With Supreme Court Privacy Case Pending, Silicon Valley Weighs In

On March 30, the Supreme Court of the United States will hear oral arguments in TransUnion LLC v. Ramirez. This case marks the first time the Court will address the residual question in Spokeo, Inc. v. Robins — what about class actions? As in Spokeo, TransUnion will wrestle both with the harms produced through noncompliance with the Fair Credit Reporting Act (“FCRA”) and whether those harms constitute sufficient injury-in-fact to establish Article III standing. Unlike Spokeo, however, TransUnion will address whether anything changes in the context of class action litigation.

The precise legal questions are: i) will noncompliance with privacy statutes, such as the FCRA, give putative class action members Article III standing to sue violators of these laws; and ii) was Rule 23’s typicality requirement stretched too far when a uniquely affected plaintiff represented the whole class.

TransUnion made its way to the Supreme Court after the Ninth Circuit held that “every member of a class certified under Rule 23 must satisfy the basic requirements of Article III . . . .” Last week, several of the giants of Silicon Valley, including Facebook, Google, and eBay (the “Amici”), filed their amici curiae brief in support of TransUnion. They argue that the Ninth Circuit erred when it “elevate[d] to an Article III injury-in-fact any technical violation of a federal statute that exposed a plaintiff to [what was] no more than a de minimis risk of harm. . . . [This] is irreconcilable with [the Supreme Court’s] precedents establishing that a risk of injury is sufficient to confer standing only when that risk is ‘material’ and the injury threatened is ‘certainly impending.’” In so doing, the Ninth Circuit held that all 8,185 members of the class satisfied the standing requirements, leading to statutory damages of $984.22, and punitive damages of $3,936.88, per class member.

The implications of the Ninth Circuit’s ruling are potentially staggering, those seeking its reversal assert. Their fundamental contention is that diminished limits on who can sue virtually ensure that more will sue. Given that the FCRA is just one of many privacy acts, companies throughout the country likely have strong incentives to support TransUnion as it seeks to have the Ninth Circuit’s decision overturned.

The Amici warn that relaxing the standing requirement in the context of class action privacy suits will only add fuel to an already explosive situation:

Under the Ninth Circuit’s decision, if any of the millions of individuals who interact with amici each day claims to be injured by a generalized act or practice that allegedly violates a statute that provides a private cause of action and statutory damages, she can, without more, launch and prosecute to trial a class action on behalf of herself and millions of other “similarly situated” users, without proving that any other member of the class has actually suffered an injury similar to hers — or any risk of injury greater than de minimis at all. Exploiting the Ninth Circuit’s lax standing and class certification rules, entire classes of plaintiffs could secure astronomical damages awards despite having suffered no injuries, or even any real risk of injury.

The FCRA may be considered the forefather of federal privacy laws. Its kin include:

• the Privacy Act of 1974
• the Right to Financial Privacy Act
• the Cable Communications Policy Act
• the Stored Communications Act
• the Electronic Communications Privacy Act
• the Video Privacy Protection Act
• the Computer Fraud and Abuse Act
• the Telephone Consumer Protection Act (record-breaking privacy law damages award of $925 million).
  
  

Congress designed all of these acts to encourage consumer privacy protection through mechanisms allowing private actions seeking both statutory and punitive damages. This statutory framework operates in tandem with traditional administrative enforcement through agencies such as the Federal Trade Commission and the Federal Communications Commission. Coupling the multiplying power of class actions with the fact that these acts assign damages awards on a per consumer basis (e.g., FCRA’s maximum of $1,000 per consumer affected), makes it clear that companies face potentially dire consequences if the Supreme Court affirms the Ninth Circuit’s decision.

Facebook, Google, and eBay are goliaths in the technology sector, but their warnings probably resonate with large (and even some smaller) companies in other sectors as well. As Congress passes more legislation safeguarding consumer privacy, companies dealing with mounds of consumer data or interfacing with hordes of consumers will continue facing increased litigation exposure. Whatever the outcome in TransUnion, companies would do well to review their compliance practices to safeguard against future private lawsuits related to alleged infringements of privacy.

1. Docket No. 20-297.
2. 136 S. Ct. 1540 (2016).
3. Ramirez v. TransUnion LLC, 951 F. 3d 1008, 1017 (2020).
4. Brief for Amici Curiae eBay, Inc., Facebook, Inc., Google LLC, Computer & Communications Industry Association, The Internet Association, and Technology Network Supporting Petitioner at 9, TransUnion LLC v. Ramirez, No. 20-291 (U.S. Feb. 8, 2021).
5. Id. at 6.