Intangible Harms, Tangible Consequences: Analyzing the Impact of TransUnion on Standing to Sue for Data Breach

Scholars and practitioners predicted that the 2021 Supreme Court case TransUnion v. Ramirez would essentially nullify the private right of action—a key enforcement mechanism for many consumer privacy laws. This Article analyzes federal courts (N=96) interpreting TransUnion in data breach contexts. Our contribution is twofold: (1) identifying tests courts employ to determine whether data breach plaintiffs have alleged sufficient “injury in fact” to establish Article III standing, and (2) highlighting the areas of inconsistency in how courts employ those tests. The analysis serves to ground the scholarly debate about the implications of TransUnion in holding breached entities accountable. Despite the fears expressed by privacy advocates, our results indicate that TransUnion has not effectively nullified the private right of action. Our findings show 60% of plaintiffs (n=58) successfully established injury in fact based on intangible data breach harms. Nevertheless, we found inconsistencies among the lower courts; scholars’ and practitioners’ concerns that data breach plaintiffs’ access to federal courts post-TransUnion may depend on geography are not unfounded.