This matter comes before the court on Defendant Regions Bank's motion to dismiss the amended complaint for lack of standing (doc. 55) and motion to exclude evidence (doc. 60). In this case, Plaintiff Terry Blumenfeld asserts that Regions Bank violated the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. § 1681 et seq. , and Alabama law by pulling her consumer report and sharing that report with her mother, all without Ms. Blumenfeld's consent.

Regions Bank contends that Ms. Blumenfeld lacks standing because she has asserted nothing more than a bare procedural violation of the FCRA for which she has not shown a concrete injury. In response, Ms. Blumenfeld submitted an affidavit in which she attests that she spent $ 40 to $ 50 on a lock box so that she could secure the consumer report that Regions Bank disclosed to her mother. This affidavit prompted Regions Bank to move to exclude that evidence for failing to timely disclose it during discovery.

The court DENIES the motion to dismiss because Ms. Blumenfeld has presented sufficient evidence to establish standing. The court DENIES the motion to exclude the evidence because Ms. Blumenfeld's failure to disclose the information is harmless.

I. BACKGROUND

The court described in detail the facts underlying this case in a previous memorandum opinion (see doc. 44), and will not now repeat all of those facts. Of relevance to the motions currently before the court, taken in the light most favorable to Ms. Blumenfeld, she has presented evidence that Regions Bank pulled her consumer report and shared that report with her mother, all while knowing it did not have her consent. (See id. at 4-6).

Ms. Blumenfeld testified that she has not experienced any issues with identity theft as a result of Regions Bank accessing or sharing her consumer report, and she is not aware of a decrease in her credit score.

*1167(Doc. 30-1 at 145-46). She also testified that she did not have any out of pocket damages as a result of the violation. (Id. at 164). But she testified that she was very angry, embarrassed, and stressed about the disclosure of her consumer report to her mother. (Id. at 115).

Now, after the close of discovery, Ms. Blumenfeld has submitted an affidavit in which she attests that she also spent $ 40 to $ 50 on a lock box in order to secure the consumer report. (Doc. 56-3 at 4 ¶ 13). The affidavit does not explain why she never before disclosed the purchase of the lock box. (See generally id. ). After Regions Bank moved to exclude that part of the affidavit, Ms. Blumenfeld submitted another affidavit in which she states that "until [she] provided the affidavit to my lawyer ..., [she] did not at the time understand the $ 40 or $ 50 dollars I spent for the lock box to be the type of out of pocket damages defendant was asking about." (Doc. 63-1 at 2). Instead, she believed out of pocket damages meant "medical bills for seeing a doctor or a psychiatrist or psychologist or lost time from work." (Id. at 3).

II. DISCUSSION

Regions Bank has moved to dismiss the case and to exclude Ms. Blumenfeld's evidence that she spent money on a lock box. (Docs. 55, 60). The court will address the motion to dismiss first, followed by the motion to exclude. But before that, the court will briefly set out the statutory background.

The FCRA regulates permissible uses of and access to consumer reports, and creates a private right of action for willful violations of the Act. See 15 U.S.C. §§ 1681b, 1681n, 1681o. By definition, a consumer report is

any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for-

(A) credit or insurance to be used primarily for personal, family, or household purposes;

(B) employment purposes; or

(C) any other purpose authorized under section 1681b of this title.

Id. § 1681a(d)(1). Section 1681b(f) of the FCRA permits a user to obtain a consumer report only for those purposes for which an agency is authorized to furnish the report. Id. § 1681b(f)(1).

When enacting the FCRA, Congress found that "[t]here is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy." 15 U.S.C. § 1681(a)(4). Congress stated that the purpose of the FCRA was "to require that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce ... in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information." Id. § 1681(b) ; see also Safeco Ins. Co. of Am. v. Burr , 551 U.S. 47, 52, 127 S.Ct. 2201, 167 L.Ed.2d 1045 (2007) ("Congress enacted FCRA in 1970 to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy."). Congress later amended the FCRA to add requirements for users of consumer reports as well as the consumer reporting agencies themselves. See 15 U.S.C. § 1681b(f) (prohibiting a "person" from using or obtaining a consumer report except for specified purposes).

*11681. Motion to Dismiss

Regions Bank moves to dismiss the amended complaint for lack of standing, under Federal Rule of Civil Procedure 12(b)(1), on the basis that Ms. Blumenfeld has not presented any evidence that she suffered a concrete injury based on the bank's violation of the FCRA. (Doc. 55). Rule 12(b)(1) permits a party to move to dismiss a claim for "lack of subject-matter jurisdiction."

Under Article III of the United States Constitution, federal courts have subject matter jurisdiction only over "cases" or "controversies." U.S. Const. art. III, § 2; Muransky v. Godiva Chocolatier, Inc. , 905 F.3d 1200, 1207 (11th Cir. 2018). "Standing is one of the essential components of Article III's case or controversy requirement." Muransky , 905 F.3d at 1207. The plaintiff bears the burden of establishing standing by showing that she "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins , --- U.S. ----, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016). The only question is this case is whether Ms. Blumenfeld has established an injury in fact; the parties do not dispute traceability or redressability and the court finds that she has satisfied her burden on those elements.

Injury in fact requires a showing that the plaintiff "suffered 'an invasion of a legally protected interest' that is 'concrete and particularized' and 'actual or imminent, not conjectural or hypothetical.' " Spokeo , 136 S.Ct. at 1548 (quoting Lujan v. Defenders of Wildlife , 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). Again, the parties do not dispute that Ms. Blumenfeld has adequately established an actual invasion of a legally protected interest, nor do they dispute that Ms. Blumenfeld's injury is particularized. See id. (defining "particularized" as "affect[ing] the plaintiff in a personal and individual way") (quotation marks omitted). The court finds that she has satisfied her burden on those points as well. The only dispute is whether Ms. Blumenfeld has shown that her injury is "concrete." (Doc. 55 at 3-4).

The United States Supreme Court has explained that to be concrete, any injury "must be 'de facto '; that is, it must actually exist." Spokeo , 136 S.Ct. at 1548. The injury may not be "abstract." Id. And "Congress cannot erase Article III's standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing." Id. at 1547-48.

But concrete does not necessarily mean tangible. Spokeo , 136 S.Ct. at 1549. In some cases, "the violation of a procedural right granted by statute can be sufficient ... to constitute injury in fact." Id. ; see also Havens Realty Corp v. Coleman , 455 U.S. 363, 373, 102 S.Ct. 1114, 71 L.Ed.2d 214 (1982) ("[T]he actual or threatened injury required by Art. III may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing....") (quotation marks omitted). In those cases, "a plaintiff ... need not allege any additional harm beyond the one Congress has identified." Spokeo , 136 S.Ct. at 1549. To determine whether an intangible harm is concrete, courts should "consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Id.

In Spokeo itself, the Supreme Court declined to express a view about whether a violation of the FCRA could, by itself, establish a concrete injury that would confer standing on a plaintiff. See Spokeo , 136 S.Ct. at 1550 (remanding the case for further consideration because the Ninth Circuit's *1169"standing analysis was incomplete," and "tak[ing] no position as to whether the Ninth Circuit's ultimate conclusion-that [the plaintiff] adequately alleged an injury in fact-was correct"). But the Eleventh Circuit has addressed whether a statutory violation can confer standing on a few occasions.

Of the Eleventh Circuit decisions on this question, the court finds Perry v. Cable News Network, Inc. , 854 F.3d 1336 (11th Cir. 2017) the most persuasive in this context. In Perry , the Eleventh Circuit addressed whether a violation of the Video Privacy Protection Act was sufficiently concrete to confer standing. Id. at 1340-41. The Court explained that Congress had enacted the law to protect personal privacy, and "a cause of action for this type of an invasion of privacy 'has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.' " Id. (quoting Spokeo , 136 S.Ct. at 1549 ). Noting that "Supreme Court precedent has recognized in the privacy context that an individual has an interest in preventing disclosure of personal information," the Eleventh Circuit held that the plaintiff had established a concrete injury despite the lack of any injury beyond the statutory violation. Id. at 1341.

The statutes at issue in this case and the Perry case are different-the FCRA in this case and the Video Privacy Protection Act in that case-but the analysis is the same. Just like the Video Privacy Protection Act, Congress enacted the FCRA to protect the privacy interests of consumers. See 15 U.S.C. § 1681(a)(4) ("There is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy. ") (emphasis added); see also Safeco Ins. Co. of Am. , 551 U.S. at 52, 127 S.Ct. 2201. Just like the defendant's actions in Perry , the defendant in this case violated that privacy interest by disclosing Ms. Blumenfeld's private and confidential consumer report to a third party. Because "a cause of action for this type of an invasion of privacy 'has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts,' " this court concludes that Ms. Blumenfeld has established a concrete injury to support standing. Perry , 854 F.3d at 1340 (quoting Spokeo , 136 S.Ct. at 1549 ).

Regions Bank contends that because this court has already rejected Ms. Blumenfeld's claim for invasion of privacy under Alabama law, she cannot now establish a concrete injury by showing that the common law traditionally protects against the same type of harm as the FCRA. (Doc. 55 at 17-18). But the question posed by Spokeo is not whether a plaintiff could prevail on a common law claim. The question is whether "an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Spokeo , 136 S.Ct. at 1549. As the court has explained above, the answer in this particular case is yes.

The court also emphasizes that Ms. Blumenfeld's ability to prevail on an Alabama law claim for invasion of privacy is beside the point. As the Eleventh Circuit has said, "the point is not that [the plaintiff]'s harm would have been actionable at common law. The inquiry under Spokeo is whether the alleged harm bears a 'close relationship' to one actionable at common law." Muransky , 905 F.3d at 1211 (quoting Spokeo , 136 S.Ct. at 1549 ); see also Spokeo , 136 S.Ct. at 1549 ("Congress may elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.") (quotation marks and alteration omitted). Regions Bank's position that Ms. Blumenfeld cannot *1170establish a concrete injury unless she can demonstrate every element of Alabama's invasion of privacy cause of action would mean that a plaintiff's standing depends on where she attempts to bring suit, because each state's specific causes of action may be different. The court rejects that suggestion.

Under the correct standard, the alleged harm in this case-disclosure of Ms. Blumenfeld's private financial information to a third party-bears a close relationship to the common law's protection against disclosure of private information. See Perry , 854 F.3d at 1341 ; see also Spokeo , 136 S.Ct. at 1553 (Thomas, J., concurring) ("If Congress has created a private duty owed personally to [the plaintiff] to protect his information, then the violation of the legal duty suffices for Article III injury in fact."); U.S. Dep't of Justice v. Reporters Comm. For Freedom of Press , 489 U.S. 749, 763, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989) ("[B]oth the common law and the literal understandings of privacy encompass the individual's control of information concerning his or her person."). Accordingly, Ms. Blumenfeld has established that she suffered a concrete injury based on Regions Bank's violation of the FCRA. The court DENIES Regions Bank's motion to dismiss her amended complaint for lack of standing.

2. Motion to Exclude Evidence

Regions Bank moves to exclude the evidence that Ms. Blumenfeld purchased a lock box, contending that under Federal Rule of Civil Procedure 37, she failed to timely disclose that evidence and cannot now rely on it. (Doc. 60). Regions Bank does not specify whether it seeks to exclude this evidence solely with respect to the motion to dismiss, but all of its arguments relate to Ms. Blumenfeld's use of the evidence to establish standing. (See id. ). Accordingly, the court's ruling on the motion to exclude the evidence is limited to whether Ms. Blumenfeld can submit this new evidence in opposition to the motion to dismiss; the court will not address whether Ms. Blumenfeld can submit this evidence to a jury on the question of damages.

Rule 37 provides:

If a party fails to provide information or identify a witness as required by [Federal] Rule [of Civil Procedure] 26(a) or (e), the party is not allowed to use that information or witness to supply evidence on a motion, at a hearing, or at a trial, unless the failure was substantially justified or is harmless. In addition to or instead of this sanction, the court, on motion and after giving an opportunity to be heard:

(A) may order payment of the reasonable expenses, including attorney's fees, caused by the failure;

(B) may inform the jury of the party's failure; and

(C) may impose other appropriate sanctions....

Fed. R. Civ. P. 37(c)(1).

Ms. Blumenfeld concedes that she did not timely disclose the purchase of the lock box, but contends that the court should excuse her late disclosure because Regions Bank waited until after the court had denied its motion for summary judgment to raise the issue of standing (doc. 63 at 3), and because she did not understand the meaning of "out of pocket damages" when she first testified that she had none (id. at 5).

The court finds that Ms. Blumenfeld has not shown substantial justification based on Regions Bank's timing in filing its motion to dismiss for lack of standing. A party's obligation to disclose evidence in discovery does not depend on what the opposing party may assert in a dispositive motion. Federal Rule of Civil Procedure 26 requires parties to provide information *1171about damages "without awaiting a discovery request." Fed. R. Civ. P. 26(a)(1)(iii). Not only did Ms. Blumenfeld not disclose this evidence in her initial disclosures, she also represented to Regions Bank that she had not incurred any out of pocket damages, and only came forth with contrary evidence when Regions Bank moved to dismiss the amended complaint on that ground. Nor does the court find convincing Ms. Blumenfeld's explanation that she did not understand what "out of pocket expenses" meant.

But the court does find that, with respect to this motion to dismiss, Ms. Blumenfeld's failure to disclose the purchase of the lock box is harmless. As the court has explained, Ms. Blumenfeld has standing to bring her FCRA claim. She does not need to show that she incurred monetary damages in order to establish standing.

The court DENIES Regions Bank's motion to exclude the evidence. This ruling relates only to the question whether to exclude the evidence from consideration in determining standing.

III. CONCLUSION

The court DENIES Regions Bank's motion to dismiss the amended complaint for lack of standing. (Doc. 55). The court DENIES Regions Bank's motion to exclude the evidence. (Doc. 60).

DONE and ORDERED this March 18, 2019.