Article III standing and damages in privacy cases: what counts as concrete harm after TransUnion, statutory damages and risk-of-future-harm theories.
Whether a privacy plaintiff can sue at all often turns on standing, and courts remain divided on when exposure of data is a concrete injury. This hub follows that doctrine, which decides more privacy cases than the merits do.
Decided 25 June 2021 by five votes to four, TransUnion LLC v. Ramirez took a jury verdict that had already been returned and removed three quarters of the class from federal court. This post reads the case as a case: the OFAC Name Screen product, the six-day trial, the arithmetic of the award, the reasoning on each of the three claims, and the two dissents.
Read more →Privacy claims rarely settle on the merits before a court rules on certification. This post traces what Rule 23 requires by its own terms, how Dukes, Amgen, Comcast, Tyson Foods and TransUnion frame the inquiry, and where the courts of appeals have divided on ascertainability and on classes containing uninjured members.
Read more →Most privacy class actions are decided on whether the plaintiff may be in federal court at all, not on whether the defendant broke the law. Article III standing doctrine, built out of Spokeo and TransUnion, asks whether a statutory violation produced a harm closely related to one the common law recognised. This guide traces that test through the decisions that made it.
Read more →