26 F.4th 1092
9th Cir.2022Background
- Plaintiffs (Tailford, Buckles, Ruderman) received §1681g disclosures from Experian after a 2017 data breach and alleged the disclosures were incomplete.
- Experian maintains a credit database (File One) and separate marketing/internal databases (ConsumerView/OmniView and Admin Reports); ConsumerView contains behavioral and aggregate marketing attributes and is sold to third parties.
- Plaintiffs alleged Experian omitted from §1681g disclosures: ConsumerView behavioral data (and identities of recipients), certain "soft" inquiries, identities of parties procuring reports (including affiliates/Alteryx), and dates employment data were reported.
- The district court denied remand, found plaintiffs had standing at the pleading stage, but dismissed the FAC with prejudice, holding none of the alleged omitted data was required to be disclosed under §§1681g(a)(1), (3), or (5).
- The Ninth Circuit affirmed: plaintiffs pleaded a concrete informational/privacy injury sufficient for Article III standing, but affirmed dismissal because the challenged categories of data are not within the FCRA’s disclosure obligations.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing / remand | Plaintiffs lacked evidence of concrete injury; Experian failed to show standing for removal | Experian: plaintiffs alleged loss of informational/privacy control from nondisclosure; pleading-stage allegations suffice | Court: plaintiffs alleged concrete informational/privacy injury under Spokeo framework; standing exists and remand denial affirmed |
| Whether ConsumerView behavioral/marketing data must be disclosed under §1681g(a)(1) | ConsumerView data (some sourced from File One) is part of a consumer's "file" and thus all information must be disclosed | Experian: ConsumerView is aggregate/marketing data not used in consumer reports and not part of the consumer "file" for §1681g | Court: ConsumerView data is aggregate/marketing, not a consumer report or part of the individual "file" that "might be furnished"; not required to be disclosed |
| Whether soft inquiries and identities of parties procuring reports must be disclosed under §§1681g(a)(1),(3),(5) | Omitted soft inquiries and procurer identities (including affiliates/Alteryx) should be included in §1681g disclosures | Experian: soft inquiries are not included in consumer reports; §1681g(a)(3) requires disclosure only where a party actually procured a consumer report; §1681g(a)(5) covers only uninitiated inquiries tied to credit/insurance transactions | Court: soft inquiries are not part of the file and need not be disclosed; §1681g(a)(3) applies only to parties that procured a consumer report (and within 1-year window); §1681g(a)(5) limited to certain firm-offer/transaction inquiries—allegations insufficient |
| Whether dates on which employment data were reported must be disclosed under §1681g(a)(1) | Reporting dates appear in Admin/Employment Insight reports and should be part of the file disclosure | Experian: reporting dates are not information that "might be furnished" in a consumer report and have no bearing on credit eligibility | Court: reporting-dates are not the kind of information used to determine credit/insurance/employment eligibility and need not be disclosed |
Key Cases Cited
- Safeco Ins. Co. of Am. v. Burr, 551 U.S. 47 (2007) (FCRA enacted to ensure fair, accurate credit reporting and protect consumer privacy)
- TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (2021) (distinguishes concrete harms from mere procedural violations in FCRA disclosure contexts)
- Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) (standing requires concrete and particularized injury; procedural violations may suffice if Congress identified a concrete interest)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (standing and injury-in-fact framework)
- Robins v. Spokeo, Inc., 867 F.3d 1108 (9th Cir. 2017) (two-step test for concreteness of alleged statutory harms under FCRA)
- Syed v. M-I, LLC, 853 F.3d 492 (9th Cir. 2017) (FCRA procedural rule violation conferred standing where procedure protected substantive privacy/control interests)
- Shaw v. Experian Info. Sols., Inc., 891 F.3d 749 (9th Cir. 2018) (definition of consumer "file" includes information that might be furnished in a consumer report)
- Cortez v. Trans Union, LLC, 617 F.3d 688 (3d Cir. 2010) (interpretation of "file" and what information may be furnished in consumer reports)
- Gillespie v. Trans Union Corp., 482 F.3d 907 (7th Cir. 2007) (caution against an interpretation of "file" that would render enumerated §1681g categories duplicative)