Category: FCRA Class Actions

By Gerald L. Maatman, Jr., Tyler Zmick, and Hayley Ryan

Duane Morris Takeaways:  In Fausett v. Walgreen Co., 2025 IL 131444 (Nov. 20, 2025), the Illinois Supreme Court narrowly construed the private right of action set forth in the federal Fair Credit Reporting Act (FCRA), holding that because the FCRA does not explicitly authorize consumers to sue for violations, the law does not authorize individual lawsuits unless a consumer shows that a violation caused a concrete injury. Thus, at least for FCRA actions, a plaintiff must now allege a “concrete injury” in Illinois state courts similar to what a plaintiff must allege to establish Article III standing in federal courts. This is a significant development, as Illinois courts have not previously required “concrete-injury” allegations for statutory claims under the state’s more liberal standing test.

Fausett is therefore a must-read opinion that represents an obstacle for future plaintiffs pursuing “no-injury” claims premised on the FCRA, in addition to other federal statutes containing similar private rights of action.

Case Background

Plaintiff alleged that Defendant violated the Fair and Accurate Credit Transactions Act (FACTA) – a provision of the FRCA – by printing a receipt containing more than the last five digits of her debit card number. Plaintiff sought statutory damages for the alleged FACTA violation, though she did not claim the violation led to actual harm by, for example, a third party using the receipt to steal her identity.

Plaintiff moved to certify a class of individuals for whom Defendant printed receipts containing more than the last five digits of their payment card numbers. In granting class certification, the trial court rejected Defendant’s argument that Plaintiff had no viable claim due to lack of standing. The trial court reasoned that Illinois courts are not bound by the same jurisdictional restrictions applicable to federal courts and that the Illinois Supreme Court’s decision in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, established that “a violation of one’s rights afforded by a statute is itself sufficient for standing.” Fausett, 2025 IL 3237846, ¶ 15. The Illinois Appellate Court affirmed the trial court’s class certification order, and Defendant subsequently appealed to the Illinois Supreme Court.

The Illinois Supreme Court’s Decision

The issue before the Illinois Supreme Court was whether standing existed in Illinois courts for a plaintiff alleging a FACTA violation that did not result in actual harm.

The Court began by distinguishing the standing doctrines applied in Illinois state courts vs. federal courts. The Court observed that Illinois courts are not bound by federal standing law and that Illinois standing principles apply to all claims pending in state court – even those premised on federal statutes.

The Court then identified the two different types of standing that exist in Illinois courts, including: (1) common-law standing, which – like Article III – requires an injury in fact to a legally recognized interest; and (2) statutory standing, which requires the fulfillment of statutory conditions to sue for legislatively created relief. See id. ¶ 39 (for statutory standing, the legislature creates a right of action and determines “who shall sue, and the conditions under which the suit may be brought”) (citation omitted). The Court further noted that a statutory violation, without actual harm, can establish statutory standing only where the statute specifically authorizes a private lawsuit for violations.

Turning to Plaintiff’s FACTA lawsuit, the Court determined that Plaintiff’s claim could not invoke statutory standing because the FCRA’s liability provisions “fail to include standing language. In other words, Congress did not expressly define the parties who have the right to sue for the statutory damages established in FCRA.” Id. ¶ 40; see also id. ¶ 44 (“the plain and unambiguous language” of the FCRA “does not state the consumer or an aggrieved person may file the cause of action”). Thus, because the FCRA is “silent as to who may bring the cause of action for damages,” Plaintiff’s FACTA claim “does not implicate statutory standing principles, and thus common-law standing applies to plaintiff’s suit.” Id.

As for common law standing, the Court concluded that Plaintiff’s claim did not satisfy Illinois’s common law standing test, under which an alleged injury, “whether actual or threatened, must be: (1) distinct and palpable; (2) fairly traceable to the defendant’s actions; and (3) substantially likely to be prevented or redressed by the grant of the requested relief.” Id. ¶ 39 (quoting Petta v. Christie Business Holdings Co., P.C., 2025 IL 130337, ¶ 18). The injury alleged must also be concrete – meaning that a plaintiff alleging only a purely speculative future injury lacks a sufficient interest to have standing.

The Court held that Plaintiff failed to allege or prove a concrete injury because she conceded that she was unaware of any harm to her credit or identity caused by the alleged FACTA violation, and she could not identify anyone who had even seen her receipts “beyond the cashier, herself, and her attorneys.” See id. ¶ 48. Thus, Plaintiff could only show an increased risk of identity theft – something the Court has found to be insufficient to confer standing for a complaint seeking money damages. Because Plaintiff lacked a viable claim due to lack of standing, the Court held that the trial court abused its discretion in granting Plaintiff’s motion for class certification.

Implications Of The Fausett Decision

Fausett will impact FCRA class actions in a significant manner by precluding plaintiffs from bringing certain “no-injury” class actions in Illinois state courts. Federal courts have regularly dismissed such claims for lack of Article III standing based on the U.S. Supreme Court’s decision in Spokeo, Inc. v. Robins, 578 U.S. 330 (2016).

Fausett now forecloses plaintiffs from refiling the same claims in Illinois state courts, leaving plaintiffs without a venue to prosecute no-injury FCRA claims in Illinois. Importantly, the Fausett decision will likely reach beyond the FCRA context, as other federal consumer-protection statutes contain liability provisions with private-right-of-action language similar to the language found in the FCRA.

By Gerald L. Maatman, Jr. and Jennifer A. Riley

Duane Morris Takeaway: Courts have often noted that Fair Credit Reporting Act (FCRA) violations lend themselves to resolution through class action litigation, and FCRA class actions have increased partially because of the Fair and Accurate Credit Transactions Act (FACTA) amendments, passed in 2003. In 2024, in FCRA cases, the class action plaintiff’s bar continued to look for any technical failure of an employer to provide disclosures or obtain proper authorization from an applicant. Of note, although these authorization and disclosure requirements may appear to be relatively straightforward, case law has created additional requirements separate and distinct from the plain statutory requirements, which may not be obvious from a plain and ordinary reading of the FCRA alone.

To that end, the class action team at Duane Morris is pleased to present the inaugural edition of the FCRA Class Action Review. We hope it will demystify some of the complexities of FCRA, FACTA, and Fair Debt Collection Practices Act (FDCPA) class action litigation and keep corporate counsel updated on the ever-evolving nuances of these issues.  We hope this book – manifesting the collective experience and expertise of our class action defense group – will assist our clients by identifying developing trends in the case law and offering practical approaches in dealing with these types of class action litigation.

Click here to bookmark or download a copy of the Duane Morris FCRA Class Action Review – 2025 eBook.

Stay tuned for more FCRA/FACTA/FDCPA class action analysis coming soon on our weekly podcast, the Class Action Weekly Wire.

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Zachary J. McCormack

Duane Morris Takeaways: In In Re Equifax Fair Credit Reporting Act Litigation, No. 1:22-CV-03072 (N.D. Ga. Sept. 11, 2023), Judge Leigh Martin May of the U.S. District Court for the Northern District of Georgia granted in part as to the state law negligence claim and injunctive relief under the Fair Credit Reporting Act (“FCRA”), but denied in part the motion to strike class action allegations, allowing the plaintiffs’ claims to proceed past the motion to dismiss stage. Judge May struck plaintiffs’ negligence and injunctive relief claims, reasoning the plaintiffs could not identify a statutory or common law duty of care owed to the plaintiffs by the Credit Reporting Agency (“CRA”) Equifax, Inc. (Equifax). As to to the FCRA claim, Judge May noted that the cases cited by Equifax center on instances where a correctly reported credit score was misleading, which was distinguishable from its position that it was not “objectively unreasonable” for the company to interpret 15 U.S.C. § 1681e(b) as being inapplicable to credit scores. The ruling is a good roadmap for defendants involved in FCRA class action litigation.

Case Background

Equifax is a multinational data analytics and CRA headquartered in Atlanta, Georgia, that collects and aggregates credit information for millions of individual consumers and businesses. On May 27, 2022, reporting first emerged that Equifax allegedly had provided inaccurate credit scores on millions of U.S. consumers seeking loans during a three-week period in 2022. According to public reporting in May of 2022, the glitch occurred when Equifax experienced a coding issue once it introduced a technology change to its legacy online model platform, leading to the miscalculation of roughly 12 percent of credit scores. This led to score inaccuracies of 20 points or more. Equifax sent the erroneous scores of individuals applying for lines of credit, which affected auto loans, mortgages, and credit card applications. Plaintiffs in this action, filed on August 3, 2022, are consumers who applied for loans during this three-week period in spring 2022, and were either denied credit, forced to pay inflated interest rates, and/or have a co-signer, due to Equifax’s reporting or artificially lowered scores.

On February 14, 2023, Equifax filed a motion to dismiss, seeking dismissal of plaintiffs’ claims of willful violation of the FCRA and common law negligence, class allegations of negligent violation of the FCRA and common law negligence, and injunctive relief. On September 11, 2023, the Court entered an Order partially dismissing plaintiffs’ claims of negligence and injunctive relief, but not their claim of willful violation of the FCRA.

The Court’s Order

A. Willful Violation of the FCRA 

The FCRA was created “to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy.” Safeco Ins. Co. of Am. V. Burr, 551 U.S. 47, 52 (2007). The FCRA requires that when a CRA “prepares a consumer report, it shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates.” 15 U.S.C § 1681e(b). This includes an obligation to investigate and account for the accuracy of such information if the customer disputes it.

In turn, 15 U.S.C. § 1681n(a) provides recovery for willful violations of the FCRA, which may entitle the consumer to actual or statutory damages and even punitive damages. Here, Equifax argued that plaintiffs’ claim for a willful violation of the FCRA was invalid because the statute is inapplicable to credit scores, and the technology glitch was a mistake rather than willful conduct. The Court noted that the cases cited by Equifax centered on instances where a correctly reported credit score was misleading, which was distinguishable from its position that it was not “objectively unreasonable” for the company to interpret 15 U.S.C. § 1681e(b) as being inapplicable to credit scores. The Court likewise rejected Equifax’s argument that because it was proactively replacing its legacy technology system, it did not act recklessly. Instead, the Court allowed plaintiffs’ claim for willful violation to remain because Equifax’s replacement of the legacy technology system provided indicia that Equifax was aware its system was antiquated.

Although Equifax insisted that each claim requires individualized analysis, the Court reasoned it would be premature to dismiss the class claims. Considering this is a data-driven case, it reasoned that discovery could establish an electronic paper trail supporting plaintiffs’ allegations and establishing cause and effect. The Court relied on these points as support that it might be possible for plaintiffs to certify a class, and as such, Equifax could not dodge a class action at this point.

B. Georgia Statutory and Common Law Negligence Claim 

The Court remained unpersuaded by plaintiffs’ negligence allegations, and granted Equifax’s motion to dismiss this claim. The Court opined that Plaintiffs could not meet the burden to plead a duty owed by Equifax. Rather than arguing that Equifax owed plaintiffs a statutory duty of care under Georgia statutory law, the plaintiffs asserted that the CRA owed them the alleged duty of care under Georgia common law. Plaintiffs relied on common law because the Georgia Supreme Court has held that mere foreseeability of a potential harm is not enough to establish a duty of care. CSX Transp., Inc. v. Williams, 608 S.E.2d 208, 209-10 (Ga. 2005).

Instead, plaintiffs relied on a recent Eleventh Circuit opinion in hopes to establish that Equifax’s “creation of a risk of foreseeable harm” is enough to create a legal duty of care. Ramirez v. Paradies Shops, LLC, 69 F.4th 1213 (11th Cir. 2023). But the Court differentiated the cited precedent, noting the employer-employee relationship was “significant” in establishing a duty of care. See Ramirez, 69 F.4th at 1219-20.

C. Injunctive Relief 

The Court likewise dismissed plaintiffs’ demand for injunctive relief, requiring the company to “(i) implement new protocols, procedures, and practices that will ensure no further harm to consumers, (ii) disgorge [their] gross revenues and profits derived from [their] furnishment of inaccurate consumer reports, (iii) and inform each affected customer that their information was misreported, what information about them was misreported, and to what entities it was misreported.” See Amended Complaint at 39.

While plaintiffs argued the Court could award injunctive relief because the FCRA does not expressly prohibit it, the Court remained skeptical at the series of cases cited by plaintiffs that contained little to no analysis. The Court was, instead, persuaded by the “affirmative grant of power to the FTC and other agencies to pursue injunctive relief and similar affirmative grant to private litigants to pursue injunctive relief from certain government conduct, contrasted with the affirmative grant to private litigants in other situations to pursue other relief, persuasively demonstrates that Congress did not grant private litigants general power to obtain injunctive relief under the FCRA.” Id. at 22.

Implications for CRAs

Overall, the Court’s order provides guidance that (i) consumer reporting agencies, like Equifax, Transunion, and Experian, cannot challenge the application of the FCRA on the basis that they are not a CRA; and (ii) that CRAs can willfully violate the FCRA by failing to identify, adopt, and maintain reasonable procedures to greatly reduce the chances of a technology glitch that incorrectly report credit scores. The decison further provides insight that CRAs cannot claim it is “objectively unreasonable” to interpret 15 U.S.C. § 1681e(b) as being inapplicable to credit scores. Unreasonable data-management procedures that undermine the numerical representations of credit scores clearly falls under the FCRA. As such, it is imperative that CRAs monitor, investigate, and account for data-management issues that could leave an electronic paper trial to surface in discovery, and ultimately lead to class action liability under the FCRA.