THERESA TAILFORD; SANFORD BUCKLES; JEFFREY C. RUDERMAN, and all similarly situated individuals v. EXPERIAN INFORMATION SOLUTIONS, INC.
No. 20-56344
United States Court of Appeals for the Ninth Circuit
March 1, 2022
D.C. No. 8:19-cv-02191-CJC-KES
FOR PUBLICATION
Appeal from the United States District Court for the Central District of California Cormac J. Carney, District Judge, Presiding
Argued and Submitted November 18, 2021 Pasadena, California
Filed March 1, 2022
Before: Richard Linn,* Jay S. Bybee, and Mark J. Bennett, Circuit Judges.
Opinion by Judge Linn
SUMMARY**
Fair Credit Reporting Act
The panel affirmed the district court‘s denial of plaintiffs’ motion for a remand to state court and the district court‘s dismissal of plaintiffs’ class action suit alleging violations of the Fair Credit Reporting Act by Experian Information Solutions, Inc., a consumer credit reporting agency.
Plaintiffs alleged that the FCRA required Experian to disclose behavioral data from its “ConsumerView” marketing database, “soft inquiries” from third parties and affiliates, the identity of certain parties who procured consumer reports, and the date on which employment data was reported.
Affirming the district court‘s denial of plaintiffs’ motion to remand the case to the state court, the panel held that plaintiffs’ pleadings contained sufficient allegations of injury to support Article III standing. The panel held that as the party invoking the federal judicial power, Experian had the burden of establishing the facts necessary to support standing at the pleading stage. Because plaintiffs’ pleadings adequately alleged particularized injuries to their individual privacy and information interests, the panel rejected plaintiffs’ argument that Experian failed to show that plaintiffs had Article III standing. Under the Spokeo III test, these interests were sufficiently concrete to confer standing because the statutory provisions at issue were established to protect a plaintiff‘s concrete interests in privacy and accuracy in the reporting of consumer credit information (and not merely procedural rights). Distinguishing TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (2021), the panel further concluded that the specific violations alleged presented a material risk of harm to plaintiffs’ concrete interest in consumer privacy.
Affirming the district court‘s dismissal of plaintiffs’ first amended complaint, the panel held that none of the data alleged to be missing from Experian‘s consumer reports was subject to disclosure under
COUNSEL
Robert S. Green (argued), James Robert Noblin, and Emrah M. Sumer, Green & Nоblin P.C., Larkspur, California, for Plaintiffs-Appellants.
Meir Feder (argued) and Kelly C. Holt, Jones Day, New York, New York; John A. Vogt and Ryan D. Ball, Jones Day, Irvine, California; for Defendant-Appellee.
LINN, Circuit Judge:
Theresa Tailford, Sanford Buckles, and Jeffrey C. Ruderman (“Plaintiffs“), appeal from the denial by the United States District Court for the Central District of California of their motion to remand to state court their class action suit alleging violations of the Fair Credit Reporting Act (“FCRA“),
I
The FCRA is a specifically tailored federal law enacted in 1970 “to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy.” Safeco Ins. Co. of Am. v. Burr, 551 U.S. 47, 52 (2007). It created a mechanism “for investigating and evaluating the credit worthiness, credit standing, credit capacity, character, and general reputation of consumers.”
To give consumers the opportunity to verify the accuracy of data maintained by
(1) All information in the consumer‘s file at the time of the request [subject to some exceptions not relevant on appeal]
. . .
(3) [E]ach person (including each end-user identified under section 1681e(e)(1) of this title) that procured a consumer report
. . .
(ii) for any other purpose [than employment purposes], during the 1-year period preceding the date on which the rеquest is made.
. . .
(5) A record of all inquiries received by the agency during the 1-year period preceding the request that identified the consumer in connection with a credit or insurance transaction that was not initiated by the consumer.
II
Experian is a credit reporting agency that collects traditional consumer credit data. Experian stores the collected consumer credit data in a database called “File One.” This data includes information about credit accounts, creditors, debts, and credit inquiries. Experian uses its File One database to rеspond to credit inquiries made under
“The ConsumerView database contains data on thousands of аttributes on more than 300 million consumers and 126 million households, including age, gender, marital status, presence of children, homeowner status, education, and occupation.” Tailford v. Experian Info. Sols., Inc., No. CV 19-02191-CJC (KESx), 2020 WL 6867157, at *1 (C.D. Cal. Nov. 18, 2020) (order granting motion to dismiss) (“Dismissal Order“) (quotation marks omitted). Experian sells this information to affiliates and third parties through a product called “OmniView.” Experian‘s marketing materials indicate that OmniView may be used to “[t]arget candidates for invitations to apply for credit.” Tailford v. Experian Info. Sols., Inc., No. SACV 19-02191JVS (KESx), 2020 WL 2464797, at *2 (C.D. Cal. May 12, 2020) (order denying motion to remand and granting motion to dismiss) (“Remand Order“). OmniView also includes credit statistics aggregated by zip code, the raw data for which Plaintiffs allege is sourced from the File One database. Experian does not include the information in its ConsumerView database in
In late 2017, a data breach in an Amazon cloud storage location revealed information on millions of households in a spreadsheet titled “ConsumerView_10_2013.yxdb.” Plaintiffs allege that this information was placed in cloud storage by data analytics company Alteryx, Inc. that allegedly bought it from Experian. Following this breach, each of the three Plaintiffs requested and received from Experian various § 1681g disclosures. Plaintiffs contend these disclosures were incomplete. Plaintiffs do not allege that Experian failed to include in its § 1681g disclosures any the information in its File One database responsive to Plaintiffs’ requests. Plaintiffs do contend, however, that Experian failed to include in its § 1681g disclosures several pieces of information they allege Experian was required by the FCRA to provide, including behavioral data from its ConsumerView database, inquiries from third parties and affiliates, the identity of certain parties who procured consumer reports, and the date on which employment datа was reported.
III
Plaintiffs sought to remedy Experian‘s alleged violation of the FCRA by joining a putative class action initially filed by Terry Carson before the United States District Court for the Central District of California, alleging violations of
Instead, Plaintiffs filed a separate class action suit in state court, again alleging violations of § 1681g. Experian, in a turnabout from the position it took in Carson, removed the case to the Central District. Experian then filed a motion to dismiss the Original Complaint for failure to state a claim.
Plaintiffs countered with a motion for remand to state court. Plaintiffs argued in their remand motion that Experian had not met its burden of establishing Article III standing, but did not expressly argue, as they did in Carson, that standing wаs lacking. Judge Selna denied Plaintiffs’ motion, holding that removal under
The case was reassigned to Judge Carney. Plaintiffs filed a First Amended Complaint (“FAC“), in which they repeated and expanded their original allegations and
This time, the district court dismissed the FAC with prejudice. Dismissal Order, 2020 WL 6867157, at *7. Regarding the missing “behavioral data,” the district сourt concluded that Experian was not obligated to include that data in its § 1681g disclosure because it was not part of the consumer‘s “file” under the FCRA and was not information that was or might be furnished in a consumer report, notwithstanding the fact that some ConsumerView data contained aggregated information from the File One database. Id. at *3. Concerning the soft inquiries, the district court held that Experian was not obligated to include those inquiries in its § 1681g disclosure because such inquiries were never included in consumer reports. Id. at *4. The district court next concluded that the dates on which employment was reported to Experian has nothing to do with a consumer‘s eligibility for credit, insurance, or employment information and is not the kind of information that might be furnished in a consumer report. Id. The district court also held that while Experian was required by the FCRA to disclose those who procured a consumer report, Plaintiffs had failed to plausibly allege that Alteryx was a procuring party. Id. at *5. Finally, the district court held that Experian was not obligated under the Act to identify the particular end-users omitted from the § 1681g report. Id.
Plaintiffs appealed the denial of their motion to remand and the dismissal for failure to state a claim. This Court has jurisdiction over a final decision of the district court under
IV
We review the district court‘s denial of Plaintiffs’ motion to remand to state court de novo. D-Beam Ltd. P‘ship v. Roller Derby Skates, Inc., 366 F.3d 972, 974 n.2 (9th Cir. 2004). We also consider whether there is constitutional standing de novo. Bernhardt v. County of Los Angeles, 279 F.3d 862, 867 (9th Cir. 2002). Likewise, we review the grant of a motion to dismiss de novo. Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir. 2005).
V
All parties agree that because this case arises out of a well-pleaded complaint alleging a violation of a federal law, there is federal question jurisdiction in the district courts under
allege particularized injuries to their individual privacy and informational interests. The only question is whether the interests allegedly violated are sufficiently concrete to confer standing.
As the party invoking the federal judicial power, Experian has the burden of establishing the facts necessary to support standing “with the manner and degree of evidence required at the successive stages of the litigation.”2 See Lujan, 504 U.S. at 561. “At the pleading stage, general factual allegations of injury resulting from the defendant‘s conduct may suffice, for on a motion to dismiss we ‘presum[e] that general allegations embrace those specific facts that are necessary to support the claim.‘” Id. (alteration in original) (quoting Lujan v. Nat‘l Wildlife Fed‘n, 497 U.S. 871, 889 (1990)).
This Court has adopted a two-step framework to determine whether alleged violations of FCRA provisions are sufficiently concrete to confer standing: “(1) whether the statutory provisions at issue werе established to protect [a plaintiff‘s] concrete interests (as opposed to purely procedural rights), and if so, (2) whether the specific procedural violations alleged in this case actually harm, or present a material risk of harm to, such interests.” Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017) (”Spokeo
III“) (adopting the standard set forth in Strubel v. Comenity Bank, 842 F.3d 181, 190 (2d Cir. 2016)). In this case, both prongs of the Spokeo III test are satisfied.
Regarding the first prong, Plaintiffs’ complaint, as noted infra, alleges the violation of specific provisions of the FCRA established to protect concrete interests of privacy and accuracy in the reporting of consumer credit information, and not merely procedural rights. One of the two principal reasons for enactment of the FCRA was the protection of consumers’ interests in “fair and аccurate credit reporting” and to “protect consumer privacy.” Spokeo III, 867 F.3d at 1113 (quoting Safeco Ins. Co., 551 U.S. at 52)). The interest in consumer privacy “resemble[s] other reputational and privacy interests that have long been protected in the law.” Id. at 1114; see also Nayab v. Capital One Bank, 942 F.3d 480, 492 (9th Cir. 2019) (holding that being “deprived of the right to keep private the sensitive information about [one‘s] person” is historically considered a harm protected by common law).
As to the second prong of Spokeo III, Plaintiffs’ complaint contains sufficient allegations of non-disclosure of information under
In Syed v. M-I, LLC, 853 F.3d 492 (9th Cir. 2017), this court recognized that an employee had standing to sue an employer for a violation of an FCRA procedural rule, namely,
Plaintiffs in their reply brief rely on TransUnion, 141 S. Ct. 2190, to support their argument that the ability to protect privacy interests is insufficient to satisfy the concrete-harm requirement. But the § 1681g claim at issue in this case is distinguishable from the disclosure claims that the TransUnion Court found lacked standing because the plaintiffs here have alleged a sufficiently conсrete injury—they alleged that without complete information in their § 1681g disclosures, they are unable to adequately opt out of certain disclosures to other parties and ensure fair and accurate reporting of their credit information. See id. at 2213 (noting that “the disclosure and summary-of-rights requirements are designed to protect consumers’ interests in learning of any inaccuracies in their credit files so that they can promptly correct the files before they are disseminated to third parties“). Unlike the plaintiffs here, who alleged that certain information was missing from Experian‘s §1681g disclosures, the plaintiffs in TransUnion lacked standing becausе their only allegation of non-disclosure was improper formatting of the information. Id. at 2214 (“The plaintiffs did not allege that they failed to receive any required information. They argued only that they received it in the wrong format.“).
For the above reasons, we conclude that the allegations of injury to Plaintiffs’ informational
VI
Plaintiffs contend that the district court erred in granting Experian‘s motion to dismiss.3 They argue that various combinations of
reported. Experian responds that its § 1681g disclosures were in full compliance with the FCRA and that nothing required was omitted. For the reasons that follow, we hold that none of the information Plaintiffs contend Experian failed to include in its § 1681g disclosures is subject to disclosure under
A
Plaintiffs first argue that
A consumer‘s “file,” for purposes of the FCRA, is “all of the information on that consumer recorded and retained by a consumer reporting agency regardless of how the information is stored.”
B
Plaintiffs next argue that Experian violated
Section
Plaintiffs are incorrect in contending that the inquiries must be disclosed under
Plaintiffs further allege that Experian violated
Plaintiffs allege that
Second, Plaintiffs argue that the OmniView product, which incorporates the ConsumerView database, is itself a consumer report because Experian markets it to “target candidates for invitations to apply for credit” and insurance. Plaintiffs assert that these are credit purposes. Notwithstanding the uses identified by Plaintiffs, OmniView is not itself a consumer report. The FCRA defines a “consumer report” as follows:
[A]ny written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer‘s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer‘s eligibility for—
(A) credit or insurance to be used primarily for personal, family, or household purposes;
(B) employment purposes; or
(C) any other purpose authorized under section 1681b of this title.
Plaintiffs next argue that
Plaintiffs also allege that Experian failed to disclose that Experian affiliates and Alteryx received consumer reports that included information from the File One database. As relevant here,
D
Finally, Plaintiffs argue that Experian violated
The date on which employment was reported to Experian is not part of the consumer‘s “file” and need not be disclosed. The district court did not err in dismissing Plaintiffs’ employment reporting date allegations. Plaintiffs argue that the reported date of emрloyment is included in Experian‘s Employment Insight report, which is itself a consumer report that should be disclosed. But even assuming that the Employment Insight report is a consumer report, the date employment dates were reported can have no “bearing on a consumer‘s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.”
VII
For the above reasons, we affirm the district court‘s denial of Plaintiffs’ motion to remand to state court and its dismissal with prejudice of Plaintiffs’ first amended complaint for failure to state a claim.4