355 F. Supp. 3d 731
E.D. Ill.
2019

Joan B. Gottschall, United States District Judge Plaintiff Terrace Browner ("Browner") has brought a one count complaint, ECF No. 1, alleging that defendant, American Eagle Bank ("defendant"), illegally accessed her individual and personal credit file from Trans Union, a "consumer reporting agency" as defined in 15 U.S.C. § 1681a(f), in violation of 15 U.S.C. § 1681b (hereinafter the Fair Credit Reporting Act or FCRA). Plaintiff alleges that at the time, she had no personal business relationship with defendant; defendant had no information in its possession to suggest that plaintiff owed defendant a debt or was responsible to pay a debt to defendant; and plaintiff did not consent to defendant's accessing her individual and personal credit report: in short, that defendant had no legitimate business reason for accessing the report and impermissibly obtained information relating to plaintiff's personal and individual credit accounts including plaintiff's payment history, individual credit accounts, and credit worthiness. See Compl. ¶¶ 9-26. By accessing plaintiff's credit report, defendant obtained personal information about plaintiff including her current and past addresses, birthdate, employment history, and telephone numbers. Compl. ¶ 25. Plaintiff alleges that unknown employees, representatives, and/or agents of defendant viewed this information, which she asserts constituted a publication of her personal information. Compl. ¶ 26. Moreover, plaintiff alleges that defendant's accessing of plaintiff's credit report will be displayed on plaintiff's credit report for two years. Compl. ¶ 26. Plaintiff alleges that she has suffered "financial and dignitary harm arising from the [d]efendant's review of her personal information and her credit information and an injury to her credit rating and reputation." Compl. ¶ 29.

Citing Spokeo, Inc. v. Robins , --- U.S. ----, 136 S.Ct. 1540, 1549, 194 L.Ed.2d 635 (2016), defendant moves to dismiss, arguing that plaintiff lacks Article III standing, specifically, injury in fact. Defendant argues that plaintiff alleges a bare procedural violation which Spokeo makes plain does not establish Article III standing. Defendant asserts that while plaintiff alleges an unspecified "injury to her credit rating and reputation," this allegation is totally conclusory and must be disregarded. Mem. Supp. Mot. to Dismiss 2, ECF No. 11 (quoting Compl. ¶ 29). For the reasons discussed below, the court concludes that the invasion of privacy of which plaintiff complains is a sufficient injury in fact to establish Article III standing and denies the motion to dismiss.

The " 'irreducible constitutional minimum' of standing" consists of three elements. Spokeo , 136 S.Ct. at 1547 (quoting Lujan v. Defenders of Wildlife , 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). They are injury in fact, which is at issue here, causation, and redressability. Id. (citations omitted). The burden to establish each element is on the plaintiff. Id. (citing FW/PBS, Inc. v. Dallas , 493 U.S. 215, 231, 110 S.Ct. 596, 107 L.Ed.2d 603 (1990) ). "To meet this burden at the pleading stage, 'the plaintiffs' complaint must contain sufficient factual allegations of an injury resulting from the defendants' conduct, accepted as true, to state a claim for relief that is plausible on its face.' " Moore v. Wells Fargo Bank, N.A. , 908 F.3d 1050, 1057 (7th Cir. 2018) (quoting Diedrich v. Ocwen Loan Servicing, LLC , 839 F.3d 583, 588 (7th Cir. 2016) ). The Seventh Circuit described injury in fact in Groshek v. Time Warner Cable, Inc. , 865 F.3d 884, 886 (7th Cir. 2017) :

To establish injury in fact, Groshek must show that he "suffered 'an invasion of a legally protected interest' that is 'concrete and particularized' and 'actual or imminent, not conjectural or hypothetical.' " To be "concrete," an injury "must actually exist;" it must be "real," not "abstract," but not necessarily tangible. In determining whether an alleged intangible harm constitutes a concrete injury in fact, both history and Congress' judgment are important.

(citations omitted). As explained in Spokeo :

Because the doctrine of standing derives from the case-or-controversy requirement, and because that requirement in turn is grounded in historical practice, it is instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.

136 S.Ct. at 1549.

In addition to considering the status of the intangible injury alleged historically, "because Congress is well positioned to identify intangible harms that meet minimum Article III requirements, its judgment is also instructive and important." Id. The Court in Spokeo noted explicitly that "Congress may 'elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.' " Id. (quoting from Lujan , 504 U.S. at 578, 112 S.Ct. 2130 ). Moreover, Congress has the power to define injuries and articulate chains of causation giving rise to cases and controversies that did not previously exist. Id. But the fact that a statute grants a person a statutory right and the right to sue does not necessarily mean that Article III is satisfied. "Article III standing requires a concrete injury even in the context of a statutory violation." Id. "[A] bare procedural violation, divorced from any concrete harm," is not sufficient. Id. Rather, the plaintiff must show that the statutory violation at issue presents an appreciable risk of harm to the underlying concrete interest that Congress was trying to protect in enacting the statute. Id.

There is little consistency in the lower court cases addressing the question of standing to bring FCRA claims involving the unauthorized access of a plaintiff's credit information. Appellate guidance is scarce. The Seventh Circuit has not addressed the issue. It has, however, addressed related issues on a few occasions, perhaps most importantly in Gubala v. Time Warner Cable, Inc. , 846 F.3d 909 (7th Cir. 2017).

Gubala involved a subsection of the Cable Communications Policy Act which required a cable operator to destroy personally identifiable consumer information if no longer necessary for the purpose for which it was collected. See 47 U.S.C. § 551(e). Gubala was a Time Warner subscriber for two years but then cancelled his subscription. Gubala , 846 F.3d at 910. Eight years later, he learned from an inquiry to Time Warner that it had kept his information in its possession. Id. Although recognizing that there was a risk of harm in such a situation, the court held that in the absence of an allegation that Time Warner had given away, leaked, or lost his information, Gubala had suffered no concrete injury and lacked standing to sue. Id. at 911-13. Nor had Gubala alleged a legitimate privacy violation, since there was no allegation of any dissemination of the information. Id. at 912.

Gubala is referred to as a "retention" case. E.g. , Haddad v. Midland Funding, LLC , 255 F.Supp.3d 735, 738 (N.D. Ill. 2017) ;

Pavone v. Law Offices of Anthony Mancini, Ltd. , 2017 WL 1197098, at *4 (N.D. Ill. Mar. 31, 2017). It is different from the case at bar, most significantly, in that the defendant in Gubala obtained plaintiff's confidential information for a permissible purpose but retained it longer than the statute allowed. See Pavone , 2017 WL 1197098, at *4 (distinguishing Gubala on a similar ground).

The Seventh Circuit again addressed the issue of standing in the FCRA context in Groshek v. Time Warner Cable, Inc. , 865 F.3d 884 (7th Cir. 2017). In Groshek , the plaintiff applied for a job with Time Warner, as well as with another company, and the job application, while informing him that a consumer report might be procured in making the application decision, failed to make that disclosure "in a document that consists solely of the disclosure," as required by a provision of the FCRA, 15 U.S.C. § 1681b(b)(2)(A)(i). Groshek , 865 F.3d at 885-86. Noting that Groshek did not allege that he did not receive a disclosure, nor that he was confused by it, nor that he failed to understand that a consumer report would be procured, the court held that the mere allegation that the disclosure form contained extraneous information, with no indication that plaintiff had failed to understand the disclosure as it was provided to him, was a mere statutory violation, removed from any concrete or appreciable risk of harm. Id. at 888-89. Plaintiff therefore lacked standing to sue.

In Robertson v. Allied Solutions, LLC , 902 F.3d 690 (7th Cir. 2018), the Seventh Circuit again addressed the intersection of standing requirements and the FCRA but this time, reached a different conclusion. Plaintiff, on behalf of a class, alleged that she had applied for a position with Allied Solutions ("Allied") which offered her a job but ran a background check before she reported for work. Id. at 693. Based on the information the background check revealed, Allied revoked the job offer. Plaintiff complained both that the disclosure forms Allied provided were not clear or conspicuous, as the FCRA required, and that the forms included extraneous information. Id. at 694. This claim was doomed by Groshek . Id. But 15 U.S.C. § 1681b(b)(3)(A) also provides that when an employer relies in any measure on a background check report, it must provide the applicant both with a copy of the report and with a written description of her rights, to permit the job applicant to correct errors or provide context for the information in the report. Allied failed to do either. See id. As to this claim, that Allied took an adverse job action against plaintiff without providing her with the report or a statement of her rights, the court held that plaintiff had standing to sue. Id. at 695-97. The statute requires disclosure of the report before any adverse action is taken. Id. at 696. "This unique pre-adverse action requirement assures that the applicant will have a chance to review the actual document on which the employer relied, and that she can do so with time to respond to unfavorable information." Id. The statute does not limit the range of possible disputes to accuracy or completeness. Rather, the statute is concerned not only with accuracy but with giving the consumer an opportunity to invoke the discretion of the decisionmaker at a time when it might matter. Id. "[W]hat matters is that Robertson was denied information that could have helped her craft a response to Allied's concerns." Id. at 697. What Allied divulged was insufficient under the Act, and its failure caused Robertson a concrete injury.

These cases, while hardly providing a bright line applicable to this case, indicate that this court must look carefully at the statutory purposes and assess whether what plaintiff complains about invaded a concrete interest, not just a procedural one. On that basis, this court believes that plaintiff's allegation, that defendant accessed her credit report from Trans Union without her consent and with no legitimate business reason to do so, adequately alleges a concrete injury sufficient to confer standing under Spokeo . The court's reasons are as follows.

First, 15 U.S.C. § 1681b is almost singularly focused on ensuring that the circumstances under which a third party that is not a consumer reporting agency can access an individual's consumer report are carefully limited. See § 1681B(a). In most cases, the consumer must authorize the disclosure. See, e.g. , § 1681b(b)(2)(A), § 1681b(a)(3)(A)-(F). Critically, with respect to a credit or insurance transaction not initiated by the consumer, the statute provides specific requirements that must be satisfied. And most important for the present case, the statute contains this explicit prohibition:

(f) Certain use or obtaining of information prohibited
A person shall not use or obtain a consumer report for any purpose unless-
(1) the consumer report is obtained for a purpose for which the consumer report is authorized to be furnished under this section; and
(2) the purpose is certified in accordance with section 1681e of this title by a prospective user of the report through a general or specific certification.

15 U.S.C. § 1681b(f) ; see also § 1681b(a)(4).

Congress could not have made clearer that this statute was intended to protect consumer privacy by preventing the dissemination of consumer credit information to third parties, except under carefully specified conditions. Plaintiff here alleges that defendant accessed her information for no permissible purpose, a clear violation of the statute if proven.

Spokeo counsels that in determining whether an intangible injury (as this clearly is) causes injury in fact, the judgment of Congress is relevant but not determinative. See Spokeo , 136 S.Ct. at 1549. History must also be considered.

As for the judgment of Congress, Congress could not have been clearer that it intended to provide fulsome protections to ensure that confidential credit information was released by credit reporting agencies only under carefully drawn conditions. Those conditions were designed to make sure that, except where Congress made a contrary judgment, the consumer's authorization is required before disclosure occurs and that any release is justified by a legitimate business or governmental purpose. See § 1681b(f). When it enacted the FCRA, Congress found, among other things, that "[t]here is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy." 15 U.S.C. § 1681(a)(4). Reading this statute, the court has no doubt that Congress intended to protect a consumer's credit information to the greatest extent practicable and to prohibit access where there was no legitimate business or statutorily-allowed purpose. See United States v. Bormes , 568 U.S. 6, 7, 133 S.Ct. 12, 184 L.Ed.2d 317 (2012) (The Fair Credit Reporting Act has as one of its purposes to "protect consumer privacy" (quotation and citation omitted) ); Cole v. U.S. Capital , 389 F.3d 719, 723 (7th Cir. 2004) ("In [ § 1681 ] Congress made it clear that the FCRA is designed to preserve the consumer's privacy in the information maintained by consumer reporting agencies.").

History in this instance leads to the same conclusion. In an analogous situation, the district court in Minnesota considered whether, under Spokeo , the plaintiff had standing to complain when she learned that a number of her coworkers had accessed her confidential, password-protected, driver's license information. The defendants claimed that accessing plaintiff's information, without more, was a mere statutory violation and not an injury in fact. The district court disagreed. Citing the case of Potocnik v. Carlson , 2016 WL 3919950, at *2-3 (D. Minn. July 15, 2016), Judge Montgomery wrote:

In Potocnik , the district court held that an alleged DPPA [Driver's Privacy Protection Act] violation constitutes a concrete injury because "the type of harm at issue-the viewing of private information without lawful authority-has a close relationship to invasion of the right to privacy, a harm that has long provided a basis for tort actions in the English and American courts." In so holding, the court noted that the Supreme Court does not require that the harm caused by a statutory violation be identical to the type of harm that would give rise to a recovery under common law, only that the harm bear a "close relationship" to a harm that has traditionally served as a basis for suit in English and American courts.

Engebretson v. Aitkin Cty. , 2016 WL 5400363, at *4 (D. Minn. Sept. 26, 2016) (internal citations and quotation omitted).

A similar result was reached in a FCRA case, Perrill v. Equifax Info. Servs., LLC , 205 F.Supp.3d 869 (W.D. Tex. 2016). Plaintiffs David and Gregory Perrill were officers of Wand Corporation ("Wand"), which did business in Texas. Id. at 871. Wand fell behind on its tax payments and reached an agreement with the Texas Comptroller on a repayment plan. Id. Plaintiff officers did not, however, sign or guarantee the agreement. Id. Pursuant to a contract between the consumer reporting agency, Equifax, and the Texas Comptroller, Equifax provided the plaintiff officers' consumer credit reports to the Comptroller, which represented that it was using the reports to collect taxes. Id. Plaintiffs sued, alleging that Equifax had willfully violated the FCRA, 15 U.S.C. § 1681b, by providing plaintiffs' credit reports to the Comptroller without reason to believe the Comptroller had a permissible purpose and for failing to maintain reasonable procedures to limit the provision of such reports to the legislatively permitted purposes. Id.

The district court denied defendant's motion to dismiss for lack of standing under Spokeo . It found that the invasion of privacy involved in the unauthorized access to plaintiff's credit information is closely related to the kind of injury which has traditionally been regarded as providing a basis for a lawsuit, as the common law has long recognized the right of an individual to control information concerning himself. Id. at 873 (citing U.S. Dept. of Justice v. Reporters Comm. for Freedom of Press , 489 U.S. 749, 763, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989) (other citation omitted) ). Moreover, an invasion of privacy is similar to the harm involved in the traditional tort of intrusion upon seclusion which holds a person liable for intentionally intruding, physically or otherwise, upon the solitude or seclusion of another or his private affairs. Id. (citing Restatement (Second) of Torts § 652B (1977) ). This, the court held, coupled with Congress' judgment in the FCRA to provide consumers a right to privacy in their credit reports, makes clear that an invasion of privacy within the meaning of the FCRA is a concrete harm that meets the injury in fact requirement for standing. Id.

Numerous cases reach a similar conclusion. See, e.g. , In re Ocwen Loan Servicing LLC Litigation , 240 F.Supp.3d 1070, 1076 (D. Nev. 2017) ("once an individual terminated her relationship with a lender it was no longer permissible for the lender to access the account" because the lender would have no reason for doing so); Kruckow v. Merchants Bank , 2017 WL 3084391, at *3 (D. Minn. July 19, 2017) ("Congress has allowed a person to access consumer reports but only when the person has a permissible purpose....Thus, when a plaintiff alleges that the person obtained the plaintiff's consumer report without a permissible purpose, the plaintiff has adequately alleged a concrete injury to her privacy.")1 ; Gillison v. Lead Express, Inc. , 2017 WL 1197821, at *8 (E.D. Va. March 30, 2017) ("a consumer who alleges that a defendant has obtained his or her personal information without authorization, like the Plaintiffs here, has alleged a concrete informational injury"). See also Santangelo v. Comcast Corp. , 341 F. Supp. 3d 830, 835 (N.D. Ill. 2018) (finding standing at summary judgment where Comcast obtained plaintiff's credit information without a permissible purpose and plaintiff might be able to show that his credit rating was lowered as a result.

Clearly, there are cases that reach the opposite conclusion. See, e.g. , Oneal v. First Tenn. Bank , 2018 WL 1352519, at *6-13 (E.D. Tenn. March 15, 2018) and Bultemeyer v. CenturyLink, Inc. , 2017 WL 634516, at *3-4 (D. Ariz. Feb. 15, 2017). These cases analogize the issue of unauthorized access to the retention problem identified in Gubala, supra , but in this court's view, they are not analogous. Oneal involved a defendant who initially obtained plaintiff's credit information legitimately, when plaintiff borrowed money from defendant. 2018 WL 1352519, at *2. But after plaintiff's debt was discharged in bankruptcy, defendant did not simply hold on to the information, as occurred in Gubala and other retention cases. Rather, it made an unauthorized credit inquiry, id. , something that did not occur in Gubala. Finding the case like Gubala and other retention cases, the court dismissed it for lack of standing. See id. at *7. In Bultemeyer , the court similarly viewed the retention cases as controlling, but the case was not about retention. See 2017 WL 634516, at *2-4. Rather, in Bultemeyer , plaintiff made inquiries of defendant's website, and pursuant to defendant's standard procedures, defendant ran a credit report once plaintiff had inputted all relevant information but before plaintiff made a purchase (she decided not to). See id. at *1. This court does not suggest that either of these cases was incorrectly decided, but merely that Gubala does not support them.

This court need not reach the complex issues involved in Oneal and Bultemeyer . The claim here is much simpler: unauthorized access for no permissible purpose. The clear intent of Congress to preclude such access, taken in connection with the long legal history of protecting the privacy of confidential information, makes clear that the complaint alleges enough to carry the plaintiff's burden of alleging standing, including injury in fact. This case survives Spokeo . Defendant's motion to dismiss, ECF No. 10, is denied.

Notes

This decision was vacated to the extent it had dismissed certain of plaintiff's claims. To the extent it found that plaintiff had standing to sue, the opinion cited above was not disturbed. See Kruckow v. Merchants Bank , 2017 WL 5990125 (D. Minn. Dec. 1, 2017).
Read the detailed case summary