797 F.3d 449
7th Cir.2015Background
- In July 2013 burglars stole four desktop computers from Advocate Health and Hospitals Corporation’s Illinois administrative office, containing unencrypted private data for ~4 million patients. Six affected patients sued as a putative class.
- Plaintiffs asserted willful and negligent violations of the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., and state-law claims (negligence, invasion of privacy). District court dismissed the FCRA claims and found four plaintiffs lacked standing; plaintiffs appeal the FCRA dismissal.
- Two plaintiffs (Benkler and Oliver) had concrete, imminent injuries from attempted misuse and thus unquestioned Article III standing; at least one plaintiff’s standing sufficed to secure jurisdiction.
- Plaintiffs alleged Advocate is a “consumer reporting agency” that failed to maintain reasonable procedures under 15 U.S.C. § 1681e(a), seeking statutory damages for willful violations.
- The crux of the dispute: whether Advocate falls within the statutory definition of a “consumer reporting agency” (requires assembling information for fees or on a cooperative nonprofit basis, regularly, and for the purpose of furnishing consumer reports to third parties).
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing of at least some plaintiffs | Plaintiffs contend they suffered concrete injuries or imminent misuse risk (all six) | Advocate argued four plaintiffs’ injuries speculative because no misuse yet | Two plaintiffs had standing; jurisdiction secure; court need not resolve standing of remaining four |
| Applicability of FCRA’s reasonable-procedures duty (is Advocate a “consumer reporting agency”?) | Advocate assembles and shares patient data for fees or on a cooperative nonprofit basis and furnishes reports to third parties, bringing it within §1681a(f) | Advocate is a health-care provider that compiles patient info for treatment and billing, not for fees for reporting or to furnish consumer reports | Plaintiffs failed to plausibly allege Advocate is a consumer reporting agency; FCRA claim dismissed |
| First prong — ‘‘for monetary fees, dues, or on a cooperative nonprofit basis’’ | Payments from insurers/government for transmission of patient data show fees or cooperative nonprofit sharing | Payments are for healthcare services, not for assembling/transmitting data; alleged programs are internal and not plausibly nonprofit data-sharing for reporting | Allegations insufficient; Advocate does not assemble information ‘‘for monetary fees’’ nor sufficiently allege cooperative nonprofit basis |
| Third prong — ‘‘for the purpose of furnishing consumer reports to third parties’’ / whether transmitted info is a ‘‘consumer report’’ | Transmissions to insurers/government serve eligibility/pricing and thus are furnishing consumer reports | Information concerns Advocate’s transactions/experiences with its own patients and fits statutory exclusion for reports about transactions with the person making the report | Information falls within the statutory exclusion; Advocate not furnishing consumer reports for third-party credit/insurance determinations |
Key Cases Cited
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007) (pleading must state a plausible claim)
- Ashcroft v. Iqbal, 556 U.S. 662 (2009) (legal conclusions insufficient at pleading stage)
- Frederick v. Marquette Nat’l Bank, 911 F.2d 1 (7th Cir. 1990) (bank not a consumer reporting agency; statute inapplicable)
- Mirfasihi v. Fleet Mortg. Corp., 551 F.3d 682 (7th Cir. 2008) (mortgage bank not a consumer reporting agency; FCRA claim meritless)
- DiGianni v. Stern’s, 26 F.3d 346 (2d Cir. 1994) (retailer that transmits info about its own customers not a consumer reporting agency)
- Rush v. Macy’s N.Y., Inc., 775 F.2d 1554 (11th Cir. 1985) (retailer merely furnishing information to a credit agency is not itself a consumer reporting agency)