By now, those in the financial services, vendor management, and consumer protection spaces have heard of Hunstein v. Preferred Collection & Mgmt. Services, Inc. and that case's rare three trips to a federal appellate court in effort to answer this question: does the federal Fair Debt Collection Practices Act (the "FDCPA") apply to prohibit the very routine communications between a debt collector and its vendors? Unfortunately, none of the opinions ultimately provide an answer to this apparent question of first impression, though they imply one.
What message does the Hunstein opinions send to companies that regularly transmit personal and potentially sensitive information to third-party vendors?
Brief Procedural History
In Hunstein 1,1 a three-judge panel of the Eleventh Circuit first unanimously held that a debt collector's transmission of a debtor's private data to a dunning vendor was actionable under the FDCPA.2
In Hunstein 2,3 the same panel then sua sponte vacated and superseded Hunstein 1 (to address the intervening Supreme Court opinion of TransUnion LLC v. Ramirez4), but ultimately reached the same conclusion, 2-1, but over a vociferous dissent.
The Eleventh Circuit then granted rehearing en banc, and on September 8, 2021, issued its Hunstein 35 opinion vacating Hunstein 2 and remanding to the district court with instructions to dismiss the case without prejudice, finding that the plaintiff failed to properly allege his claim. In doing so, the Hunstein 3 court considered but ultimately did not make a ruling on the pivotal question—whether the FDCPA prohibits a debt collector from sending a consumer's private data to a dunning vendor.
Background
Section 1692c(b) of the FDCPA provides, in pertinent part, that "without the prior consent of the consumer given directly to the debt collector, . . . a debt collector may not communicate, in connection with the collection of any debt, with any person other than the consumer . . . ." Here, the plaintiff's son received medical care, and the plaintiff allegedly did not pay the bill, which was then placed for collections with the defendant. The defendant then sent certain information, including the plaintiff's status as a debtor, the exact balance of the debt and the entity to which it was owed, that the debt concerned his son's medical treatment, and the plaintiff's son's name, to its dunning vendor, Compumail, to issue dunning letter(s) to the plaintiff.
The issue in all three Hunstein opinions was not whether this communication of information was prohibited by § 1692c(b), but whether plaintiff had alleged a "concrete harm" such that he had standing to bring the claim (i.e., whether the courts had a case or controversy sufficient to confer jurisdiction).
Concrete harm is normally alleged by showing an injury in fact—some tangible harm to a person's body or property. In cases of a bare statutory violation unaccompanied by an injury in fact, however, the plaintiff must show an "intangible harm."6 Intangible harm is a relatively illusory concept, but one way courts assess it is by "compar[ing] [the intangible harm] to a harm redressed in a traditional common-law tort."7
In his complaint, Hunstein alleged that Preferred Collection's communication with Compumail in connection with debt collections was comparable to the common-law tort of Public Disclosure of Private Facts ("Public Disclosure"), which requires showing, amongst other things, the "publicity" of private information.
The Majority Opinion
The Hunstein 3 Majority ultimately punted on whether the plaintiff had shown standing, ruling that Hunstein failed to even allege publicity in his complaint, and thus he failed to state a prima facie case for concrete harm.
According to the Majority, publication—"to communicate a fact concerning plaintiff's private life to a single person or even to a . . . group of persons"—is insufficient to show a Public Disclosure.8 Publicity, on the other hand, "requires either actual public disclosure or a substantial certainty that the disclosed information will reach the public at large."9 This was not present in Hunstein's complaint, the court reasoned, because "Hunstein did not even allege that a single [Compumail] employee ever read or understood the information about his debt."10 Thus, the court remanded for dismissal without prejudice because "Hunstein did not allege any publicity at all. . . ."11
The Majority relied heavily on the Supreme Court's 2021 decision in Transunion, LLC, where the Court considered whether the plaintiffs (a class) had alleged concrete injury in their claims that the defendant TransUnion, LLC, a credit reporting agency, failed to use reasonable procedures to ensure the accuracy of their credit reporting to not include inaccurate OFAC data labeling the plaintiffs as potential terrorists.12 In order to determine if plaintiffs alleged concrete injury from a bare statutory violation (i.e., unaccompanied by an injury-in-fact), the Court compared the plaintiffs' alleged harm to defamation, which traditionally requires publication (which, unlike publicity, can be a private communication) of a false statement. The Court ultimately concluded that the 1,856 class members whose credit reports had been disseminated to third parties (mainly creditors or potential creditors doing credit checks) had alleged a sufficient intangible injury to confer standing, whereas the 6,332 class members whose credit reports were never disseminated did not.
In cases such as these where allegedly inaccurate or misleading information sits in a company database, the plaintiffs' harm is roughly the same, legally speaking, as if someone wrote a defamatory letter and then stored it in her desk drawer. A letter that is not sent does not harm anyone, no matter how insulting the letter is.13
In reaching its conclusion, the Majority reasoned that Hunstein effectively claimed that Preferred Collection sent Hunstein's information to Compumail, where it "[sat] in a company database . . . ."14
So where does that leave us? Technically, Hunstein 3 is nothing more than a guide on how to (and how not to) plead an FDCPA claim. Some value can be gleaned, however, from the Majority's dicta, in which it suggested that it would not have found standing even if Hunstein had alleged that Compumail's employees read or understood the information, because this would have been publication, but not publicity.
In drawing the distinction between public (publicity) and private (publication) communications, the court reasoned that "any publication in a newspaper or a magazine, even of small circulation, or in a handbill distributed to a large number of persons, or any broadcast over the radio, or statement made in an address to a large audience, is sufficient to give publicity."15 On the other hand, "[w]hen a trade secret is communicated to thousands of new employees after a merger, for example, it does not become public information."16
So was Preferred Collection's transmission of Hunstein's personal information publication or publicity? The court ultimately did not answer this question, but its approach in dicta strongly implies that it would have characterized the communication as a private disclosure and thus insufficient to establish a concrete injury under the comparison to Public Disclosure:
- All that to say, nowhere does Hunstein suggest that Preferred Collection's communication reached, or was sure to reach, the public. Quite the opposite—the complaint describes a disclosure that reached a single intermediary, which then passed the information back to Hunstein without sharing it more broadly.17
- Under even the most generous reading of [Hunstein's] complaint, one company sent his information to another, where it was "populated" into a private letter that was sent to his own home. That is simply not enough.18
- So Preferred did indeed disclose information to the mail vendor's agents, but the complaint describes the same automatic process that the Supreme Court explained does not constitute an injury.19
The Concurrence
The Concurrence echoed the Majority's holding but went further to draw a second distinction between Hunstein's claims and another element of the comparator tort of Public Disclosure—that the information communicated was "highly offensive."20
Even if there was publicity, the Concurrence reasoned, it would not be an actionable Public Disclosure because the information communicated may have caused personal offense (which is not sufficient) but was not "a kind highly offensive to the ordinary reasonable man."21
The Dissent
The Dissent starts off by calling into question the Majority's "refusing to give Hunstein's complaint an appropriately charitable reading and, worse, just flat disregarding its express allegations."22 The Dissent quotes the complaint where it says "Preferred violated [the FDCPA] when it disclosed information about Mr. Hunstein's purported [medical] debt to the employees of an unauthorized third-party . . . in connection with the collection of the Debt."23 Moreover, the Dissent raises the "the eminently reasonable inference that the flesh-and-blood individuals to whom that information was disclosed read it."24
The Dissent also called into question the Majority's reliance on the Supreme Court's decision in TransUnion because that case was decided on the merits and appealed post-judgment, whereas the Hunstein 3 opinion was decided at the pleading stage on a motion to dismiss, at which point the plaintiff's claims are read in the light most favorable to plaintiff, indulging every inference in plaintiff's favor. Under this more forgiving light, the Dissent concluded, Hunstein stated a prima facie case for an intangible injury as compared to Public Disclosure.
Conclusion
The Hunstein on its face is a little bit much ado about nothing. Hunstein advanced a relatively novel theory that the FDCPA acts as a consumer-privacy statute, and the Hunstein 1 and 2 panels tacitly approved by finding standing, only to have the en banc Eleventh Circuit effectively overrule and dismiss on the basis that Hunstein failed to adequately allege one of the elements of Public Disclosure. It dodged the substantive question and ultimately does little more than provide rudimentary-level guidance on how to plead a claim.
But, to the extent the Eleventh Circuit (and potentially another circuit) were to comport with the Hunstein 3 dicta, the conclusion would seemingly be that the FDCPA does not confer standing to bring consumer-privacy claims on the basis of a debt collector's transmission of a consumer's information to a dunning vendor. And of course, the concurrence raises the question-not-reached as to, even if there was publicity, whether the information conveyed was the type of "highly offensive" disclosure that is actionable in Public Disclosure—concluding it was not.
This is almost certainly not the final word on the machination of consumer-privacy claims under the FDCPA. Indeed, we may even see Hunstein re-file his complaint with the magic missing language. Or, Hunstein may decide to appeal the decision up to the Supreme Court for a final resolution on the issue of standing. Until then, with little-to-nothing in the way of precedent from the Eleventh Circuit to date, debt collectors and lenders who meet the definition of a debt collector in all jurisdictions need to take affirmative steps to implement policies and procedures to avoid (or at least mitigate) class-action FDCPA cases based upon their continued (and prior) use of third party debt-collection vendors.
Takeaway
Even if your company is not a debt collector and would not be subject to the FDCPA, the facts in Hunstein should give you pause if you regularly transmit personal and potentially sensitive information regarding consumers to third-party vendors. What can your company do to avoid a similar suit?
Consumer privacy is a huge concern for regulators of all kinds. This is nothing new. But the focus on vendor management (or lack thereof) and how it contributes to the violation of consumer privacy is relatively new. Whenever your company is negotiating with a vendor that will be touching consumer information, make certain that vendor will be contractually obligated to maintain that information in the strictest confidence. Since Hunstein was decided on a motion to dismiss, we did not get to see what facts Preferred Collection had in its defense. Perhaps its agreement with Compumail restricted access to debtor information to a small group of Compumail employees tasked with preparing its dunning letters. That would certainly have been a fact in favor of showing that there was no publication, let alone publicity, of Hunstein's information.
Use this opportunity to review your company's contracts with its vendors and ensure that the confidentiality provisions restrict access to sensitive data. Even if Hunstein was ultimately much ado about nothing, it is a powerful reminder of the risk associated with vendor management.
Footnotes
1. Richard Hunstein v. Preferred Collection & Mgmt. Services, Inc., 994 F.3d 1341, 1344 (11th Cir. 2021), opinion vacated and superseded on reh'g, 17 F.4th 1016 (11th Cir. 2021), reh'g en banc granted, opinion vacated, 17 F.4th 1103 (11th Cir. 2021) and on reh'g en banc, No. 19-14434, 2022 WL 4102824 (11th Cir. Sept. 8, 2022).
2. To read more about Hunstein 1, see our prior Client Alert, Eleventh Circuit Renews the FDCPA as a Consumer Privacy Statute; Deals Major Blow to Debt Collection Services (April 29, 2021).
3. Richard Hunstein v. Preferred Collection & Mgmt. Services, Inc., 17 F.4th 1016, 1020 (11th Cir. 2021), reh'g en banc granted, opinion vacated, 17 F.4th 1103 (11th Cir. 2021) and on reh'g en banc, No. 19-14434, 2022 WL 4102824 (11th Cir. Sept. 8, 2022).
4. TransUnion LLC v. Ramirez, ––– U.S. ––––, 141 S. Ct. 2190, 210 L.Ed.2d 568 (2021).
5. Richard Hunstein v. Preferred Collection & Mgmt. Services, Inc., No. 19-14434, 2022 WL 4102824 (11th Cir. Sept. 8, 2022).
6. See TransUnion LLC v. Ramirez, 210 L. Ed. 2d 568, 141 S. Ct. 2190, 2205 (2021) ("[U]nder Article III, an injury in law is not an injury in fact. Only those plaintiffs who have been concretely harmed by a defendant's statutory violation may sue that private defendant over that violation in federal court.").
7. Hunstein 3 at *1.
8. Id. at *9 (quoting and citing Restatement (Second) of Torts § 652D cmt. a).
9. Id. at *8.
10. Id.
11. Id. at *10.
12. TransUnion LLC, 141 S. Ct. at 2205.
13. Id. at 2210; see also id. n.6 (publication (and, according to the Hunstein 3 Majority, therefore publicity) "generally require[s] evidence that the document was actually read and not merely processed." (citations omitted)).
14. Hunstein 3 at *11 (citing and quoting TransUnion LLC, 141 S. Ct. at 2210).
15. Id.
16. Id. at *7. The keen observer might question whether an emerging company's disclosure of its own trade secrets would be a relevant comparator to public disclosure of private facts. The Dissent points this out, see id. at *28, n.12, to which the Majority responds, see id., at *7, n.7.
17. Id. at *8.
18. Id.
19. Id. at *13 (citing and quoting TransUnion, LLC, 141 S. Ct. at 2210 n.6 (requiring that "the document was actually read and not merely processed ." (emphasis added)).
20. Id. at *15.
21. Id. at *14 (quoting and citing Restatement (Second) of Torts, § 652D cmt. c) (emphasis omitted).
22. Id. at *26.
23. Id. at *27 (citing and quoting the complaint, ¶ 5) (emphasis omitted).
24. Id. at *19.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
