Cir. 2011).
 TransUnion, slip op. at 22–23.
 State courts “are not bound by the limitations of a case or controversy or other federal rules of justiciability even when they address issues of federal law.” ASARCO Inc. v. Kadish, 490 U.S. 605, 617 (1989).
 See Bennett, The Paradox of Exclusive State-Court Jurisdiction Over Federal Claims, 105 Minn. L. Rev. 1211 (2021).
 TransUnion, slip op. at 18 n.9 (Thomas, J., dissenting).