Summary
explaining that "to prove a reckless violation" of the statute, "a plaintiff must show that the defendant's interpretation was objectively unreasonable" and an interpretation of the FCRA that is contrary to "the plain language of the statute" is unreasonable
Summary of this case from Jones v. Sky Grp. U.S.Opinion
Civil Action No. 1:18-CV-01233-CAP
2020-03-19
Glenn HEAGERTY, Plaintiff, v. EQUIFAX INFORMATION SERVICES LLC and National Consumer Telecom & Utilities Exchange, Inc., Defendants.
Charles Jackson Cole, Craig Edward Bertschi, McRae Bertschi & Cole, LLC, Dunwoody, GA, for Plaintiff. John Anthony Love, King & Spalding LLP, Norman Charles Campbell, II, Equifax, Inc., Atlanta, GA, Kendall W. Carter, Accrescent Marketing LLC, Suwanee, GA, for Defendants.
Charles Jackson Cole, Craig Edward Bertschi, McRae Bertschi & Cole, LLC, Dunwoody, GA, for Plaintiff.
John Anthony Love, King & Spalding LLP, Norman Charles Campbell, II, Equifax, Inc., Atlanta, GA, Kendall W. Carter, Accrescent Marketing LLC, Suwanee, GA, for Defendants.
ORDER
CHARLES A. PANNELL, JR., United States District Judge
On March 23, 2018, the plaintiff initiated this action against Equifax Information Services LLC ("Equifax") and National Consumer Telecom & Utilities Exchange, Inc. ("NCTUE"), asserting violations of the Fair Credit Reporting Act ("FCRA" or the "Act"), 15 U.S.C. §§ 1681b and 1681e. In Count One of his complaint, the plaintiff alleges that both the defendants violated § 1681b(a), which sets out the permissible purposes for which a credit reporting agency ("CRA") may furnish a consumer report to "a person." In Count Two, the plaintiff alleges that NCTUE violated § 1681e(a), which requires CRAs to maintain reasonable procedures designed to ensure that consumer reports are furnished only for the limited permissible purposes set out in § 1681b. In Count Three, the plaintiff alleges that Equifax violated § 1681b(f), which prohibits "a person" from using or obtaining a consumer report for any purpose other than those specifically authorized under the statute. The plaintiff alleges each statutory violation, in the alternative, as being either negligently or willfully done.
Upon the completion of discovery, the parties filed cross motions for summary judgment. The plaintiff then moved to strike a declaration that the defendants filed contemporaneously with their reply brief in support of their summary judgment motion. The magistrate judge then issued a report and recommendation ("R & R") [Doc. No. 76] recommending that both summary judgment motions be denied, and, further, ordered that the plaintiff's motion to strike be denied. The defendants timely filed objections to the R & R [Doc. No. 80], to which the plaintiff responded [Doc. No. 81]. The plaintiff filed no objections regarding the denial of his motion.
No objection to the R & R's factual findings were made, so the court will summarize them here.
A. Factual background
In the spring of 2016, the plaintiff decided to check his Equifax credit report for accuracy, so he contacted Equifax and asked for a copy of his credit file. After the plaintiff received his Equifax file disclosure, he noticed that a company called "Eqxncatt" had obtained his Equifax credit report on several occasions in 2014 and 2015. According to the plaintiff, he became concerned because he had never heard of "Eqxncatt," and he had never authorized a company by that name to obtain his Equifax consumer report. To investigate the situation, he called the telephone number for Eqxncatt listed on his Equifax file disclosure. The plaintiff was told that Eqxncatt was "The Exchange Service Center," which is affiliated with defendant NCTUE.
The FCRA provides that upon request, CRAs such as Equifax are required to "clearly and accurately disclose to the consumer: ... [a]ll information in the consumer's file at the time of the request," "[t]he sources of the information," and also the "identification of each person ... that procured a consumer report" on the consumer during the previous year. 15 U.S.C. § 1681g(a)(1)–(3).
After doing some research the plaintiff learned that NCTUE, like Equifax, is also a CRA; and he did not understand why one CRA would be providing a copy of his credit report to another CRA. To investigate, the plaintiff asked NCTUE to provide him with a copy of his NCTUE credit file. After receiving his NCTUE file disclosure report, the plaintiff saw that companies described as "EISCOMPANY" and "EIS/EQUIFAX" had accessed his NCTUE credit file or data report on at least 73 occasions, beginning in June 2014. These are pseudonyms for Equifax.
On July 8, 2016, the plaintiff emailed attorney Meryl W. Roper of King & Spalding (who had represented Equifax in prior unrelated litigation with the plaintiff), claiming that Equifax had obtained 73 consumer reports from NCTUE without a permissible purpose and under false pretenses, in violation of the FCRA. He also raised the possibility that King & Spalding had been involved in obtaining his NCTUE credit report, and that it was "terrifying to think people were monitoring me during the case, violating my privacy, what information was obtained, what was done with it, who all got it, where is it now, how many other individuals has this happened to?"
In response, Ms. Roper replied that, after speaking with someone at NCTUE, she learned the NCTUE system and the dispute resolution system at Equifax Information Services are linked, and that is what caused the inquiries to show up on the NCTUE report. She stated, "In order to address your concerns and allegations in the prior lawsuit, it was necessary for attorneys at my firm to speak with Equifax and pull up your Equifax credit file to determine how accounts ... were reporting and whether changes needed to be made. Each time we needed to address your file, it created the inquiry on the NCTUE report and multiple updates would cause multiple entries on the same day." Ms. Roper indicated that these inquiries were the direct result of the prior lawsuit, and there no basis to say there was an impermissible purpose to access the plaintiff's file. She claimed, "I can assure you that nobody was monitoring you or trying to violate your privacy. There was no consumer report provided from NCTUE to Equifax Information Services .... no third party obtained the information and this had no impact on a credit score or ability to receive credit."
The plaintiff spent the next eighteen months trying to get an explanation for why Equifax had obtained his NCTUE credit report 73 times without authorization. Because the explanations were confusing and ultimately unsatisfactory to him, the plaintiff filed this lawsuit.
B. The defendants' business models
Although both the defendants are CRAs, they operate in different ways. Equifax gathers information about consumers from sources such as banks, collection agencies, and court records; it then creates credit files that it uses to prepare consumer reports for use in evaluating the potential credit risk of consumers, among other permissible purposes. NCTUE is also a CRA but it gathers consumers' account history, unpaid closed accounts, and customer service applications from companies in the telecommunications, pay TV, and utilities industries (such as AT & T, DirecTV, and Georgia Power). This information is sold to companies deciding whether to extend services to consumers.
Equifax and NCTUE are separate companies, and each maintains its own separate database of consumer credit files and account information. There is no common ownership between Equifax and NCTUE, but NCTUE—which has no employees—uses Equifax to host and maintain NCTUE's database of consumer data and to provide certain operational services for NCTUE. Equifax does not include NCTUE's consumer data in its own consumer reports, and NCTUE does not include Equifax's consumer data in its own consumer reports. However, Equifax has created a credit risk score called the "Insight Score" that utilizes data contained in NCTUE's database as well as Equifax's credit files.
The services Equifax provides NCTUE under this contract include: (1) sending consumers copies of their NCTUE data file disclosures upon request, and (2) conducting reinvestigations of disputes by consumers concerning the accuracy of their NCTUE data files.
The Insight Score is an additional scoring model designed to assist in predicting credit risk for individuals who may not have any or a lot of traditional credit, and is comprised of a consumer's credit history information along with his/her utility history. Upon request, consumers may purchase their Insight Score from Equifax.
Equifax, as a CRA, is obligated to conduct "reinvestigations" when consumers dispute the accuracy or completeness of information contained in their Equifax credit file. To reinvestigate and track consumer disputes, Equifax uses a software platform called "ACIS," which is an acronym for "Automated Consumer Interview System." When an Equifax ACIS operator accesses a consumer's Equifax credit file to conduct a dispute reinvestigation, the ACIS system automatically, and without prompting, provides the ACIS operator with the consumer's Insight Score that is viewable on the operator's computer screen. The operator is also able to view the Insight Score when accessing an Equifax consumer's file to do other things such as process a request for a consumer disclosure, add a fraud alert to the consumer's file, answer a question a consumer has about his or her file, and during other consumer-initiated contacts with Equifax. The Equifax operators, however, can see only the Insight Score and are not able to see or otherwise access the full NCTUE data file or any of the data used to calculate the Insight Score. Every time Equifax obtains this information from a consumer's NCTUE credit file to generate an Insight Score, that event is recorded as an "soft inquiry" on the consumer's NCTUE data report. The generation of an Insight Score is unnecessary to the reinvestigation of consumer disputes.
A "soft inquiry" is recorded when a credit report is accessed without affecting a consumer's credit rating, and can also occur when a consumer requests his or her credit report, or a consumer's existing creditor conducts an account review.
Since 2014, the plaintiff has disputed the accuracy and completeness of information contained in his Equifax credit file on numerous occasions. Following its general procedures for reinvestigating consumer disputes, Equifax reinvestigated the plaintiff's disputes using its ACIS software platform. As noted above, each time an ACIS operator accessed the plaintiff's Equifax credit file, an Insight Score was generated using information from the plaintiff's NCTUE and Equifax credit files, the score was displayed to the ACIS operator, and the event was recorded as an "inquiry" on the plaintiff's NCTUE file. The companies that are listed as having inquired or requested the plaintiff's NCTUE data report are "EISCOMPANY," "EIS/EQUIFAX," "ACIS," and "GESC," which are all pseudonyms for Equifax and its ACIS system. When NCTUE learned (as a result of this lawsuit) that Equifax, through its ACIS system, was generating Insight Scores on consumers using NCTUE's data, which was causing a hit on the consumers' NCTUE file, NCTUE instructed Equifax to cease this practice.
II. The Magistrate Judge's R & R
In their motion for summary judgment, the defendants argued that they were entitled to summary judgment because they did not invade the plaintiff's privacy, so the plaintiff has no injury in fact and lacks Article III standing to sue and because the Insight Scores at issue in this lawsuit were not consumer reports. The R & R, however, found that the plaintiff had alleged and presented credible evidence showing an actual unauthorized disclosure of at least some of his NCTUE credit information to Equifax, and that this disclosure amounted to an invasion of privacy, which is the type of injury that Congress sought to protect through the FCRA. Accordingly, it concluded that the plaintiff had Article III standing to assert his claims. The magistrate judge also concluded that the Insight Score was a consumer report, and the fact that specific Equifax operators were not able to view any of the underlying NCTUE data that went into creating the Insight Scores did not alter the fact that Equifax obtained had proprietary credit data from the plaintiff's NCTUE credit file and used it, in combination with Equifax's own credit data, to generate a credit risk score as a product to be offered for sale by Equifax to the consumer and possibly third parties.
Next the defendants argued that they were entitled summary judgment because the Insight Scores were not impermissibly distributed to a third party. But this argument ignored the fact that Equifax is a distinct and separate corporate entity from NCTUE—their contract notwithstanding—so the NCTUE data was distributed to a third party: Equifax. Based on these findings, the R & R recommends the denial of summary judgment on the plaintiff's claims.
The defendants, however, argued in the alternative that they are entitled to summary judgment on the plaintiff's claim(s) for emotional distress because he offers nothing but his own testimony to support these claims. He never went to a doctor about these issues, has not taken any medications or received any medical treatment, and no medical professional has told him that the issues were caused or exacerbated by Equifax or NCTUE. The magistrate judge determined that summary judgment was improper because in FCRA cases, a plaintiff is not required to produce evidence of emotional distress beyond his own testimony.
Finally, the defendants claimed that even if they do not prevail on their arguments regarding standing, consumer reports, and damages, they should be granted summary judgment on the plaintiff's claims for willful violations of the FCRA—which come with both statutory and punitive damages. While acknowledging that willfulness is typically a question for the jury, the defendants nevertheless contended their actions were not knowing or reckless—the standard for willfulness under the FCRA—because the defendants are merely two entities that already had access to the data and were its stewards, and there is no case law or regulatory finding establishing that using the NCTUE data in this manner violated the FCRA. The magistrate judge, construing the facts in the light most favorable to the plaintiff, determined that Equifax willfully accessed the data in the plaintiff's NCTUE credit file, and that it did so with NCTUE's implied, if not actual, knowledge and tacit consent.
III. The Defendants' Objections
The defendants set forth three objections to the R & R. First, they argue that the magistrate judge's conclusion that the plaintiff has Article III standing is based on non-binding case law that is both procedurally and factually inapposite to the facts of this case. The defendants claim that while the cases cited in the R & R do recognize a concrete privacy harm resulting from impermissible disclosures of credit information, they do not stand for the proposition that all violations of the FCRA necessarily result in concrete harm. They maintain that, under Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S. Ct. 1540, 194 L.Ed.2d 635 (2016), not all violations of a statute will result in concrete harm, and the concreteness analysis depends on the specific facts of each case. According to the defendants, the undisputed facts of this case show that the plaintiff did not suffer a concrete harm because his credit information, while technically transmitted between CRAs, was never viewed by humans and it was not used for determining the plaintiff's eligibility for credit, insurance, or employment.
Second, the defendants' object to the conclusion that the plaintiff's testimony of emotional distress is sufficient to survive summary judgment, as it is based on an incorrect statement of law. They contend that the majority of courts—including this one—require a plaintiff to present corroborating evidence of emotional distress to withstand summary judgment.
Third, the defendants argue the R & R erroneously concludes that they are not entitled to judgment as a matter of law on the plaintiff's willfulness claims. They maintain that the R & R ignores the framework of Safeco Ins. Co. of America v. Burr , 551 U.S. 47, 127 S.Ct. 2201, 167 L.Ed.2d 1045 (2007), and, without finding that the defendants' interpretation of the FCRA was objectively unreasonable, concluded that whether the defendants willfully violated the FCRA was an issue of fact. The defendants contend that the text of the FCRA and applicable authoritative guidance show their interpretation was not objectively unreasonable, because it is not clearly established that the information obtained was a "consumer report," and because CRA-to-CRA transfers of consumer credit information, as occurred here, are permitted.
IV. Standard of Review
To challenge the findings and recommendations of the magistrate judge, a party must file with the clerk of court written objections. These objections "must specifically identify those findings objected to. Frivolous, conclusive, or general objections need not be considered by the district court." Marsden v. Moore , 847 F.2d 1536, 1548 (11th Cir. 1988) ; see also Heath v. Jones , 863 F.2d 815, 822 (11th Cir. 1989) (objections "shall specifically identify the portions of the proposed findings and recommendation to which objection is made and the specific basis of the objection"). If timely and proper objections are filed, the district court "shall make a de novo determination of those portions of the report or specified proposed findings or recommendations to which objection is made." 28 U.S.C. § 636(b)(1)(C). The court "may accept, reject, or modify the recommended disposition; receive further evidence; or return the matter to the magistrate judge with instructions." FED. R. CIV. P. 72(b)(3).
V. Legal Analysis
In Count One of his complaint, the plaintiff alleges that both defendants violated § 1681b(a), which sets out the permissible purposes for which a CRA may furnish a consumer report to "a person." In Count Two, the plaintiff alleges that NCTUE violated § 1681e(a), which requires CRAs to maintain reasonable procedures designed to ensure that consumer reports are furnished only for the limited permissible purposes set out in § 1681b. In Count Three, the plaintiff alleges that Equifax violated § 1681b(f), which prohibits "a person" from using or obtaining a consumer report for any purpose other than those specifically authorized under the statute. The plaintiff alleges each statutory violation, in the alternative, as being either negligently or willfully done.
A. Article III standing
"It is by now axiomatic that ‘Article III of the Constitution limits the judicial power of the United States to the resolution of cases and controversies.’ " DiMaio v. Dem. Nat'l Comm. , 520 F.3d 1299, 1301 (11th Cir. 2008) (quoting Valley Forge Christian Coll. v. Ams. United for Separation of Church & State, Inc. , 454 U.S. 464, 471, 102 S.Ct. 752, 70 L.Ed.2d 700 (1982) ) (internal quotation marks omitted). The issue of standing is an essential part of the case-or-controversy requirement. DiMaio , id. To satisfy Article III's standing requirements, a plaintiff must show that (1) he has suffered an injury in fact that is concrete and particularized as well as actual or imminent; (2) the injury is fairly traceable to the challenged conduct of the defendant; and (3) the injury is likely to be redressed by a favorable decision. Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc. , 528 U.S. 167, 180–81, 120 S.Ct. 693, 145 L.Ed.2d 610 (2000) (citing Lujan v. Defenders of Wildlife , 504 U.S. 555, 560–61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). For an injury to be particularized, it "must affect the plaintiff in a personal and individual way." Lujan , 504 U.S. at 560 & n.1, 112 S.Ct. 2130. To be "concrete," the injury need not be tangible, but it must be "real" and not "abstract." Michael v. HOVG, LLC , 232 F. Supp. 3d 1229, 1234 (S.D. Fla. 2017) (citing Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S. Ct. 1540, 1548–49, 194 L.Ed.2d 635 (2016) ).
The defendants have challenged only the first element: whether the plaintiff suffered an injury in fact.
The defendants do not dispute that the injury alleged by the plaintiff is particularized; after all, it was his information that was purportedly disclosed without a permissible purpose. See Spokeo , id. at 1548. (agreeing with the Ninth Circuit's conclusion that a plaintiff's interests in the handling of his credit information are individualized—i.e., particular to him—rather than collective). Instead, they allege that his injury is abstract and therefore insufficient to confer standing. To determine whether an injury is sufficiently concrete to confer standing, the court must "consider whether [the] alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts," and determine if Congress has elevated the intangible harm to the status of a legally cognizable injury. Spokeo , 136 S. Ct. at 1549.
As to the first inquiry, the court concludes that the harm created by impermissible access to a consumer report has a close relationship to a common law harm. Accessing a consumer report without a permissible purpose would be similar to several common law torts that fall under the umbrella of invasion of privacy, such as the public disclosure of private facts or intrusion upon seclusion (in this case, intrusion on financial information). Of particular relevance here, the tort of intrusion has been applied to cases where a defendant has illegitimately accessed personal or confidential information. See, e.g. , Bray v. Cadle Co. , No. 4:09-cv-663, 2010 WL 4053794 (S.D. Tex. Oct. 14, 2010) (improperly accessing bank records); Kausch v. Wilmore , 2009 WL 481346, at *4 (C.D. Cal. Feb. 24, 2009) (allegations that defendant had an impermissible purpose in obtaining plaintiff's credit report in relation to litigation); Capitol Records, Inc. v. Weed , 2008 WL 1820667 (D. Ariz. Apr. 27, 2008) (accessing hard disk and copying files without authorization); Rodgers v. McCullough , 296 F. Supp. 2d 895 (W.D. Tenn. 2003) (improperly obtaining a mother's credit report in attempt to show she was irresponsible, untruthful, and financially unstable during custody dispute); Smith v. Bob Smith Chevrolet , 275 F. Supp. 2d 808 (W.D. Ky. 2003) (accessing credit report for improper purpose); Pulla v. Amoco Oil Co. , 882 F. Supp. 836 (S.D. Iowa 1994) (employer gained access to employee's credit card records and put them in plaintiff's personnel file), aff'd in part, rev'd in part on other grounds , 72 F.3d 648 (8th Cir. 1995).
Second, there is no dispute that Congress enacted the FCRA to, at least in part, "protect consumer privacy." Safeco Ins. Co. of America v. Burr , 551 U.S. 47, 52, 127 S.Ct. 2201, 167 L.Ed.2d 1045 (2007) ; accord Spokeo , 136 S. Ct. at 1545 (quoting 15 U.S.C. § 1681(a)(1) ). One of the primary protections within the FCRA—and the one most relevant here—is the requirement that users have a permissible purpose when they obtain or use a consumer report. See 15 U.S.C. § 1681b(a) and (f). To this end, Congress included in the Act an elaborate set of interlocking provisions that restrict the access to and dissemination of consumer reports. See, e.g. , 15 U.S.C. § 1681b(a) (permissible purpose); 15 U.S.C. § 1681e(a) (certification of permissible purpose); 15 U.S.C. § 1681b(f) (user's certification of permissible purpose). Further, the FCRA provides, "Any person who willfully fails to comply with any requirement [of the FCRA] with respect to any consumer is liable to that consumer" for, among other things, either "actual damages" or statutory damages of $100 to $1,000 per violation, costs of the action, attorney's fees, and possibly punitive damages. 15 U.S.C. § 1681n(a).
Based on this analysis, the court concludes that the FCRA creates a substantive right to privacy with regard to access to an individual's sensitive credit information, and the impermissible disclosure of this information is more than a bare procedural violation of the Act. The defendants however, argue that the information disclosed does not implicate significant privacy rights, that any privacy rights the plaintiff had were not invaded, and they otherwise attempt to distinguish this case on its "unique" set of facts.
Even after Spokeo , courts across this country have reached the same conclusion. Accord Vanamann v. Nationstar Mortg., L.L.C. , 735 F. App'x 260, 261 (9th Cir. 2018) (finding standing where plaintiff alleged an invasion of privacy and emotional distress from impermissible credit access); Perrill v. Equifax Info. Servs., L.L.C. , 205 F. Supp. 3d 869 (W.D. Tex. 2016) (invasion of privacy associated with obtaining credit report for impermissible purpose is a concrete injury in and of itself regardless of actual damages); Witt v. CoreLogic SafeRent, L.L.C. , No. 3:15-cv-386, 2016 WL 4424955, at *12 (E.D. Va. Aug. 18, 2016) (holding § 1681b(a) "creates a right to privacy and confidentiality of ... personal information"; plaintiff had standing to pursue claim that defendant had obtained her credit report without permissible purpose); Thomas v. FTS USA, L.L.C. , 193 F. Supp. 3d 623 (E.D. Va. 2016) (finding standing for § 1681b(b)(2)(A) subclass; noting unauthorized disclosure without proper notice constitutes invasion of privacy establishing concrete injury); Benton v. Clarity Servs., Inc. , No. 16-cv-06583-MMC, 2017 WL 345583 (N.D. Cal. Jan. 24, 2017) (concrete invasion of privacy where consumer report was furnished to user that lacked permissible purpose); Duraj v. PNC Bank N.A. , No. 1:17 CV 775, 2017 WL 5508380 (N.D. Ohio. Nov. 15, 2017) ("[A]n invasion of privacy has an actual negative effect on a plaintiff. It is not simply a bare procedural violation."); Firneno v. Nationwide Mktg. Servs., Inc. , No. 2:14-cv-10104, 2017 WL 85831, at *2–3 (E.D. Mich. Jan. 10, 2017) (finding standing where consumer had alleged that consumer report has been pulled for impermissible marketing purposes); Gillison v. Lead Express, Inc. , No. 3:16cv41, 2017 WL 1197821, at *7–9 (E.D. Va. Mar. 30, 2017) ("[U]nauthorized acquisitions of personal information would constitute invasions of privacy that qualify as concrete injuries sufficient to confer Article III standing."); Griffin v. Bank of Am. , 226 F. Supp. 3d 899, 904 (N.D. Ohio 2016) ("[T]he right to privacy contemplated by Congress under the FCRA is a substantive and, as such, the alleged violations committed by Defendants when they obtained Ms. Griffin's credit report without a permissible purpose constitute a concrete harm."); In re Ocwen Loan Servicing Litig. , 240 F. Supp. 3d 1070, 1076 (D. Nev. 2017) (finding standing because "credit inquiries that exceed the scope of § 1681b(a)(3) ... invade a plaintiff's right to privacy and result in concrete harm"); Kruckow v. Merchants Bank , No. 3:16cv41, 2017 WL 3084391, at *3 (D. Minn. July 19, 2017) ("[W]hen a plaintiff alleges that the person obtained the plaintiff's consumer report without a permissible purpose, the plaintiff has adequately alleged a concrete injury to her privacy."); Maldonado v. HSBC Mortg. Sys., Inc. , No. 2:16-cv-00784-JAD-VCF, 2017 WL 3496460, at *3–4 (D. Nev. Aug. 15, 2017) ("The Ninth Circuit has signaled that willfully pulling a consumer's credit report without a permissible reason is a concrete privacy injury that confers standing."); Rodriguez v. Your First Choice, L.L.C. , No. 2:16-cv, 2017 WL 4855406, at *4–5 (D. Nev. Oct. 25, 2017) (finding standing for impermissible purpose claim); Smith v. One Nevada Credit Union , No.: 2:16-cv-02156-GMN-NJK, 2017 WL 2803169, at *4 (D. Nev. June 27, 2017) ; Ruk v. Crown Asset Mgmt. , No. 1:16-CV-3444-LMM-JSA, 2017 WL 3085282, at *2–7 (N.D. Ga. Mar. 22, 2017).
1. The plaintiff's privacy right
First, the defendants argue that Equifax accessed only certain "limited" information from the NCTUE credit file, not the whole file. They claim that NCTUE did not release detailed, specific information about each of the plaintiff's telecommunication, pay TV, and utility service accounts, but instead released only numbers that summarize the plaintiff's payment history, the number of accounts, the type of accounts, his available credit, his credit used, and the length of his credit history.
Second, they claim that the specific type of "credit information" disclosed here does not implicate the privacy concerns that Congress sought to address. While a typical CRA collects credit information like mortgage accounts, auto loans, credit cards, bankruptcies, or public records, NCTUE collects payment information from telecommunications, pay TV, and utility service providers. This data, they claim, does not reflect sensitive information about a consumer's employment history, arrest records, drinking, marital discord, adulterous behavior, or any other aspect of a person's moral character.
Third, they claim that consumers have reduced privacy interests when only limited information, short of a traditional credit report, is at issue. They go on to assert that Congress amended the FCRA to allow prescreening, which permits the disclosure of certain information about consumers who meet certain credit criteria, without their authorization. And they argue numerous courts have held that the disclosure of this limited prescreening information does not establish an injury in fact.
But these arguments, which attempt to downplay the nature of the data at issue, all fail for the same reason: viewing the facts in the light most favorable to the plaintiff, the credit data disclosed in this case constituted a "consumer report" under the Act. The FCRA's definition of the term "consumer report" is very broad and includes "any written, oral, or other communication of any information" that has a "bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living." 15 U.S.C. § 1681a(d)(1). This broad definition rebuts the defendants' arguments that the information at issue here is not entitled to protection. The FCRA makes no distinction between the "utility credit data" maintained by NCTUE and the "traditional credit data" maintained by a more "traditional" CRA like Equifax. Nor does it require the disclosure of the full report or underlying data, as urged by the defendants.
Viewing the facts in the light most favorable to the plaintiff, the court concludes that the NCTUE data obtained by Equifax was a communication bearing on the plaintiff's creditworthiness, credit standing, or credit capacity. Accordingly, that data is entitled to the privacy protections afforded to credit reports under the FCRA, the defendants' analogies notwithstanding.
2. The invasion of the plaintiff's privacy right
The defendants also argue that whatever privacy interest the plaintiff had in his NCTUE report was not invaded because no Equifax employee or any other human saw the NCTUE data. According to them, the impermissible disclosure of the NCTUE data was the result of an automatic process in which Equifax's algorithm used this data, along with data from Equifax's own credit file on the plaintiff, to calculate an Insight Score. So, to the extent Equifax obtained the NCTUE data, it did so only in the abstract sense, and the plaintiff's privacy was not invaded in any real way. Section 1681b(f) prohibits a person from using or obtaining a consumer report for any purpose other than those specifically authorized under the statute. As discussed in the R & R, the fact that specific Equifax operators did not view any of the underlying NCTUE data does not alter the fact that Equifax itself obtained the plaintiff's NCTUE credit data and used it, in combination with Equifax's own credit data, to generate the Insight Score.
The defendants also claim that Equifax never "used" the plaintiff's NCTUE data. Even if this were true—it isn't, because Equifax used this data to calculate the Insight Score which it then attempted to sell to potential creditors—the statute says "shall not use or obtain" not use and obtain. 15 U.S.C. § 1681b(f) (emphasis added).
Furthermore, the court is not convinced that there is a difference between an Equifax employee viewing the underlying NCTUE data, or simply viewing the plaintiff's Insight Score. Credit scores themselves have been determined to be confidential, Albu v. Home Depot, Inc. , No. 1:15-cv-00412-ELR-JFK, 2016 WL 11544404, at *13 n. 26 (N.D. Ga. Nov. 2, 2016) (explaining, "Consumer reports typically contain private and identifying personal information such as ... [an individual's] credit score ...") report and recommendation adopted , 2017 WL 10752731 (N.D. Ga. Mar. 20, 2017), and viewing the facts in the light most favorable to the plaintiff, the court concludes the Insight Score is itself a credit score because it purports to represent the creditworthiness of an individual. So even if the court were to require that the confidential information must be viewed, not just obtained, the defendants' argument would still fail.
The defendants also point out that Equifax is not an end user but is instead a CRA subject to the same consumer protection restrictions as NCTUE. They argue that NCTUE understood that Equifax would not use NCTUE's data to take any action towards the plaintiff; instead, Equifax pulled the NCTUE data to calculate the Insight Score, which it could have provided to any end user—including the plaintiff—with a permissible purpose. But the two cases they rely on to support this CRA-to-CRA transfer argument are both inapposite to the facts at hand.
In Harmon v. RapidCourt, LLC , the plaintiff alleged that RapidCourt, a CRA, violated the FCRA when it provided certain criminal records to another CRA, Checkr, that ultimately sold a consumer report regarding the plaintiff to Uber, his prospective employer. Harmon v. RapidCourt, LLC , No. CV 17-5688, 2018 WL 6062355, at *1 (E.D. Pa. Nov. 20, 2018). Specifically, in the information RapidCourt provided Checkr were records relating to a criminal charge against the plaintiff that was over seven years old and had not resulted in a conviction. The plaintiff sued RapidCourt (under a different FCRA section than the one at issue here) and claimed to suffer from: "(a) embarrassment; (b) frustration; (c) fear of future reports to other future employers containing the same information; and (d) substantial administrative steps taken by Plaintiff to clear his [Checkr] file." Id. He did not, however, claim invasion of privacy, nor did he allege that the criminal records at issue had actually been provided by Checkr to Uber (who did in fact hire the plaintiff). Id. Under these facts, the Pennsylvania district court was "unwilling to find that the transmission of allegedly prohibited information from one consumer reporting agency to another is a concrete injury that is ‘real and not abstract.’ " Id. at *5. But central to this holding was the fact that the records at issue must be excluded only from some consumer reports—not all—and, therefore, this information was properly in the file that RapidCourt maintained on the plaintiff. Furthermore, Checkr had a permissible purpose in obtaining the plaintiff's RapidCourt file—which properly included the criminal records—since it did so on behalf of the plaintiff's prospective employer. And Checkr, although it possessed the criminal records, omitted them from the report it gave Uber, because that information was not permitted to be in the type of consumer report Uber requested.
CRAs may include in a consumer report records relating to criminal charges from more than seven years ago which did not result in a conviction if the report relates to: (1) a credit transaction involving, or which may reasonably be expected to involve, a principal amount of $150,000 or more; (2) the underwriting of life insurance involving, or which may reasonably be expected to involve, a face amount of $150,000 or more; or (3) the employment of any individual at an annual salary which equals, or which may reasonably be expected to equal $75,000, or more. 15 U.S.C. § 1681c(b)
The other case relied upon by the defendants, State v. Credit Bureau of Nashua, Inc. , 115 N.H. 455, 342 A.2d 640 (1975), is also distinguishable. There, New Hampshire brought suit against a private credit bureau, seeking to enjoin the sale of the bureau's files to individual consumers and the transfer of ownership or possession of the files to any other party. Id. at 640. The court held that the bureau may transfer the ownership or possession of its consumer credit files to another CRA, because such a transaction would not frustrate the main purposes of the FCRA, but that it may not transfer its files to any other person without complying with the provisions of the FCRA. Id. at 641.
Harmon is not a privacy case and instead analyzes whether a CRA may be overinclusive when providing a consumer report to another CRA for a permissible purpose. Nashua deals with the transfer of ownership of consumer files from one CRA to another. Neither addresses the central issue here, which is whether it is an invasion of privacy for a CRA to obtain a consumer file from another CRA when it has no permissible purpose for doing so. In the absence of relevant caselaw, the court agrees with the magistrate judge's reasoning that the FCRA provision at issue in this case unequivocally provides that a CRA may furnish a consumer report only under the listed circumstances, "and no other." 15 U.S.C. § 1681b(a) ; When drafting this section, Congress could have made an exception for CRA-to-CRA transfers but did not do so. Based on this, the plaintiff has presented credible evidence showing an actual unauthorized disclosure of at least some of his NCTUE credit information to Equifax. This disclosure amounts to an invasion of privacy, which is the type of injury that Congress sought to protect through the FCRA. As a result, the plaintiff has established standing to assert his claims, and the defendants' objection on this basis is OVERRULED.
B. Evidence of emotional distress
Next the defendants argue the R & R erroneously concluded that the plaintiff's own testimony describing his emotional distress is sufficient to withstand summary judgment. This conclusion, they claim, is contrary to the holdings of a majority of courts, including this one, that emotional distress must be shown with a degree of specificity and supported by corroborating evidence, such as the observations of others or medical or psychological evidence. They cite authority both from within and outside this circuit to support their position. The plaintiff, in response, directs the court to cases holding the opposite—that in a FCRA case, a plaintiff's testimony is sufficient to create a genuine issue of material fact as to whether he suffered emotional distress.
The Eleventh Circuit has not expressly determined whether a plaintiff in a FCRA case must provide corroborating evidence of emotional distress to survive summary judgment. The closest it came to answering this question was in Levine v. World Fin. Network Nat. Bank , where it concluded that a FCRA plaintiff seeking compensatory damages for emotional distress need not satisfy the restrictive common law rules for an intentional infliction of emotional distress ("IIED") or similar claim, i.e., show physical injury or out-of-pocket expenses. 437 F.3d 1118, 1124 (11th Cir. 2006). This is because emotional distress is merely a form of recoverable damages under the FCRA, while it is part of the prima facie case for an IIED claim. Id. The court stopped short of deciding whether the plaintiff could survive summary judgment solely on the strength of his own testimony, or if he still must set forth some sort of additional evidence.
Within this district, however, there is a line of cases affirmatively holding that a plaintiff need not offer evidence of emotional distress, aside from his own testimony, in order to survive summary judgment. Moore v. Equifax Info. Servs. LLC , 333 F. Supp. 2d 1360, 1365 (N.D. Ga. 2004) ("Such damages for mental distress are recoverable under the FCRA even if the consumer has suffered no out-of-pocket losses."); King v. Asset Acceptance, LLC , 452 F. Supp. 2d 1272, 1281 (N.D. Ga. 2006) ("In FCRA cases, a plaintiff is not required to produce evidence of emotional distress beyond his own testimony."); Bumpus v. Nat'l Credit Sys., Inc. , No. 1:16-CV-1209-TWT-JFK, 2017 WL 6994576, at *11 (N.D. Ga. Nov. 27, 2017), report and recommendation adopted , No. 1:16-CV-1209-TWT, 2018 WL 1229994 (N.D. Ga. Feb. 1, 2018) (holding that the defendant was not entitled to summary judgment on plaintiff's FCRA claim because "Plaintiff's testimony is sufficient to create a genuine issue of material fact as to whether she suffered emotional distress as a result of Defendant's actions"); McGhee v. Rent Recovery Sols., LLC , No. 1:17-CV-72-CC-JKL, 2018 WL 4850119, at *16 (N.D. Ga. July 6, 2018) ("Plaintiff's proffered testimony is admissible on the issue of her emotional distress, and Rent Recovery is therefore not entitled to summary judgment on this aspect of Plaintiff's negligent violation claim."); Smith v. E-Backgroundchecks.com, Inc. , 81 F. Supp. 3d 1342, 1366 (N.D. Ga. 2015) ("Plaintiff has provided his own testimony in support of his allegations, and the Court cannot say, as a matter of law, that plaintiff is not entitled to recover damages for emotional distress, especially since in FCRA cases, a plaintiff is not required to produce evidence of emotional distress beyond his own testimony.") (quotations omitted); Carlisle v. Nat'l Commercial Servs., Inc. , No. 1:14-CV-515-TWT-LTW, 2017 WL 1075088, at *15 (N.D. Ga. Feb. 22, 2017), report and recommendation adopted , No. 1:14-CV-515-TWT, 2017 WL 1049454 (N.D. Ga. Mar. 20, 2017), aff'd , 722 F. App'x 864 (11th Cir. 2018) (holding that an award for mental distress was appropriate under the FCRA based on plaintiff's testimony).
The defendants argue that Moore —the first in this line of cases—does not stand for the proposition that a plaintiff may survive summary judgment solely on his own testimony. As a result, the defendants contend that the cases which follow Moore misinterpret its holding and, therefore, were wrongly decided. This argument is without merit. Moore says, in relevant part:
Third, there is a genuine issue as to plaintiff's claims for damages for emotional distress and for damages arising from a mortgage lender's imposing a higher mortgage interest rate. Plaintiff testified that he suffered humiliation and embarrassment as a result of Equifax's inaccurate credit report. Such damages for mental distress are recoverable under the FCRA even if the consumer has suffered no out-of-pocket losses. [cit.] There is also evidence that, as a result of Equifax's publication of the inaccurate bad check report in plaintiff's credit file, a lender required plaintiff to pay a higher interest rate on his mortgage loan than he would have otherwise.
Moore , 333 F. Supp. 2d at 1365. Moore , in turn, relied on the Eleventh Circuit's decision in Jones v. CSX Transp. , which held that a plaintiff suing under the Federal Employers' Liability Act, seeking damages for personal injuries allegedly sustained as result of exposure to asbestos, need not produce evidence of objective manifestations of purported emotional distress to recover for his fear of contracting cancer, so long as his fear is "genuine and serious." 337 F.3d 1316, 1317 (11th Cir. 2003).
The defendants do not argue that the plaintiff's emotional distress is not genuine or serious, so the court will not address this issue.
The undersigned reads Moore to stand for the proposition that a plaintiff's "testi[mony] that he suffered humiliation and embarrassment as a result of Equifax's inaccurate credit report" is sufficient to survive summary judgment on the issue of emotional distress damages. While Moore and its progeny are not binding on this court, they are persuasive, and the defendants point to no binding authority to the contrary. Accordingly, the defendants' objection to the magistrate's conclusion that the plaintiff's own testimony describing his emotional distress is sufficient to withstand summary judgment is OVERRULED.
C. Willfulness
The defendants also object to the R & R's conclusion that there is an issue of fact as to the defendants' willfulness when purportedly violating the FCRA. To prove a claim for willful violation of the FCRA, a plaintiff must allege and establish that a CRA "either knowingly or recklessly violated the requirements of the [FCRA]." Levine v. World Fin. Network Nat'l Bank , 554 F.3d 1314, 1318 (11th Cir. 2009) (citing Safeco , 551 U.S. at 57–58, 127 S.Ct. 2201 ). A CRA recklessly violates the FCRA when its actions are "not only a violation under a reasonable reading of the statute's terms, but [the plaintiff] shows that the company ran a risk of violating the law substantially greater than the risk associated with a reading that was merely careless." Id. (quoting Safeco , 551 U.S. at 69, 127 S.Ct. 2201 ). In other words, to prove a reckless violation, a plaintiff must show that the defendant's interpretation was " ‘objectively unreasonable’ under either the text of the Act or ‘guidance from the courts of appeals or the Federal Trade Commission that might have warned [the defendant] away from the view it took.’ " Id. (quoting Safeco , 551 U.S. at 68–69, 127 S.Ct. 2201 ). Conversely, "[a] consumer reporting agency that adopts an objectively reasonable reading of the Act does not knowingly violate the Act." Pedro v. Equifax, Inc. , 868 F.3d 1275, 1280 (11th Cir. 2017).
Damages for willful violations of the FCRA come with both statutory and punitive damages, 15 U.S.C. § 1681n(a)(2), while damages for negligent violations are limited to actual damages, costs, and attorney's fees. 15 U.S.C. § 1681o(a).
Here, the defendants claim they reasonably thought transmitting the NCTUE data as described above was not construed as the transmission of a "consumer report" under the FCRA, for which § 1681b would apply. Their interpretation, the defendants maintain, was not unreasonable for two reasons. First they argue that it was reasonable to assume the NCTUE data, accessed as it was here and never used for the purpose of extending credit, are not "consumer reports." Defendants also contend that the contractual agreement between the defendants establishes that Equifax was acting as a "reseller" when it obtained the data from NCTUE and calculated the Insight Score, and thus no permissible purpose was required.
Section 1681b addresses the permissible purposes of consumer reports.
1. Defendants' belief that the NCTUE data was not a consumer report
Under the FCRA, a consumer report is "any communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for (A) credit or insurance to be used primarily for personal, family, or household purposes; (B) employment purposes; or (C) any other purpose authorized under section 1681b ...." 15 U.S.C. § 1681a(d)(1). At issue here is the "used or expected to be used or collected" language.
The defendants' first argument is that they reasonable believed the NCTUE data—summaries of the plaintiff's account payment history, the number of accounts, the type of accounts, his available credit, his credit used, and the length of his credit history—did not constitute a consumer report because it was neither used nor expected to be used by Equifax for the purpose of any credit, insurance, or employment decision.
To support their position, the defendants cite to two circuit court of appeals cases. The first, Wantz v. Experian Info. Sols. , sheds no light on the issue before the court, as the Seventh Circuit's decision turned on the fact there was no communication of information; why the information was used or collected was not at issue. 386 F.3d 829, 833 (7th Cir. 2004), as amended (Nov. 16, 2004), and abrogated by Safeco , 551 U.S. at 59, 127 S.Ct. 2201 ("In short, where there is no evidence of disclosure to a third party, the plaintiff cannot establish the existence of a consumer report. Without such a report, there could be no duty to follow reasonable procedures regarding the report, nor could damages flow from a breach of that duty.").
More on point is the defendants' second case, Hovater v. Equifax, Inc. , 823 F.2d 413 (11th Cir. 1987). There, the plaintiff's home was destroyed by fire, and it was undisputed that it was arson. Id. at 414. The plaintiff filed a proof of loss with his insurer, who, in light of the circumstances, sought to obtain background information about the plaintiff for use in evaluating the claim and therefore hired Equifax. Id. Upon learning that Equifax disclosed information about him to his insurer, the plaintiff filed suit against Equifax for violating the FCRA by disclosing his consumer report without a permissible purpose. Id. The district court granted Equifax's motion to dismiss, which the Eleventh Circuit affirmed while holding, "it is clear that a transference of information by a credit reporting agency to an insurance company for the sole intended purpose of evaluating a claim for insurance benefits under an existing policy is not a ‘consumer report,’ " id. at 418, and because "[t]he express language of the Act does not reach reports for the purpose of evaluating claims for benefits, accordingly, we hold that such reports are not governed by the FCRA." Id. at 419.
The defendants are correct that Hovater stands for the proposition that regulated consumer reports consist of information provided from a CRA about a consumer for use in making eligibility determinations about credit, insurance, or employment. And there, it was clear the information collected was to be used in an insurance investigation, moving it outside the scope of the FCRA. But the defendants' argument focuses solely on the "used or expected to be used" language of the statute and ignores the third "collected" requirement.
Much more on point are the cases cited by the plaintiff, Yang v. Gov't Employees Ins. Co. , 146 F.3d 1320, 1325 (11th Cir. 1998) and St. Paul Guardian Ins. Co. v. Johnson , 884 F.2d 881, 884–85 (5th Cir. 1989), which both hold that, in addition to the "used or expected to be used" language, the purpose for which the information was collected also governs whether the report is a ‘consumer report’ under the FCRA. Yang , id. ("Under the plain language of the FCRA, a ‘communication of information’ is a ‘consumer report’ if any one of the three components in the Purpose clause is met. Thus, [the plaintiffs' information] is a protected ‘consumer report’ because Equifax compiled it for credit-related purposes and expected it to be used for such purposes.").
In Yang , the plaintiff's insurer suspected fraud and was investigating an insurance claim submitted by the plaintiff. Id. at 1321. As part of the investigation, the insurer obtained from Equifax a preexisting, non-customized document containing the subject's name, recent addresses, social security number, date of birth and recent employers, as well as a list of all the entities that had inquired about the subject's credit history for the previous two years, such as lending institutions and collection agencies. Id. at 1322. The plaintiff filed suit, claiming that his insurer's actions violated the FCRA, and the district court, relying on Hovater , concluded that the information at issue was not a consumer report because it was not used to make a credit-related decision. Id. But on appeal the Eleventh Circuit held that the communication of the data—which was compiled for credit-related purposes—was a consumer report under the FCRA because it was a communication by a CRA bearing on a consumer's credit worthiness which was collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for credit. It did not matter that, in this specific instance, the data was not actually used for a credit-related purpose. Id. at 1325. What mattered to the Eleventh Circuit was the reason the data was collected in the first place.
Viewing the facts in the light most favorable to the plaintiff, the court concludes that NCTUE collected the data at issue for credit-related purposes and expected it to be used for such purposes. Under Yang , it is irrelevant that Equifax was not actually using it to make such a decision. Because this information was "collected in whole or in part for the purpose of serving as a factor in establishing the [plaintiff's] eligibility for [credit]," 15 U.S.C. § 1681a(d)(1), the defendants' interpretation of the FCRA is contrary to both Yang and the plain language of the statute. Accordingly, it is unreasonable.
2. Defendants' belief that Equifax was a "reseller" under the FCRA
The defendants next claim that their contractual agreement provides that Equifax was acting as a "reseller" with respect to its access to the NCTUE data. The FCRA defines "reseller" as a CRA that "assembles and merges information contained in the database of another consumer reporting agency or multiple consumer reporting agencies concerning any consumer for purposes of furnishing such information to any third party" but "does not maintain a database of the assembled or merged information from which new consumer reports are produced." 15 U.S.C. § 1681a(u). This definition, the defendants claim, suggests that the disclosure of information from a CRA to a reseller does not require a permissible purpose under § 1681b ; only the disclosure of information from the reseller to a third party implicates § 1681b. They also submitted guidance from the FTC to support their position.
According to an FTC Staff Report from 2011, "a CRA may furnish a consumer report to another CRA, so that the second CRA can sell such reports to subscribers with a permissible purpose. In these circumstances, the receiving CRA must carry out the responsibilities of companies that procure reports for resale, as set forth in section 607(e) [1681e(e) ]. If the CRA meets the definition of ‘reseller,’ it must also comply with provisions imposed on ‘resellers.’ "
But the defendants' argument that they reasonably believed they were a reseller is undercut by a further reading of the Act. Importantly, a reseller "may not procure a consumer report for purposes of reselling the report (or any information in the report) unless the [reseller] discloses to the consumer reporting agency that originally furnishes the report (A) the identity of the end-user of the report (or information); and (B) each permissible purpose under section 1681b of this title for which the report is furnished to the end-user of the report (or information)." 15 U.S.C. § 1681e(e)(1). See also NATIONAL CONSUMER LAW CENTER, FAIR CREDIT REPORTING § 2.6.3.3 (9th ed.) ("A reseller may not procure a report from a CRA without disclosing to the CRA the identity of the end-user of information in the report and each permissible purpose for which the information is furnished to the end-user.").
The record shows that when NCTUE learned that Equifax was generating Insight Scores on the consumers using NCTUE's data, which was causing a hit on the consumer's NCTUE file, it instructed Equifax to cease this practice. This leads to the inference that Equifax was neither providing NCTUE with the identity of the end-user of the report or information, nor stating each permissible purpose for which it was obtaining the report or information. Because the evidence, viewed in the light most favorable to the plaintiff, shows Equifax was not otherwise complying with the Act's reseller requirements, the court concludes that the defendants' position that Equifax believed it was a reseller under the Act to be unreasonable.
The defendants' objection to the magistrate's conclusion that they are not entitled to summary judgment on the issue of willfulness is OVERRULED.
VI. Conclusion
As explained above, the defendants' objections to the R & R are OVERRULED. The defendants' motion for summary judgment [Doc. No. 53] is DENIED. After carefully considering the remainder of the R & R [Doc. No. 76] and finding no error, the court receives it with approval and the plaintiff's motion for summary judgment [Doc. No. 48] is also DENIED.
Furthermore, the parties filed a joint motion to stay [Doc. No. 82] informing the court that they have scheduled a mediation for March 27, 2020, and request that the court stay any case-related deadlines through April 1, 2020. That motion is GRANTED. The parties are ORDERED to file, by April 1, 2020, a status report informing the court of the outcome of the mediation. If the mediation is unsuccessful, the parties are further ORDERED to file their proposed consolidated pretrial order by May 1, 2020. See LR 16.4, NDGa.
SO ORDERED this 19th day of March, 2020.