Congress amended the federal Fair Credit Reporting Act in 2003 to add protections specifically addressing identity theft. These new provisions made it much easier for a consumer to remove information from a credit report where the consumer's dispute is grounded in identity theft as opposed to, say, a merchant dispute. Under narrow circumstances, the credit bureaus may keep information in a report notwithstanding the consumer's request, if they conclude the consumer's request is fraudulent or mistaken. Because this exception threatens to absorb the rule, the New Mexico Legislature passed that state's Fair Credit Reporting and Identity Security Act in 2010, requiring that credit bureaus keep such information removed unless a court, or the consumer him- or her-self, concludes that the request was fraudulent or mistaken. Although well-meaning, such a provision is likely to be held pre-empted by the federal FCRA provisions. In the event of a violation of this requirement by the bureaus, the New Mexico law permits any aggrieved consumer, or the state Attorney General, to sue to enforce its provisions.
In this case, a credit bureau industry association sued the New Mexico Attorney General to enjoin enforcement of the New Mexico law. The district court dismissed the case, holding it not justiciable under Article III of the U.S. Constitution.
To be justiciable under Article III, the suit must address a real injury, caused by the defendant, which the court is capable of redressing by ordering some relief. The district court held, essentially, that because the law permits any aggrieved consumer to sue the bureaus, an injunction directed only at the New Mexico Attorney General would not redress the bureaus' threatened injury of being sued.
The Tenth Circuit, unsurprisingly, reversed, essentially holding that an order at the Attorney General would redress some injury, and so satisfies Article III requirements, which the district court read too stringently. In effect, the court held that Article III does not make the perfect the enemy of the good. Here, the injunction sought was "good enough" to satisfy Article III justiciability.
As a practical matter, it seems unlikely that the credit bureaus will be deluged by consumer suits under the New Mexico law. The district court on remand will likely hold the law pre-empted and enjoin enforcement, and such a decision is likely to be followed by state courts; the very prospect should deter many consumers from filing such suits.
This is a shame. New Mexico is in a perfect position to act as a "laboratory of democracy" testing an alternative approach to identity-theft protection that may better serve consumers than the current federal regime, which New Mexico citizens obviously felt granted too much unsupervised discretion to the credit bureaus. Citizens there and elsewhere may still lobby Congress to similarly amend the FCRA - or to amend the FCRA to permit states to adopt stronger identity-theft protections.