In its recent decision in TransUnion v. Ramirez, the Supreme Court clarified the mere risk of future injury can not support standing without a separate concrete harm. This will have far reaching repercussions in data breach and privacy litigation.
Suffered some actual or threatened injury.
That can fairly be traced to the challenged action of the defendant.
That is likely to be redressed by a favorable decision.
Standing could be supplied by a statutory violation and penalty as long as this close relationship between the actual harm and the statutory violation was present. Whatever that meant.
The mere risk of future injury from the credit report could not support standing without a separate concrete harm.