Johns v. Trans Union LLC.

• Court: District Court, N.D. Illinois
• Decided: August 20, 2025
• Docket: 1:25-cv-03915
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION Alycia Johns,

Plaintiff,

No. 25 CV 3915 v.

Judge Lindsay C. Jenkins TransUnion, LLC and Quilling, Selander, Lownds, Winslett & Moser, P.C.,

Defendants.

MEMORANDUM OPINION AND ORDER Amid an earlier, ongoing lawsuit against TransUnion, LLC (“TransUnion”) for furnishing inaccurate credit information, Alycia Johns (“Johns”) has brought separate claims against TransUnion for sharing an updated credit report with its counsel, Quilling, Selander, Lownds, Winslett & Moser, P.C. (“Quilling”). The claims brought against TransUnion—for violations of the Fair Credit Reporting Act and intrusion upon seclusion—have also been brought against Quilling. Before the court is TransUnion’s motion to dismiss Counts One and Three of Johns’s first amended complaint for failure to state a claim under Rule 12(b)(6). [Dkt. 19]. The motion is granted.

I. Background To decide the motion to dismiss, the court accepts as true all well-pleaded allegations set forth in Plaintiff’s first amended complaint and draws all reasonable inferences in her favor. Thomas v. Neenah Joint Sch. Dist., 74 F.4th 521, 522 (7th Cir. 2023).

Plaintiff Johns was the victim of fraudulent credit activity. See [Dkt. 18 ¶ 13.]1 In a separate, underlying matter, she sued Defendant TransUnion, a consumer reporting agency, for issuing inaccurate credit reports to third parties. [Id. ¶¶ 4, 11– 12.] Quilling, a defendant in this action, represents TransUnion as counsel in the underlying matter. [Id. ¶ 19.]

In April 2024, after the fraudulent activity was scrubbed from Johns’s account, Quilling requested and received from TransUnion an updated credit report. [Id. ¶¶ 15–17, 20–21.] The report contained, among other items, Johns’s up-to-date credit

1 Citations to docket filings generally refer to the electronic pagination provided by CM/ECF, which may not be consistent with page numbers in the underlying documents. information, her applications for credit, and the last four digits of her social security number. [Id. ¶ 21.] She alleges that Quilling wanted “‘to have the information’ contained in the report” in connection with a deposition in the underlying matter, as well as to determine “Plaintiff’s eligibility and/or ineligibility for credit”—not to investigate her claims. [Id. ¶¶ 23–26.]

This lawsuit followed. Johns sued both TransUnion and Quilling, alleging that the disclosure violated the “privacy rights of any reasonable consumer” and the “confidentiality that the [Fair Credit Reporting Act] sought to impose.” [Id. ¶¶ 27– 28.] She alleges violations of the FCRA and intrusion upon seclusion against each defendant, alleging that she suffered anguish, humiliation, and embarrassment from knowing TransUnion disclosed her private information to an “unauthorized third party.” [Id. ¶¶ 35, 39, 45, 50.] TransUnion has moved to dismiss both claims against it under Federal Rule of Civil Procedure 12(b)(6).

II. Legal Standard A motion to dismiss under Rule 12(b)(6) tests the legal sufficiency of a plaintiff's claims. To survive a motion to dismiss under Rule 12(b)(6), “a complaint’s factual allegations ‘must be enough to raise a right to relief above the speculative level.’” Emerson v. Dart, 109 F.4th 936, 941 (7th Cir. 2024) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007)). Although the court takes well-pleaded factual allegations as true, conclusory allegations are insufficient to avoid dismissal. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).

III. Analysis TransUnion argues that the first amended complaint fails to allege sufficient facts to establish a violation of the FCRA or intrusion upon seclusion. Before delving into the merits, however, the court has an independent obligation to confirm its subject matter jurisdiction and ensure that Johns has standing to bring suit. See Gadelhak v. AT&T Servs., Inc., 950 F.3d 458, 461 (7th Cir. 2020).

A. Standing In connection with TransUnion’s issuance of her credit information to Quilling, Johns alleges that she experienced a series of intangible injuries: “mental anguish, humiliation, and embarrassment.” [Dkt. 18 ¶¶ 35, 39, 45, 50.]2 For standing

2 “At the pleading stage, general factual allegations of injury resulting from the defendant’s conduct may suffice, for on a motion to dismiss we ‘presum[e] that general allegations embrace those specific facts that are necessary to support the claim.’” Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992) (quoting Lujan v. Nat'l Wildlife Fed'n, 497 U.S. 871, 889 (1990)). These allegations need only “plausibly suggest each element of standing,” with all inferences drawn in the plaintiff’s favor. Bazile v. Fin. Sys. of Green Bay, Inc., 983 F.3d 274, 278 (7th Cir. 2020) (internal quotation marks and citation omitted). purposes, the Seventh Circuit has both recognized and rejected the sufficiency of intangible injuries in related contexts. See Baysal v. Midvale Indem. Co., 78 F.4th 976, 979 (7th Cir. 2023) (observing that, for standing purposes, intangible harms stemming from unauthorized disclosures have been classified “on one side of the Court’s divide or another”). A brief discussion is therefore warranted notwithstanding the lack of challenge.

Consistent with Article III’s limitation of federal court jurisdiction to “cases and controversies,” plaintiffs must have standing to pursue their cases. Pucillo v. Nat’l Credit Sys., Inc., 66 F.4th 634, 637 (7th Cir. 2023). In other words, they must have a “personal stake” in the litigation. TransUnion v. Ramirez, 594 U.S. 413, 423 (2021). To establish standing, the plaintiff must demonstrate “(1) a concrete and particularized injury in fact (2) that is traceable to the defendant's conduct and (3) that can be redressed by judicial relief.” Pierre v. Midland Credit Mgmt., Inc., 29 F.4th 934, 937 (7th Cir. 2022) (citing Lujan v. Defs. of Wildlife, 504 U.S. at 560–61). Intangible injuries can be concrete, so long as they are “‘real, and not abstract.” Spokeo, Inc. v. Robins, 578 U.S. 330, 340 (2016) (cleaned up).

Both history and Congress’s judgment inform whether a harm is concrete. Pucillo, 66 F.4th at 639. The court thus considers “whether the alleged injury to the plaintiff has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts.” Ramirez, 594 U.S. at 424 (quoting Spokeo, 578 U.S. at 341). The Supreme Court has recognized “reputational harms, disclosure of private information, and intrusion upon seclusion” among these common-law analogues. Id. at 425. Congress, meanwhile, “specifically articulate[d] a statutory right to privacy in consumer credit reports,” in the FCRA. Crabtree v. Experian Info. Sols., Inc., 948 F.3d 872, 880 (7th Cir. 2020); 15 U.S.C. § 1681(a) (finding “a need to insure that consumer reporting agencies exercise … respect for the consumer’s right to privacy”).

To that end, the Seventh Circuit has recognized as concrete a plaintiff’s alleged “dignitary” harm in response to an unauthorized inquiry into their credit information—“analogous to the unlawful inspection of one’s mail, wallet, or bank account.” Persinger v. Sw. Credit Sys., L.P., 20 F.4th 1184, 1191–92 (7th Cir. 2021) (holding that disclosure of customer’s propensity-to-pay score establishes a concrete injury, despite providing “less information” than a full credit report). So, too, has it classified the disclosure of a credit score as so potentially embarrassing, and a social security number as so intimate as to qualify as an injury in fact. See Baysal, 78 F.4th at 979.

Here, Johns’s up-to-date credit information, applications for credit, and parts of her social security number were shared with whom she describes as an “unauthorized third party.” [Dkt. 18 ¶ 27]. This is precisely the type of disclosure recognized in this jurisdiction as sufficiently private to fit within the Supreme Court’s common-law-analogue framework. Baysal, 78 F.4th at 979. She alleges that TransUnion’s sharing of such information violated “the privacy rights of any reasonable consumer,” thereby causing her mental anguish, humiliation, and embarrassment. [Dkt. 18 ¶ 28]. This harm, though decidedly emotional, is rooted in the alleged disclosure of private information.3

The case is different from those in which the Seventh Circuit held that “worry and anxiety are not the kind of concrete injury essential to standing.” Baysal, 78 F.4th at 977. See also Wadsworth v. Kross, Lieberman & Stone, Inc., 12 F.4th 665, 668 (7th Cir. 2021) (“anxiety and embarrassment are not injuries in fact” in FDCPA context); Pierre, 29 F.4th at 939 (“Psychological states induced by a debt collector’s letter likewise fall short”). In many of those instances, the emotional response was divorced from any invasion of privacy, such as when a recipient of an unintrusive debt collection letter experienced anxiety, stress, embarrassment, or fear. See Wadsworth, 12 F.4th at 668; Pierre, 29 F.4th at 939; Pucillo, 66 F.4th at 640. Or, there was a disclosure, but it lacked any “potentially embarrassing or intimate details.” Baysal, 78 F.4th at 979 (discussing driver’s license numbers); Dinerstein v. Google, LLC, 73 F.4th 502, 513 (7th Cir. 2023) (“anonymized” medical data).

Johns’s situation is distinct. Her anguish, humiliation, and embarrassment evidence a reaction to a perceived disclosure of private credit information—an intangible injury recognized both in tradition and by Congress. She thus pleaded sufficient facts to plausibly suggest a concrete injury, traceable to TransUnion’s issuance of the report, and redressable by the court.

B. Failure to State a Claim under 12(b)(6) The court now turns to TransUnion’s motion to dismiss both the FCRA violation and intrusion upon seclusion claims.

1. Violation of the Fair Credit Reporting Act Johns alleges that TransUnion provided Quilling a “consumer report” without any permissible purpose, without receiving from Quilling the requisite certification, and without providing Quilling notice of its responsibilities. [Dkt. 18 ¶¶ 32–34]. The parties dispute only whether the report constitutes a “consumer report” as that term is used in the FCRA, a question that turns on counsel’s authorization to receive a report. 15 U.S.C. § 1681a. In short, TransUnion argues that it issued the report not to a third party, but to its own agent. [Dkt. 20 at 6]. Johns, meanwhile, characterizes

3 This does not bear on the court’s evaluation of the merits of Johns’s FCRA and intrusion upon seclusion claims. Whether she will ultimately prevail is “irrelevant” to standing, which requires only a “‘close relationship’” to a tort analog, rather than an “‘exact duplicate.’” Persinger, 20 F.4th at 1192, 1192 n.3 (quoting Ramirez, 594 U.S. at 433). Quilling—notwithstanding its representation of TransUnion in the underlying matter—as a third party. [Dkt. 24 at 6].

In Wantz v. Experian Info. Sols., the Seventh Circuit held that “there cannot be a consumer report without disclosure to a third party,” in which case an agency has no duty to follow FCRA procedures. 386 F.3d 829, 834 (7th Cir. 2004), abrogated by other grounds by Safeco Ins. Co. of America v. Burr, 551 U.S. 47 (2007). The law remains clear in that regard. Thornhill v. TransUnion, LLC, 2025 WL 588623, at *5 (N.D. Ill. Feb. 24, 2025); Ayala v. Experian Info. Sols., Inc., 2024 WL 1328827, at *5 (N.D. Ill. Mar. 28, 2024). So, too, is it clear that, traditionally, attorneys are agents of their clients. See Johnson v. McBride, 381 F.3d 587, 589 (7th Cir. 2004); Steffes v. Stepan Co., 144 F.3d 1070, 1075 (7th Cir. 1998); RESTATEMENT (THIRD) OF AGENCY § 1.01 cmt. c (2006) (“elements of common-law agency are present in the relationships between … client and lawyer”). Because their acts are “attributed to the clients they represent,” they are not third parties. See Johnson, 381 F.3d at 589.

To succeed, then, Johns must allege facts making it reasonable to infer that TransUnion issued Quilling the report outside the confines of the attorney-client representation. While TransUnion cites several decisions establishing that “an attorney representing a CRA in defense of litigation concerning the contents of a credit report is not a ‘third party,’” Johns correctly notes that her case is distinguishable, since the actually furnished report was not in dispute in the underlying litigation. [Dkt. 20 at 6] (quoting Mostofi v. Experian Info. Solutions, Inc., 2014 WL 3571804, at *3 (D. Md. July 18, 2014)). See also Norman v. Lyons, 2013 WL 655058, at *3 (N.D. Tex. Feb. 22, 2013); Rajapaske v. Shaw, 2022 WL 1051108, at *6 (S.D.N.Y. Feb. 18, 2022). Still, she fails to allege that TransUnion provided the report to Quilling in a third-party capacity. In fact, her first amended complaint affirmatively alleges the opposite.

Johns alleges “[u]pon information and belief, the reason Quilling wanted ‘to have the information,’ was simply because a deposition of TransUnion corporate representative was being conducted in the” underlying case. [Dkt. 18 ¶ 24]. It’s irrelevant, then, that Quilling didn’t need the report to investigate Johns’s claims as she also alleges. [Id., ¶ 26.] Johns’s counterarguments—that there was no “legitimate business need” for the report and that “TU’s and Quilling’s actions [] were not about the defending the litigation,”—are literally not true, at least according to the complaint. [Dkt. 24 at 6–7.] Johns affirmatively alleges that Quilling received the report in connection with the underlying litigation—for a deposition. By extension, the only reasonable inference is that Quilling was bound by a fiduciary “relationship of trust, confidence, and confidentiality with his client.” Hartman v. Lisle Park Dist., 158 F. Supp. 2d 869, 876 (N.D. Ill. 2001). The effect is no different than if TransUnion accessed the report itself. See id. at 876–77. Even absent the specific allegation that TransUnion provided the information to inform a deposition, Johns has not pleaded anything that gives rise to a reasonable inference that Quilling sought the report as a third party. The complaint alleges that Quilling “simply sought to take advantage of their access to Plaintiff’s information” but says nothing as to why, or how it intended to take advantage of such information. [Dkt. 18 ¶ 26]. Indeed, no credit, employment, insurance, license, investment, or business purpose described in 15 U.S.C. § 1681b(a) is discernible from the complaint.

Accordingly, Johns has failed to allege anything that takes Quilling outside the ambit of the traditional principal-agent relationship associated with clients and their attorneys. Thus, the complaint does not allege facts supporting an inference that TransUnion provided Johns’s information to a third party, as is necessary to establish that it issued a consumer report. The duties set forth by the FCRA are inapplicable, and Count One is dismissed.

2. Intrusion Upon Seclusion Johns has also alleged that TransUnion intruded upon her seclusion by “provid[ing her] sensitive information to unauthorized-third-party Quilling.” [Dkt. 18 ¶ 43]. But as TransUnion correctly argues, “a plaintiff fails to state a claim for invaded seclusion if the harm flows from publication rather than the intrusion.” Thomas v. Pearl, 998 F.2d 447, 452 (7th Cir. 1993) (citing Lovgren v. Citizens First Nat'l Bank, 126 Ill.2d 411, 417 (1989)). Johns’s claim fails for that very reason.

To state a claim for intrusion upon seclusion under Illinois law, a plaintiff must show that “(1) the defendant committed an unauthorized intrusion or prying into the plaintiff’s seclusion; (2) the intrusion would be highly offensive or objectionable to a reasonable person; (3) the matter intruded on was private; and (4) the intrusion caused the plaintiff anguish and suffering.” Spiegel v. McClintic, 916 F.3d 611, 619 (7th Cir. 2019) (quoting Busse v. Motorola, Inc., 351 Ill.App.3d 67, 71 (2004)). The fundamental basis of the tort is the “highly offensive prying,” not “publication or publicity.” Lovgren, 126 Ill.2d at 416–17. By alleging only the former, a plaintiff “plead[s] themselves out of court.” Angelo v. Moriarty, 2016 WL 640525, at *5 (N.D. Ill. Feb. 18, 2016).

Nowhere in her complaint does Johns suggest that TransUnion engaged in offensive prying. Rather, she alleges three-times over that TransUnion’s liability emerges from the “provi[sion of] sensitive information … [t]he transmission of said financial information … [the] publish[ing] to an unauthorized third party.” [Dkt. 18 ¶¶ 43–45]. This misunderstands the very essence of intrusion upon seclusion.

In opposing TransUnion’s motion to dismiss, Johns pivots to arguing that “the very fact that [TransUnion] generated this report and accessed it, is an unlawful intrusion by itself, regardless of the subsequent disclosure to Quilling.” [Dkt. 24 at 7]. But the court cannot consider new allegations raised for the first time in response briefs. See Pirelli Armstrong Tire Corp. Retiree Med. Benefits Tr. v. Walgreen Co., 631 F.3d 436, 448 (7th Cir. 2011). In any event, the argument fails; review of one’s “own records is not an unreasonable intrusion upon seclusion.” Socha v. City of Joliet, 107 F.4th 700, 711 (7th Cir. 2024) (quoting Schmidt v. Ameritech IIl., 329 Tll.App.3d 1020, 1031 (2002)); In re Trans Union Corp., Priv. Litig., 326 F. Supp. 2d 893, 902 (N.D. III. 2004). Johns has thus failed to plausibly allege that TransUnion intruded upon her seclusion. Disclosure is not a basis for the tort, and the agency was within its rights to access its own records. Count Three is therefore dismissed with prejudice. IV. Conclusion The motion to dismiss is granted. Count One (violation of the FCRA as to TransUnion) is dismissed without prejudice. Though the court is skeptical of Johns’s ability to state a claim against TransUnion consistent with her Rule 11 obligations, it grants leave to amend. See Zimmerman v. Bornick, 25 F.4th 491, 494 (7th Cir. 2022). Because amendment would be futile as to Count Three (intrusion upon seclusion as to TransUnion), that claim is dismissed with prejudice. Id.

Enter: 25-cv-3915 Date: August 20, 2025 Lindsay C. Jenkins