United States Court of Appeals
                           For the Eighth Circuit
                       ___________________________

                               No. 17-2413
                       ___________________________

                                Colleen M. Auer,

                      lllllllllllllllllllllPlaintiff - Appellant,

                                          v.

           Trans Union, LLC, a Delaware Limited Liability Company,

                            lllllllllllllllllllllDefendant,

 CBCInnovis, Inc., a Pennsylvania Corporation; City of Minot, a North Dakota
Municipal Corporation; Smith, Bakke, Porsborg, Schweigert & Armstrong, a North
            Dakota General Partnership; John Does 1-100, inclusive,

                     lllllllllllllllllllllDefendants - Appellees.
                                      ____________

                   Appeal from United States District Court
                  for the District of North Dakota - Bismarck
                                 ____________

                            Submitted: April 9, 2018
                            Filed: September 6, 2018
                                 ____________

Before COLLOTON, SHEPHERD, and STRAS, Circuit Judges.
                         ____________
COLLOTON, Circuit Judge.

       This appeal concerns claims brought by Colleen Auer against several
defendants: the City of Minot (her former employer); the law firm of Smith, Bakke,
Porsborg, Schweigert & Armstrong; and the consumer reporting agency CBCInnovis,
Inc. (CBC). Auer alleged that these parties violated their obligations under the Fair
Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., in handling a consumer report
that she agreed to provide as part of her application for employment with the City.

       The district court dismissed Auer’s claims against the City and the law firm for
failure to state a claim under Federal Rule of Civil Procedure 12(b)(6), and granted
judgment on the pleadings for CBC under Rule 12(c). Auer appeals these orders, and
a separate order directing the City and the Smith law firm to dispose of copies of her
consumer report that remained in their possession. Because Auer lacked Article III
standing to bring her claims in federal court, we vacate the district court’s orders and
remand with instructions that Auer’s complaint be dismissed for lack of jurisdiction.

                                           I.

      On February 26, 2014, Auer accepted appointment as the city attorney for the
City of Minot. Several days later, the City’s human resources director requested that
Auer authorize a background check. Auer completed and signed an authorization
form. The single-page form was entitled “Authorization to Release Information and
Waiver,” and contained the following three paragraphs of text:

      I hereby authorize representatives of the City of Minot to obtain any
      information in my files pertaining to my driver’s license records,
      criminal history records, education records; credit records; and personal
      history records.




                                          -2-
      I hereby direct you and release you, as the custodian of such records, and
      any school, college, university or other education institution, credit
      bureau or related personnel, both individually or collectively, from any
      and all liability for damages of whatever kind, which may be at any time
      result to me, my heirs, family or associates because of compliance with
      this authorization and request to release information, or any attempt to
      comply with it.

      Should there be any questions as to the validity of this release, you may
      contact me as indicated below.

The form then included a space for Auer’s signature, and several spaces for Auer to
input her identifying information, including her social security number and driver’s
license number.

      After Auer signed the authorization form, the City’s police department
completed a background check. As part of the investigation, the police department
obtained Auer’s credit report from the consumer reporting agency CBC. CBC had
obtained Auer’s credit information from another consumer reporting agency, Trans
Union, LLC.

       On May 2, 2014, the City terminated Auer’s employment as city attorney. Auer
filed claims against the City for wrongful termination, and requested that the City
provide her with records related to her employment and termination, including her
complete personnel file. The City retained the Smith law firm for representation in
that action and for assistance in responding to Auer’s records request. The City, in an
attempt to comply with the records request, provided the law firm with Auer’s
authorization form and associated credit check. The law firm then contacted Auer,
stating that it had received Auer’s consumer information pursuant to her records
request, and offering to furnish that information to Auer.




                                         -3-
       After Auer received the Smith law firm’s letter and subsequent correspondence,
she brought this action. She alleged that the City, the Smith law firm, and CBC had
violated a number of obligations under the FCRA in procuring, using, and furnishing
her consumer report. The City and the Smith law firm moved to dismiss Auer’s
claims against them for failure to state a claim. In the same motion, they requested
the court’s permission to destroy any of Auer’s consumer information that remained
in their possession.

      The district court granted the motion to dismiss and denied a later motion for
reconsideration under Rule 60(b) as to all claims at issue on appeal. The court also
ordered the City and the Smith law firm to surrender all physical copies of the
consumer report to the clerk of court, but to destroy all electronic copies. The City
and the law firm, in compliance with the order, have since destroyed all electronic
copies of Auer’s report and deposited the hard copies with the clerk.

      Separately, the district court granted judgment on the pleadings for CBC under
Rule 12(c). The court reasoned that the complaint contained “nothing more than
formulaic recitations of the elements of a claim and assertions without factual
enhancement,” and thus failed to state a plausible claim for relief.

      Auer appeals the district court’s orders dismissing her claims against the City
and the Smith law firm, granting judgment on the pleadings for CBC, and directing
the City and the law firm to destroy and surrender the remaining copies of her
consumer report.

                                           II.

      We begin with the threshold question whether Auer has Article III standing to
bring her suit in federal court. “Federal jurisdiction is limited by Article III of the
Constitution to cases or controversies; if a plaintiff lacks standing to sue, the district

                                           -4-
court has no subject-matter jurisdiction.” ABF Freight Sys., Inc. v. Int’l Bhd. of
Teamsters, 

, 958 (8th Cir. 2011). “Subject-matter jurisdiction can never
be waived or forfeited,” Gonzalez v. Thaler, 

, 141 (2012), and we have
an obligation to satisfy ourselves of our own jurisdiction and that of the district court.
Bender v. Williamsport Area Sch. Dist., 

, 541 (1986).

        To have standing, Auer “must have (1) suffered an injury in fact, (2) that is
fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be
redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 

,
1547 (2016). To establish an injury in fact, a plaintiff must show an injury that is
“‘concrete and particularized’ and ‘actual or imminent, not conjectural or
hypothetical.’” 

(quoting Lujan v. Defs. of Wildlife, 

, 560
(1992)). “Article III standing requires a concrete injury even in the context of a
statutory violation,” and a plaintiff cannot “allege a bare procedural violation,
divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article
III.” 

       In Count 4 of her complaint, Auer pleaded that the City violated several
procedural requirements of the FCRA. She asserted that the City procured her
consumer report without making “a clear and conspicuous disclosure” that her
“consumer report may be obtained for employment purposes.” She also complained
that the City did not obtain Auer’s written authorization. See 15 U.S.C.
§ 1681b(b)(2)(A)(i), (ii). Auer further alleged that the City procured and used her
report for purposes that were not authorized by the FCRA, see 

and
furnished her report to the Smith law firm for an unauthorized purpose and without
obtaining the required certifications. See 

(2). Auer pleaded that
these violations caused her to suffer “injury to her privacy, reputation, personal
security, the security of her identity information and loss of time spent trying to
prevent further violations of her rights under the FCRA.”



                                           -5-
       “To determine whether an intangible harm counts as an injury in fact, we must
consider Congress’ judgment and whether the alleged intangible harm has a close
relationship to a harm that traditionally provided a basis for suit in the Anglo-
American legal system.” Heglund v. Aitkin County, 

, 577 (8th Cir.
2017). Although invasion of privacy did provide a basis for suit at common law,
Braitberg v. Charter Commc’ns, Inc., 

, 930 (8th Cir. 2016), a plaintiff’s
consent to the invasion of a protected interest traditionally served as a bar to recovery
in a tort action. Restatement (Second) of Torts § 892A (Am. Law. Inst. 1979); see,
e.g., Hill v. Nat’l Collegiate Athletic Ass’n, 

, 648 (Cal. 1994); Gray v.
McDonald, 

, 488 (1888), aff’d, 

(Mo. 1891); Sampson
v. Burnside, 

, 265 (1842).

      Because Auer consented to the City’s background check, she failed to plead an
intangible injury to her privacy that is sufficient to confer Article III standing. Before
the City procured Auer’s consumer information, it provided Auer with an
authorization form that stated: “I hereby authorize representatives of the City of
Minot to obtain any information in my files pertaining to my driver’s license records,
criminal history records, education records; credit records; and personal history
records.” Auer filled out this authorization form because she understood that “a
completed Authorization was required to initiate a background check,” and that “a
completed background check was a prerequisite to City Council approval of [Auer’s]
appointment as City Attorney.”

       Although Auer pleaded that she did not “authorize or consent (in writing or
otherwise) to the procurement and use” of her consumer report “for any purpose,” this
conclusory allegation is belied by her well-pleaded allegation that she completed the
City’s authorization form, so we need not accept the denial as true. See Griffin Indus.,
Inc. v. Irvin, 

, 1205-06 (11th Cir. 2007). Auer asserts in a conclusory
fashion that the City used her report for unauthorized purposes, but there is no well-
pleaded allegation that the City acted beyond her consent. Auer’s “unadorned, the-

                                           -6-
defendant-unlawfully-harmed-me accusation[s]” are not entitled to the assumption of
truth. Ashcroft v. Iqbal, 

, 678 (2009). Thus, even assuming that there
were technical violations of the statute, Auer has not established that she suffered a
concrete injury to her privacy interests. See Groshek v. Time Warner Cable, Inc., 

, 889 (7th Cir. 2017); Woods v. Caremark, LLC, No. 4:15–cv–00535–SRB,

, at *4 (W.D. Mo. July 28, 2016).

       Nor do we think that Auer established Article III standing on the basis of her
other claimed injuries—namely, reputational harm, compromised security, and lost
time. Although reputational harm may constitute an injury in fact for Article III
purposes, see Robins v. Spokeo, Inc., 

, 1115 (9th Cir. 2017), Auer did
not plead any facts establishing that the City’s actions damaged her reputation. Auer’s
“naked assertion[]” of reputational harm, “devoid of ‘further factual enhancement,’”
falls short of plausibly establishing injury. 

(quoting Bell Atl.
Corp. v. Twombly, 

, 557 (2007)).

       As to Auer’s alleged injury to her personal security and identity information,
she did not allege that her identity information had been stolen or accessed by any
person other than the defendants within the scope of her consent. Auer did plead that
the City kept her consumer information in “unsecure locations,” where it was
supposedly accessible to “unauthorized persons,” but these facts alone do not establish
an “actual” or “certainly impending” injury. Any breach of Auer’s security interests
is speculative. See Clapper v. Amnesty Int’l USA, 

, 401 (2013); In re
SuperValu, Inc., 

, 769-71 (8th Cir. 2017).

        Finally, Auer pleaded that she lost time “trying to prevent further violations of
her rights under the FCRA.” But plaintiffs “cannot manufacture standing merely by
inflicting harm on themselves based on their fears of hypothetical future harm that is
not certainly impending.” 

. Because Auer did not establish
that the City was likely to violate the FCRA on future occasions, she did not suffer an

                                          -7-
injury in fact by dedicating her time to this cause. Auer failed to plead even “general
factual allegations of injury resulting from the [City’s] conduct,” so she lacked Article
III standing to pursue her claims against the City in federal court. Defs. of 

.

       For similar reasons, Auer lacked standing to pursue her claims against the
Smith law firm in Count 5 of her complaint. Auer alleged that § 1681b(f)(2) required
the law firm to certify that it would use Auer’s report for a permissible purpose before
procuring her report from the City. According to Auer, the Smith law firm did not
provide the City with this certification and used Auer’s report for unauthorized
purposes, in violation of § 1681b(f)(1). Auer claimed the same injuries that she
allegedly suffered at the hands of the City: invasion of privacy, reputational harm,
compromised security, and lost time.

        As discussed, Auer consented to the background check, and signed a form
authorizing “representatives of the City of Minot” to obtain her credit records and
other personal information. The Smith law firm was a representative of the City, so
disclosure to the firm was covered by Auer’s consent. Whether or not the law firm
provided the City with a certification that satisfied § 1681b(f)(2), Auer did not plead
sufficient facts to establish an injury to her privacy. She consented to the law firm
obtaining her consumer information as a representative of the City; indeed, she alleged
that the law firm obtained the information to assist the City in responding to Auer’s
own open records request. Auer provided no factual enhancement for her threadbare
assertion that the law firm used her information for an unauthorized purpose, or that
its actions otherwise caused her injury.

      In Count 6, Auer claimed that the Smith law firm and CBC failed to take
“reasonable measures” to dispose of her consumer information, in violation of 15
U.S.C. § 1681w and 16 C.F.R. § 682.3(a). Federal regulations provide several
examples of “reasonable measures” used to dispose of consumer information,

                                          -8-
including “burning, pulverizing, or shredding of papers containing consumer
information.” 16 C.F.R. § 682.3(b). Auer did not allege, however, that the law firm
or CBC disposed of her consumer information in an unreasonable manner. She
claimed that by retaining her information, the law firm and CBC violated the statute
and regulations. But the defendants’ alleged retention of Auer’s information does not,
without more, establish a privacy injury. 

. Even if their
alleged failure to dispose of Auer’s information may have increased the risk that
Auer’s information could fall into the wrong hands, that risk is too speculative to
support Article III standing. In re SuperValu, 

. That Auer’s
consumer information remains theoretically “accessible by unauthorized persons”
does not establish a likelihood that such persons will access her information. Auer
does not have standing to pursue her § 1681w claim against the law firm or CBC.

       In Counts 1, 2, and 3 of her complaint, Auer alleged that CBC violated several
procedural requirements of the FCRA. She claimed that CBC violated § 1681b(a)
when it furnished her report to the City for an unauthorized purpose; violated
§§ 1681e(a) and 1681e(e)(2) when it did not make “reasonable efforts” to verify the
City’s identity or the use the City had for Auer’s report, and failed to maintain and
enforce “reasonable procedures” to ensure that it furnished consumer reports for
permissible purposes only; violated § 1681b(b)(1) when it furnished Auer’s consumer
report to the City for employment purposes before the City certified that it had made
a proper disclosure to Auer; and violated § 1681e(e)(1) when it failed to make certain
disclosures to Trans Union about the City before it procured Auer’s information from
Trans Union for resale purposes. Auer again alleged harm to her privacy, reputation,
and security interests, as well as loss of time.

       Taking as true the allegation that CBC failed to comply with the panoply of
procedural requirements set forth in the FCRA before furnishing Auer’s report to the
City, Auer suffered no injury because she gave the City consent to obtain her report.
Thus, whether or not CBC met all of its statutory obligations before furnishing the

                                         -9-
report, no concrete harm came of the transaction. Auer did not allege that CBC
disclosed her consumer information to any person other than the City. She did not
assert sufficient facts to establish that CBC’s policies and procedures for handling
consumer information created an imminent risk that unauthorized persons would
access her report in the future. And even assuming that Auer suffered an invasion of
privacy when CBC obtained her consumer information from Trans Union, CBC’s
alleged failure to provide Trans Union with the identity and permissible purpose
information required by § 1681e(e)(1) did not cause Trans Union to furnish the
information. Any injury, then, is not “fairly traceable to the challenged conduct of the
defendant.” 

.

        Auer also appeals the portion of the district court’s April 7, 2015, order
directing the City and the Smith law firm to surrender all physical copies of Auer’s
consumer report to the clerk of court, and to destroy all electronic versions of the
reports. Auer’s only reason for seeking to unwind the order is that she thinks it will
assist in her litigation of claims that the defendants did not handle or dispose of the
reports properly. Given that all claims will be dismissed, however, Auer’s request to
transfer materials among third parties to assist with litigating the dismissed claims is
moot.

                                   *       *       *

       For the foregoing reasons, we vacate the district court’s orders dismissing
Auer’s claims on the merits and remand with instructions to dismiss for lack of
jurisdiction.
                       ______________________________




                                         -10-