The opinion
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF NEW JERSEY
JOHN DOE-1, et al. : CIVIL ACTION
:
v. :
:
LEXISNEXIS RISK SOLUTIONS, : NO. 24-4566
INC., et al. :
MEMORANDUM
Bartle, J. May 7, 2025
Plaintiffs John Doe (“Doe-1”) and Jane Doe (“Doe-2”),
as set forth in their second amended complaint, bring this
putative class action against defendant LexisNexis Risk
Solutions, Inc. (“LexisNexis”) and a number of presently unknown
persons and entities for violating the Fair Credit Reporting
Act, 15 U.S.C. § 1681, et seq. (“FCRA”).
Plaintiffs first claim that they were harmed when
LexisNexis without their permission imposed a credit freeze on
their accounts instead of adhering to their request simply to
delete their home addresses and unlisted phone numbers as
allowed under a New Jersey statute known as Daniel’s Law. In
the alternative, plaintiffs plead that even if LexisNexis
properly imposed a credit freeze it violated various provisions
of the FCRA to their detriment. Plaintiffs seek actual and
punitive damages, statutory damages, and reasonable attorney’s
fees.1
Before the court is the motion of LexisNexis to
dismiss the second amended complaint under Rule 12(b)(1) of the
Federal Rules of Civil Procedure for lack of standing and under
Rule 12(b)(6) for failure to state a claim on which relief can
be granted (Doc. # 73).
I
The court must accept as true all well-pleaded facts
in plaintiffs’ second amended complaint when, as here, there is
a motion under Rule 12(b)(1) making a facial challenge to
standing and a motion under Rule 12(b)(6). See Bell Atlantic
Corp. v. Twombly, 550 U.S. 544, 555 (2007); see also Const.
Party of Pa. v. Aichele, 757 F.3d 347, 358 (3d Cir. 2014). The
court may also consider “exhibits attached to the complaint and
matters of public record.” Pension Benefit Guar. Corp. v. White
Consol. Indus., Inc., 998 F.2d 1192, 1196 (3d Cir. 1993) (citing
1. Plaintiffs’ first amended complaint had three claims. The
first was that LexisNexis’s imposition of a credit freeze on
plaintiffs’ accounts violated the New Jersey Identity Theft
Protection Act, N.J. Stat. Ann. §§ 56:11-44, et seq. (“NJITPA”)
(Count I). Count II was for intentional interference with
contractual and prospective relations. Count III sought
declaratory relief. The court dismissed this complaint in its
entirety and granted plaintiffs leave to assert claims under the
FCRA. Order, Doe v. LexisNexis Risk Sols., Inc., Civ. A. No.
24-4566 (D.N.J. Jan. 27, 2025) (Doc. # 67). Plaintiffs filed
their second amended complaint on February 6, 2025.
5A Charles Allen Wright & Arthur R. Miller, Federal Practice and
Procedure § 1357 (2d ed. 1990)). A document “integral to or
explicitly relied upon in the complaint,” may likewise be taken
into account. See Schmidt v. Skolas, 770 F.3d 241, 249 (3d Cir.
2014) (quoting In re Burlington Coat Factory Secs. Litig., 114
F.3d 1410, 1426 (3d Cir. 1993) (quotation marks omitted)).
At the pleading stage, plaintiffs must clearly allege
facts demonstrating standing for each element of a claim and
each form of relief. TransUnion LLC v. Ramirez, 594 U.S. 413,
431, 435 (2021); Spokeo, Inc. v. Robins, 578 U.S. 330, 338
(2016). To withstand a Rule 12(b) motion, the plaintiff must
aver sufficient facts to make their claims plausible. Ashcroft
v. Iqbal, 556 U.S. 662, 678 (2009). The pleading must contain
more than “labels and conclusions.” Twombly, 550 U.S. 545. It
must set forth more than “a formulaic recitation of the elements
of a cause of action” or “naked assertions devoid of further
factual enhancement.” Ashcroft, 556 U.S. at 678 (quoting
Twombly, 550 U.S. at 555) (internal quotations and alterations
omitted).
II
Plaintiffs first allege that LexisNexis failed to
comply with 15 U.S.C. § 1681c-1(i)(2)(A) by imposing security
freezes on their credit files without their direct request.
This subsection provides:
Upon receiving a direct request from a
consumer that a consumer reporting agency
place a security freeze, and upon receiving
proper identification from the consumer, the
consumer reporting agency shall, free of
charge, place the security freeze not later
than . . . in the case of a request that is
by toll-free telephone or secure electronic
means, 1 business day after receiving the
request directly from the consumer . . . .
As noted, plaintiffs also plead additional claims in
the alternative. They allege that even if the nondisclosure
requests were properly deemed requests for a security freeze
LexisNexis violated the FCRA by: (1) failing to confirm to
plaintiffs the placement of the security freeze within five
business days after placement under § 1681c-1(i)(2)(B)(i); (2)
failing to inform plaintiffs of their rights under § 1681m(d)(1)
(D) within five business days of the security freeze placement;
(3) failing to provide plaintiffs with a summary of their rights
under § 1681g; and (4) relying on the security freezes to avoid
providing consumer reports for certain uses as outlined in
§ 1681c-1(i)(4).
A person that either willfully or negligently fails to
comply with the obligations set forth by the FCRA may be liable
to the affected consumer for damages and attorney’s fees. See
15 U.S.C. §§ 1681n, 1681o.
The facts as stated in the second amended complaint
are as follows. Plaintiff Doe-1 is a former police officer with
the South Plainfield, New Jersey police department and a former
U.S. Marine. Plaintiff Doe-2 is a retired New Jersey police
officer who suffers from multiple sclerosis. LexisNexis is an
entity that provides data-brokering and credit-reporting
services.
On January 1, 2024, Officer Doe-2 sent emails to
LexisNexis with requests to remove her home address and
telephone number pursuant to Daniel’s Law,2 the statutory
citations to which were included in the emails. On January 2,
2024, Officer Doe-1 did the same. Daniel’s Law provides that
judges, prosecutors and other law enforcement officials as well
as their immediate family members may submit a written notice to
any person, business, or association (“entity”) not to disclose
or otherwise make available their home addresses and unpublished
personal telephone numbers. The entity must comply within 10
business days. The law creates a civil remedy for damages and
injunctive relief as well as criminal penalties for
noncompliance.
Plaintiffs’ first emails to LexisNexis stated:
To Whom It May Concern:
I Am a “Covered Person” as defined by New
Jersey law P.L. 2023, c. 113, P.L. 2021, c.
2. Daniel’s Law, as amended, is codified as follows: N.J.
Stat. Ann. §§ 2C:20-31.1, 17:46B-1.1, 19:31-18:1, 46:26A–12,
47:1-17, 47:1A-1.1, 47:1A-5, 47:1B-1, 47:1B-2, 47:1B-3, 47:1B–4,
56:8-166.1, 56:8-166.3.
371 (as amended, the “Act”). Pursuant to
the Act and Section 3 of New Jersey P.L.
2015, c.226 (C.56:8-166.1) (as amended)
[Daniel’s Law], I hereby request that you
not disclose or re-disclose on the Internet
or otherwise make available, the following
protected information:
Name: [plaintiff’s name was inserted]3
Home Address: [plaintiff’s home address was
inserted]
Within an hour of these emails, plaintiffs sent
parallel emails to LexisNexis requesting that their unlisted
phone numbers not be disclosed. While those second emails were
not quoted in or attached to the second amended complaint,
plaintiffs submitted unredacted and undisputed copies to the
court in connection with the motion of LexisNexis to dismiss the
first amended complaint.
On January 17, 2025, LexisNexis via email acknowledged
receipt of Doe-1’s January 2 requests and on January 19 receipt
of Doe-2’s January 1 requests. Instead of simply deleting their
home addresses and telephone numbers, LexisNexis communicated to
plaintiffs that their requests had been processed and that a
security freeze “will be placed on [their] file[s].” LexisNexis
thereafter sent letters to Doe-1 and Doe-2, confirming that the
3 While plaintiffs list their names in the letter as information
not to be disclosed, they contend that LexisNexis knew they were
only seeking to have their home addresses and unlisted telephone
numbers removed and not their names based on their citation to
Daniel’s Law.
security freezes had been placed on their files. The letters,
which in the record contain no dates, read in relevant part:
RE: Security Freeze Confirmation
Thank you for your request to place a
security freeze on your file with LexisNexis
Risk Solutions. (“LexisNexis”) as provided
by law in your state of residence. This
letter is to confirm that a security freeze
has been placed on your file.
Security freezes will be placed based on
your state of residency and the customers
use case. Based on this information,
LexisNexis may not release your report(s) or
score(s) derived for those use cases. You
should be aware that applying a security
freeze to your file may delay, interfere
with, or prohibit the timely approval of
applications you make for items such as
credit, benefits, or insurance underwriting.
WARNING TO PERSONS SEEKING A CREDIT FREEZE
AS PERMITTED BY THE CREDIT REPORT PROTECTION
ACT: YOU MAY BE DENIED CREDIT AS A RESULT OF
A FREEZE PLACED ON YOUR CREDIT FILE. A
security freeze does not apply to certain
users of consumer reports, including those
with whom you already have an existing
account. These users request your file for
the purpose of reviewing that account.
This security freeze is being placed on your
file pursuant to the security freeze laws in
your state of residence, NJ, specifically,
N.J. Stat. Ann. § 56:11-30, 56:11-46,
13:45F-2.7, 18:45F-5.1 as of the date of
this letter. . . . This security freeze
will remain in place indefinitely until you
decide to temporarily or permanently remove
the security freeze. Below you will find a
unique Personal Identification Number (PIN)
that you will need in the event that you
choose to temporarily or permanently remove
the security freeze.
[plaintiff’s PIN is inserted]
Should you wish to remove your security
freeze, you must contact us and provide
proper identification and your PIN number.
. . .
If you have any further questions, you may
contact the LexisNexis Consumer Center via
email at
consumer.documents@LexisNexisRisk.com or by
phone at 800-456-1244.
. . .
LexisNexis Consumer Center
As a result of the security freezes, both Doe-1 and
Doe-2 allege that they “have been unable to obtain or extend
various important financial, insurance, and health services,
including those that periodically require a credit report pull
or updated financial history.” Second Amended Complaint at ¶ 30
(Doc. # 68) (“SAC”).
Doe-1 attempted to have LexisNexis remove the freeze
on multiple occasions.4 He first called LexisNexis to request
the lifting of the freeze. Despite providing his identifying
information, he was unable over the phone to have the freeze
undone. As a result, he uploaded multiple forms of
4. Doe-1 does not allege that he provided his personal
identification number to request the removal of his security
freeze. While the NJITPA requires that a consumer provide his
or her PIN in order to remove a security freeze, the FCRA does
not.
identification to the LexisNexis portal. After two weeks,
LexisNexis notified him in a letter that those documents were
insufficient. On February 17, 2024, he emailed LexisNexis
requesting the freeze’s removal. LexisNexis has yet to respond
to his request. Doe-1 avers that he “feels that he has
exhausted his options, and that LexisNexis is operating in bad
faith, punishing him for exercising his rights under Daniel’s
Law.” SAC at ¶ 36.
Doe-2 further alleges that the security freeze “caused
[her] to fear for her financial stability and her ability to
access credit in case of an emergency.” Due to her multiple
sclerosis, she has not attempted to have LexisNexis eliminate
the freeze. She has a “limited capacity to deal with
unwarranted mental and emotional stress” and attempting to
remove the security freeze from her account would cause anxiety
and increase her “risk of relapses, flare-ups, and exacerbations
of multiple sclerosis’s most debilitating effects.” Id. at
¶ 42. She requires “unfettered access to sophisticated and
expensive treatments to moderate her medical conditions” which
“requires equally unfettered access to credit on an ongoing
basis.” Id. at ¶ 41.
III
LexisNexis first makes a facial challenge under Rule
12(b)(1) to plaintiffs’ standing. To have standing, a person
must have a personal stake in the outcome. Without standing,
this court does not have subject matter jurisdiction under
Article III of the Constitution as there is no case or
controversy to decide. TransUnion LLC v. Ramirez, 594 U.S. 413,
422-27. As previously noted, plaintiffs must clearly plead
facts alleging standing for each element of each claim as well
as for each form of relief being sought. Id. at 431, 435.
To establish standing,
[A] plaintiff must show (i) that he [or she]
suffered an injury in fact that is concrete,
particularized, and actual or imminent; (ii)
that the injury was likely caused by the
defendant; and (iii) that the injury would
likely be redressed by judicial relief.
Id. at 423 (citing Lujan v. Defs. of Wildlife, 504 U.S. 555,
560-61 (1992)). Such injury cannot be conjectural or
hypothetical. Lujan, 504 U.S. at 560.
Traditional tangible harms, such as monetary loss or
physical injury, “readily qualify as concrete injuries under
Article III.” TransUnion, 594 U.S. at 425. So do intangible
harms, such as emotional or psychological harm. Id.; Clemens v.
ExecuPharm Inc., 48 F.4th 146, 154 (3d Cir. 2022). An
intangible harm is concrete either if there is a close
relationship between the injury and a harm historically
recognized as a basis for common-lawsuits or if the Constitution
or Congress has elevated the harm to the status of a legally
cognizable injury. See TransUnion, 594 U.S. at 425; see also
Long v. Se. Pa. Transp. Auth., 903 F.3d 312, 322-23 (3d Cir.
2018). As our Court of Appeals explained in Clemens:
[W]e hold that . . . where the asserted
theory of injury is a substantial risk of
identity theft or fraud, a plaintiff suing
for damages can satisfy concreteness as long
as he alleges that the exposure to that
substantial risk caused additional,
currently felt concrete harms. For example,
if the plaintiff’s knowledge of the
substantial risk of identity theft causes
him to presently experience emotional
distress or spend money on mitigation
measures like credit monitoring services,
the plaintiff has alleged a concrete injury.
48 F.4th at 155-56.
Plaintiffs clearly allege facts that they have
suffered tangible, concrete, and particularized monetary and
physical harms because of LexisNexis’s wrongfully imposed freeze
on their credit reports. In paragraph 30 of the second amended
complaint, they state that as a result they “have been unable to
obtain or extend various important financial, insurance, and
health services, including those that periodically require a
credit report pull or updated financial history.”
Doe-2 clearly alleges additional concrete and
particularized physical harm as well as concrete and
particularized emotional harm. The imposition of the security
freeze “caused [her] to fear for her financial stability and her
ability to access credit in case of an emergency.” SAC at ¶ 40.
Furthermore, any effort to attempt to unfreeze her credit file
would increase “her mental and emotional stress” and “risk of
relapses, flare-ups, and exacerbations of multiple sclerosis’s
most debilitating effects.” SAC at ¶ 42.
Both plaintiffs have clearly alleged facts
demonstrating standing for their claims under § 1681c-1(i)(2)(A)
for damages for the improper placement of security freezes on
their credit files.
Plaintiffs make the additional claims in paragraph 68
of the second amended complaint. LexisNexis describes them as
“a series of procedural/notice violations” which, it argues, are
insufficient to confer standing. See TransUnion, 594 U.S. at
440; see also Long, 903 F.3d at 325. Plaintiffs allege in
paragraph 68:
LexisNexis willfully violated the FCRA by:
a. Failing to inform Plaintiffs within 5
business days of placing the security
freeze of the imposition of a freeze
under 1681c-1 of the FCRA, see 15
U.S.C. § 1681c-1(i)(2)(B)(i);
b. Failing to inform Plaintiffs within 5
business days after placing the
security freezes of their rights under
section 1681m(d)(1)(D);
c. Failing to provide the summary of
rights required under section 1681g;
d. Relying on the security freezes in
circumstances covered by the exceptions
contained in section 1681c-1(i)(4),
including citing the security freeze to
avoid its obligation to make a consumer
report; for use of information in
connection with the underwriting of
insurance; for use of information in
connection with background screening
purposes; and for use of information
for assessing, verifying, or
authenticating Plaintiffs’ identities
for purposes other than granting of
credit, or for investigating or
preventing actual or potential fraud.
Plaintiffs’ claims under § 1681c-1(i)(2)(B)(i),
§ 1681m(d)(1)(D), and § 1681g are based on the alternative
theory that the credit freeze was properly placed but that
LexisNexis did not timely provide them with certain information
required when a freeze has been properly placed. Here
plaintiffs have simply not alleged any facts that they have
suffered any monetary, physical or emotional harm as a result of
these violations. They rely primarily on informational harm to
confer standing.
Our Court of Appeals, just days ago, handed down a
decision involving informational standing. Public Interest
Legal Foundation v. Secretary Commonwealth of Pennsylvania, No.
23-1590, 2025 WL 1242229 (3d Cir. Apr. 25, 2025).5 The Court
made clear that a plaintiff to establish informational standing
must prove “a nexus among the omitted information . . . , the
purported harm actually caused by the specific violation, and
the ‘concrete interest’ that Congress identified as ‘deserving
5 Unlike the present action, the Court of Appeals decided the
standing issue in Public Interest on the record after the
District Court had ruled on summary judgment motions.
of protection’ when it created the disclosure requirement.” Id.
at *6 (quoting Kelly v. RealPage, Inc., 47 F.4th 202, 213 (3d
Cir. 2022)). A violation of a statute with a disclosure
requirement is not sufficient in and of itself to support
standing. Rather, a plaintiff must demonstrate “a nexus among a
downstream consequence, his alleged harm, and the interest
Congress sought to protect.” Pub. Int. Legal Found., 2025 WL
1242229, at *6.
In Public Interest, the plaintiff was a “public
interest organization” seeking to obtain information from the
Pennsylvania Secretary of the Commonwealth under the National
Voter Registration Act of 1993 (“NVRA”), 52 U.S.C. § 20507. Id.
at *1. Plaintiff there maintained that a computer glitch at the
Pennsylvania Department of Transportation had resulted in the
registration of ineligible persons to vote when they applied for
or sought to renew their drivers’ licenses or vehicle
registrations. Id. The Court ruled that the aim of the statute
was to increase citizen participation in federal elections. Id.
at *7. While the statute contains a provision for public
inspection of records related to the accuracy of official voter
lists and a right to sue, the Court concluded that plaintiff, an
out-of-state organization, did not show that its desire to
protect voting rights was hindered by the refusal of the
Secretary of the Commonwealth to turn over records. Id. at *8-
9.
The Court emphasized that NVRA had a broader purpose
than the access to records. It explained that “if disclosure of
information is the essence of a statute, as it is in [the
Freedom of Information Act], standing would easily be met
because public availability of information is itself the
interest that Congress seeks to protect under such statutes.”
Id. at *5.
Here Doe-1 and Doe-2 have not clearly pleaded that the
absence of information required to be furnished under the FCRA
caused them any harm. Even if they have done so, they have not
pleaded a nexus among the harm, the consequence, and the
interest Congress sought to protect.
The FCRA is designed to insure “fair and accurate
credit reporting” and the exercise by consumer reporting
agencies of “their grave responsibilities with fairness,
impartiality and a respect for the consumer’s right to privacy.”
See 15 U.S.C. § 1681(a). In essence, the purpose of the FCRA is
to require fair, impartial and accurate credit reports and to
protect the consumer’s privacy when directed to do so by the
consumer. While the FCRA requires disclosure of specified
information to a consumer under certain circumstances, it is not
the essence of the statute so as to create informational
standing without more.
The plaintiffs’ position that they suffered
informational harm is undermined not only by what they do not
allege but also by what they do. According to the second
amended complaint, they had information at the outset from
LexisNexis as to the adverse consequences that may occur from
the imposition of a security freeze. In its letters to
plaintiffs, LexisNexis advised:
You should be aware that applying a security
freeze to your file may delay, interfere
with, or prohibit the timely approval of
applications you make for items such as
credit, benefits, or insurance underwriting.
WARNING TO PERSONS SEEKING A CREDIT FREEZE
AS PERMITTED BY THE CREDIT REPORT PROTECTION
ACT: YOU MAY BE DENIED CREDIT AS A RESULT OF
A FREEZE PLACED ON YOUR CREDIT FILE. A
security freeze does not apply to certain
users of consumer reports, including those
with whom you already have an existing
account. These users request your file for
the purpose of reviewing that account.
The letters further advised them on the steps to take to remove
the freeze.
These letters reveal that plaintiffs had significant
information. Plaintiffs do not state what material information
was omitted so as to cause them harm. As noted, omitted
information is a necessary ingredient for informational
standing. In sum, plaintiffs have not pleaded what is required
for informational standing for claims under § 1681c-
1(i)(2)(B)(i), § 1681m(d)(1)(D), and § 1681g.
Finally, plaintiffs assert a claim under § 1681c-
1(i)(4). Under this provision, a consumer reporting agency is
still required to supply a credit report for certain uses
notwithstanding the placement of a security freeze by the
consumer. Plaintiffs maintain that LexisNexis wrongfully relied
on the freeze when it should have supplied their credit reports
to third parties. Among other situations, the freeze does not
control when a credit report is sought by “a person using
information in connection with the underwriting of insurance.”
See 15 U.S.C. § 1681c-1(i)(4)(H). The facts pleading a
concrete and particularized harm fit only this situation among
the situations enumerated under § 1681c-1(i)(4). In paragraph
30 of the second amended complaint, plaintiffs allege that as a
result of the actions of LexisNexis, they have been unable to
obtain or extend insurance services. Accordingly, plaintiffs
have properly pleaded standing for their claim under § 1681c-
1(i)(4)(H).
IV
Even if plaintiffs have standing, LexisNexis maintains
that this action should be dismissed under Rule 12(b)(6) as
plaintiffs have not stated any claim upon which relief can be
granted. To avoid dismissal, plaintiff must state facts that
make the claims plausible. Ashcroft v. Iqbal, 556 U.S. 662, 678
(2009).
First, LexisNexis argues that plaintiffs have no claim
against it for the imposition of a credit freeze without the
permission of the consumer because neither § 1681c-1(i)(2)(A)
nor any other provision of the FCRA prohibits it from doing so.
The FCRA provides that a consumer reporting agency may place a
security freeze on a consumer’s account “[u]pon receiving a
direct request from” either a consumer or his or her
representative. 15 U.S.C. §§ 1681c-1(i)(2)(A), 1681c-
1(j)(2)(A).
The FCRA specifies only two circumstances when a
consumer reporting agency may impose a security freeze: (1) when
it receives a direct request from the consumer or (2) when it
receives a direct request from the consumer’s representative.
The FCRA authorizes no other instance for the placement of a
security freeze. By enumerating two circumstances, Congress is
necessarily excluding all others. In interpreting § 1681c-
1(i)(2)(A), it is appropriate for the court to apply the well-
established canon of statutory construction that the expression
of one thing means the exclusion of other things (expressio
unius est exclusio alterius). See United States v. Nasir, 17
F.4th 459, 471-72 (3d Cir. 2021); Collinsgru v. Palmyra Bd. of
Educ., 161 F.3d 225, 232 (3d Cir. 1998), abrogated on other
grounds, Winkelman v. Parma City Sch. Dist., 550 U.S. 516
(2007); Moyer v. Showboat Casino Hotel, 56 F. Supp. 2d 498, 502
(D.N.J. 1999). Black’s Law Dictionary contains an apt
illustration: “[w]hen a car dealer promises a low financing rate
to ‘purchasers with good credit,’ it is entirely clear that the
rate is not available to purchasers with spotty credit.”
Expressio unius est exclusion alterius, Black’s Law Dictionary
(12th ed. 2024) (quoting Antonin Scalia & Bryan A. Garner,
Reading Law: The Interpretation of Legal Texts 107 (2012)).
The argument of LexisNexis that plaintiffs have not
stated a claim under § 1681c-1(i)(2)(A) also runs counter to the
findings of Congress incorporated into the FCRA. These findings
recognize that:
(1) The banking system is dependent upon
fair and accurate credit reporting.
Inaccurate credit reports directly
impair the efficiency of the banking
system, and unfair credit reporting
methods undermine the public confidence
which is essential to the continued
functioning of the banking system.
...
(3) Consumer reporting agencies have
assumed a vital role in assembling and
evaluating consumer credit and other
information on consumers.
(4) There is a need to insure that consumer
reporting agencies exercise their grave
responsibilities with fairness,
impartiality, and a respect for the
consumer's right to privacy.
15 U.S.C. § 1681(a).
A person’s credit history is essential information for
the proper functioning of the banking system and commerce in
general. Freezing a consumer’s credit report without the
consumer’s approval impedes this system. It would be an
unreasonable reading of the FCRA to allow consumer reporting
agencies, which are in the business of providing credit reports,
to block access to a consumer’s credit reports with impunity
when the consumer’s permission has not been obtained. It would
also constitute an “unfair credit reporting method.” Such
action would be contrary to a consumer reporting agency’s “vital
role in assembling and evaluating consumer credit and other
information on consumers.” Such action would also undermine the
purpose of the FCRA “to insure that consumer reporting agencies
exercise their grave responsibilities with fairness,
impartiality and a respect for the consumer’s right to privacy.”
Id. at § 1681(a)(4) (emphasis added). Defendant’s position that
it cannot be liable for placing a credit freeze without the
request of the consumer lacks merit.
LexisNexis further argues that the law does not
mandate that it supply credit reports and therefore that cannot
be held liable if it does not do so because of a credit freeze
it has unilaterally imposed. It is, of course, true that
LexisNexis is not mandated to undertake the business of a
consumer reporting agency. Nonetheless, once it enters the
business, it must act within the bounds set by the FCRA. It
must exercise its grave responsibilities impartially. Again, it
cannot negligently or willfully freeze a consumer’s credit file
as alleged here.
The court has held that plaintiffs do not have
standing for their claims under § 1681c-1(i)(2)(B)(i),
§ 1681m(d), and § 1681g of the FCRA. Even if standing does
exist, plaintiffs have not stated claims upon which relief can
be granted under these provisions.
Subsection 1681c-1(i)(2)(B)(i) requires that “[n]ot
later than 5 business days after placing a security freeze under
subparagraph (A), a consumer reporting agency shall--(i) send
confirmation of the placement to the consumer . . . .”
LexisNexis asserts that this claim fails because the second
amended complaint does not set forth facts that the freezes were
placed more than 5 business days before LexisNexis confirmed the
freezes to the plaintiffs.
Plaintiffs do not allege either the date LexisNexis
imposed the security freezes or the date they received notice
confirming the security freezes. They merely plead that
LexisNexis informed them that a security freeze “will be placed
on [their] files” and that at some unidentified point thereafter
they received notice that such freezes were imposed. Absent is
any detail on the timing of the imposition and the timing of the
confirmation. Thus, it is speculation as what the time interval
was. Plaintiffs do not meet the plausibility test.
Accordingly, plaintiffs have not stated a claim under § 1681c-
1(i)(2)(B)(1).
Subsection 1681m(d)(1) imposes requirements on persons
such as insurance companies, lenders, or employers when they use
a consumer report in connection with a credit or insurance
transaction not initiated by the consumer.6 When providing a
consumer with any written solicitation, these persons must
include “clear and conspicuous” statements informing the
consumer that he or she has the right to prohibit information
contained in his or her credit file from being used in
connection with such transactions.
LexisNexis maintains there is no private right of
action under § 1681m. It is correct. Subsection 1681m(h)(8) of
the FCRA provides that § 1681m may not be enforced by § 1681n
and § 1681o of the FRCA, which impose civil liability for
willful or negligent noncompliance. Rather, § 1681m may only be
enforced by the Federal Trade Commission, other federal
administrative agencies, and state officials or agencies
6. Such persons may receive credit information from a consumer
reporting agency in order to solicit business from certain
consumers. For example, a telephone company may send an offer
for a “free phone” to certain consumers after reviewing their
credit reports. See, e.g., Murray v. New Cingular Wireless
Servs., Inc., 523 F.3d 719, 722 (7th Cir. 2008).
pursuant to § 1681s of the FCRA. Because plaintiffs have no
private right of action for any purported violation of § 1681m,
their claim under § 1681m(d)(1)(D) is not viable.7
LexisNexis next contends that plaintiffs fail to state
a claim under § 1681g of the FCRA. This section compels
consumer reporting agencies to provide a summary of rights to
consumers when they either request information regarding their
credit file or when they express a belief that they have been a
victim of identity theft. See 15 U.S.C. §S 1681g(a); (d)(2).
Plaintiffs do not allege any request. Their emails on
January 1 and 2 did not request the disclosure of any
information under § 1681g(a). Nor do they aver a belief that
they have been the victim of identity theft. Plaintiffs do not
state claims under § 1681g.
Lastly, LexisNexis asserts that plaintiffs do not
state a claim under § 1681c-1(i)(4) which obligates a consumer
reporting agency to supply a credit report under certain
circumstances even if a consumer had requested a freeze. This
obligation on the part of the consumer reporting agency exists
7 Even if a private right of action existed, Plaintiffs fail to
allege any facts to state that LexisNexis was obligated to
provide such a clear and conspicuous statement to plaintiffs.
There are no allegations in the second amended complaint to show
that LexisNexis “use[d] a consumer report on any consumer in
connection with any credit or insurance transaction that is not
initiated by the consumer.” Id. at § 1681m(d)(1).
when a person requests a report in connection with the
underwriting of insurance. See 15 U.S.C. § 1681c-1(i)(4)(H).
Plaintiffs allege that LexisNexis improperly relied on the
security freeze in not providing their credit reports in this
situation. Plaintiffs aver in paragraph 30 of the second
amended complaint that as a result of the actions of LexisNexis,
they “have been unable to obtain or extend . . . insurance . . .
.” This is a viable claim.
V
The motion of LexisNexis to dismiss the second amended
complaint will be granted in part and denied in part.
Plaintiffs have standing and state viable claims under § 1681c-
1(i)(2)(A) and § 1681c-1(i)(4)(H) of the FCRA. To this extent
the motions of LexisNexis under Rule 12(b)(1) and Rule 12(b)(6)
will be denied. The motion of LexisNexis under Rule 12(b)(1)
will otherwise be granted. Plaintiffs’ allegations that
LexisNexis violated § 1681c-1(i)(2)(B)(i), § 1681m(d)(1)(D), and
§ 1681g of the FCRA will be dismissed for lack of standing.
BY THE COURT:
/s/ Harvey Bartle III
J.