By Jim Harper
A few months ago, I asked whether the law should recognize new “privacy harms.” The Supreme Court partially answered that question a few weeks ago in TransUnion LLC v. Ramirez: The federal courts will not recognize new privacy harms that Congress creates from whole cloth. This case is fascinating not only because of its privacy dimensions; it’s also a potential blockbuster for separation of powers and federalism.
As I noted in my recent AEI report, “Privacy and the Four Categories of Information Technology,” a number of interests go by the name “privacy.” Among them are fairness and reputation, which are affected when unfair decisions result from data processing or when a person is sullied by adverse information.
Those interests were in Congress’ sights when it passed the Fair Credit Reporting Act (FCRA) fifty years ago. A nominal privacy law, the FCRA requires credit bureaus to “follow reasonable procedures to assure maximum possible accuracy” in their reports.
Sergio Ramirez, the plaintiff, shares a name with someone on the Office of Foreign Assets Control’s (OFAC) Specially Designated Nationals List of individuals who allegedly threaten America’s national security. TransUnion did not try to winnow out incorrect matches by comparing the birthdates of listed people against those with similar names. And in a credit report issued to an auto dealer, it noted the possibility that Ramirez was a bad guy. The auto dealer declined to sell him a car, which was not cool. Ramirez is not on OFAC’s list and is almost certainly not a terrorist or drug kingpin.
Ramirez sued for himself and 8,184 others who had been recognized in TransUnion’s files as potential matches to OFAC’s bad-guy list. But of that group, only 1,853 had been portrayed as a potential bad guy to recipients of credit reports. The rest were only treated as potential bad guys somewhere in TransUnion’s files.
Everyone in the larger class had been the subject of insufficient procedures within TransUnion. The FCRA created damages of between $100 and $1,000 for people wronged this way. But the Court decided that being the victim of insufficient procedures alone does not create the “case or controversy” required by Article III of the Constitution to invoke the jurisdiction of the federal courts. Being “thought of wrongly” in a computer file somewhere is too metaphysical. The common law does not treat this kind of wrong as a harm.
Ramirez and the smaller group of plaintiffs still have a federal case. What happened to them when TransUnion disclosed their potential bad-guy status is akin to being defamed. That is a wrong recognized by general law.
For what it is worth, I have always believed that the case or controversy requirement exists to serve the adversarial process. It helps ensure that the parties to suits make every effort to win so the courts will hear the sharpest arguments and get as close as possible to correct results. The FCRA’s bounty of at least $100 per victim adds up, so I can see the “case or controversy” requirement being satisfied. I am sympathetic to Justice Clarence Thomas’s dissent in the case. He finds no authority in the Constitution for the idea that Congress cannot create rights — and thus “cases or controversies” — sufficient for review in the federal courts.
The majority claimed to be defending the separation of powers. Giving bounties to plaintiffs who have suffered metaphysical “harms” makes them and the federal courts guardians of outcomes that are given to the executive branch by the Constitution. Invented “harms” are a subterfuge for getting administrative regulation done by other means.
For me, federalism is part of the explanation too. The Ramirez case may be an improvisation required by the distended state of federal power. It was never thought that Congress would be in the business of defining and defending private parties’ rights against each other or designing picayune regulatory systems. Those things were the province and option of the states, according to the original design of the Constitution.
With the enumerated powers doctrine a shambles, Ramirez’ case limits federal power a different way, by reserving to the states the power to adopt and validate what constitutes “harm.” If Congress’ powers were still within their boundaries, Congress would have very little occasion to create “harms,” and the Supreme Court would not have to police this line. That explains the result and reconciles what Justice Thomas is signaling to be a bit of constitutional adventurism.
Whatever the case, one thing is sure: If there are to be new privacy harms, they won’t come from Congress through this federal judiciary.