UNITED STATES DISTRICT COURT MIDDLE DISTRICT OF FLORIDA TAMPA DIVISION
SHANELL GRAY,
Plaintiff,
v. Case No. 8:23-cv-981-WFJ-AEP
EXPERIAN INFORMATION SOLUTIONS, INC.,
Defendant. ________________________________/
ORDER Before the Court is Defendant’s motion to dismiss (Dkt. 26), Plaintiff’s response (Dkt. 33), and Defendant’s reply (Dkt. 38). After careful review of the allegations of the amended complaint (Dkt. 23), the submissions, and the applicable law, the Court concludes the amended complaint is due to be dismissed with leave to amend. BACKGROUND Plaintiff Shanell Gray, a consumer, brings this action against Defendant Experian Information Solutions, Inc. (“Experian”), a credit reporting agency, for violations of the Fair Credit Reporting Act (“FCRA”), specifically 15 U.S.C. §§ 1681e, 1681g(a)(2). Ms. Gray is a consumer and Experian is a consumer reporting agency as each is defined in the FCRA.1 Dkt. 23 ¶¶ 6; 9. The amended complaint alleges the following facts, which the Court presumes are true.
On April 24, 2023, Plaintiff “obtained her consumer disclosure from Experian.” Id. ¶ 10. This disclosure revealed that Plaintiff had two “social security number variations.” Id. ¶ 11; Dkt. 23-1. According to Plaintiff, she has
had the same social security number (“SSN”) all her life and has not obtained or used another SSN. Dkt. 23 ¶¶ 13, 14, 15. The alternate SSNs provided in the disclosure only revealed the last four digits. Id. ¶¶ 21–23. This truncated disclosure did not reveal the source of the false SSNs. Id. ¶ 29, 30, 98.
Based on the disclosure, as just described, Plaintiff concludes that “Experian inaccurately included false information” in its report. Id. ¶¶ 17, 76. Plaintiff asserts the alternate SSNs are part of Experian’s consumer “file.” Id. ¶ 48.
Plaintiff alleges that Experian failed to comply with § 1681e, which requires policies in place that reasonably ensure the “maximum possible accuracy” of the consumer reports produced and sold to third parties. Id. ¶¶ 26–28, 67, 73, 93 (Count I). According to Plaintiff, Experian also violated 15 U.S.C. § 1681g(a)’s
disclosure requirement by not disclosing “the source(s) of information on which it
1 A “consumer” is an “individual.” 15 U.S.C. § 1681a(c). A “consumer reporting agency” is “any person which . . . regularly engages . . . in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports as third parties . . . .” Id. § 1681a(f). relied” in making its determination that she had used other SSNs. Id. ¶¶ 11, 18–20, 55–58, 72, 81, 98 (Count II).
On each of the 76 consumer reports regarding Plaintiff that were purportedly sold by Experian to third parties, Plaintiff alleges that on “information and belief” Experian listed the two false alternate SSNs. Id. ¶¶ 31–34, 93. Plaintiff adds that
products sold by Experian, such as Experian Fraud Shield, factor the presence of alternate SSNs into credit reports. Id. ¶¶ 39, 40. With respect to a consumer’s fraud shield score, Plaintiff contends that Experian’s fraud-screening algorithms use variations, including SSN variations, in a consumer’s personal identifying
formation. Id. ¶¶ 41, 61. Plaintiff alleges that “the presence of alternate SSNs in an Experian report may adversely impact the consumer’s ability to obtain credit from—or even do business with—certain creditors.” Id. ¶ 54.
Plaintiff filed this lawsuit within two weeks of the disclosure. Dkt. 1. Plaintiff alleges that at the time she filed this action, “Experian was unquestionably in receipt of a formal dispute of the alternate SSN information by Ms. Gray.” Dkt. 23 ¶ 55. Both counts allege Experian’s conduct was willful and intentional, or
done with reckless disregard, or alternatively, Experian’s conduct was negligent. Id. ¶¶ 94, 96, 99, 101. She seeks the greater of actual or statutory damages as well as punitive damages under §§ 1681n(a)(1)(A), 1681o(a)(1), and 1681n(a)(2),
respectively. Id. at 16–17,19. PLEADING STANDARDS The Court accepts all factual allegations, not legal conclusions, as true and
draws all reasonable inferences from those facts in the light most favorable to the plaintiff. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555–556 (2007)); Pielage v. McConnell, 516 F.3d 1282,
1284 (11th Cir. 2008) (viewing facts in the light most favorable to plaintiff).2 To survive a motion to dismiss filed pursuant to Rule 12(b)(6), Fed. R. Civ. P., the complaint must contain sufficient facts to state a claim for relief that is “plausible on its face.” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 570). While
Rule 8(a) does not require detailed allegations, it does require more than mere “labels and conclusions.” Id. (quoting Twombly at 555). If necessary, the Court may consider “documents central to or referenced in the complaint[] and matters
judicially noticed.” La Grasta v. First Union Sec., Inc., 358 F.3d 840, 845 (11th Cir. 2004) (citations omitted). DISCUSSION Experian moves to dismiss, contending that Ms. Gray cannot state a legal
claim for relief under either identified section of the FCRA. Under both § 1681e(b) and § 1681g, according to Defendant, an individual’s personal
2 See also Papasan v. Allain, 478 U.S. 265, 286 (1986) (stating legal conclusions “couched” as facts need not be accepted as true); Davila v. Delta Air Lines, Inc., 326 F.3d 1183, 1185 (11th Cir. 2003) (stating “legal conclusions masquerading as facts” will not prevent dismissal). identifying information (“PII”), including the SSN and all reported variations, is not considered “consumer report” information and therefore Defendant is not
required to disclose same. In the alternative, Defendant contends that even if the SSN and reported variations were to fall into the category of a consumer report, there are no factual allegations supporting a claim under either or both statutory
sections. Each ground for dismissal will be addressed in turn. Count I: § 1681e(b)—Inaccuracy of Consumer Report To establish a viable claim under § 1681e(b), the consumer must show that a consumer reporting agency, or “CRA,” communicated inaccurate information in its
consumer report to a third party and failed to follow reasonable procedures to ensure the report’s maximum possible accuracy, thereby causing actual damages to the consumer. See Bermudez v. Equifax Info. Servs., LLC, No. 6:07-cv-1492-Orl-
31GJK, 2008 WL 5235161, at *2 (M.D. Fla. Dec. 15, 2008) (citing Enwonwu v. Trans Union, LLC, 164 F. App’x 914 (11th Cir. 2006)). When preparing a consumer report, the CRA “shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the
report relates.” Id. § 1681e(b) (emphasis added). Inaccuracies do not impose strict liability on the reporting agency, which may avoid liability by showing the “inaccurate report was generated by following reasonable procedures.” Williams v.
First Advantage LNS Screening Solutions, Inc., 947 F.3d 735, 745 (11th Cir. 2020) (citing Cahlin v. Gen. Motors Acceptance Corp., 936 F.2d 1151, 1156 (11th Cir. 1991)); Rumbough v. Experian Info. Sols., Inc., No. 6:16-cv-1305-Orl-18GJK,
2018 WL 10455201, at *3 (M.D. Fla. Feb. 14, 2018) (same). The amended complaint alleges that Defendant communicated inaccuracies in Plaintiff’s SSNs to third parties (lenders and the listed purchasers) and in doing
so failed to follow reasonable procedures to ensure the maximum possible accuracy in preparing credit reports. Notwithstanding the absence of any identification of the lenders or additional context, the threshold obstacle Plaintiff faces is satisfying the statutory criteria of a “consumer report.” A “consumer
report” is defined as “any . . . communication of any information” by a consumer reporting agency pertaining to a consumer’s “credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of
living,” which information is collected to determine the consumer’s eligibility for personal credit, insurance, or employment. 15 U.S.C. § 1681a(d)(1).3 Defendant argues that the FCRA does not regulate a CRA’s furnishing of personal identifying information to third parties. Defendant asserts that SSNs are
not considered part of a “consumer report” under the Act. On the other hand, Plaintiff urges that the false alternate SSNs should be considered consumer report
3 Other permissible purposes for which a reporting agency may furnish a consumer report to a third party are listed in § 1681b. 15 U.S.C. § 1681a(d)(1). information because they bear on Plaintiff’s character and general reputation. After a thorough review of the case law and agency guidance, the Court finds that
under the facts as alleged here, Plaintiff’s false alternate SSNs do not constitute consumer report information for the following reasons. The amended complaint makes the following references to (consumer)
reports. The “[Defendant’s] report” contained false, alternate SSNs not belonging to Plaintiff. Dkt. 23 ¶¶ 16, 17, 93. The reports included “the full 9-digits of the alternate SSNs to lenders who requested Ms. Gray’s credit report.” Id. ¶ 21. Experian incorporated the two alternate SSNs into reports it sold to third parties.
Id. ¶¶ 26, 93. The “[r]ecords from Experian indicate that it has sold at least seventy-six (76) consumer reports regarding Ms. Gray in the last 24 months.” Id. ¶¶ 31, 32 (listing purchasers of reports); Dkt. 23-1 at 1–11 (Exh. B). Upon
“information and belief” each of the 76 consumer reports sold by Experian contained the two alternate complete SSNs associated with Plaintiff’s name. Dkt. 23 ¶¶ 24, 26, 37. Only certain consumer information falls within the protection of accuracy
reporting under § 1681e(b). Courts, generally, have held that personal identifying information such as a consumer’s name and social security number does not itself constitute a credit report but only “header information.” See, e.g., In re Equifax,
Inc., Customer Data Sec. Breach Litig., 362 F. Supp. 3d 1295, 1313 (N.D. Ga. 2019) (holding that PII stolen from a reporting agency during a data breach is neither “furnished” nor a “consumer report” under the FCRA). The term “header”
derives from the information’s location at the top of a credit report. Experian Info. Sols., Inc. v. FTC, No. Civ. 3:00-CV-1631-H, 2001 WL 257834, at *1 (N.D. Tex. Mar. 8, 2001). Notably, only a “[f]ew courts expressly define ‘header data’, but
the concept certainly includes some combination of name (and aliases), address, change in address, date of birth, phone number, and social security number.” Parker v. Equifax Info. Servs., LLC, No. 2:15-cv-14365, 2017 WL 4003437, at *3 (E.D. Mich. Sept. 12, 2017) (citing Thompson v. Equifax Credit Info. Servs., Inc.,
No. D-1468, 2001 WL 34142847, at *1–*2 (M.D. Ala. Dec. 14, 2001) and other cases). This biological, header-type information does not typically have any bearing
on a consumer’s credit worthiness or any of the other six factors listed in § 1681(d). See, e.g., Bickley v. Dish Network, LLC, 751 F.3d 724, 729 (6th Cir. 2014) (holding that header information is not a consumer report in contrast with an “Echostar Risk” number, which has a bearing on credit worthiness); Individual
Reference Servs. Grp., Inc. v. FTC, 145 F. Supp. 2d 6, 17 (D.D.C. 2001), aff’d sub nom., Trans Union LLC v. FTC, 295 F.3d 42 (D.C. Cir. 2002) (noting that “credit header” data, such as name, address, and social security number, is not a consumer
report because this information does not bear on credit worthiness, and also citing agency authority).4 As observed by Plaintiff, however, these cases do not foreclose the possibility that personal identifying information could function as a
consumer report depending on the context. See Parker, 2017 WL 4003437, at *3 (citing Trans Union Corp. v. FTC, 81 F.3d 228, 229–30 (D.C. Cir. 1996)). For example, a list of names and addresses prepared by the CRA and sold for
marketing to consumers who meet certain criteria (target marketing list) is considered a consumer report. See Trans Union, 81 F.3d at 230; Individual Reference, 145 F. Supp. 2d at 17. In this case, however, the amended complaint does not allege a target
marketing list scenario. Nor does Plaintiff’s reliance on the Experian’s Fraud Shield product transform the listing of her inaccurate alternate SSNs into regulated consumer reports. Count I, as alleged, does not state facts giving rise to a reporting
agency’s liability under § 1681e(b), because alternate SSNs listed in a credit report are not considered “consumer report” information subject to the “accuracy”
4 See also Daniels v. Experian Info. Sols., Inc., No. CV 109-017, 2009 WL 1811548, at *4 (S.D. Ga. June 24, 2009) (noting that a consumer report does not include the consumer’s name, address, SSN, or phone number and citing Individual Reference, 145 F. Supp. 2d at 17). In an unpublished order with no precedential effect, the Second Circuit has held that a “consumer report” does not encompass contact information because such information has no bearing on credit worthiness. Cohen v. Equifax Info. Servs., LLC, 827 F. App’x 14, 17 (2d Cir. 2020) (summary order). requirement.5 Although it appears unlikely that Plaintiff will be able to replead a viable claim under § 1681e(b), she is afforded an opportunity to do so.
Count II: § 1681g(a)(2)—Disclosure of source information at consumer’s request
The FCRA requires reporting agencies, upon a consumer’s request, to disclose to that consumer certain types of information. 15 U.S.C. § 1681g(a) (“Every consumer reporting agency shall, upon request, and subject to section 1681h(1)(1) of this title, clearly and accurately disclose to the consumer [six categories of information]”). The first category includes “all information in the consumer’s file” with some exceptions. Id. § 1681g(a)(1). Five additional categories list information to be disclosed:
(2) The sources of information” [provided an exception does not apply] . . . (3) Identification of each person . . .that procured a consumer report . . . (4) The dates, original payees, . . .upon which is based any adverse characterization of the consumer . . . (5) A record of all inquiries . . . (6) If a consumer requests the credit file . . .
Id. § 1681g(a)(2)–(6).
5 Cohen affirmed summary judgment, holding that inaccuracies in contact information do not give rise to a claim under § 1681e(b) because contact information does not bear on credit worthiness. 827 F. App’x at 17. Although “contact information” is not explained in Cohen, the Second Circuit relies on another unpublished case in which the plaintiff alleged inaccuracies in her social security number in her credit report. Id., citing Williams-Steele v. Trans Union, 642 F. App’x 72, 72–3 (2d Cir. 2016) (summary order). The only categories relevant to the amended complaint are the first two. Before addressing whether the alternate SSNs at issue fall within the definition of a
consumer’s “file” subject to disclosure, the Court examines Plaintiff’s allegations concerning her request to Defendant. Request
Defendant contends that Plaintiff never made the “request” necessary to trigger a consumer disclosure under § 1681g. According to Defendant, Plaintiff was required to make a separate (not generic) request for source information under subsection (2). Dkt. 26 at 15-16; Dkt. 38 at 6–7. Defendant argues, in the
alternative, that even if only a single request for information under the first two subsections were sufficient, Plaintiff fails to plead that she “directly requested the disclosure from Experian.” Dkt. 38 at 7. In Defendant’s words, she “vaguely”
states that she “obtained” her disclosure “without pleading whether she requested it or obtained it by other means, thus failing to plead she requested source information.” Id. To state a claim under § 1681(g), a plaintiff must plead that she requested a
disclosure of her information from the reporting agency. See Green v. Chase Card Bankcard Servs., No. 8:16-cv-3252-T-33AAS, 2017 WL 1135314, at *6 (M.D. Fla. Mar. 25, 2017) (granting leave to amend complaint because plaintiff “fail[ed]
to allege that she requested a disclosure of her consumer information form Trans Union”). A plaintiff must allege and elaborate on the content of the requests for disclosure. Bey v. Am. Honda Fin. Corp., No. 8:17-cv-759-T-33MAP, 2017 WL
4869015, at *3 (M.D. Fla. Oct. 26, 2017). The amended complaint states that on April 24, 2023, Plaintiff “obtained her consumer disclosure from Experian.” Dkt. 23 ¶ 10. In her response, Plaintiff
states that “she requested her consumer disclosure on April 24, 2023.” Dkt. 33 at 16. The response does not clarify or elaborate on exactly how, when, and what she requested from Defendant. Nor did Plaintiff allege that she requested Defendant to include the sources of information. See Diaz v. Chase, 416 F. Supp. 3d 1090, 1097
(D. Nev. 2019) (granting leave to amend complaint where plaintiff did not allege that she requested Experian to include the sources of information). The Court agrees with Experian that Plaintiff fails to allege whether she
requested disclosures directly from Experian or obtained the disclosure by other means. Dkt. 38 at 7. Although Plaintiff need not make “specific discrete requests for each of the six categories of disclosures,” she must expressly state whether she made a direct request to Defendant or merely received courtesy copies from other
sources. See Kelly v. RealPage, Inc., 47 F.4th 202, 219 (3rd Cir. 2022) (reversing lower court and holding that requirement of specific discrete requests for each category would “limit[] the CRA’s disclosure obligation to the particular category expressly requested” but plaintiff must still allege a request was made to the reporting agency).
In keeping with the authorities cited above, Plaintiff will be given an opportunity to replead and allege the date the request was made, the factual content of the request, and the date, time, and content of the response from Defendant.
Plaintiff should include any requests as exhibits to any amended complaint. Consumer file A consumer “file” is defined in § 1681a(g), and a “consumer report” is defined in § 1681a(d). Because Congress provided different statutory terms and
used them in different sections, it is presumed that distinct meanings were intended. Collins v. Experian Info. Sols., Inc., 775 F.3d 1330, 1335 (11th Cir. 2015) (construing and contrasting § 1681e(b) pertaining to a consumer report and §
1681i(a) to a file).6 The FCRA defines a “file” to include “all of the information on that consumer recorded and retained by a consumer reporting agency regardless of how the information is stored.” 15 U.S.C. § 1681a(g). “A file is simply the information
retained by a consumer reporting agency.” Collins, 775 F.3d at 1335. The main
6 Collins “concluded that the FCRA’s different uses of the terms was deliberate, and that the provisions relating to ‘consumer reports’ do not apply to the ‘files’ of information maintained by a CRA, but only to communications—that is, reports—about that consumer information.” Thomas v. Equifax Info. Servs., LLC, No. 1:22-cv-4848-CAP-JKL, 2023 WL 4049317, at *2 n.1. (N.D. Ga. Apr. 12, 2023). distinction between a consumer report and a file is that “a ‘consumer report’ requires communication to a third party, while a ‘file’ does not.” Id.
Defendant contends that other circuits have stated that a consumer’s “file” does not encompass personal identifying information. See Gillespie v. Trans Union, LLC, 482 F.3d 907, 909 (7th Cir. 2007); Shaw v. Experian Info. Sols., 891
F.3d 749, 759 (9th Cir. 2018); Tailford v. Experian Info. Sols., 26 F.4th 1092, 1101–02 (9th Cir. 2022). These circuits hold that a consumer’s file includes “all information on the consumer” recorded and retained by a CRA “that might be furnished, or has been furnished, in a consumer report on that consumer.”
Tailford, 26 F.4th at 1101 (quoting Shaw, 891 F.3d at 759, and citing Gillespie, 482 F.3d at 909). Tailford gives a reasonable interpretation of “might be furnished” as information like that shown to have been included by the CRA in a
consumer report or, at least, planned to be included in a report in the future. Id., 26 F.4th at 1101–02. Tailford stresses that this definition should neither include “any and all information ever retained by a CRA” nor swallow up the enumerated categories under § 1681g into one expansive definition. Id.
Another court recently discussed the importance of maintaining the separate nature of each of the five categories listed after the first very broad and expansive one under § 1681g. See Nelson v. Experian Info. Sols., Inc., No. 4:21-cv-894-
CLM, 2023 WL 5284831 (N.D. Ala. Aug. 16, 2023). Nelson involved a § 1681i claim for failure to correct inaccurate PII, including an SSN, on the plaintiff’s credit report. Starting with the definition of “file” in 1681a(g), the court noted that
SSNs constitute information recorded and retained by a CRA. Nelson relied on the circuit authority cited above in maintaining that all five independent categories, which follow the first, seemingly all-inclusive category, must be given effect.
Recognizing the integrity of each category, Nelson concluded that “the ultimate question [of whether] names, addresses, and SSNs are the type of information that CRAs must reinvestigate when disputed” remains unanswered. Nelson, however, proceeded to resolve this issue in the context of § 1681i.
This Court will not guess at this juncture whether Plaintiff could state a claim under § 1681i. The amended complaint invokes only § 1681g, not § 1681i. Although Count II states that she received a customer disclosure, the contents of
any disclosure are not alleged. Again, the disclosures should be attached as exhibits to any amended complaint. Plaintiff is permitted the opportunity to replead, should she so choose, and clarify and flesh out specific facts supporting any viable claim under the FCRA.
Plaintiff must allege the request for the disclosure, whether the request sought disclosure of the full nine-digit false, alternate SSNs, and whether the request sought the sources of information Defendant relied on to determine Plaintiff had
used, or attempted to use, more than one social security number in credit transactions. Plaintiff must also allege and provide the specifics with respect to the disclosure, as discussed above. A final caveat: Should Plaintiff choose to amend the complaint, using the term “‘on information and belief’ should be avoided. At the very least, Plaintiff should provide sufficient factual content to support a basis for the belief. See, e.g., Joseph v. Experian Info Sols., Inc., No. 1:18-cv-3443-WMR-RGV, 2019 WL 5458009, at *8 (N.D. Ga. July 3, 2019); Gavin v. Trans Union LLC, No. 7:18- 00523-DCC-JDA, 2018 WL 782443, at *4 (D. S.C. Sept. 24, 2018); Scott v. Experian Info. Sols., Inc., No. 18-CV-60178, 2018 WL 3360754, at *6 (S.D. Fla. June 29, 2018). Accordingly, Defendant’s Motion to Dismiss (Dkt. 26) is granted with leave to amend. The amended complaint (Dkt. 23) is dismissed without prejudice. If Plaintiff chooses to replead, an amended complaint consistent with this Order must be filed within fourteen (14) days. DONE AND ORDERED at Tampa, Florida, on October 19, 2023. me, UNITED STATES DISTRICT JUDGE COPIES FURNISHED TO: Counsel of record