Defendant's Claims in Capital One Data Breach Suit Preempted by FCRA: TransUnion

for Northern California in San Francisco. Smith claimed in his pro se suit (see 2306120045) involving the 2019 Capital One data breach, in which an Amazon Web Services employee stole data affecting about 106 million customers, that at least 12 of his accounts were fraudulently accessed to buy unknown merchandise. Fraudulent purchases using Smiths accounts for American Express, Best Buy, Capital One, Chase, Citibank, Macy’s and Nordstrom totaled $92,300 in loans, merchandise and products, he said. Despite receiving identity theft and fraudulent activity police reports, credit reporting agencies and furnisher defendants continued adversely reporting identity theft and fraud on Smith’s credit profile, alleged the complaint, and furnisher defendants “failed to conduct a reasonable reinvestigation” into disputed information to consumer reporting agencies they “knew or should have known was inaccurate.” In its Tuesday response, credit reporting agency TransUnion said Smith and retailers are barred by the theories of estoppel, waiver and laches. Smith failed to state a claim upon which relief may be granted and his claims are barred by the applicable statute of limitations, it said. TransUnion’s reports concerning Smith were “true or substantially true,” and the reporting agency “at all times followed reasonable procedures to assure maximum possible accuracy” of its credit reports concerning him. Smith failed to take reasonable steps to mitigate damages, and any damages he suffered are the result of acts or omissions he committed, said the response. Smith’s claim of exemplary and punitive damages violates TransUnion’s rights under due process and excessive fines clauses of the Fifth, Sixth, Eighth and 14th amendments, plus those of state constitutions, it said.