By Gerald L. Maatman, Jr., Jennifer A. Riley, and Zachary J. McCormack
Duane Morris Takeaways: In In Re Equifax Fair Credit Reporting Act Litigation, No. 1:22-CV-03072 (N.D. Ga. Sept. 11, 2023), Judge Leigh Martin May of the U.S. District Court for the Northern District of Georgia granted in part as to the state law negligence claim and injunctive relief under the Fair Credit Reporting Act (“FCRA”), but denied in part the motion to strike class action allegations, allowing the plaintiffs’ claims to proceed past the motion to dismiss stage. Judge May struck plaintiffs’ negligence and injunctive relief claims, reasoning the plaintiffs could not identify a statutory or common law duty of care owed to the plaintiffs by the Credit Reporting Agency (“CRA”) Equifax, Inc. (Equifax). As to to the FCRA claim, Judge May noted that the cases cited by Equifax center on instances where a correctly reported credit score was misleading, which was distinguishable from its position that it was not “objectively unreasonable” for the company to interpret 15 U.S.C. § 1681e(b) as being inapplicable to credit scores. The ruling is a good roadmap for defendants involved in FCRA class action litigation.
Case Background
Equifax is a multinational data analytics and CRA headquartered in Atlanta, Georgia, that collects and aggregates credit information for millions of individual consumers and businesses. On May 27, 2022, reporting first emerged that Equifax allegedly had provided inaccurate credit scores on millions of U.S. consumers seeking loans during a three-week period in 2022. According to public reporting in May of 2022, the glitch occurred when Equifax experienced a coding issue once it introduced a technology change to its legacy online model platform, leading to the miscalculation of roughly 12 percent of credit scores. This led to score inaccuracies of 20 points or more. Equifax sent the erroneous scores of individuals applying for lines of credit, which affected auto loans, mortgages, and credit card applications. Plaintiffs in this action, filed on August 3, 2022, are consumers who applied for loans during this three-week period in spring 2022, and were either denied credit, forced to pay inflated interest rates, and/or have a co-signer, due to Equifax’s reporting or artificially lowered scores.
On February 14, 2023, Equifax filed a motion to dismiss, seeking dismissal of plaintiffs’ claims of willful violation of the FCRA and common law negligence, class allegations of negligent violation of the FCRA and common law negligence, and injunctive relief. On September 11, 2023, the Court entered an Order partially dismissing plaintiffs’ claims of negligence and injunctive relief, but not their claim of willful violation of the FCRA.
The Court’s Order
A. Willful Violation of the FCRA
The FCRA was created “to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy.” Safeco Ins. Co. of Am. V. Burr, 551 U.S. 47, 52 (2007). The FCRA requires that when a CRA “prepares a consumer report, it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.” 15 U.S.C § 1681e(b). This includes an obligation to investigate and account for the accuracy of such information if the customer disputes it.
In turn, 15 U.S.C. § 1681n(a) provides recovery for willful violations of the FCRA, which may entitle the consumer to actual or statutory damages and even punitive damages. Here, Equifax argued that plaintiffs’ claim for a willful violation of the FCRA was invalid because the statute is inapplicable to credit scores, and the technology glitch was a mistake rather than willful conduct. The Court noted that the cases cited by Equifax centered on instances where a correctly reported credit score was misleading, which was distinguishable from its position that it was not “objectively unreasonable” for the company to interpret 15 U.S.C. § 1681e(b) as being inapplicable to credit scores. The Court likewise rejected Equifax’s argument that because it was proactively replacing its legacy technology system, it did not act recklessly. Instead, the Court allowed plaintiffs’ claim for willful violation to remain because Equifax’s replacement of the legacy technology system provided indicia that Equifax was aware its system was antiquated.
Although Equifax insisted that each claim requires individualized analysis, the Court reasoned it would be premature to dismiss the class claims. Considering this is a data-driven case, it reasoned that discovery could establish an electronic paper trail supporting plaintiffs’ allegations and establishing cause and effect. The Court relied on these points as support that it might be possible for plaintiffs to certify a class, and as such, Equifax could not dodge a class action at this point.
B. Georgia Statutory and Common Law Negligence Claim
The Court remained unpersuaded by plaintiffs’ negligence allegations, and granted Equifax’s motion to dismiss this claim. The Court opined that Plaintiffs could not meet the burden to plead a duty owed by Equifax. Rather than arguing that Equifax owed plaintiffs a statutory duty of care under Georgia statutory law, the plaintiffs asserted that the CRA owed them the alleged duty of care under Georgia common law. Plaintiffs relied on common law because the Georgia Supreme Court has held that mere foreseeability of a potential harm is not enough to establish a duty of care. CSX Transp., Inc. v. Williams, 608 S.E.2d 208, 209-10 (Ga. 2005).
Instead, plaintiffs relied on a recent Eleventh Circuit opinion in hopes to establish that Equifax’s “creation of a risk of foreseeable harm” is enough to create a legal duty of care. Ramirez v. Paradies Shops, LLC, 69 F.4th 1213 (11th Cir. 2023). But the Court differentiated the cited precedent, noting the employer-employee relationship was “significant” in establishing a duty of care. See Ramirez, 69 F.4th at 1219-20.
C. Injunctive Relief
The Court likewise dismissed plaintiffs’ demand for injunctive relief, requiring the company to “(i) implement new protocols, procedures, and practices that will ensure no further harm to consumers, (ii) disgorge [their] gross revenues and profits derived from [their] furnishment of inaccurate consumer reports, (iii) and inform each affected customer that their information was misreported, what information about them was misreported, and to what entities it was misreported.” See Amended Complaint at 39.
While plaintiffs argued the Court could award injunctive relief because the FCRA does not expressly prohibit it, the Court remained skeptical at the series of cases cited by plaintiffs that contained little to no analysis. The Court was, instead, persuaded by the “affirmative grant of power to the FTC and other agencies to pursue injunctive relief and similar affirmative grant to private litigants to pursue injunctive relief from certain government conduct, contrasted with the affirmative grant to private litigants in other situations to pursue other relief, persuasively demonstrates that Congress did not grant private litigants general power to obtain injunctive relief under the FCRA.” Id. at 22.
Implications for CRAs
Overall, the Court’s order provides guidance that (i) consumer reporting agencies, like Equifax, Transunion, and Experian, cannot challenge the application of the FCRA on the basis that they are not a CRA; and (ii) that CRAs can willfully violate the FCRA by failing to identify, adopt, and maintain reasonable procedures to greatly reduce the chances of a technology glitch that incorrectly report credit scores. The decison further provides insight that CRAs cannot claim it is “objectively unreasonable” to interpret 15 U.S.C. § 1681e(b) as being inapplicable to credit scores. Unreasonable data-management procedures that undermine the numerical representations of credit scores clearly falls under the FCRA. As such, it is imperative that CRAs monitor, investigate, and account for data-management issues that could leave an electronic paper trial to surface in discovery, and ultimately lead to class action liability under the FCRA.