The United States Supreme Court has reshaped class standing in a landmark ruling.  TransUnion LLC v. Ramirez asked whether class members who suffer no actual injury can be included in a damages class under Federal Rule of Civil Procedure 23.  The Court, in a 5-4 opinion led by Justice Kavanaugh, put it simply: “no concrete harm, no standing.”  The Court’s holding has potentially significant implications for data breach and privacy class actions.

In Ramirez, the lead Plaintiff attempted to purchase a car from a dealership when an inaccurate credit report identified him as a potential terrorist.  After a jury trial, the certified class of 8,815 members was awarded $40 million in statutory and punitive damages for TransUnion’s alleged violations of the Fair Credit Reporting Act.  On appeal, the Ninth Circuit impermissibly bundled into one class members whose credit files were disclosed to third-parties and members whose files were not disclosed.  In doing so, the Ninth Circuit found that Ramirez’s claims were sufficiently “typical” of the class and that the absent class members suffered an “injury” because they had been erroneously notified by mail that they were on the same terrorist list.

The Supreme Court reversed, finding that only the members who had that their misleading credit reports were disclosed to third-parties by TransUnion had suffered a sufficient harm to trigger Article III standing.  In assessing whether a class member has suffered a “concrete harm” under Article III, the Court reaffirmed principles from Spokeo v. Robins, namely that courts must “[a]ssess . . . whether the asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts – such as physical harm, monetary harm, or various intangible harms including (as relevant here) reputational harm.” 

Beyond the facts of Ramirez, the Court’s decision will impact data security and privacy class action litigation by providing defendants with a more powerful defense in cases where alleged privacy and security violations do not result in a disclosure of information resulting in any tangible harm.  In the data breach context, if private information was not published, or if the data was not used in any fraudulent way, defendants may be able to argue that the class has not been harmed and, therefore, lacks standing.

Courts across the country have been waiting for Ramirez to decide certification issues in data breach class actions.  For example, in Stoll v. Musculoskeletal Inst., Chtd., the plaintiffs alleged that “Defendant experienced a ransomware attack which resulted in exposure of sensitive and private personally identifiable information (PII) of at least 100,000 patients, and potentially in excess of 150,000 patients of Defendant.” 2021 U.S. Dist. LEXIS 30154 (M.D. Fla. Feb. 18, 2021).  The court stayed the case pending Ramirez finding that “the parties would benefit significantly from the Supreme Court's ruling in litigating the issue as to whether a class can be certified and who may be included within that class.”  Now, the Stoll Court (and district courts throughout the country) will have to dissect classes at—or before—certification to determine which members have suffered a cognizable injury, and which have not.  For this reason, Ramirez will successfully chip away large putative classes where real injury may be limited to only a few individuals.

On the other hand, Ramirez may also cause a flood of “no injury” privacy class actions in state courts, where standing thresholds are lower than the mandates of Article III.  In dissent, Justice Thomas cautioned that Ramirez “might actually be a pyrrhic victory for TransUnion.”  He reasoned that plaintiffs without Article III standing will simply file complaints in state court moving forward.  Moreover, Justice Thomas warned that defendants will be unable to remove because Ramirez “does not prohibit Congress from creating statutory rights for consumers; it simply holds that federal courts lack jurisdiction to hear some of these cases.” States like California, for example, with more lenient standing requirements, and also have judges that are likely to liberally interpret federal statutes upon which most “no injury” class actions are based. 

While it is yet to be seen how and at what stage of litigation Ramirez will be applied, it will be a prominent authority in privacy and data breach class actions moving forward in federal court.  Under its standard, all class members must have standing, not just a select few.  At the very least, plaintiffs will now be required to allege that data was actually misused not just improperly exfiltrated by hackers.  As a result, defendants will be successful in paring down class size by exposing class members who did not suffer the same harms as the class representative.