Alycia Johns v. TransUnion, LLC and Quilling, Selander, Lownds, Winslett & Moser, P.C.

• Court: District Court, N.D. Illinois
• Decided: December 22, 2025
• Docket: 1:25-cv-03915
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION Alycia Johns,

Plaintiff,

No. 25 CV 3915 v.

Judge Lindsay C. Jenkins TransUnion, LLC and Quilling, Selander, Lownds, Winslett & Moser, P.C.,

Defendant.

MEMORANDUM OPINION AND ORDER Plaintiff Alycia Johns sued Defendants TransUnion, LLC (“TransUnion”) and Quilling, Selander, Lownds, Winslett & Moser, P.C. (“Quilling”) alleging violations of the Fair Credit Report Act and intrusion upon seclusion. Quilling, which represents TransUnion in a related action against Johns, obtained her credit information while compiling materials for a deposition. The court previously dismissed both claims against TransUnion, finding that Quilling received the information as TransUnion’s counsel and agent, so there was no unauthorized disclosure. Johns filed a second amended complaint, and Defendants now move together to dismiss. The motion is granted.

I. Background1 In 2022, Johns sued TransUnion in the Eastern District of Pennsylvania for issuing inaccurate credit reports to third parties. [Dkt. 35 ¶¶ 11–12, 14.] The reports contained fraudulent credit activity, which by April 2024 was removed from her account. [Id. ¶¶ 13, 15–17.]

Quilling represents TransUnion in the Pennsylvania matter. [Id. ¶ 19.] Ahead of an April 2024 deposition, TransUnion provided Quilling with Johns’s accurate, up- to-date credit information—its reason for doing so was discussed during the deposition, which is reproduced in the second amended complaint:

Q.: All right. Can you tell us what this document is? A.: This is a credit report. Q.: What prompted the creation of this credit report? A.: This is just a current copy of the credit report.

1 The court accepts as true plaintiff's well-pleaded allegations and draws all reasonable inferences in her favor. Thomas v. Neenah Joint Sch. Dist., 74 F.4th 521, 522 (7th Cir. 2023). Q.: What prompted the creation of this report? A.: Deposition. Q.: What do you mean by that? A.: Just to have the information. Q.: Whose deposition? A.: Today’s deposition. Q.: This report on April 11, 2024 was generated for today's deposition? A.: Yes. Q.: Is it typical of TransUnion to create a report for a deposition? A.: I can’t speak for every case, so I don’t know. Q.: Have you seen that before? A.: I’ve seen it.

[Id. ¶¶ 20–21, 23 n.1.] Johns then sued TransUnion and Quilling, raising claims under the FCRA and for intrusion upon seclusion. Both arise from the anguish, humiliation, and embarrassment she suffered knowing TransUnion shared private information with an “unauthorized third party.” [Id. ¶¶ 35, 39, 45.]

Before Quilling was served, TransUnion moved to dismiss. [Dkt. 19.] The court granted the motion, concluding (1) that Quilling—as TransUnion’s counsel and agent—was not a third party, and (2) that the complaint never alleged that TransUnion engaged in offensive prying. [Dkt. 34 at 5–7.2] These proved fatal to the FCRA and intrusion upon seclusion claims, respectively.3

Quilling has since been served, and Johns filed a second amended complaint. Defendants now move together to dismiss.

II. Legal Standard A motion to dismiss under Rule 12(b)(6) tests the legal sufficiency of a plaintiff's claims. To survive a motion to dismiss under Rule 12(b)(6), “a complaint's factual allegations ‘must be enough to raise a right to relief above the speculative level.’” Emerson v. Dart, 109 F.4th 936, 941 (7th Cir. 2024) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007)). Although the court takes well-pleaded factual allegations as true, conclusory allegations are insufficient to avoid dismissal. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).

2 Citations to docket filings generally refer to the electronic pagination provided by CM/ECF, which may not be consistent with page numbers in the underlying documents. 3 The court dismissed the latter with prejudice, also observing that TransUnion was “within its rights to access its own records.” [Dkt. 34 at 7.] III. Analysis Johns’s second amended complaint re-alleges that TransUnion violated the FCRA, and that Quilling violated the FCRA and intruded upon her seclusion. Again, Defendants’ attorney-client, principal-agent relationship compels dismissal.

A. Fair Credit Reporting Act Violations In granting the first motion to dismiss, this court observed that the FCRA claim “turn[ed] on counsel’s authorization to receive a report.” [Dkt. 34 at 4.] Johns alleged that “TransUnion provided Quilling a ‘consumer report’ without any permissible purpose, without receiving from Quilling the requisite certification, and without providing Quilling notice of its responsibilities.” [Id.] But the Seventh Circuit has held that “there cannot be a consumer report without disclosure to a third party,” Wantz v. Experian Info. Sols., 86 F.3d 829, 834 (7th Cir. 2004), abrogated by other grounds by Safeco Ins. Co. of America v. Burr, 551 U.S. 47 (2007), and several courts have agreed that “when the FCRA refers to ‘third parties,’ that term does not include counsel hired to represent the consumer reporting agency.” Norman v. Lyons, 2013 WL 655058, at *3 (N.D. Tex. Feb. 22, 2013) (citing Hartman v. Lisle Park Dist., 158 F.Supp.2d 869, 876–77 (N.D. Ill. 2001). See Rajapakse v. Seyfarth Shaw, 2022 WL 1051108, at *6 (S.D.N.Y. Feb. 18, 2022) (collecting cases).

Fatal to Johns’s claim, then, was her acknowledgment that “Quilling received the report in connection with the underlying litigation—for a deposition.” [Dkt. 34 at 5.] She consequently “failed to allege anything that takes Quilling outside the ambit of the traditional principal-agent relationship associated with clients and their attorneys,” and so TransUnion never disclosed her information to a third party. [Id. at 6.]

Little has changed. As Johns recognizes, the FCRA claims against both TransUnion and Quilling turn on “the scope of an attorney-client relationship.” [Dkt. 42 at 4.] Her second amended complaint again observes that Defendants sought the report “because a deposition of TransUnion’s corporate representative was being conducted in the ongoing Johns 1 case.” [Dkt. 35 ¶ 24] She now clarifies:

[T]he purpose behind wanting to have the information was not to “inform the deposition.” No preparation for the deposition could be achieved through pulling the report at issue because both Quilling and TransUnion affirmatively knew that the pulled credit report related to information after the relevant period of time, and after any relevant information remained on the report.

[Id.]

But the second amended complaint also quotes the deponent, who affirms that “[t]oday’s deposition” prompted the report’s creation. [Id. ¶ 23 n.1.] Johns therefore does not dispute—and, in fact, still affirmatively alleges—that the report was created and provided for the deposition. She simply disagrees that it was necessary for counsel’s defense.

She misses the point. What distinguishes the attorney-client relationship from those with an outside entity is the attorney and client’s “fiduciary and agency relationship.” Hartman, 158 F. Supp. 2d at 877. Both fiduciary and agency principles make clear that Quilling did not receive the credit report in a third-party capacity.

As Hartman observes, “the attorney has a [fiduciary] relationship of trust, confidence, and confidentiality with his client,” and thus “is acting as the client” when handling confidential credit information. Id. at 876 (emphasis in original). See also Mattiaccio v. DHA Grp., Inc., 21 F. Supp. 3d 15, 23 (D.D.C. 2014) (endorsing Hartman and its reliance on principles of attorney-client privilege and fiduciary duty). The duty of confidentiality, for example, extends to “all information relating to the representation, whatever its source,” and whatever its “nature.” I.L.C.S. S. Ct. Rules of Prof. Conduct Rule 1.6; People v. Curry, 1 Ill. App. 3d 87, 90 (1971). This principle, which guarantees confidentiality without regard to source or nature, is fundamentally at odds with the dictionary definition of “disclosure”—disclose, Merriam-Webster, https://www.merriam-webster.com/dictionary/despite (“to make known or public”)—let alone any notion of a third-party disclosure.

Meanwhile, Johns does not dispute that “an attorney is an agent of their client when acting on behalf of their client.” [Dkt. 42 at 6 (quoting Goracke v. Atchison Hosp. Ass’n, at *12 (D. Kan. May 7, 2019) (alterations accepted).] Rather, she reasons that because the report “was not necessary for the defense of the claim,” Quilling did not request and receive it within its scope of authority. [Id. at 4.] But her concept of ‘scope’ is too narrow—by her own admission, the report was “obtained ‘for’ the deposition,” see dkt. 42 at 3, and it’s this context, rather than the report’s contents, that is relevant to the scope of authority. Indeed, just as a lawyer’s harmful activities are attributable to their clients, Johnson v. McBride, 381 F.3d 587, 589 (7th Cir. 2004), so too is litigation activity that is merely unhelpful. And compiling materials for a deposition, necessary or not, is necessarily part of the litigation.4

Johns’s arguments to the contrary are unavailing. She first cites Mostofi v. Experian Info. Sols., Inc., 2014 WL 3571804 (D. Md. July 18, 2014), which she says “outlines exactly the circumstances that obtaining a current copy of the report falls

4 She equates Quilling requesting unnecessary materials for a deposition to an attorney who “upgrade[s] to first class for a business trip.” [Dkt. 42 at 3.] Rather than make a persuasive point about necessity, the court thinks that this flimsy analogy better highlights the stark difference between deposition preparation—part of the litigation for which an attorney is hired—and incidental attorney travel, at least as it relates to actions taken “in the course of representation.” Jackson v. Bank of New York, 62 F. Supp. 3d 802, 820 (N.D. Ill. 2014). within the scope of an attorney-client relationship.” [Dkt. 42 at 5.] In her view, “to be within the scope of the relationship, it must be necessary to obtain a current copy of the report because the entry must still be on the report. These are the parameters of the relationship as defined by the court.” [Id. (emphasis in original)] This greatly overstates Mostofi. The court never characterized these circumstances as necessary (as opposed to sufficient, on the facts) for its holding—in fact, it considered them as an afterthought.5

Johns also argues that “the blanket excuse of existing litigation cannot give a law firm or [TransUnion] carte blanche to obtain any information it wants about Plaintiff,” and that a “holding otherwise obviously allows for abuse.” [Dkt. 42 at 6.] To be clear, though, TransUnion here is “accessing its own lawfully obtained files,” see In re Trans Union Corp., Priv. Litig., 326 F. Supp. 2d 893, 902 (N.D. Ill. 2004), and sharing them with its own attorney. Nothing here gives future defendants or their counsel carte blanche to obtain otherwise-undiscoverable information about a plaintiff.

Finally, the complaint analogizes with a hypothetical, again suggesting a slippery slope:

For instance, if Quilling was provided a report on Plaintiff 3 years after the Pennsylvania litigation concluded, providing that information would be outside the confines of attorney-client privilege even though Quilling was TransUnion’s attorney in Ms. Johns’ case. This is so, because said report would not be pulled to defend the action. The same applies here—the credit pull at issue was not pulled to defend the action as, upon information and belief, Quilling and TransUnion knew all the disputed information was already removed. The mere fact that a deposition was occurring was happenstance, as the report could not been needed or used to inform the deposition given that the pull was made after all the accounts in question had been removed.

[Dkt. 35 ¶ 25 n.2.] But the report’s utility doesn’t change the underlying fact: that Quilling requested it for a deposition. This is what distinguishes the present situation from Johns’s three-years-later scenario—which, by its own terms, occurs outside “the course of representation.” Jackson v. Bank of New York, 62 F. Supp. 3d 802, 820 (N.D. Ill. 2014).

5 The Maryland District Court analogized Mostofi to the “strikingly similar” Norman case. 2014 WL 3571804, at *2. It referenced plaintiff’s “attempt to distinguish Norman by stating that that case had to do with sharing a contested credit report, whereas … what [the Mostofi defendant] shared was not the 2010 contested credit report, but an entirely new report generated after the lawsuit was filed.” Id. at 3. However, before explaining away any distinction by offering what Johns characterizes as necessary circumstances, Mostofi observed that the “distinction did not seem to be driving the Norman court.” Id. Johns’s amended FCRA claims therefore fall short for the same reasons as before. Having confirmed that TransUnion provided Quilling the credit report for a deposition, she cannot plausibly allege the requisite disclosure to a third party. The FCRA claims against both TransUnion and Quilling are therefore dismissed.

B. Intrusion Upon Seclusion To state a claim for intrusion upon seclusion against Quilling, Johns must show that “(1) the defendant committed an unauthorized intrusion or prying into the plaintiff's seclusion; (2) the intrusion would be highly offensive or objectionable to a reasonable person; (3) the matter intruded on was private; and (4) the intrusion caused the plaintiff anguish and suffering.” Spiegel v. McClintic, 916 F.3d 611, 619 (7th Cir. 2019) (quoting Busse v. Motorola, Inc., 351 Ill.App.3d 67, 71 (2004)).

The court need not delve into the elements, though, because any liability is barred by the absolute litigation privilege. This “broad” privilege “affords immunity to attorneys … from tort liability arising out of statements made in connection with the litigation.” Steffes v. Stepan Co., 144 F.3d 1070, 1074 (7th Cir. 1998) (citing Imbler v. Pachtman, 424 U.S. 409, 439 (1976). Illinois extends the privilege “beyond communications to include conduct performed within the practice of law, since attorneys typically do things—actions—in addition to communications in order to secure justice for their clients.” Scarpelli v. McDermott Will & Emery LLP, 2018 IL App (1st) 170874, ¶ 25 (citing O’Callaghan v. Satherlie, 2015 IL App (1st) 142152, ¶ 15). Critically, it bars claims against attorneys for intrusion upon seclusion. Id. ¶ 33.

In applying the privilege, motive is irrelevant, “as is the reasonableness or unreasonableness” of an attorney’s conduct. Id. ¶ 31. The only requirement is that the conduct “must pertain to proposed or pending litigation”—a requirement that is “not strictly applied,” and which, in the event of any doubt, “must be resolved in favor of a finding of pertinency.” Id. ¶ 19.

Here, Johns challenges only the pertinency of Quilling’s request and receipt of her information, reiterating her FCRA argument that “there was no need to obtain a current copy of the credit report,” and thus “[t]here is nothing that connects the request to the litigation.” [Dkt. 42 at 8.] But, again, she concedes that the report was created and shared for a deposition. The notion that, despite this fact, “nothing … connects the request to the litigation” falls flat. Id.

It’s true in a FCRA context and even more so here, given instructions to ignore motive and resolve doubt in favor of a finding of pertinency. Johns’s argument—that “it was simply a whim or a practice to pull the consumer’s credit report when there is a deposition in a case—even without there being any use for it in the litigation”—is directly concerned with Quilling’s motives. [Dkt. 35 ¶ 24.] But the only fact of relevance is the (acknowledged) deposition context, which connects Quilling’s request to the litigation. Therefore, Johns’s intrusion upon seclusion against Quilling is dismissed. IV. Conclusion Having already amended her complaint, and with amendment otherwise futile, the motion to dismiss Johns’s remaining counts is granted with prejudice.

Enter: 25-cv-3915 Date: December 22, 2025 aS Lindsay C. Jenkins