Summary
finding standing based on an unauthorized credit inquiry that allegedly exposed the plaintiff to an increased risk of identity theft or data breach
Summary of this case from Oneal v. First Tenn. BankOpinion
Civil Action No. 3:16cv153-HEH
08-09-2016
ASHLEY BURKE, Plaintiff, v. FEDERAL NATIONAL MORTGAGE ASSOCIATION, Defendant.
MEMORANDUM OPINION
(Denying Defendant's Motion to Dismiss)
THIS MATTER is before the Court on Defendant's Motion to Dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) (ECF No. 30), filed on June 27, 2016. Plaintiff has filed her Response in Opposition (ECF No. 39) and Defendant has filed a Reply (ECF No. 45). For the reasons stated herein, the Motion will be denied.
I. BACKGROUND
In her Complaint, Ashley Burke ("Plaintiff" or "Burke") alleges that Federal National Mortgage Association ("Defendant") violated her rights under the Fair Credit Reporting Act ("FCRA") by unlawfully obtaining her credit report under the false pretense of an "account review," even though no account existed. (Compl. ¶ 3.) In claiming that Defendant violated 15 U.S.C. § 1681b(f), she contends that her privacy was invaded and that she was placed at an increased risk of identity theft and/or a data breach, resulting in anxiety and emotional distress. (Compl. ¶¶ 24-25.) Defendant moved to dismiss this Complaint pursuant to Fed. R. Civ. P. 12(b)(1), claiming that because Plaintiff has not alleged a concrete injury but only a bare procedural violation, she therefore lacks standing. (Def.'s Mot. Dismiss at 1.)
II. LEGAL FRAMEWORK
Federal Rule of Civil Procedure 12(b)(1) provides that a complaint may be dismissed for lack of subject-matter jurisdiction. Subject-matter jurisdiction requires a justiciable case or controversy within the meaning of Article III of the United States Constitution. See Allen v. Wright, 468 U.S. 737, 750-51 (1984) (abrogated on other grounds by Lexmark Int'l, Inc. v. Static Control Components, Inc., 134 S. Ct. 1377 (2014)). Standing constitutes one component of justiciability. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). Standing presents a "threshold question in every federal case, determining the power of the court to entertain the suit." Warth v. Seldin, 422 U.S. 490, 498 (1975).
The Supreme Court has established that the "irreducible constitutional minimum" of standing includes three elements: (1) an injury-in-fact, (2) a causal connection between the injury and the conduct complained of, and (3) a likelihood that the injury will be redressed by a favorable decision. Lujan, 504 U.S at 560-61 (citations omitted). Because Plaintiff seeks to invoke this Court's jurisdiction, Plaintiff bears the burden of establishing all three elements. Id. at 561.
To establish an injury-in-fact, the plaintiff "must allege a distinct and palpable injury to himself[.]" Warth, 422 U.S. at 501 (citations omitted). The injury must "affect the plaintiff in a personal and individual way." Lujan, 504 U.S. at 560 n.1. Additionally, claims asserting "'generalized grievance[s]' shared in substantially equal measure by all or a large class of citizens . . . normally do[] not warrant exercise of jurisdiction." Warth, 422 U.S. at 499 (citations omitted).
In Spokeo, Inc. v. Robins, the Court reiterated the basic tenants of the standing doctrine. 136 S. Ct. 1540, 1547 (2016). The Court noted that to satisfy the injury-in-fact requirement, a plaintiff must show "'an invasion of a legally protected interest' that is 'concrete and particularized' and 'actual and imminent, not conjectural or hypothetical.'" Id. at 1548. A concrete injury must be real, not abstract. Id. Yet, even intangible injuries may "nevertheless be concrete." Id. at 1549. Spokeo offers two considerations in evaluating concreteness: (1) "whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit;" and (2) the judgment of Congress. Id. A concrete injury is required even in the context of a statutory violation. Id. A bare procedural violation, apart from concrete harm, is not enough to satisfy the injury-in-fact requirement. Id. Within the specific context of the FCRA, "not all inaccuracies cause harm or present any risk of harm." Id. at 1550. And yet, where "harms may be difficult to prove or measure," the violation of a statutory procedural right may be sufficient, even without the plaintiff alleging any additional harm. See id. at 1549.
III. BRIEF SUMMARY OF ARGUMENTS
Defendant claims that Plaintiff's alleged harm is exactly the kind of bare, procedural harm that Spokeo indicated was not enough to establish a concrete injury-in-fact. (Def.'s Mem. Supp. Mot. Dismiss at 1, 5, 8.) In making this argument, Defendant seems to assert that the relevant section of the FCRA does not create a substantive right, therefore Plaintiff's harm is merely procedural, and that Defendant proffers no real damages. (Def.'s Mem. Supp. Mot. Dismiss at 8-9.) As to the alleged harm of increased risk for identity theft or further invasion of privacy, Defendant notes that these lack particularity, and further, depend upon future speculation and the actions of third parties. (Def.'s Mem. Supp. Mot. Dismiss at 5-7.)
Burke claims that Defendant violated § 1681b(f) of the FCRA by obtaining her credit report, at least twice, without a permissible purpose. (Pl.'s Mem. Opp'n Mot. Dismiss at 3-4.) She alleges three injuries: invasion of privacy, exposure to an increased risk of identity theft, and exposure to an increased risk of further invasion of privacy. (Pl.'s Mem. Opp'n Mot. Dismiss at 3.) Plaintiff maintains that the FCRA statutorily created a substantive right to privacy, building upon the general right of privacy being recognized under common law. (Pl.'s Mem. Opp'n Mot. Dismiss at 8-10.) Despite alleging no harm or damages beyond the wrongful obtaining of her credit report, she contends that simply alleging the statutory violation is enough in this instance, because the right is substantive in nature, not merely procedural. (Pl.'s Mem. Opp'n Mot. Dismiss at 8-11.)
IV. ANALYSIS
This is admittedly a close question. While Spokeo leaves some questions unanswered, it clearly requires some analysis of the alleged harm to determine whether it amounts to more than a bare, procedural violation, and therefore reaches the threshold of a concrete injury. 136 S. Ct. at 1545, 1550.
In a recent case with a similar standing issue, the Court analyzed Sections 1681b(b)(2) and (3) of the FCRA with the guidance of Spokeo. Thomas v. FTS USA, LLC, 2016 WL 3653878 at *6 (E.D. Va. June 30, 2016). The Court found that these sections of the FCRA established a right to privacy in one's consumer report, as well as a right to specific information. Id. at *7. Based on the plain statutory text, the Court found both of these rights to be substantive in nature, not merely technical or procedural. Id. Thomas also reviewed relevant legislative history and concluded that overall, the FCRA had the goal and intention "to afford consumers rights to information and privacy." Id. at *8. Additionally, Thomas makes the point that in general, "the common law has long recognized a right to personal privacy." Id. at *10 (citing United States Dept. of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 763 (1989). The Court also noted that "unauthorized dissemination of one's personal information, even without a showing of actual damages, is an invasion of one's privacy that constitutes a concrete injury sufficient to confer standing." Id. at *10. Further, it made clear that "Congress may create a statutory right to privacy in certain information that strengthens or replaces the common law." Id.
In another recent case decided after Spokeo, the Third Circuit resolved that when a defendant fails to comply with statutory rules protecting privacy, the plaintiff's privacy has been unlawfully invaded and the plaintiff has therefore suffered a concrete injury, regardless of actual damages. See In re Nickelodeon Consumer Privacy Litigation, ---F.3d.---, 2016 WL 3513782 (3d Cir. June 27, 2016). That Court noted that while the harm may be intangible, the "unlawful disclosure of legally protected information" is an injury, particularly when Congress has decided the information in question should remain private. Id. at *7. Nickelodeon was not dealing with the FCRA, but the principle is comparable. This Court finds the analysis in Thomas and Nickelodeon to be persuasive. While the immediate case deals with a different portion of the FCRA than Thomas, specifically Section 1681b(f), it is an analogous provision.
The FCRA is clear in its prohibition of using or obtaining consumer reports, except in certain, specified circumstances:
A person shall not use or obtain a consumer report for any purpose unless--15 U.S.C. § 1681b(f).
(1) the consumer report is obtained for a purpose for which the consumer report is authorized to be furnished under this section; and
(2) the purpose is certified in accordance with section 1681e of this title by a prospective user of the report through a general or specific certification.
Within the same section, the legitimate purposes for which a reporting agency may furnish records are made clear:
Subject to subsection (c) of this section, any consumer reporting agency may furnish a consumer report under the following circumstances and no other...
(3) To a person which it has reason to believe--
(A) intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer; or
(B) intends to use the information for employment purposes; or
(C) intends to use the information in connection with the underwriting of insurance involving the consumer; or
(D) intends to use the information in connection with a determination of the consumer's eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant's financial responsibility or status; or
(E) intends to use the information, as a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation; or
(F) otherwise has a legitimate business need for the information--
(i) in connection with a business transaction that is initiated by the consumer; or
(ii) to review an account to determine whether the consumer continues to meet the terms of the account.
(G) executive departments and agencies in connection with the issuance of government-sponsored individually-billed travel charge cards.15 U.S.C. § 1681b(a)(3).
The FCRA makes explicit that it is meant to protect the "consumer's right to privacy," in part by ensuring the "confidentiality" of consumers' credit information. See 15 U.S.C. § 1681; see also Cole v. U.S. Capital, 389 F.3d 719, 725 (7th Cir. 2004). In furtherance of this goal, Congress limited the circumstances in which a consumer report may be legitimately obtained. 15 U.S.C. § 1681b(a); Zamora v. Valley Fed. Sav. & Loan Ass'n of Grand Junction, 811 F.2d 1368, 1370 (10th Cir. 1987) ("By enacting the FCRA, Congress intended to prevent invasions of consumers' privacy"). These facts indicate that the FCRA meant to protect privacy as a substantive right, not only as a procedural means to prevent other harms.
A concrete injury need not be tangible, it need only be real. Spokeo, 136 S. Ct. at 1548-49. While it is true that Burke does not allege an obviously tangible harm, such as the loss of money, the denial of employment, or the denial of credit, that does not necessarily mean that her alleged injury is only a bare, technical violation.
The FCRA was meant to protect the interest of privacy. The portion of the FCRA at issue here is clear that one's consumer report is not to be obtained except for the limited purposes specifically provided by the statute. The language and context of this provision seem to establish a statutory right to privacy based in one's consumer report. As Spokeo counsels, this Court must defer to history and the judgment of Congress in deciding whether the alleged harm constitutes an injury-in-fact. In some sense, the right at issue can appear procedural, as it is a mechanism intended to prevent further harms. Yet, given the purposes, framework, and structure of the FCRA, the right to privacy established by the statute appears to be more substantive than procedural. See e.g., Thomas, 2016 WL 3653878 at *7.
Spokeo clearly stated that in some circumstances, the violation of a procedural right granted by statute can be sufficient to state an injury-in-fact, even if no additional harm is alleged. 136 S. Ct. at 1549. Meaning, in this matter, that even if the right were more procedural than substantive, the Plaintiff may have still pleaded a concrete injury.
This being so, Plaintiff's alleged violation of privacy is a concrete harm, even if that harm does not lead to other, more tangible harms. Therefore, by claiming that the Defendant obtained her consumer report without a lawful purpose under the FCRA, Burke has pleaded a concrete harm.
Because Burke has pleaded an injury-in-fact, via invasion of privacy under the FCRA, this Court need not analyze whether her other alleged harms (being placed at an increased risk of identity theft and further invasion of privacy) constitute a true injury-in-fact. And while this Court does not analyze these alleged harms here, it is noteworthy that the Supreme Court made clear in Spokeo that "the risk of real harm" can, under some circumstances, satisfy the requirement of concreteness. 136 S. Ct. at 1549. --------
V. CONCLUSION
For the preceding reasons, this Court finds that Plaintiff has alleged more than a bare procedural violation. While a close question, at this stage of the litigation, based on the existing record, it appears that Plaintiff has alleged a concrete injury-in-fact, enough to survive a Rule 12(b)(1) motion to dismiss.
The Defendant's Motion to Dismiss (ECF No. 30) will be denied.
An appropriate Order will accompany this Memorandum Opinion.
The Clerk is DIRECTED to send a copy of this Memorandum Opinion to all counsel of record.
/s/_________
Henry E. Hudson
United States District Judge Date:August 9, 2016
Richmond, Virginia