This case deals with a fading technology (checks) and an evergreen imperative (Article III standing). When a customer buys something with a check, merchants often consult a check verification company to determine whether to accept the check. Invoking his rights under the Fair Credit Reporting Act, James Huff requested a copy of his file from a check verification company called TeleCheck. The report omitted that his driver's license was linked to six different bank accounts and omitted two transactions that occurred on those accounts. Huff filed this lawsuit under the Act. Because Huff has not shown that the incomplete report injured him in any way, we affirm the district court's dismissal of his case for lack of standing.

I.

When a retail consumer offers a check to a merchant, the customer usually provides a form of identification such as a driver's license. The merchant often takes the bank account number on the check and the driver's license number, called identifiers, and sends them to companies like TeleCheck. TeleCheck runs each identifier through its system. If one of the identifiers has a debt on file, TeleCheck sends the merchant a "Code 4"-what the industry calls a negative decline. If there is not a debt on file, TeleCheck examines the customer's check-writing history to determine whether to send a "Code 3"-what the industry calls a risk-based decline. If TeleCheck recommends a decline, the merchant refuses the customer's check. If there are no debts on file and the customer presents a low risk, TeleCheck approves the transaction, and the merchant accepts the check.

When a customer presents two identifiers in a transaction, TeleCheck records a link between the identifiers in its system. If in a later transaction a customer uses only one of those identifiers, TeleCheck recommends a Code 4 decline if there is a debt associated with the presented identifier or the linked identifier. Say a customer presents his driver's license along with a check to buy milk. That links his license number and the account number on the check in TeleCheck's system. Then the customer bounces a check on the same account. Now, when the customer tries to buy eggs with a check from a different account and presents his license, TeleCheck will see that an identifier linked to the license-the bad bank account-shows a debt, and it will issue a Code 4 decline. By contrast, linked identifiers play no role in TeleCheck's Code 3 decline recommendations.

James Huff often pays by check. Inspired by a legal services advertisement, Huff requested a copy of his file from TeleCheck under the Fair Credit Reporting Act. 15 U.S.C. § 1681g(a)(1). Huff provided TeleCheck with only a copy of his driver's license. As a result, the report contained only the 23 transactions in which he presented his license during the past year. But the report also told Huff that TeleCheck had more information. A bolded disclaimer at the bottom of the report read: "Linked Data: Your record is linked to information not included in this report, subject to identity verification prior to disclosure. Please contact TeleCheck at 1-800-366-1435 to verify Monday-Friday 830am-430pm CST." R. 78-6 at 3.

Huff did not call. He sued.

Huff's driver's license as it happens contains links to six different bank accounts: his own account, his wife's account, and four accounts that haven't been used for years. The accounts were linked because Huff had presented his license in transactions alongside checks from each of the accounts. In addition to leaving off the linked accounts, the report did not reveal two checks from those accounts over the past year that were not presented with Huff's license. One of the checks was from Huff's own account, and one was from his wife's.

TeleCheck has never told a merchant to decline one of Huff's checks due to his linked information.

After discovery, Huff moved for class certification, and TeleCheck moved for summary judgment based on lack of standing. The district court dismissed the case because Huff lacked standing to bring it.

II.

Article III of the United States Constitution limits the "judicial Power" of the federal courts to deciding "Cases" and "Controversies." U.S. Const. art. III, § 2. That limitation checks the power of the judicial branch by confining it to resolving concrete disputes, Spokeo, Inc. v. Robins , --- U.S. ----, 136 S.Ct. 1540 , 1547, 194 L.Ed.2d 635 (2016), and checks the power of the legislative branch by prohibiting it from using the Judiciary as an adjunct to its own powers, see Hagy v. Demers & Adams , 882 F.3d 616 , 623 (6th Cir. 2018). To protect the vital, but limited all the same, role of the Judiciary in our system of government, the Constitution makes standing an indispensable ingredient of a judicial dispute.

To establish standing, Huff had to show three things: (1) that he suffered an injury, (2) caused by TeleCheck, (3) that a judicial decision could redress. Lujan v. Defs. of Wildlife , 504 U.S. 555 , 560-61, 112 S.Ct. 2130 , 119 L.Ed.2d 351 (1992). The burden of establishing standing rests with Huff, and he must provide the allegations or evidence required at each stage of the litigation. Id. at 561 , 112 S.Ct. 2130 . At summary judgment, the current stage of this litigation, Huff cannot rely on allegations alone but must set forth evidence demonstrating his standing.

This case turns on the "[f]irst and foremost" prong of that inquiry, injury in fact. Steel Co. v. Citizens for a Better Env't , 523 U.S. 83 , 103, 118 S.Ct. 1003 , 140 L.Ed.2d 210 (1998). An injury in fact must be real, not abstract, actual, not theoretical, concrete, not amorphous. Spokeo , 136 S.Ct. at 1548 .

Before turning to Huff's efforts to satisfy this requirement, it is well to keep in mind a distinction that's easy to miss in this area. There is a difference between failing to establish the elements of a cause of action and failing to show an Article III injury. One is a failure of proof. The other is a failure of jurisdiction. Yes, there can be overlap between the two inquiries. But they are not one and the same.

Consider the distinction from this vantage point. The Fair Credit Reporting Act creates a cause of action that has three elements: (1) duty-a consumer agency must disclose "[a]ll information in the consumer's file" upon request; (2) breach of duty-any consumer agency that fails to meet this requirement is liable to the affected individual; and (3) damages-the affected individual may recover $ 100 to $ 1000 for each willful violation. 15 U.S.C. § 1681g(a)(1) ; see id. § 1681n(a)(1)(A).

In one way, Huff does not have a problem in establishing injury. In answering TeleCheck's motion for summary judgment, Huff went beyond mere allegations and tried to provide proof of each required element-including proof of a breach of duty that creates a statutory injury-of the cause of action. If he provided evidence checking each of these boxes, that indeed satisfies the requirements under the statute and indeed satisfies his burden of proof at this stage of the case when it comes to the elements of the cause of action.

But that leaves a different question: Does Congress have authority to label this violation of the statutory duty an Article III injury when it comes to Huff? After Spokeo , we know there is no such thing as an "anything-hurts-so-long-as-Congress-says-it-hurts theory of Article III injury." Hagy , 882 F.3d at 622 . That requires us to assess whether enforcement of this cause of action, as invoked by Huff and as applied to Huff, exceeds Congress's power.

We see three ways in which Huff potentially could satisfy Article III with this cause of action. One, the statutory violation created an injury in fact as applied to him because it actually injured him when the violation led, say, to a check decline. Two, the statutory violation did not injure him in any traditional way, but the risk of injury was so imminent that it satisfies Article III. Three, the statutory violation did not create an injury in any traditional sense, but Congress had authority to establish the injury in view of its identification of meaningful risks of harm in this area. Each possibility deserves its turn.

1. Actual injury as applied to Huff? Huff's lawsuit does not satisfy the first option. He does not allege, much less prove, harm in the flesh-and-blood or dollars-and-cents sense of the term. By way of examples: He does not claim that TeleCheck's conduct caused a declined check or a denied rental application. He does not suggest that he wasted time or suffered emotional distress while looking for his linked information. He does not contend that he would have done anything with the missing information had he received it-say, by adjusting his spending habits. All in all, Huff acknowledges that TeleCheck's incomplete report did not "have any effect on [him] whatsoever." R. 78-2 at 25.

2. Risk of imminent injury as applied to Huff? The second option does not work either. The record evidence does not show that TeleCheck created a risk that Huff would suffer a check decline-or any other harm covered by the statute-based on the checking activities of the linked accounts. Quite the opposite on this record.

A material risk of harm, it is true, may establish standing. Spokeo , 136 S.Ct. at 1549 . But the "threatened injury must be certainly impending to constitute injury in fact." Clapper v. Amnesty Int'l USA , 568 U.S. 398 , 409, 133 S.Ct. 1138 , 185 L.Ed.2d 264 (2013) (quotation omitted); see Soehnlen v. Fleet Owners Ins. Fund , 844 F.3d 576 , 585 (6th Cir. 2017).

The risk that TeleCheck's incomplete disclosure would cause Huff to suffer a check decline was highly speculative. Four of the linked accounts (whose precise connection to Huff the record does not reveal) were last used between 2008 and 2010, making it a virtual certainty that no one would write a bad check on them today. One of the other linked accounts was Huff's personal account, meaning he could not blame TeleCheck's nondisclosure if he bounced a check on it. The remaining account belonged to Huff's wife. For Huff to suffer a check decline based on her account, his wife would have to bounce a check with a TeleCheck merchant, the merchant would have to report the debt to TeleCheck, Huff's wife would have to leave the debt unresolved, and Huff would have to try to use a check at a TeleCheck merchant while presenting his driver's license. The odds of that happening are remote. The inescapable truth is that Huff has not suffered a check decline in the five years since he requested his file from TeleCheck.

The question, bear in mind, is not whether Huff faces some risk of a check decline in general but what additional risk of harm stems from TeleCheck's nondisclosure of Huff's information. See Macy v. GC Servs. Ltd. , 897 F.3d 747 , 758 (6th Cir. 2018) (risk of harm must stem from the procedural violation). That means we have to ask about the difference between what Huff would have done with a report containing the linked information and what he did with the report he received. Huff offers no evidence that, had he received what he wanted, he would have tried to delink any accounts from his driver's license. Nor has he done so since acquiring that information. Full disclosure by TeleCheck, in short, would not have reduced the risk a merchant would decline Huff's check.

Now that Huff has all the information he wants, any remaining risk of a check decline flows from his failure to delink the accounts, not TeleCheck's failure to disclose them in the first instance. Because Huff has the power to eliminate any lingering risk of a check decline based on a wrongly linked account, his risk of harm does not amount to a concrete injury caused by TeleCheck. See Bassett v. ABM Parking Servs., Inc. , 883 F.3d 776 , 783 (9th Cir. 2018).

Don't forget one last point. TeleCheck alleviated any risk of harm by including the linked data disclaimer. The disclaimer warned Huff that his "record is linked to information not included in this report" and instructed him to call to get his information. R. 78-6 at 3. Had he done so, Huff could have learned which accounts TeleCheck linked him to, determined if TeleCheck linked him to any accounts mistakenly, and asked TeleCheck to delete any inappropriate links. Courts assess injuries caused by the deprivation of information based not only on the information the consumer agency fails to provide but also on the information it does provide. Dreher v. Experian Info. Sols., Inc. , 856 F.3d 337 , 346 (4th Cir. 2017). Because TeleCheck enabled, indeed encouraged, Huff to access all the information he sought, its failure to disclose the information created only a negligible risk that Huff would suffer a check decline.

3. Statutory violation as intangible injury in fact? In the absence of a tangible injury or material risk of harm, Huff offers a different theory of injury: a statutory violation that created a procedural or intangible injury. TeleCheck's failure to provide him with his linked accounts and the two missing transactions, he says, violated the Fair Credit Reporting Act. The Act creates a duty-that a consumer agency must disclose "[a]ll information in the consumer's file" upon request-and consequences for breaching that duty. 15 U.S.C. § 1681g(a)(1). And Huff has provided evidence of a breach of that duty. That's all it takes, as Huff sees it, to create a cognizable Article III injury.

Huff is right and wrong.

Huff is right that intangible injuries premised on statutory violations in some instances may satisfy Article III's injury-in-fact requirement. Spokeo , 136 S.Ct. at 1549 . Historical practice and the judgment of Congress help to determine whether an intangible injury provides Article III standing. Id. Congress's judgment is "instructive and important," id. , and it has some authority "to define injuries and articulate chains of causation," Lujan , 504 U.S. at 580 , 112 S.Ct. 2130 (Kennedy, J., concurring in part and concurring in the judgment). When Congress confers a procedural right to protect a plaintiff's concrete interests, a violation of that right may establish the requisite injury in fact. See Macy , 897 F.3d at 756 .

Huff is wrong that Congress's authority to create Article III injuries has no boundaries, save limits to congressional imagination or congressional self-restraint. Separation-of-powers considerations preserve an outer limit on Congress's authority. "Article III standing requires a concrete injury even in the context of a statutory violation." Spokeo , 136 S.Ct. at 1549 ; see Lyshe v. Levy , 854 F.3d 855 , 858 (6th Cir. 2017) ; Wall v. Mich. Rental , 852 F.3d 492 , 495 (6th Cir. 2017). If a claimant has not suffered a genuine harm or risk of harm, a federal court has no business entertaining his lawsuit. Congress cannot conjure standing by declaring something harmful that is not, by saying anything causes injury because the legislature says it causes injury. Hagy , 882 F.3d at 622 . A difference remains between injury in law and injury in fact. Otherwise Congress (or a state legislature) could create injuries in law that require the federal courts to issue advisory opinions.

As is sometimes the case with tricky legal problems, the border between what Congress may do in creating cognizable intangible injuries and what it may not do remains elusive. The Maginot Line comes to mind as a metaphor for our efforts. But that's only because the federal courts have frequently allowed Congress to create intangible injuries in the first place, often for legitimate reasons. Still, the federal courts must preserve a line, some line. Else Congress becomes the author of the limitations on its own power, a problem of greater magnitude. Cf. Marbury v. Madison , 5 U.S. (1 Cranch) 137, 177, 2 L.Ed. 60 (1803).

Huff's claim falls on the wrong side of this line. A few cases help to explain why, each involving a statutory violation-and statutory injury-that did not necessarily result in standing. Start with Spokeo v. Robins . 136 S.Ct. 1540 (2016). In that case, the Supreme Court noted that Congress enacted the Fair Credit Reporting Act to curb the dissemination of false information. Id. at 1550 . But it recognized that a violation of the law that results in the dissemination of an objectively false report does not necessarily cause a concrete harm if the disclosure has no consequences for the consumer. Id. "[A] bare procedural violation," such as the dissemination of an incorrect zip code, would not work a concrete harm for purposes of Article III. Id.

Hagy v. Demers & Adams respected that principle and elaborated on how it works. 882 F.3d 616 (6th Cir. 2018). A creditor sent a letter to the lawyer of two debtors and allegedly violated the Fair Debt Collection Practices Act by failing to disclose that it came from a debt collector. Id. at 619 . Even if that action violated the Act, we held, the debtors lacked standing because they could not point to any negative consequences, whether immediately or imminently, caused by the violation. Id. at 622 .

The Fourth Circuit looked at the problem the same way in a case arising under the Fair Credit Reporting Act, the same law at issue here. Dreher , 856 F.3d at 340 . A consumer requested and received his file from a credit agency under § 1681g. Id. The report did not name the correct source of information about one of his debts, as required by the Act, listing the name of the debt's original (but not current) owner. Id. at 341 . But the contact information in the report connected the consumer to the right creditor all the same. Id. Because the procedurally inadequate report did not "adversely affect[ ] [the consumer's] conduct in any way," the court found that the statutory violation did not harm the consumer's interests under the Act. Id. at 347 .

All three cases lead to the same destination. TeleCheck's alleged statutory violation did not harm Huff's interests under the Fair Credit Reporting Act because it had no adverse consequences. In TeleCheck's system, linked accounts play a role only when one of the accounts lists an active debt. None of the six accounts linked to Huff's driver's license has ever been associated with an outstanding debt. That means the "linked data never affected, altered, or influenced a single consumer report on [Huff]." R. 81 at 4. By omitting the linked accounts and the missing transactions, TeleCheck at most prevented Huff from delinking those accounts from his driver's license. But because the undisclosed information was irrelevant to any credit assessment about Huff, delinking the accounts would not have had any effect.

Behind all of this stands an important principle. Although Congress wields broad authority to define injuries, it does not have a blank check. Hagy , 882 F.3d at 623 . Any other conclusion would give Congress the final say over the injury-in-fact limitations in Article III, an outcome inconsistent with the architecture of the Constitution. The Framers feared an overweening Congress, "every where extending the sphere of its activity, and drawing all power into its impetuous vortex." The Federalist No. 48, at 241 (James Madison) (Terence Ball ed., 2003). To fend off that possibility, they erected structural safeguards throughout the National Charter. The horizontal separation of powers prevents Congress from flattening Article III's limitations by defining harmless procedural violations-or for that matter anything at all-as injuries in fact. See Hagy , 882 F.3d at 623 .

All of this still leaves Congress with plenty of power to define and create intangible injuries. It just has to explain itself in a way it never did here. In the absence of an explanation of how a seemingly harmless procedural violation constitutes a real injury, we are left with a canyon-sized gap between Congress's authority and the problem it seeks to resolve.

Two analogies come to mind.

One comes from United States v. Lopez . 514 U.S. 549 , 115 S.Ct. 1624 , 131 L.Ed.2d 626 (1995). The Supreme Court invalidated a federal law banning firearms within a certain distance of any school on the ground that it exceeded Congress's power "[t]o regulate Commerce ... among the several States." U.S. Const. art. I, § 8, cl. 3 ; Lopez , 514 U.S. at 567 , 115 S.Ct. 1624 . Among other explanations for its decision, the Court noted the lack of congressional findings explaining how the law regulated interstate commerce. Lopez , 514 U.S. at 562-63 , 115 S.Ct. 1624 . Congress amended the statute to include such findings, see Violent Crime Control and Law Enforcement Act of 1994, Pub. L. No. 103-322, § 320904, 108 Stat. 1796 , 2125-26 (codified as amended at 18 U.S.C. § 922 (q)(1) ); Lopez , 514 U.S. at 563 n.4, 115 S.Ct. 1624 , and to include an interstate-jurisdictional prerequisite for a prosecution, see Omnibus Consolidated Appropriations Act, 1997, Pub. L. No. 104-208, § 657, 110 Stat. 3009 , 3009-369-71 (codified as amended at 18 U.S.C. § 922 (q)(2) ). Since then, courts have upheld the amended statute. See, e.g. , United States v. Dorsey , 418 F.3d 1038 , 1046 (9th Cir. 2005) ; United States v. Danks , 221 F.3d 1037 , 1039 (8th Cir. 1999) (per curiam).

The other comes from City of Boerne v. Flores . 521 U.S. 507 , 117 S.Ct. 2157 , 138 L.Ed.2d 624 (1997). The Court invalidated the Religious Freedom Restoration Act as applied to the States because it exceeded Congress's enforcement power under Section Five of the Fourteenth Amendment. Id. at 536 , 117 S.Ct. 2157 . Among other explanations for its decision, the Court noted that Congress failed to provide a legislative record documenting any pattern of religious liberty violations that would justify extending the Act's protections beyond the Court's decisions interpreting the Free Exercise Clause. Id. at 530-33 , 117 S.Ct. 2157 . After the decision, Congress enacted the Religious Land Use and Institutionalized Persons Act, which cut back on the scope of the law and supplied the necessary record to support the new law. See 146 Cong. Rec. 16,698-700 (2000); H.R. Rep. No. 106-219, at 18-24 (1999). Subsequent challenges to the new law have been rejected. See, e.g. , Guru Nanak Sikh Soc. of Yuba City v. County of Sutter , 456 F.3d 978 , 993 (9th Cir. 2006) ; cf. Cutter v. Wilkinson , 544 U.S. 709 , 714, 125 S.Ct. 2113 , 161 L.Ed.2d 1020 (2005).

Congressional findings are neither necessary nor sufficient in every case. Congress is not an administrative agency, bound to record the reasoning behind the statutes it enacts. See Turner Broad. Sys., Inc. v. FCC , 512 U.S. 622 , 666, 114 S.Ct. 2445 , 129 L.Ed.2d 497 (1994) (opinion of Kennedy, J.). Nor will findings invariably salvage laws at the edge of congressional power. See United States v. Morrison , 529 U.S. 598 , 614, 120 S.Ct. 1740 , 146 L.Ed.2d 658 (2000). But in the borderlands of congressional power to define intangible injuries that satisfy Article III, a vexing area under any circumstance, guidance about the ills a statute is meant to remedy can instruct and guide.

Congress has not provided any such guidance here. Had it explained why the type of incomplete disclosure Huff received constitutes an injury in fact, our analysis might well have been different. But because Congress has not attempted to show how technical violations of the Fair Credit Reporting Act that carry no actual consequences or real risk of harm are concrete injuries, we must find that Huff has not been injured in this case.

Huff tries to counter this conclusion on two grounds. Neither one is convincing.

Huff insists that TeleCheck's failure to disclose this information injured his concrete interests under the Fair Credit Reporting Act by "robb[ing] [him] of his right to monitor his file," which prevented him from disputing the accuracy of the links. Appellant's Br. 33. Regardless of whether he presented his driver's license alongside checks from the six missing accounts, he explains, his license should not be linked to some of the accounts because they don't belong to him, and he had no way of delinking them without knowing about them.

Assume for now that TeleCheck wrongly linked Huff's accounts. The linked information nonetheless never made a difference in any credit determination, meaning its continued existence in TeleCheck's system did not harm Huff's concrete economic interests. See Owner-Operator Indep. Drivers Ass'n v. U.S. Dep't of Transp. , 879 F.3d 339 , 345 (D.C. Cir. 2018). Confirming the point, Huff never took any action after receiving the undisclosed information, indicating he wouldn't have done anything even if he had received it earlier.

Public Citizen v. U.S. Department of Justice , 491 U.S. 440 , 109 S.Ct. 2558 , 105 L.Ed.2d 377 (1989), and FEC v. Akins , 524 U.S. 11 , 118 S.Ct. 1777 , 141 L.Ed.2d 10 (1998), do not alter this conclusion. In those cases, the Court held that a deprivation of information sufficed to provide standing because the plaintiffs would have used the information to participate in the political process. See Akins , 524 U.S. at 21 , 118 S.Ct. 1777 ; Pub. Citizen , 491 U.S. at 449 , 109 S.Ct. 2558 . Here, in contrast, TeleCheck's incomplete report had no effect on Huff or his future conduct. See Dreher , 856 F.3d at 346-47 . The Act never attempts to show how a technical impairment of a consumer's ability to monitor a credit report-that carries no actual consequences for the consumer-rises to the level of an Article III injury, even an Article III intangible injury. See id. at 347 . That leaves us with a "bare procedural violation," attenuated from any real harm or imminent risk of harm, that Congress cannot convert into Article III standing. Spokeo , 136 S.Ct. at 1549 ; Hagy , 882 F.3d at 622 .

Huff argues that Macy v. GC Services Ltd. shows that the risk of a check decline created by TeleCheck's nondisclosure establishes standing. 897 F.3d 747 (6th Cir. 2018). Macy , to start, involved a different law: the Fair Debt Collection Practices Act. 15 U.S.C. § 1692 et seq . Two debtors received a letter from a debt collector notifying them that their credit card accounts had been referred to the company for collection. Macy , 897 F.3d at 751 . The letter informed the debtors that they could dispute their debt within 30 days, but it failed to say the dispute had to be "in writing." Id. That violated § 1692g(a), and the debtors sued. We found the debtors had standing because the debt collector's failure to include the words "in writing" created a material risk the debtors might forfeit other protections for their concrete economic interests. Id. at 758 .

The Macy statute made a risk of harm far more likely than this law does. In enacting the Fair Debt Collection Practices Act, Congress sought to curb abusive debt collection activities. Id. at 756 ; see 15 U.S.C. § 1692 (e). In finding that the nondisclosure of the "in writing" requirement posed a material risk of harm, we observed that a written dispute triggered other statutory protections, such as forcing the debt collector to verify the debt and blocking the collector from collecting the debt until completing the verification. Macy , 897 F.3d at 758 ; see 15 U.S.C. § 1692g(b). An oral dispute would forfeit those protections. Macy , 897 F.3d at 758 . Because Congress tied the writing requirement to statutory protections of concrete economic interests, the failure to include the words "in writing" created a material risk of harm.

The Fair Credit Reporting Act does not contain such interlocking statutory protections. While it allows consumers to look into and correct information in their files, it does not provide a shield from imminent economic harm in the way the Fair Debt Collection Practices Act does. The Fair Credit Reporting Act's main target is the dissemination of inaccurate and harmful information, just as in Spokeo . See 136 S.Ct. at 1550 . Because TeleCheck's nondisclosure never harmed Huff, and because it did not create a material risk that Huff would suffer a check decline, Huff has not suffered an injury in fact.

The difference between Macy and this case comes down to a difference in how Congress exercised its power. In Macy , Congress did not trespass on Article III because the statutory violation was closely connected to real economic harm and thus amounted to an injury in fact. In this instance, Congress crossed the line. It has not shown how a deprivation of information that neither holds consequences for the consumer nor imposes a real risk of harm creates an injury. In the absence of that showing, we have only Congress's say-so, and that does not suffice-at least so long as the federal courts preserve the Constitution's structural boundaries.

The dissent claims that we have "declare[d] the Fair Credit Reporting Act unconstitutional as exceeding Congress's power to provide a judicial remedy for statutory violations." Infra , at 469. That overstates. Just as no one can obtain an advisory opinion about the meaning of this law or any other, no one can enforce this law or any other without a concrete Article III injury in fact. And even in this case, our decision does not mean that TeleCheck's alleged violations must escape scrutiny. Regardless of Huff's standing, the Federal Trade Commission and other agencies have both the authority to enforce compliance with the Act and a sovereign interest in doing so. See 15 U.S.C. § 1681s.

That leaves a perspective that has not been raised in today's case but may deserve consideration in a future case. As Justice Thomas has pointed out, Article III standing may draw a line between private and public rights. With respect to statutes creating private rights-that create duties owed to the plaintiffs as individuals-a bare statutory violation may suffice to establish standing. But with respect to statutes creating public rights-that create duties owed to the community as a whole-a bare statutory violation may not suffice, and the plaintiff must show some individual harm beyond the violation. See Spokeo , 136 S.Ct. at 1551-53 (Thomas, J., concurring); see also Frank v. Gaos , --- U.S. ----, 139 S.Ct. 1041 , 1046-47, --- L.Ed.2d ---- (2019) (Thomas, J., dissenting). The theory deserves further consideration at some point. It seems to respect history and cuts a path in otherwise forbidding terrain. See William Baude, Standing in the Shadow of Congress , 2016 Sup. Ct. Rev. 197 , 227-31 ; Ann Woolhandler & Caleb Nelson, Does History Defeat Standing Doctrine? , 102 Mich. L. Rev. 689 , 693-712 (2004). But the theory also raises questions of its own in an age of statutes. Whatever is true of Congress's power to create standing by statute would seem to hold for state legislatures as well, posing another threat to Article III's limits. And even if the dichotomy between public and private rights honors original meaning, what of laws that use nominally private rights as a way of commissioning private attorneys general to enforce public regulatory schemes-a modern reality without obvious eighteenth-century heirs? What amounts to a public right and what amounts to a private right may not be easy to transpose today. Either way, clarification from Congress about whether a right was meant to protect personal or public interests would ease the judicial task. For now, under Spokeo and our own decisions, Huff has failed to establish injury in fact.

We affirm.

DISSENT

HELENE N. WHITE, Circuit Judge, dissenting.

The majority declares the Fair Credit Reporting Act ("FCRA") unconstitutional as exceeding Congress's power to provide a judicial remedy for statutory violations. 1 Contrary to the majority's conclusion, Huff's injury in fact was sufficiently concrete to satisfy Article III standing requirements because (1) Congress conferred on consumers like Huff the right to request their entire file to protect their interest in having only accurate information reported about them, and (2) TeleCheck's failure to provide Huff's entire file created a material risk that inaccurate information would be reported about him and he would face a check decline. Accordingly, I respectfully dissent.

This court recently held that the violation of a procedural right granted by statute is sufficient to constitute a concrete injury in fact where (1) "Congress conferred the procedural right to protect a plaintiff's concrete interests" and (2) "the procedural violation presents a material risk of real harm to that concrete interest." Macy v. GC Services Limited Partnership , 897 F.3d 747 , 756 (6th Cir. 2018). Both requirements are met here.

First, Congress conferred on consumers like Huff the right to obtain their full file to protect their interest in not having false credit information reported about them. In enacting the FCRA, "Congress plainly sought to curb the dissemination of false information by adopting procedures designed to decrease that risk." Spokeo, Inc. v. Robins , --- U.S. ----, 136 S.Ct. 1540 , 1550, 194 L.Ed.2d 635 (2016). One such procedure is that "[u]pon request and identification, the reporting agency is required to divulge the information in its files concerning the interested consumer." Hovater v. Equifax, Inc. , 823 F.2d 413 , 417 (11th Cir. 1987) (citing 15 U.S.C. § 1681g ). "The purpose of the [FCRA's] disclosure requirement [in 15 U.S.C. § 1681g ] is to provide the consumer with an opportunity to dispute the accuracy of information in his file." Hauser v. Equifax, Inc. , 602 F.2d 811 , 817 (8th Cir. 1979). Once the consumer identifies the allegedly inaccurate information, the FCRA sets forth a detailed grievance procedure governing how to correct that inaccuracy. 15 U.S.C. § 1681i. In short, "[a] primary purpose[ ] of the statutory scheme provided by the disclosure in § 1681g(a)(1) is to allow consumers to identify inaccurate information in their credit files and correct this information via the grievance procedure established under § 1681i." Gillespie v. Equifax Info. Servs., L.L.C. , 484 F.3d 938 , 941 (7th Cir. 2007). Thus, Congress conferred on consumers the procedural right to receive their file upon request to reduce the concrete risk that inaccurate information about them would be disclosed.

Second, TeleCheck's failure to provide Huff with the identifiers linked to him created a material risk of real harm. Unbeknownst to Huff, TeleCheck linked his driver's license number with bank accounts that were not his. When Huff exercised his right to receive his file, TeleCheck failed to disclose those bank accounts, and Huff therefore was unable to use the FCRA's grievance procedures to correct that information. Consequently, Huff was at risk of harm if one of those accounts developed a debt and Huff presented his driver's license while paying by check.

The majority disagrees that Huff faced a material risk of real harm, distinguishing Macy on the basis that unlike the protections in the Fair Debt Collection Practices Act ("FDCPA") at issue in Macy , the FCRA does not contain "such interlocking statutory protections." (Maj. Op. at 468.) However, the FCRA "interlocks" the consumer's right to his file with his ability to correct inaccurate information through the FCRA's provided procedure. Moreover, it makes sense that Congress would use different procedural protections given the different purposes of the FCRA and FDCPA. In other words, the method by which Congress chose to protect Huff's interests under the FCRA is a function of the harm he faced. Just as notifying a debtor of the actions required to preserve his rights minimizes the risk of abusive debt practices, enabling a consumer, well-situated to detect his own inaccurate information, to review his file minimizes the risk of the disclosure of an inaccurate credit report. By providing the incomplete file, TeleCheck deprived Huff of the information necessary to dispute the errantly linked accounts and thus created a material risk that if one of those accounts developed a debt, inaccurate information would be reported about Huff, and Huff's check would be declined. It appears that the majority's real quarrel is with Macy itself; the majority would prefer a rule that requires the plaintiff to show actual harm.

The cases relied on by the majority do not support the conclusion that there was no material risk of harm. Spokeo 's example of an incorrect zip code suggests a lower bar for risk of harm than the bar set by the majority here. 136 S.Ct. at 1550 . Erroneously linked identifying information presents a far greater risk of harm than an incorrect zip code. Although it is hard to imagine the risk of harm from an incorrect zip code, the risk of linking an individual to accounts not owned by him is apparent: TeleCheck effectively tied Huff's creditworthiness to another consumer's, and Huff faced the risk of TeleCheck erroneously reporting a negative credit assessment solely because of that.

Similarly, Hagy v. Demers & Adams , 882 F.3d 616 (6th Cir. 2018) is materially different from this case because in Hagy , a creditor failed to provide the required disclosure on a letter in which the creditor discharged a debt. 882 F.3d at 622 . Thus, unlike in this case, the violation presented no risk of harm because the creditor's letter to the debtors was "good news." Id.

Finally, the majority's reliance on Dreher v. Experian Information Solutions, Inc. , 856 F.3d 337 (4th Cir. 2017) is misplaced for at least two reasons. Dreher applied the standard for informational injuries formulated by Friends of Animals v. Jewell , 828 F.3d 989 (D.C. Cir. 2016), relying on the Supreme Court's decision in Federal Election Commission v. Akins , 524 U.S. 11 , 118 S.Ct. 1777 , 141 L.Ed.2d 10 (1998). Under that standard, a plaintiff lacks standing unless he is "denied access to information required to be disclosed by statute, and he 'suffers, by being denied access to that information, the type of harm Congress sought to prevent by requiring disclosure.' " 856 F.3d at 345-46 (quoting Jewell , 828 F.3d at 992 ) (emphasis omitted). That standard is different from the one based on Spokeo articulated by Macy because it requires that the consumer suffer a "harm" rather than simply face the "risk" of harm. Macy , 897 F.3d at 756 . Second, before the Dreher court even considered whether the violation "adversely affected" the consumer's conduct, it concluded that the harm the consumer claimed-what the court called a "customer-service" harm-"is not the type of harm Congress sought to prevent when it enacted the FCRA." 856 F.3d at 346 . The court explained: "Failing to identify either a common law analogue or a harm Congress sought to prevent , [the consumer] is left with a statutory violation divorced from any real world effect." Id. (emphasis added). Here, however, Huff claims a risk of harm to a concrete interest that Congress sought to prevent-an inaccurate credit report based on bank accounts that are not his.

The majority also errs in suggesting that Congress should have "explain[ed] itself" and did not when it allowed a customer to sue after receiving an incomplete file. (Maj. Op. at 466.) As an initial matter, even if an explanation were necessary here, Congress did provide such an explanation. Rather than the "canyon-sized gap between Congress's authority and the problem it seeks to resolve" perceived by the majority ( id. ), Congress closely tied the right to disclosure of one's entire file to the legitimate purpose of preventing the report of inaccurate information to others. Congress established the disclosure requirement to enable a consumer to correct inaccurate information in his or her file, thereby reducing the risk of an inaccurate credit report. Moreover, the majority supplies little basis for faulting Congress for failing to connect the procedural violation with the risk of harm. Spokeo does not impose such an obligation, and the majority's only authority is its analogy to United States v. Lopez , 514 U.S. 549 , 115 S.Ct. 1624 , 131 L.Ed.2d 626 (1995) and City of Boerne v. Flores , 521 U.S. 507 , 117 S.Ct. 2157 , 138 L.Ed.2d 624 (1997). However, neither Lopez nor City of Boerne involved limits on Congress's power to provide a judicial remedy for statutory harms under Article III standing requirements.

For the above reasons, I respectfully dissent.