In Cortez v Trans Union LLC, the United States Court of Appeals for the Third Circuit decided a case at the intersection of the Fair Credit Reporting Act (FCRA) and the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, better known as the USA PATRIOT Act (Patriot Act). Central to the case was a service offered by Trans Union through a third-party vendor called “OFAC Advisor.” OFAC Advisor was designed to generate an alert on a Trans Union credit report whenever an individual’s name was similar to a name on the Office of Foreign Asset Control’s (OFAC) “Specially Designated Nationals” (SDN) list. The SDN list is compiled by OFAC to identify individuals such as terrorists and narcotics traffickers with whom, under the Patriot Act and accompanying regulations, U.S. persons are generally prohibited from dealing.

In Cortez, the plaintiff, Sandra Cortez, had decided to purchase a car from John Elway Subaru in Colorado. She planned on financing the purchase with a loan from the dealership, and prior to going to the dealership, obtained a copy of her credit report from Trans Union. The report obtained by Cortez did not contain any OFAC Advisor alert or reference to the SDN list. When the dealership obtained a copy of Cortez’s credit report from Trans Union, however, it did contain an OFAC Advisor alert, which stated that the “input name matches name on the OFAC database.” The SDN identified by the OFAC Advisor alert as a match was “Cortes Quintero, Sandra.” After several hours, the dealership eventually confirmed that Cortez was not the individual on the SDN list, and approved Cortez for financing on her car.

In light of her experience at the dealership, Cortez sought to correct the information on her credit report. She contacted Trans Union a total of four times, informing the company that she was not the “Sandra Cortes Quintero” whose name appeared on the SDN list and requesting that Trans Union remove the erroneous OFAC Advisor alert from her credit report. Trans Union, however, did not conduct any investigation regarding Cortez’s complaint or whether the OFAC alert should appear on her credit report. Instead, Trans Union simply responded that the alert did not appear on Cortez’s credit report. Cortez took this to mean that the problem had been corrected. But when she later attempted to rent an apartment, the credit report obtained by the landlord still contained the erroneous OFAC Advisor alert.

Upon learning that the alert still appeared on her credit report, Cortez sued Trans Union for violations of the FCRA. A jury returned a verdict in her favor finding that: (1) Trans Union failed to follow reasonable procedures to assure maximum accuracy in Cortez’s credit report in violation of 15 U.S.C. § 1681e; (2) Trans Union willfully failed to provide Cortez all of the information in her file in violation of 15 U.S.C. § 1681g ; (3) Trans Union willfully failed to reasonably investigate Cortez’s disputes after informing the company of the erroneous OFAC Advisor alerts in violation of 15 U.S.C. § 1681i(a); and (4) Trans Union willfully failed to note Cortez’s dispute on subsequent credit reports in violation of 15 U.S.C. §§ 1681i(b) and (c). The jury awarded Cortez $50,000 in compensatory damages and $750,000 in punitive damages, which the district court reduced to $100,000.

Trans Union appealed both its liability under the FCRA and the damages awards. On appeal, Trans Union advanced two primary legal arguments with respect to its liability. First, Trans Union argued that it could not be liable for failing to assure maximum reliability in Cortez’s credit report because the OFAC Advisor alert was not part of a “consumer report” as defined by the FCRA. The company asserted that the OFAC Advisor alerts were not “used or expected to be used . . . in establishing the consumer’s eligibility for . . . credit,” because, under its contract with Elway Subaru and other customers, they were to be used for Patriot Act compliance only. The Court of Appeals swiftly rejected this argument, noting that under the Patriot Act, companies are generally prohibited from extending credit to individuals on OFAC’s SDN list. Thus, the court concluded, the OFAC Advisor alert was central to an individual’s “eligibility” for credit inasmuch as it “goes to the very legality of a credit transaction.”

Second, Trans Union argued that it could not be liable for failing to provide Cortez all of the information in her file or for failing to conduct an investigation of disputed information in her file because the OFAC Advisor alert was not a part of Cortez’s “file” as defined by the FCRA. The FCRA defines a consumer’s “file” as “all of the information on that consumer recorded and retained by a consumer reporting agency regardless of how the information is stored.” Trans Union’s OFAC Advisor product is provided to its customers by third-party vendor Accuity, Inc. As a result, Trans Union itself does not maintain the data for OFAC Advisor in any of its own databases. In light of this, Trans Union claimed that the OFAC data was not in Cortez’s “file” because it was not “retained by” Trans Union. The Third Circuit rejected this claim, noting that it did “not believe that Congress intended to allow credit reporting companies to escape the disclosure requirement in § 1681a(g) by simply contracting with a third party to store and maintain information that would otherwise clearly be part of the consumer’s file and is included in a credit report.”

In addition to appealing the jury’s determination of liability, Trans Union also challenged the jury’s award of compensatory and punitive damages. First, Trans Union claimed that Cortez presented insufficient evidence as a matter of law to support the jury’s award of $50,000 in compensatory damages. Cortez had testified extensively about the “severe anxiety, fear, distress, and embarrassment” she had suffered as a result of the erroneous information on her credit report. Notwithstanding Trans Union’s argument to the contrary, the Court of Appeals held that this testimony was sufficient to support the jury’s award, because “damages for violations of the FCRA allow recovery for humiliation and embarrassment or mental distress even if the plaintiff has suffered no out-of-pocket expenses.” In so holding, the Third Circuit expressly refused to adopt the Fifth Circuit’s standard, set forth in Cousin v. Trans Union Corp., 246 F.3d 359 (5th Cir. 2001), requiring “a degree of specificity which may include corroborating testimony or medical or psychological evidence in support of the damage award.”

Finally, Trans Union claimed that punitive damages should not have been awarded because the evidence did not support a finding that its violation of the FCRA was willful. Trans Union noted that there was a dearth of precedent regarding the relation of OFAC’s SDN list to the FCRA and that it reasonably relied on its legal department’s conclusion that the OFAC Advisor alerts were not governed by the FCRA. In rejecting this argument, the Court of Appeals noted that the mere fact that Trans Union’s actions rested on a legal conclusion did not immunize it from liability and that an interpretation of the FCRA could be in reckless disregard of that statute’s requirements even where there was a lack of definitive authority on the particular issue. Accordingly, the Third Circuit affirmed Trans Union’s liability and the jury’s award of compensatory and punitive damages in all respects.