The Supreme Court recently considered an Article III standing issue in data privacy and data breach litigations, establishing that only plaintiffs concretely harmed by a defendant’s statutory violation have Article III standing in federal court.^[1]

In Ramirez v. TransUnion, a class of approximately 8,000 individuals sued TransUnion, which is a credit reporting agency that compiles personal and financial information to create consumer reports. TransUnion introduced an add-on product to their reports called OFAC Name Screen Alert; this add-on used a third-party software to compare the consumer’s name against a list of names maintained by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) of terrorists, drug traffickers and other serious criminals. The TransUnion tool would place an alert on a credit report if the first and last name of an individual on OFAC’s list matched the consumer. This alert notified others of a “potential match” to a name on the OFAC list. TransUnion only shared first and last names, and no other data.