By Gordon Hull
Last time, I started to look at the details of the Supreme Court’s recent TransUnion decision, which ruled that a credit agency that wrongly labeled someone as a match for a terrorist watch list (using only first and last names, with no effort at verification. Sorry “John Smith”…) could only be sued if that person could show that the credit agency also distributed this information to others. So basically you have to lose a job opportunity or a mortgage approval, and then you can sue. There is nothing you can do to pre-emptively force them to correct the problem. Worse, this ruling is in defiance of explicit statutory language in the FCRA. The opinion directly says that SCOTUS can override Congressional determination of when something is legally actionable, and (just to be contrary, I guess), it does so in the name of separation of powers.
So what are we to make of this? As the various critical theories will remind you, law is a form of power. One thing that’s happening here is the protection of the powerful from the weak. With some high profile exceptions (like Justice Gorsuch’s endorsement of LGBTQ rights), the Roberts court has fairly consistently sided with the powerful, like corrupt politicians and conservative dark money donors by whittling away at laws designed to rein them in. One limitation to that thesis is to argue, as Erwin Chemerinsky has, that “Throughout history the court has overwhelmingly favored corporate power over employees, consumers, and the public, and has favored government power over individuals’ rights.” While it’s tempting to leave it at that here, I think there’s more nuance to be had. So two points.
First, as Solove and Citron note, one of the problems is that the regulatory state is weak, and private rights of action have become important enforcement mechanisms:
“Using a private right of action is an important enforcement mechanism for laws. Nearly all regulatory agencies are significantly understaffed and under-resourced, and they cannot enforce in every case. They must be highly selective in enforcement. A private right of action works to deputize “private attorneys general” to help enforce the law. The monetary award works as a kind of bounty, encouraging the private enforcement of the law and easing the burden on regulators.”
In that context, I think Justice Kavanaugh’s insistence that Ramirez has been wronged by the disclosure of his information, but that most of the plaintiffs in the class have not, is legible as part of the court’s recent hostility to class certification. For example, in a 2019 case (Lamps Plus v. Varela), the Court ruled that the Federal Arbitration Act’s supposed prioritization of individual arbitration (and the supposed inefficiency of class arbitration) overruled state contract law to deny class certification, even when the language of the arbitration agreement did not clearly deny it. If we take Varela as indicative, then two things emerge: one is the priority placed on arbitration by SCOTUS, and the other is skepticism about the applicability of class certification in cases outside of securities and exchange.
The problem is that this is occurring in the context of a weak regulatory state. Regulatory agencies and state attorneys general can go after corporations for violating rules. But the regulatory agencies are unfunded, and as Citron notes elsewhere, data privacy actions brought by state attorneys general tends to diffuse into settlements and consent decrees. In the absence of the regulatory state, the only way for individual plaintiffs to fight data abuses is as a class. Individually, their losses are likely to be either too small to be worth the effort and expense of litigation, or any damages they might win are far too small to make a dent in corporate behavior. If Sergio Ramirez had sued TransUnion on his own, he would likely have bankrupted himself in attorney’s fees and won at most a few thousand dollars. In other words, class certification (kind of like unions, which the current SCOTUS also doesn’t like) is a mechanism for individual claims to add up to enough to force large corporations to take notice of them, and in that regard is serving as a proxy for the missing regulatory state.
In this regard, we can align the decision in TransUnion with the Court’s hostility toward the regulatory state. The conservative justices – Gorsuch in particular – would really like to radically constrain the power of regulatory agencies, and conservative groups are queuing up a series of cases designed to achieve that result. So the regulatory state is weak and likely to get weaker, and the Court is also dismantling the power of individuals to band together in class actions.
The other element in this constellation is the rise of arbitration agreements, to which (as Varela indicates) the current court is very, very solicitous. These arbitration agreements are a hallmark of the rise of information capitalism. They are ubiquitous, especially in website and software terms of service, and the outcome is that you don’t even generally have a right to go to court to try to enforce a claim against a corporation – you have to submit to arbitration in a venue of the vendor’s choosing. When you combine the solicitude toward arbitration with the hostility toward both the regulatory state and its class-certification shadow, individuals have essentially no recourse against algocratic governance by corporations.
This combination allows to Court to pretend to protect individuals: after all, if TransUnion violates your rights under the FCRA and harms you in so doing, you “unquestionably” have a right to take them to court. It’s just that this right is meaningless and unenforceable because of the apparatus the Court has erected around it.
The second general point is that property is the exception to all of the above. If you lose property, then you are almost automatically entitled to statutory damages. As Justice Thomas' dissent notes in its history of statutory causes of action, intellectual property laws grant statutory damages. The current Copyright Act provides:
“The copyright owner may elect, at any time before final judgment is rendered, to recover, instead of actual damages and profits, an award of statutory damages for all infringements involved in the action, with respect to any one work, for which any one infringer is liable individually, or for which any two or more infringers are liable jointly and severally, in a sum of not less than $750 or more than $30,000 as the court considers just”
If the infringement is deemed “willful,” then the cap rises to $150,000. This is per infringement. Does anyone seriously imagine that the TransUnion majority’s theory of concrete harm is going to be applied to a copyright case? Let’s see… “the Copyright Act provides a cause of action, but you have to show concrete harm. Can you show that you have lost any sales? Defendants testify that none of them were ever going to buy plaintiff’s lousy music, so no monetary loss.” How is the violation of the Copyright Act in that situation a more concrete harm to the record label than opening an envelope and discovering that a credit scoring company thinks you’re a terrorist? The answer will be something about “theft” or “trespass,” and it’s certainly true that copyright has been protected under common law. But this answer poses a theoretical and an empirical problem. The theoretical problem is that there is also a tradition of treating intellectual property as something different from tangible property (because it’s non-rivalrous). Solove and Citron point out that in the case of privacy, the common law has a lot of sources, including academic articles. Certainly the history of intellectual property has been replete with academic sources that are skeptical of the concept in the first place. The empirical problem is that the provision above explicitly applies to derivative works (ex, I can’t make a movie using Star Wars characters). But statutory protection for derivative works didn’t happen until 1976. The FCRA was passed in 1970. So it’s not clear what the “traditional” contours of common law protection are; they are in part created by the statutes being assessed.
The real answer, of course, is that IP law is written by and for large corporations. The slightly less cynical answer – the one that helps to explain why legislators are receptive to this particular line of argument by large corporations – is that property is special. Thomas more or less calls this out, pointing out that the problem with statutory damages can’t be that they are statutory, since “no one could seriously dispute, for example, that a violation of property rights is actionable, but as a general matter, ‘[p]roperty rights are created by the State.’” (7; citation to Palazzolo v. Rhode Island, 533 U. S. 606, 626 (2001)).
No wonder those same corporations like to treat their relations with consumers as a matter of contract. Contract is a way to avoid the troublesome rights that attach to property, at least when it belongs to other people.
In short: No Soup for You!
Recent Comments