ORDER

SAM SPARKS, UNITED STATES DISTRICT JUDGE.

BE IT REMEMBERED on this day the Court reviewed the file in the above-styled cause, and specifically Defendant's Motion to Dismiss [#111], Plaintiffs' Response [#112] in opposition, and Defendant's Reply [#115] in support. Having considered these documents, the case file as a whole, and the applicable law, the Court enters the following opinion and order.

Background

This is a consumer class action arising under the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681. Plaintiffs David and Gregory Perrill (Plaintiffs) are officers of Wand Corporation (Wand). First Am. Compl. [#110] ¶ 8. Wand, which does business in Texas, fell behind on its tax payments. See id. Wand and the Texas Comptroller (Comptroller) entered into a settlement agreement detailing Wand's outstanding debt and a schedule for payments. See id. Plaintiffs did not sign or guarantee the agreement. See id. Wand soon missed a payment under the agreement. See id. ¶ 20. Defendant Equifax Information Services, LLC (Equifax) provided Plaintiffs' consumer credit reports to the Comptroller pursuant to a contract between them. See id. ¶¶ 20-21. The Comptroller represented to Equifax that "it was using the reports to collect taxes." Id. ¶ 23.

Plaintiffs allege Equifax willfully violated two provisions of the FCRA: (1) § 1681b, by providing Plaintiffs' consumer reports to the Comptroller without having reason to believe the Comptroller had a permissible purpose; and (2) § 1681e(a), for failing to maintain reasonable procedures to limit the provision of consumer reports to the purposes listed under § 1681b. See id. ¶¶ 37-38. Plaintiffs contend these violations constituted an invasion of their privacy. See id. ¶¶ 39-40. Plaintiffs bring the action individually and as a class action purporting to represent "[a]ll consumers whose consumer reports were furnished by Equifax to the Comptroller from December 4, 2011 to the date of class certification," excluding (i) consumers against whom the Comptroller had a lien or judgment prior to obtaining the consumer's report and (ii) consumers with whom the Comptroller had an agreement to pay taxes prior to obtaining the consumer's report. See id. ¶ 27.

Over a year ago, the Court granted Equifax's Motion to Stay [#101] in light of the Supreme Court's then-pending decision in Spokeo, Inc. v. Robins, ___ U.S. ___, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016). See Order [#105] at 1. After the Supreme Court decided Spokeo, Plaintiffs filed their First Amended Complaint [#110]. Equifax now moves to dismiss the case under Federal Rules of Civil Procedure 12(b)(1) for lack of standing and, in the alternative, 12(b)(6) for failure to state a claim for relief. See Mot. Dismiss [#111] at 4-5.

Analysis

I. Motion to Dismiss — Legal Standard

A. Rule 12(b)(1)

A motion under Rule 12(b)(1) asks a court to dismiss a complaint for lack of subject matter jurisdiction. FED. R. CIV. P. 12(b)(1). "A case is properly dismissed for lack of subject matter jurisdiction when the court lacks the statutory or constitutional power to adjudicate the case." Home Builders Ass'n of Miss., Inc. v. City of Madison, Miss., 143 F.3d 1006, 1010 (5th Cir.1998) (internal quotation marks omitted). Motions to dismiss under Rule 12(b)(1) challenge a court's "very power to hear the case," and the court may therefore "weigh the evidence and satisfy itself" subject matter jurisdiction exists. MDPhysicians & Assocs., Inc. v. State Bd. of Ins., 957 F.2d 178, 181 (5th Cir.1992) (internal quotation marks omitted).

Article III of the Constitution limits the jurisdiction of federal courts to cases and controversies. U.S. Parole Comm'n v. Geraghty, 445 U.S. 388, 395, 100 S.Ct. 1202, 63 L.Ed.2d 479 (1980). "One element of the case-or-controversy requirement is that [plaintiffs], based on their complaint, must establish that they have standing to sue." Raines v. Byrd, 521 U.S. 811, 818, 117 S.Ct. 2312, 138 L.Ed.2d 849 (1997). To meet the standing requirement a plaintiff must show (1) she has suffered an "injury in fact" that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision. Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180-81, 120 S.Ct. 693, 145 L.Ed.2d 610 (2000); Consol. Cos., Inc. v. Union Pacific R.R. Co., 499 F.3d 382, 385 (5th Cir.2007); Fla. Dep't of Ins. v. Chase Bank of Tex. Nat'l Ass'n, 274 F.3d 924, 929 (5th Cir.2001) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992)). "The party invoking federal jurisdiction bears the burden of establishing these elements." Lujan, 504 U.S. at 561, 112 S.Ct. 2130.

B. Rule 12(b)(6)

Federal Rule of Civil Procedure 8(a)(2) requires a complaint to contain "a short and plain statement of the claim showing that the pleader is entitled to relief." FED. R. CIV. P. 8(a)(2). A motion under Federal Rule of Civil Procedure 12(b)(6) asks a court to dismiss a complaint for "failure to state a claim upon which relief can be granted." FED. R. CIV. P. 12(b)(6). The plaintiff must plead sufficient facts to state a claim for relief that is facially plausible. Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Iqbal, 556 U.S. at 678, 129 S.Ct. 1937. Although a plaintiffs factual allegations need not establish that the defendant is probably liable, they must establish more than a "sheer possibility" that a defendant has acted unlawfully. Id. Determining plausibility is a "context-specific task," and must be performed in light of a court's "judicial experience and common sense." Id. at 679, 129 S.Ct. 1937.

In deciding a motion to dismiss under Rule 12(b)(6), a court generally accepts as true all factual allegations contained within the complaint. Leatherman v. Tarrant Cnty. Narcotics Intelligence & Coordination Unit, 507 U.S. 163, 164, 113 S.Ct. 1160, 122 L.Ed.2d 517 (1993). However, a court is not bound to accept legal conclusions couched as factual allegations. Papasan v. Allain, 478 U.S. 265, 286, 106 S.Ct. 2932, 92 L.Ed.2d 209 (1986). Although all reasonable inferences will be resolved in favor of the plaintiff, the plaintiff must plead "specific facts, not mere conclusory allegations." Tuchman v. DSC Commc'ns Corp., 14 F.3d 1061, 1067 (5th Cir.1994). In deciding a motion to dismiss, courts may consider the complaint, as well as other sources such as documents incorporated into the complaint by reference, and matters of which a court may take judicial notice. Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 322, 127 S.Ct. 2499, 168 L.Ed.2d 179 (2007).

II. Application

A. Standing

In Spokeo, the Supreme Court recently addressed the standing requirements. 136 S.Ct. at 1545-50. The Court confirmed that "[t]o establish injury in fact, a plaintiff must show that he or she suffered `an invasion of a legally protected interest' that is `concrete and particularized' and `actual or imminent, not conjectural or hypothetical.'" Id. at 1548 (quoting Lujan, 504 U.S. at 560, 112 S.Ct. 2130). With regard to concreteness, the Court reiterated that both tangible and intangible injuries can suffice. See id. at 1549. "In determining whether an intangible harm constitutes injury in fact, both history and the judgment of Congress play important roles." Id. First, courts should consider "whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Id. Second, Congress "may `elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law ..." and "has the power to define injuries ... that will give rise to a case or controversy where none existed before." Id. (quoting Lujan, 504 U.S. at 578, 112 S.Ct. 2130).

At the same time, the Court stated, "Article III standing requires a concrete injury even in the context of a statutory violation," emphasizing "a bare procedural violation, divorced from any concrete harm" would not satisfy the injury-in-fact requirement. Id. at 1543, 1549. Sometimes, however, "the violation of a procedural right granted by statute can be sufficient... to constitute injury in fact...." Id. at 1544. The Court offered two examples:

(2) "[T]wo advocacy organizations' failure to obtain information subject to disclosure under the Federal Advisory Committee Act `constitutes a sufficiently distinct injury'...."

Id. at 1549-50 (internal citation omitted).

In this case, Plaintiffs claim Equifax violated §§ 1681 b and 1681e of the FCRA by providing their credit reports to the Comptroller, causing Plaintiffs to suffer an invasion of privacy. See First Am. Compl. at ¶¶ 39-40. According to Equifax, this alleged harm is an example of the "bare violation of a statutory right" that the Court in Spokeo determined did not meet the concrete injury requirement. See Mot. Dismiss [#111] at 6. Specifically, Equifax claims an invasion of privacy is "abstract," and Plaintiff's "mere disclosure of personal information" does not amount to a concrete harm. Id. at 7.

Following the analysis identified in Spokeo, this Court first considers whether invasion of privacy "has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit...." Spokeo, 136 S.Ct. at 1549. Invasion of privacy is widely recognized in common law tort. See Witt, et al. v. Corelogic Saferent, LLC, No. 3:15-cv-386, 2016 WL 4424955, at *12 (E.D.Va. Aug. 18, 2016) ("The common law has long recognized a right to personal privacy, and `both the common law and the literal understandings of privacy encompass the individual's control of information concerning his or her person.'") (quoting U.S. Dept. of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 763, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989)); Mey v. Got Warranty, Inc., No. 5:15-cv-101, 193 F.Supp.3d 641, 645, 2016 WL 3645195, at *3 (N.D.W.Va. June 30, 2016) ("Almost all states recognize invasion of privacy As a Common Law Tort.") (Citing Eli A. Meltz, No Harm, No Foul? "Attempted" Invasion of Privacy and the Tort of Intrusion Upon Seclusion, 83 FORDHAM L. REV. 3431, 3441 (2015)). Further, as Plaintiffs argue, an invasion of privacy injury is similar to the harm forming the basis of an intrusion upon seclusion claim, which holds a person liable for "intentionally intrud[ing], physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns...." See Resp. [#112] at 5 (citing Restatement (Second) of Torts § 652B (1977)).1

In addition, Congress's judgment in enacting the FCRA was to provide consumers a right to privacy. The plain language of the statute as well as the legislative history illustrate this intent. See 15 U.S.C. § 1681(4) ("There is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy."); Safeco v. Burr, 551 U.S. 47, 52, 127 S.Ct. 2201, 167 L.Ed.2d 1045 (2007) ("Congress enacted FCRA ... to protect consumer privacy."); Resp. [#112] at 6 (citing legislative history); Thomas v. FTS USA, LLC, No. 3:13-cv-825, 193 F.Supp.3d 623, 633, 2016 WL 3653878, at *8 (E.D.Va. Jun. 30, 2016) ("It is clear from the statute's legislative history that Congress intended that the FCRA be construed to promote the credit industry's responsible dissemination of accurate and relevant information and to maintain the confidentiality of consumer reports."); Hawkins v. S2Verify, No. C 15-03502 WHA, 2016 WL 3999458, at *5 (N.D.Cal. Jul. 26, 2016) ("[Under the FCRA], Congress decided to restrict access to information regarding arrests older than seven years, which bestowed a degree of privacy on that information.").

Considering this history and Congress's judgment, the Court finds an invasion of privacy within the context of the FCRA constitutes a concrete harm that meets the injury-in-fact requirements. The Court is not alone in this holding. See Witt, 2016 WL 4424955, at *12 ("Accordingly, it has long been the case that an unauthorized dissemination of one's personal information, even without a showing of actual damages, is an invasion of one's privacy that constitutes a concrete injury sufficient to confer standing to sue."); Thomas, 193 F.Supp.3d at 636, 2016 WL 3653878, at *11 (same); Burke v. Fed. Nat'l Mortg. Ass'n, No. 3:16cv153-HEH, 2016 WL 4249496, at *4 (E.D.Va. Aug. 9, 2016) ("Plaintiff's alleged violation of privacy is a concrete harm, even if that harm does not lead to other, more tangible harms."); Hawkins, 2016 WL 3999458, at *5 (Plaintiff's alleged injury to his privacy interest was concrete and thus plaintiff established standing.); Hancock v. Urban Outfitters, Inc., No. 14-7047, 830 F.3d 511, 514, 2016 WL 3996710, at *3 (D.C.Cir. Jul. 26, 2016)2 (Plaintiffs' allegations that Defendant violated two of Washington, DC's consumer protection laws did not confer standing because Plaintiffs did "not allege for example, any invasion of privacy, increased risk of fraud or identify theft, or pecuniary or emotional injury.") (emphasis added).3

Some of the cases Equifax cites to establish Plaintiffs' lack of standing do not address the same injury — invasion of privacy — that Plaintiffs allege. See Peters v. St. Joseph Servs. Corp., 74 F.Supp.3d 847, 854 (S.D.Tex.2015) (Plaintiff's alleged increased risk of "future identity theft/ fraud" did not constitute a cognizable injury); Reilly v. Ceridian Corp., 664 F.3d 38, 42 (3d Cir.2011) (Plaintiffs' "allegations of hypothetical, future injury [by potential hacker as a result of a data breach] are insufficient to establish standing"). Other cases Equifax refers to fail to properly analyze the concrete injury prong as explained in Spokeo, and instead summarily state invasion of privacy does not constitute an injury in fact. See Khan v. Children's Nat'l Health Sys., No. TDC-15-2125, 188 F.Supp.3d 524, 533, 2016 WL 2946165, at *6 (D.Md. May 19, 2016) (Plaintiff "has not identified any potential damages arising from [her loss of privacy] and thus fails to allege a `concrete and particularized injury.'") (internal citation omitted); In re Zappos.com, Inc., 108 F.Supp.3d 949, 962 n. 5 (D.Nev.2015) ("Even if Plaintiffs adequately allege a loss of privacy, they have failed to show how that loss amounts to a concrete and particularized injury."). The Court finds these cases unpersuasive.

Equifax does cite two cases where the District Courts for the Southern District of Ohio and the Eastern District of Wisconsin found the plaintiffs' alleged loss of privacy injury was insufficient under the FCRA and the Federal Debt Collection Practices Act, respectively. See Smith v. Ohio State Univ., No. 2:15-CV-3030, 191 F.Supp.3d 750, 753-54, 2016 WL 3182675, at *1 (S.D.Ohio Jun. 8, 2016); Groshek v. Time Warner Cable, Inc., No. 15-C-157, 2016 WL4203506, at *1 (E.D.Wis. Aug. 9, 2016). These cases, however, improperly focus on the plaintiffs' failure to allege actual damages. See Smith, 191 F.Supp.3d at 757, 2016 WL 3182675, at *4 ("Plaintiffs admitted that they did not suffer a concrete consequential damage as a result of [defendant's] alleged breach of the FCRA."); Groshek, 2016 WL 4203506, at *3 (Plaintiff did not allege concrete harm because he stated "I do not know of any actual damages that I am claiming nor do I believe I've ever actually claimed actual damages against [the defendant] nor do intend to."). The Court is not convinced by this reasoning since Spokeo does not require a plaintiff to allege actual damages. In fact, the Supreme Court stated, "the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. In other words, a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified." Spokeo, 136 S.Ct. at 1549; see id. at 1552 (J., Thomas, concurring) ("Our contemporary decisions have not required a plaintiff to assert an actual injury beyond the violation of his personal legal rights to satisfy the `injury-in-fact' requirement."). When history and Congress have established an injury resulting from a statutory violation, such as an invasion of privacy, is "a legally cognizable injur[y]," a plaintiff need not show any additional harm. Spokeo, 136 S.Ct. at 1549.

In sum, Plaintiffs' alleged invasion of privacy is a concrete harm. The Court DENIES Equifax's Motion to Dismiss Plaintiffs' claims based on lack of standing under Rule 12(b)(1).

B. Failure to State a Claim

Plaintiffs claim Equifax violated two provisions of the FCRA: § 1681b(a)(3)(A) and § 1681e(a).

1. Section 1681b(a)(3)(A)

Section 1681b limits the circumstances in which consumer reporting agencies can provide consumer reports. To properly assert a violation of § 1681b(a) and recover statutory damages, a plaintiff must allege (1) there was a "consumer report"; (2) the defendant used or obtained the report; (3) without a permissible purpose; and (4) the defendant acted willfully. 15 U.S.C. §§ 1681b(a), 1681 n(a)(1)(A). Because Plaintiffs cannot show Equifax acted willfully, the Court does not address the remaining elements of the claim.

The Supreme Court has held that "willfully," as used in the FCRA, requires a showing of knowing misconduct or recklessness. See Safeco, 551 U.S. at 57, 127 S.Ct. 2201. In addition, subjective bad faith does not support a willfulness finding if the defendant acted in accordance with an objectively reasonable interpretation of an ambiguous statute. See id. at 70, 127 S.Ct. 2201 n. 20. To determine if the defendant "ran a risk of violating the law substantially greater than the risk associated with a reading that was merely careless," and was thus reckless, the Safeco Court examined whether the plain language of the statute was "less-than-pellucid," whether the defendant's proposed interpretation had a foundation in the statutory text, and whether the court of appeals or the Federal Trade Commission (FTC) provided any guidance. See id. at 69-70, 127 S.Ct. 2201.

Plaintiffs allege Equifax wilfully violated § 1681b(a) because it did not have reason to believe the Comptroller had a permissible purpose. See First. Am. Compl. [#110] ¶ 37. Equifax counters it falls within § 1681b(a)(3)(A), which allows a consumer reporting agency to furnish a consumer report to a person it has reason to believe "intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer...." See Mot. Dismiss [#111] at 12. This provision, according to Equifax, allows consumer reporting agencies to provide "consumer reports to state taxing agencies for the purpose of collecting back taxes."4 Id. at 11.

The statute itself does not shed much light on the issue. The FCRA's text does not explicitly include or exclude tax collection as a permissible purpose under § 1681b(a)(3)(A). See Safeco, 551 U.S. at 69-70, 127 S.Ct. 2201. (finding "objectively unreasonable" standard as not met, in part because the statute was "silent on the point" at issue and thus "less-than-pellucid").

Plaintiffs argue a taxpayer's obligation to pay taxes is not a "credit transaction" since FCRA defines "credit" as "the right granted by a creditor to a debtor to defer payment of debt," and taxpayers do not have a right to defer payment of taxes. Resp. [#112] at 12 (quoting 15 U.S.C. §§ 1681a(r)(5), 1691a(d)). Equifax responds that a taxpayer does have a right to defer payment of taxes in certain circumstances, establishing a "credit transaction" between the tax payer and the Comptroller. See Reply [#115] at 6 (citing TEX. TAX CODE § 1513.401, which allows a company to defer payment of sales taxes due until the month after the sale). Equifax's interpretation of the provision has a foundation in the text: Plaintiffs had a right to defer payment of their company's delinquent taxes under the settlement agreement and thus fall within the statute's definition of a "credit transaction." See Safeco, 551 U.S. at 69-70, 127 S.Ct. 2201.

The authority on this issue is scant. Neither party has pointed to a case directly addressing whether tax collection constitutes a permissible purpose under § 1681b(a)(3)(A). Indeed, after conducting its own research, the Court did not find a single case, from the federal courts of appeal or otherwise, that would have put Equifax on notice that the Comptroller did not have a permissible purpose. In support of their argument, Plaintiffs rely on Pintos v. Pac. Creditors Ass'n, 504 F.3d 792 (9th Cir.2007), which the Ninth Circuit has withdrawn, dicta from Stergiopoulos & Ivelisse Castro v. First Midwest Bancorp, Inc., 427 F.3d 1043, 1047 (7th Cir.2005), and two cases from the District Court for the Northern District of Illinois. See Resp. [#112] at 15-16. These cases determined a "credit transaction" under § 1681b(a)(3)(A) is one in which the consumer directly participates and voluntarily seeks credit. According to Plaintiffs, because a taxpayer does not voluntarily seek credit from the Comptroller, this case law supports excluding tax collection as a permissible "credit transaction." See id. at 15-16. First, the Court does not consider Pintos since it has been withdrawn. Second, the Court does not find Plaintiffs' inference — that a taxpayer does not voluntarily seek credit — is as obvious as Plaintiffs claim. One could reasonably argue, as Equifax does, that a taxpayer does initiate a credit transaction with the Comptroller merely by electing to do business in Texas or by signing an settlement agreement to defer payment of delinquent taxes.5 See Mot. Dismiss [#111] at 17 n.10; Reply [#115] at 8 n.6.

The only authority directly on point is the FTC's "40 Years of Experience with the Fair Credit Reporting Act, An FTC Staff Report with Summary of Interpretations" (July 2011)6 (FTC Report), which states: "A tax collection agency does not have a permissible purpose to obtain a consumer report to collect delinquent tax accounts because [§ 1681b(a)(3)(A)] applies only to `credit' accounts." FTC Report, 2011 WL 3020575, at *38 (2011). The FTC Report is not binding and does not have the force or effect of regulations or statutory provisions. See id. at *4. Further, the FTC is no longer the entity with the "primary regulatory and interpretive roles under the FCRA" since the Consumer Financial Protection Act (CFPA) delegated those powers to the Consumer Financial Protection Bureau (CFPB). See id at *2. The FTC's Report serves to only assist the CFPB in making its own, independent interpretations of the statute.7 See id. at *5. The Court cannot conclude from this non-binding report, standing alone, that Equifax "ran a risk of violating the law substantially greater than the risk associated with a reading that was merely careless." See Safeco, 551 U.S. at 69-70, 127 S.Ct. 2201 (determining plaintiff's alleged violation was not willful despite a non-binding FTC letter); Long v. Tommy Hilfiger U.S.A., Inc., 671 F.3d 371, 377 n.3 (3d Cir.2012) (refusing to find plaintiff's violation was willful under the Fair and Accurate Credit Transactions Act, an amendment to the FCRA, when the only guidance was a non-binding FTC "Business Alert").8

After applying the analysis announced in Safeco, the Court concludes Equifax's interpretation of the statute was at least objectively reasonable. Thus, Plaintiffs have failed to state a claim for a willful violation under § 1681b(a)(3)(A) of the FCRA.

2. Section 1681e(a)

Plaintiffs' second claim is that Equifax willfully violated § 1681e(a) of the FCRA, which requires a consumer reporting agency to "maintain reasonable procedures designed to ... limit the furnishing of consumer reports to the purposes listed under section 1681b." See First Am. Compl. [#110] ¶ 38. As Equifax explains, "a plaintiff bringing a claim that a reporting agency violated the `reasonable procedures' requirement of § 1681e must first show that the reporting agency released the report in violation of § 1681b." Reply [#115] at 10 (quoting Washington v. CSC Credit Servs. Inc., 199 F.3d 263, 267 (5th Cir.2000)). Therefore, because Plaintiffs did not show Equifax willfully violated § 1681b(a)(3)(A), they have also failed to plead a willful violation of § 1681e(a). See Levine v. World Fin. Network Nat'l Bank, 554 F.3d 1314, 1319 (11th Cir.2009) ("Because it was not objectively unreasonable to read the [FCRA] as allowing the sale of a report for a closed account, no investigation or procedure would have alerted [the defendant] to the possibility of an impermissible use.").

Thus, the Court GRANTS Equifax's Motion to Dismiss on the Rule 12(b)(6) grounds.

Conclusion

Accordingly,

IT IS ORDERED that Defendant Equifax's Motion to Dismiss [#111] is GRANTED IN PART and DENIED IN PART as described in this opinion.