Keypoint: Supreme Court’s decision could require individuals to suffer an actual injury prior to participating in a class action.
On December 16, the Supreme Court of the United States agreed to review a case with potential major implications for data-breach class actions.
Trans Union v. Ramirez arises out of a class action about inaccurate credit reports. The class representative claimed that his credit report contained an error indicating that his name matched someone on the government’s list of persons with whom businesses in the United States are prohibited from transacting. Mr. Ramirez claimed this error caused him to be unable to obtain credit when purchasing a vehicle, caused him embarrassment in front of his family, and caused him to cancel a vacation to Mexico.
In his lawsuit, Mr. Ramirez sued Trans Union on behalf of himself and anyone who received a notification from Trans Union of a similar error in their credit report within the relevant time period (upwards of 8,000 people). Trans Union opposed this class, arguing that several of the proposed class members did not have legal standing to assert a claim because it was not established that their inaccurate credit report was ever sent to any third-party, much less that it caused them the denial of credit or any other injury. Indeed, Mr. Ramirez stipulated that over 75% of the class members had never had an inaccurate report sent to a third-party. Trans Union also argued that Mr. Ramirez’s claims were not “typical” of those asserted by the rest of the class, another requirement for a plaintiff to proceed in a federal class action.
The district court rejected Trans Union’s arguments and the case proceeded to trial. The jury awarded approximately $8 million in statutory damages and approximately $52 million in punitive damages. On appeal, the United States Court of Appeals affirmed in a 2-1 decision (other than slightly reducing the punitive damages award), allowing the decision to stand. Trans Union has now appealed to the Supreme Court, and the Court has agreed to review the case.
The Supreme Court’s decision in this case could have a major impact on data-breach cases as well. In many data-breach class actions, the named plaintiff—just like Mr. Ramirez—will allege personal fraud as a result of a data breach but will seek to represent a large class of individuals, many of whom have not suffered fraud themselves. Indeed, in some such cases, it is not even established that the other class members’ information was taken in the breach, only that access to the information was possible for a period of time. Defendants in these cases frequently make the same arguments as Trans Union, especially arguments claiming a lack of standing. Thus, depending on the outcome of this case and the scope of the Supreme Court’s ruling, the landscape of data-breach class-action litigation may be in for a change.
A decision from the Supreme Court is expected by June 2021.