In 2009 Allstate Insurance Company launched an internal investigation into suspicious trading on its equity desk. The initial inquiry unearthed email evidence suggesting that several portfolio managers might be timing trades to inflate their bonuses at the expense of their portfolios, which included two pension funds to which Allstate owed fiduciary duties. Allstate retained attorneys from Steptoe & Johnson to investigate further, and they in turn hired an economic consulting firm to calculate potential losses. Based on the email evidence, the consulting firm found reason to believe that timed trading had potentially cost the portfolios $8 million and possibly much more. Because actual losses could not be established, the consult-ants used an algorithm to estimate a potential adverse impact of $91 million on the pension funds. Everyone understood that this estimate was wildly unrealistic, but in an abundance of caution, Allstate poured $91 million into the pension portfolios.
When the investigation wrapped up, Steptoe lawyers delivered oral findings to Allstate. The company thereafter determined that four portfolio managers-Daniel Rivera, Stephen Kensinger, Deborah Meacock, and Rebecca Scheuneman-had *1034violated the company's conflict-of-interest policy by timing trades to improve their bonuses. On December 3, 2009, Allstate fired them for cause.
On February 25, 2010, Allstate filed its annual Form 10-K for 2009. The report explained that: (1) in 2009 the company had received information about possible timed trading and retained counsel to investigate; (2) counsel hired an economic consulting firm to estimate the potential impact on the portfolios; and (3) based on this outside investigation, Allstate paid $91 million into the two pension funds to cover the potential adverse impact. That same day Allstate sent a memo to employees in its Investment Department describing the information disclosed in the 10-K. Neither document mentioned the four fired portfolio managers.
Three weeks later the four former employees sued Allstate for defamation based on the 10-K and the internal memo. They also alleged that Allstate violated 15 U.S.C. § 1681a(y)(2), a provision in the Fair Credit Reporting Act ("FCRA or the Act"), by failing to give them a summary of Steptoe's findings after they were fired. A jury returned a verdict in their favor, awarding more than $27 million in compensatory and punitive damages. The district judge tacked on additional punitive damages and attorney's fees under the FCRA.
Allstate's appeal attacks the defamation awards on multiple grounds. We need address only one. The statements in the 10-K and internal memo were not defamatory per se, so they are actionable (if at all) only on a theory of defamation per quod. This type of claim requires proof of special damages causally connected to the publication of the defamatory statements. So the plaintiffs had to prove that prospective employers declined to hire them because of Allstate's defamatory statements and that they suffered damages as a result. The plaintiffs testified that they could not find comparably lucrative work after they were fired, but they presented no evidence that any prospective employer declined to hire them as a consequence of Allstate's statements in the 10-K or the internal memo. That's fatal to the defamation claims.
As for the FCRA claims, we're skeptical that § 1681a(y)(2) applies at all, but Allstate hasn't raised this point. Rather, Allstate argues that the awards must be vacated for lack of standing under Spokeo, Inc. v. Robins , --- U.S. ----, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016). We agree. We therefore vacate the judgment and remand for entry of judgment for Allstate on the defamation claims and dismissal of the FCRA claims.
I. Background
Plaintiffs Rivera, Kensinger, Meacock, and Scheuneman were employed as securities analysts in the Equity Division of Allstate's Investment Department. Rivera was the Division director, and Kensinger, Meacock, and Scheuneman were analysts on the growth team. During their time with the company, the Equity Division managed and invested $10 billion in assets on behalf of various funds, including two defined-benefit pension plans. Because the plaintiffs helped manage two pension portfolios, they occupied positions of trust and owed a duty of loyalty to plan beneficiaries under the Employee Retirement Income Security Act. See 29 U.S.C. § 1104(a)(1). They were also bound by Allstate's code of ethics, which required them to avoid conflicts of interest.
In addition to their salaries, the plaintiffs were eligible to receive bonus compensation under Allstate's "pay-for-performance" plan. The plan relied on a formula called the "Dietz method" to estimate portfolio returns and evaluate performance accordingly. The Dietz *1035method assumes that all cash flows in a portfolio occur at the same time of day; high transaction volume makes it impractical to use actual trade times. The particular formula in use at Allstate assumed all cash flows occurred at midday.
While practical, Allstate's formula had two drawbacks. First, it distorted a portfolio's actual performance, both positive and negative. The midday Dietz method inflated measured performance for sales on up days and buys on down days; conversely, it understated measured performance when sales were made on down days and buys on up days. Allstate's traders referred to this discrepancy as the "Dietz effect."
Second, the formula could be manipulated. Because it assumed that all cash flows occurred midday, portfolio managers could wait until the end of day to calculate the Dietz effect before deciding to execute a trade. The system consequently rewarded portfolio managers who waited to make trades even if the portfolio suffered as a result. Moreover, Allstate's bonus structure measured performance relative to a daily benchmark; it didn't consider market movement in the preceding days. This feature also pitted the interests of the manager against those of the portfolio. A manager could improve his performance by delaying a sale over several down days before selling on an up day even if the portfolio would have been better off if he sold earlier. In sum, under Allstate's pay-for-performance plan, portfolio managers could boost their bonus pay by timing trades-potentially at the expense of their portfolios.
In mid-2009 Allstate received troubling information that its portfolio managers were doing just that. Peter Hecht, a member of Allstate's Performance Management Group, reported to Chief Compliance Officer Trond Odegaard that members of the Equity Division were delaying trades to maximize their bonuses at the expense of their portfolios. Odegaard passed these concerns along to Chief Investment Officer Judy Greffin, who ordered him to investigate.
Odegaard and a team of Allstate employees soon discovered signs of timed trading. The team noted several trading patterns that suggested portfolio managers had delayed trades to take advantage of the Dietz effect. The investigation also uncovered emails suggesting that the managers were aware of the Dietz effect and actively considered it when trading. Though not conclusive, the investigation raised concerns that personnel in the Equity Division had timed trades to increase bonuses at the expense of their portfolios; as a result, Allstate may have reported inaccurate financial information to the public.
Allstate accordingly retained the law firm Steptoe & Johnson to investigate further. Steptoe attorneys interviewed Rivera and Scheuneman regarding their trading practices and hired NERA Economic Consulting, Inc., an independent economic consulting firm, to determine if timed trading had harmed the portfolios, especially the pension funds. Beginning with the trades mentioned in the suspicious emails and eventually reviewing six years of trading data, NERA preliminarily estimated a potential adverse portfolio impact of $8.2 million.
But NERA had reason to believe that the actual impact may be much higher. Several suspicious emails could not be tied to particular trades, and other evidence suggested that portfolio managers routinely considered Dietz in the course of trading. Based on Allstate's records, however, it was not possible to calculate actual losses with any precision. So NERA devised an algorithm that would capture every Dietz-favorable trade from June 2003 to May 2009 that was executed after a series *1036of days where the Dietz effect would have harmed the trader's performance. Based on these parameters, NERA estimated that over the six years surveyed, the potential adverse impact on the pension plans was $91 million and the potential adverse impact on the company's other portfolios was $116 million. It was clear to everyone that these estimates vastly overstated the potential effect of timed trading. Erring on the side of caution, however, in mid-December Allstate paid $91 million into the two pension plans to compensate for any potential losses.
While the investigation was ongoing, Allstate disbanded the Equity Division and outsourced its work to Goldman Sachs. On October 6, 2009, Greffin met first with Rivera and then the rest of the division and explained that every member, save those who managed convertible portfolios, would be let go effective December 31, 2009. The laid-off employees would, however, receive severance pay. Later that day Steptoe attorneys conducted off-site interviews with Equity Division managers concerning Dietz trading.
The outside investigation soon wrapped up, and Steptoe attorneys orally reported the findings to Allstate. Based on the internal and external investigations, Allstate concluded that Rivera, Meacock, Scheuneman, and Kensinger had violated the company's conflict-of-interest policy by timing trades. On December 3, 2009, Brett Winchell, the Director of Human Resources, informed each of the four analysts that they were fired for cause effective immediately. Winchell delivered the bad news by reading from a short script that reminded the four managers of the investigation into timed trading, noted that each of them had been interviewed by outside counsel, and explained that they were being fired because they violated Allstate's conflict-of-interest policy. All four asked Winchell for additional explanation; they later asked the same questions in writing. No further explanation, oral or written, was forthcoming. Allstate immediately escorted them off the premises and disconnected their phone and email service the next day.
On December 16 Steptoe attorneys met with regulators in the Department of Labor's Employee Benefits Security Administration to discuss the investigation as it related to the pension funds. At the Department's request, Steptoe sent a follow-up letter summarizing the allegations of timed trading and the subsequent investigation. The letter-dated January 29, 2010-advised the Department that the employees in Allstate's Equity Division had denied that they improperly delayed trades but that several emails "could support a contrary conclusion." The letter further explained that NERA's algorithm "estimate[d] potential disadvantage to the plans" but that "there is little question that the algorithm overstate[d] any disadvantages that the plans might have suffered." Finally, the letter explained that "taking into account returns recalculated by NERA," the estimated "increase in the aggregate bonuses for the entire group" was "approximately $1.2 million."
Fast-forward to October 14, 2010. On that day Allstate's in-house counsel sent another letter to the Labor Department clarifying that the $1.2 million figure "roughly approximate[d] the potential increase in bonuses, ... assum[ing] the algorithm used by NERA ... reflected actual trading activity." This letter emphasized that NERA's calculations estimated "a possible maximum impact" and explained that "[n]o one believed, then or now, that this was an accurate description of the activity on the equity desk, nor that any actual impact on the portfolios was anywhere near the result produced by using the NERA algorithm." The October letter also stated that if the analysis had been *1037limited to the trades mentioned in the suspicious emails, "there would have been virtually no effect on bonuses."
Returning now to our chronology, on February 25, 2010, Allstate filed its annual 10-K report for 2009 in which it disclosed the allegations of timed trades and explained in general terms the subsequent investigation and the company's decision to reimburse the two pension plans. As relevant here, the 10-K stated:
In 2009, we became aware of allegations that some employees responsible for trading equity securities in certain portfolios of two [Allstate Insurance Company] defined benefit pension plans and certain portfolios of [Allstate Insurance Company] and an [Allstate Insurance Company] subsidiary may have timed the execution of certain trades in order to enhance their individual performance under incentive compensation plans, without regard to whether such timing adversely impacted the actual investment performance of the portfolios.
We retained outside counsel, who in turn engaged an independent economic consulting firm to conduct a review and assist us in understanding the facts surrounding, and the potential implications of, the alleged timing of these trades for the period from June 2003 to May 2009. The consulting firm reported that it was unable to determine from our records the precise amounts by which portfolio performance might have been adversely impacted during that period. Accordingly, the economic consultant applied economic modeling techniques and assumptions reasonably designed to estimate the potential adverse impact on the pension plans and the company accounts, taking into account, among other things, the distinctions between the pension plans and the company portfolios.
Based on their work, the economic consultants estimated that the performance of the pension plans' portfolios could have been adversely impacted by approximately $91 million (including interest) and that the performance of the company portfolios could have been adversely impacted by approximately $116 million (including interest) in the aggregate over the six-year period under review. We believe that our financial statements and those for the pension plans properly reflected the portfolios' actual investment performance results during the entire period that was reviewed.
In December 2009, based on the economic consultant's modeled estimates, we paid an aggregate of $91 million into the two defined benefit pension plans. These payments had no material impact on our reported earnings or shareholders' equity, but reduced our assets, operating cash flows, and unfunded pension liability to the plans.... At all times during this period, the plans were adequately funded pursuant to applicable regulatory and actuarial requirements. As a result of these additional funds in the plans, our future contributions to the plans, based on actuarial analysis, may be reduced. Using the economic consultant's calculation of the potential adverse impact on the portfolios, we currently estimate that the additional compensation paid to all the employees working in the affected group was approximately $1.2 million over the six-year period as a result of these activities. In late 2009, we retained an independent investment firm to conduct portfolio management and trading activity for the specific portfolios impacted by these activities.
That same day Greffin sent a memo to all employees in the Investment Department alerting them to the information in the 10-K filing. In full, the Greffin memo states:
*1038Allstate released its annual financial report on Form 10-K today. Within that filing, we disclosed details around allegations regarding trading practices within our equity portfolios that came to light in the past year. We took this matter very seriously and launched an investigation as soon as we became aware of the allegations.
Outside counsel was retained to assist us in understanding the facts surrounding, and the potential implications of, these activities. As part of their analysis, an independent economic consulting firm was retained to estimate the potential adverse impact to the performance of our portfolios. The consultant determined that the performance on some of our portfolios, as well as our two pension plan portfolios, could have been adversely impacted by the activities. As a result, Allstate made a contribution to the pension plans during the 4th quarter which is disclosed in the 10-K.
We believe that our financial statements and those of the pension plans properly reflected the portfolios' actual investment performance and the pension plans were adequately funded during this entire period. This matter did not affect the plans' ability to continue to provide benefits to plan participants.
Situations like this can be unsettling and can reflect poorly on our organization. However, I believe organizations are also defined by how they respond to events like this. We were transparent in reporting this matter to the U.S. Department of Labor and the S.E.C., and disclosed it to our investors. We're taking steps to improve our governance, compliance practices and training.
We remain committed to the highest levels of ethics and integrity in the stewardship of Allstate's assets.
Three weeks later the four fired portfolio managers sued Allstate and Greffin for defamation based on the 10-K and Greffin's internal memo. They also asserted FCRA claims against Allstate for violation of § 1681a(y)(2) and claims against Greffin for tortious interference with prospective economic advantage. The district judge dismissed the tortious-interference claims, and the plaintiffs then amended their complaint to add age-discrimination claims against Allstate. They later dismissed the discrimination claims as well as the defamation claims against Greffin.
Lengthy discovery ensued and in due course Allstate moved for summary judgment. Judge Feinerman ruled that the statements in the 10-K and the Greffin memo were not defamatory per se. Rivera v. Allstate Ins. Co. , 140 F.Supp.3d 722, 729-30 (N.D. Ill. 2015). But he permitted the case to go forward on a theory of defamation per quod and on the FCRA claims. Id. at 730-37.
As narrowed, the case proceeded to a jury trial with Judge Hart presiding. The jury found for the plaintiffs across the board and awarded more than $27 million in compensatory and punitive damages, broken down roughly as follows:
Rivera :
$7.1 million (defamation compensatory damages)
$4 million (defamation punitive damages)
$1,000 (FCRA statutory damages)
Kensinger :
$2.9 million (defamation compensatory damages)
$2 million (defamation punitive damages)
$1,000 (FCRA statutory damages)
Meacock :
$3.6 million (defamation compensatory damages)
$3 million (defamation punitive damages)
*1039$1,000 (FCRA statutory damages)
Scheuneman :
$3.4 million (defamation compensatory damages)
$1 million (defamation punitive damages)
$1,000 (FCRA statutory damages)
Allstate moved for judgment as a matter of law, or alternatively, for a new trial. The plaintiffs separately asked the judge for an award of punitive damages and attorney's fees under the FCRA. 15 U.S.C. § 1681n(a)(2), (3) (authorizing "such amount of punitive damages as the court may allow" and attorney's fees for willful violations of the FCRA).
Judge Hart denied Allstate's motion and granted the plaintiffs' requests, awarding each plaintiff an additional $3,000 in punitive damages under the FCRA and approving their request for $357,716.25 in attorney's fees associated with the statutory claims.
II. Discussion
Allstate attacks this large judgment on many grounds. In brief, the company argues that the defamation awards must be set aside because: (1) the statements in the 10-K and the Greffin memo were substantially true; (2) neither the 10-K nor the Greffin memo identified the plaintiffs, and no evidence supports a finding that these documents could be reasonably understood to refer to them; (3) the statements in the 10-K and the Greffin memo were privileged; and (4) the plaintiffs failed to prove special damages as required for recovery for defamation per quod. Regarding the FCRA awards, Allstate argues that the plaintiffs lack standing under Spokeo , and secondarily, that the record does not support the jury's finding of a willful violation of the statute as required for statutory and punitive damages. (There are no actual damages.) Finally, Allstate attacks the award of FCRA attorney's fees as excessive and disproportionate considering the relative insignificance of the statutory claims to this litigation.
A. Defamation Per Quod
Though Allstate raises several challenges to the defamation awards, we need consider only one. In Illinois a claim for defamation per quod requires proof of special damages. Maag v. Ill. Coalition for Jobs, Growth & Prosperity , 368 Ill.App.3d 844, 306 Ill.Dec. 909, 858 N.E.2d 967, 975 (2006). Special damages are "actual damages of a pecuniary nature," id. , that are "a necessary and proximate consequence of the publication involved," Cont'l Nut Co. v. Robert L. Berner Co. , 393 F.2d 283, 286 (7th Cir. 1968). To prove special damages, the plaintiff generally must present direct, rather than merely circumstantial, evidence that the defendant's defamatory statement caused pecuniary harm. See id. at 286-87. Put in more concrete terms, the plaintiff must identify a third party who refused to do business with him based on the defendant's defamatory statements. See Barry Harlem Corp. v. Kraff , 273 Ill.App.3d 388, 210 Ill.Dec. 101, 652 N.E.2d 1077, 1082-83 (1995) ; Taradash v. Adelet/Scott-Fetzer Co. , 260 Ill.App.3d 313, 195 Ill.Dec. 420, 628 N.E.2d 884, 888 (1993).
Our decision in Continental Nut Co. v. Robert L. Berner Co. is instructive on this element of the claim. Continental Nut Company and Robert L. Berner Company both sold Brazilian nuts through separate broker networks. 393 F.2d at 284. The Berner Company sent a letter to its brokers disparaging Continental's nuts, and Continental sued for defamation per quod. Id. at 284-85. To prove special damages, Continental presented broker testimony that a few of its customers had seen the defamatory letter and others had declined to purchase Continental's nuts over the following two years. Id. at 285. Continental *1040also presented evidence that its sales and profits had decreased while the Berner Company's had increased during this same time period. Id. at 285-86. But this evidence was highly generalized; Continental did not present testimony from even a single customer that the defamatory letter prompted it to take its business elsewhere. Id. at 286-87.
That, we explained, was fatal to the claim for defamation per quod. Although circumstantial evidence implied that the letter harmed Continental's business, Continental did not "produce[ ] the testimony of a single customer or former customer," so "the jury was left to speculate as to ... whether the libel caused the losses." Id. at 286. Because the evidence "implied" rather than "specifically proved" special damages, Continental failed to carry its burden to establish defamation per quod as a matter of law. Id.
So too here. The plaintiffs testified that they were unable to find comparably compensated employment after Allstate fired them. One of their experts opined that a for-cause termination can stigmatize a professional and limit career prospects. Another expert testified that professionals with the plaintiffs' credentials likely would have been employed in a comparable position within a short period of time. So circumstantial evidence implies that Allstate's statements harmed the plaintiffs' careers.
But that's not enough to prove special damages. Here, as in Continental Nut , the plaintiffs failed to present the testimony of even a single prospective employer who declined to hire them because of the statements in the 10-K or the Greffin memo. As a result the jury was "left to speculate" based on circumstantial evidence alone whether the defamatory statements actually caused the claimed harm. Id. That's a failure of proof.
The plaintiffs respond that Illinois law doesn't always require direct testimony from a third party who refused to do business with the plaintiff as a result of the defendant's defamatory statement. For support they cite Imperial Apparel, Ltd. v. Cosmo's Designer Direct, Inc. , 367 Ill.App.3d 48, 304 Ill.Dec. 693, 853 N.E.2d 770 (2006), rev'd on other grounds , 882 N.E.2d 381 (Ill. 2008). In that case a discount clothing retailer, Imperial Apparel, sued its competitor, Cosmo's Designer Direct, for publishing a defamatory advertisement in the Chicago Sun-Times . Id. 304 Ill.Dec. 693, 853 N.E.2d at 774. Imperial alleged that its sales had decreased following the publication. Cosmo moved to dismiss, arguing that because a claim for defamation per quod requires the plaintiff to plead and prove special damages, Imperial needed to "allege with particularity which potential customers were deterred from purchasing Imperial's merchandise" because of the advertisement. Id. 304 Ill.Dec. 693, 853 N.E.2d at 780.
The Illinois Appellate Court disagreed, noting that because Imperial sold goods "to the general public" and Cosmo's advertisement was "wide[ly] disseminat[ed] ... to persons unknown," it was "obviously impossible" for Imperial to "specifically identify the potential customers" who were swayed by the advertisement. Id. 304 Ill.Dec. 693, 853 N.E.2d at 781. The court went on to explain that although special damages in a claim for defamation per quod must be pleaded with specificity, "a plaintiff is only obligated to be as specific as it is reasonable to require." Id. Accordingly, the court concluded that Imperial was not required to identify particular customers who were deterred by Cosmo's advertisement from purchasing its wares; alleging a decline in sales was sufficient.
It's easy to see why Imperial Apparel does not apply here. Our plaintiffs are not *1041mass-market retailers; they are highly specialized investment portfolio managers. They did not offer their services to the general public; rather, they were seeking replacement employment in the investment community, which, according to their own testimony, is small and close-knit. The pool of potential substitute employers did not comprise "persons unknown." Quite the opposite: the plaintiffs obviously know to which companies and firms they applied after Allstate fired them. So although there may be cases in which a plaintiff may rely solely on circumstantial evidence to prove special damages, this is not one of them. We therefore vacate the defamation awards and remand with instructions to enter judgment for Allstate.
B. Fair Credit Reporting Act
Relying on Spokeo , Allstate maintains that the FCRA awards must be tossed out for lack of standing. Alternatively, Allstate argues that the trial evidence doesn't support the jury's finding that it violated the statute willfully , a necessary predicate for statutory and punitive damages. 15 U.S.C. § 1681n(a). Finally, Allstate contends that the award of attorney's fees under the statute is excessive given the relative unimportance of the FCRA claims to the overall litigation.
A bit of statutory background is required to understand the FCRA claims in this case. We note for starters that the claims represent an odd application of the Act. The FCRA regulates the activities of consumer reporting agencies and the permissible uses of consumer reports by third parties. Among many other regulatory requirements, the Act imposes certain procedures for the use of consumer reports for employment purposes.
For example, the Act prohibits an employer from procuring a consumer report about an employee or job applicant without first giving that person a stand-alone written notice that "clear[ly] and conspicuous[ly]" discloses the employer's request for permission to access the report and the person signs a written consent to release the report to the employer. See id. § 1681b(b)(2)(A) (establishing the disclosure and consent requirements); see id. § 1681a(d)(1) (defining "consumer report" to include reports about a consumer's creditworthiness and personal background compiled by a "consumer reporting agency" and "used or expected to be used ... for the purpose of serving as a factor in establishing the consumer's eligibility for" credit, insurance, or "employment purposes").
The Act further requires that before taking any adverse action against an employee or job applicant "based in whole or in part" on such a report, the employer must give the employee or applicant a copy of the report and a written description of the person's rights under the Act. Id. § 1681b(b)(3)(A).
The FCRA provision at issue here appears in § 1681a, which contains the Act's definitions and rules of construction. (The statutory scheme is reticulated and complex, so bear with us.) Subsection (d)(2)(D) of § 1681a excludes from the definition of "consumer report" any "communication described in subsection (o) or (x)." The reference to "subsection (x)" is an error; it should read "subsection (y)." The error was introduced in the Dodd-Frank Act of 2010,1 which redesignated the former subsection (x) as subsection (y) but neglected to update the cross-reference in *1042§ 1681a(d)(2)(D). See Pub. L. No. 111-203, § 1988(a)(1)(A), 124 Stat. 1376, 2086.
Subsection (y), the cross-referenced provision, was enacted as part of the Fair and Accurate Credit Transactions Act of 2003, Pub. L. No. 108-159, § 611, 117 Stat. 1952, 2010. It reads in pertinent part:
(1) Communications described in this subsection
A communication is described in this subsection if-
(A ) but for subsection (d)(2)(D), the communication would be a consumer report;
(B ) the communication is made to an employer in connection with an investigation of-
(i ) suspected misconduct relating to employment; or
(ii ) compliance with Federal, State, or local laws and regulations, the rules of a self-regulatory organization, or any preexisting written policies of the employer;
(C ) the communication is not made for the purpose of investigating a consumer's credit worthiness, credit standing, or credit capacity; and
(D ) the communication is not provided to any person except-
(i ) to the employer or an agent of the employer;
(ii ) to any Federal or State officer, agency, or department, or any officer, agency, or department of a unit of general local government;
(iii ) to any self-regulatory organization with regulatory authority over the activities of the employer or employee;
(iv ) as otherwise required by law; or
(v ) pursuant to section 1681f of this title.
(2) Subsequent disclosure
After taking any adverse action based in whole or in part on a communication described in paragraph (1), the employer shall disclose to the consumer a summary containing the nature and substance of the communication upon which the adverse action is based , except that the sources of information acquired solely for use in preparing what would be but for subsection (d)(2)(D) an investigative consumer report need not be disclosed.
15 U.S.C. § 1681a(y) (emphasis added).
So in sum, and to radically simplify: By operation of the cross-reference in subsection (d)(2)(D) of § 1681a (and adjusting for the Dodd-Frank mistake), the effect of subsection (y) is to exclude from the definition of "consumer report"-and thus from the myriad regulatory requirements applicable to consumer reports-any communication that:
(1) otherwise qualifies as a consumer report (but for subsection (d)(2)(D));
(2) was made to an employer in connection with an investigation of employee misconduct;
(3) was not made to the employer for purposes of investigating an employee's creditworthiness; and
(4) is not disclosed to anyone other than the employer, a regulatory agency or authority, or as otherwise required by law.
And although § 1681a simply defines statutory terms and rules of construction, subsection (y) goes on to say that "[a]fter taking any adverse action based in whole or in part on" a communication of this type, the employer "shall disclose to the consumer a summary containing the nature and substance" of the communication. Id. § 1681a(y)(2).
Needless to say, this is an odd place to find a regulatory mandate on employer investigations into workplace misconduct. Indeed, the provision is so obscure that in *1043its 15-year existence, subsection (y)(2) of § 1681a appears in no published opinion save the district court's decision in this case.
Still, taking § 1681a(y)(2) at face value, we understand it to mean that when an employer procures what would otherwise qualify as a consumer report in connection with an investigation into employee misconduct, the report is not considered a consumer report under the Act and thus is not subject to either § 1681b(b)(2)(A) (requiring the employer to give a stand-alone written notice and obtain written consent before procuring the report) or § 1681b(b)(3)(A) (requiring the employer to give the employee or job applicant a copy of the report and a description of his FCRA rights before taking an adverse action based on it). Instead, the employer need only provide a summary-an oral summary apparently suffices (subsection (y)(2) does not require anything in writing)-and then only after taking an adverse action based in whole or in part on the report.
The FCRA claims in this case rest on the premise that Allstate was required under subsection (y)(2) to provide a summary of Steptoe's investigation after firing the plaintiffs but failed to do so. It's not at all clear, though, that the Steptoe investigation would otherwise qualify as a "consumer report" but for the subsection (d)(2)(D) exclusion. And if the Steptoe investigation isn't a "consumer report" in the first place, then subsection (y)(2) does not come into play and the FCRA simply does not apply.
Here is the Act's full definition of the term "consumer report":
The term "consumer report" means any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for-
(A ) credit or insurance to be used primarily for personal, family, or household purposes;
(B ) employment purposes; or
(C ) any other purpose authorized under section 1681b of this title.
Id. § 1681a(d)(1) (emphasis added).
The Steptoe investigation thus cannot be a "consumer report" unless Steptoe qualifies under the Act as a "consumer reporting agency." Here, in turn, is how the Act defines a "consumer reporting agency":
The term "consumer reporting agency" means any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.
Id. § 1681a(f).
Steptoe & Johnson is a law firm. Nothing in the record suggests that it "regularly engages" in "assembling or evaluating consumer credit information" or "furnishing consumer reports to third parties." The parties have not explained how Steptoe qualifies as a consumer reporting agency or how its investigation into timed trading at Allstate qualifies as a consumer report. That's probably because Allstate never disputed these points, choosing instead to contest the FCRA claims on other grounds.
As we explain in a moment, the plaintiffs' FCRA awards must be vacated on *1044jurisdictional grounds based on the lack of any concrete injury to support Article III standing to sue. This opinion should not be construed as endorsing the position that a law-firm investigation of this type qualifies as a consumer report within the meaning of the Act or that subsection (y)(2) applies in a like situation.
With that reservation out of the way, we move to the question of the plaintiffs' standing. In Spokeo the Supreme Court reinforced the principle that the "injury in fact" element of Article III standing requires an injury that is both "concrete and particularized," and that to be "concrete," the injury must be "real" and "not abstract"-"that is, it must actually exist." 136 S.Ct. at 1548. The injury need not be tangible; Congress may identify intangible harms and authorize litigants to seek their redress in court. Id. at 1549. But a plaintiff does not "automatically satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right." Id.
In Spokeo the plaintiff filed a proposed class action alleging violations of the FCRA-specifically, several provisions imposing procedural requirements on consumer reporting agencies. Id. at 1545-46. The Court explained that a plaintiff "cannot satisfy the demands of Article III by alleging a bare procedural violation" of the Act because "[a] violation of one of the FCRA's procedural requirements may result in no harm." Id. at 1550. The Court said that "a bare procedural violation [of the Act], divorced from any concrete harm," is not an injury in fact sufficient to confer standing to sue. Id. at 1549. On the other hand, the Court observed that some statutory violations present a risk of real harm to a litigant and that "a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified." Id.
So standing questions in cases of this type sometimes require us to identify the particular interest Congress sought to protect and to determine if the plaintiff has suffered a concrete injury to that interest. Our recent decisions in Groshek v. Time Warner Cable, Inc. , 865 F.3d 884 (7th Cir. 2017), and Robertson v. Allied Solutions, LLC, 902 F.3d 690 (7th Cir. 2018), are illustrative.
The plaintiff in Groshek signed a form authorizing a prospective employer to obtain a consumer report about him in connection with his job application; he alleged that the disclosure form was not a stand-alone document as required by § 1681b(b)(2)(A). 865 F.3d at 885-86. Applying Spokeo , we held that this claim rested on "a statutory violation completely removed from any concrete harm or appreciable risk of harm." Id. at 887. We explained that the requirement of a stand-alone disclosure "does not seek to protect [the plaintiff] from the kind of harm he claims he has suffered, i.e., receipt of a non-compliant disclosure." Id. at 888. That is, "Congress did not enact § 1681b(b)(2)(A)(i) to protect job applicants from disclosures that do not satisfy the requirements of that section; it did so to decrease the risk that a job applicant would unknowingly consent to allowing a prospective employer to procure a consumer report." Id . Because the plaintiff acknowledged that he read and signed the employer's disclosure form, he had not suffered an injury to any interest protected by the Act. Id . at 888-89.
In Robertson the plaintiff applied for a job with the defendant, and the defendant procured a background check in the process of considering her application. The background check qualified as a consumer report under the FCRA, and the employer asked the plaintiff to sign a consent form giving it permission to obtain the report.
*1045She did so. The employer initially offered her a job but then rescinded the offer when the background check turned up negative information. 902 F.3d at 693-94. She sued for two FCRA violations: (1) the employer violated § 1681b(b)(2)(A) because the consent form was not a stand-alone document and did not contain "clear and conspicuous" disclosures, and (2) the employer violated § 1681b(b)(3)(A) by failing to give her a copy of the report before rescinding the job offer. Id. at 693. We referred to the first claim as a "notice claim" and the second as an "adverse-action claim." Id.
The district court dismissed the entire case for lack of standing, and we affirmed in part and reversed in part. The first claim, we said, was squarely controlled by our decision in Groshek , which held that "an injury functionally indistinguishable from the one underpinning [the plaintiff's] notice claim was not concrete and did not confer standing." Robertson , 902 F.3d at 694. Our conclusion in Groshek applied with equal force in Robertson , so we affirmed the dismissal of the plaintiff's notice claim. Id.
The adverse-action claim, however, was a different matter. Recall that § 1681b(b)(3)(A) states that when an employer procures a consumer report about an employee or job applicant, the employer must disclose a copy of the report to the employee or applicant before taking any adverse action against him based on it either in whole or in part. In Robertson we held that this disclosure obligation protects the employee's (or applicant's) interest in the information needed to correct mistakes and respond to the employer's potential concerns before the adverse action occurs, perhaps averting it altogether. Id. at 696-97. Testing the plaintiff's claim against that interest, we held that she suffered a concrete injury because she "was denied information that could have helped her craft a response to [the defendant's] concerns" about the content of her consumer report before the defendant rescinded the job offer. Id. at 697.
The question we confront here is whether subsection (y)(2) is sufficiently similar to § 1681b(b)(3)(A) to require the same outcome. The answer is no. Subsection (y)(2) requires only that the employer disclose a "summary" of "the nature and substance" of a "communication" (i.e., a consumer report) obtained from a third party in connection with an investigation into employee misconduct. The summary need not be in writing, and specificity is not required. Finally, the summary is required only after the employer takes an adverse action, not before.
A postdecision, summary-only disclosure obligation like this one is a far cry from § 1681b(b)(3)(A), which (to repeat) requires the employer to provide a complete copy of the consumer report and a written explanation of his FCRA rights before taking any adverse action against an employee (or job applicant). That robust disclosure requirement, we held in Robertson , provides substantive protection: it gives the employee or applicant important information at a time and in a form that allows him to correct errors and address the employer's concerns before any adverse action is taken. And that, we said, brought the case within the line of Supreme Court precedents dealing with informational injuries. 902 F.3d at 694 (citing Fed. Election Comm'n v. Akins , 524 U.S. 11, 118 S.Ct. 1777, 141 L.Ed.2d 10 (1998) ; Pub. Citizen v. U.S. Dep't of Justice , 491 U.S. 440, 109 S.Ct. 2558, 105 L.Ed.2d 377 (1989) ).
Subsection (y)(2), in contrast, performs a mere post hoc notice function; it does little more. In that sense this case is closer to Groshek than to Robertson. Indeed, the disclosure requirement at issue in Groshek applies before the employer may access an *1046employee's or job applicant's consumer report and thus provides the entire basis for the statutory informed-consent procedure. If anything, the disclosure requirement in Groshek serves a far stronger notice purpose than does subsection (y)(2), which operates entirely after the fact.
And the post hoc summary required by subsection (y)(2) may be quite generalized. It does not provide information at a time or in a form that allows the employee to meaningfully respond and possibly avert an adverse employment action. If the employer's failure to provide a compliant disclosure in Groshek was a bare procedural violation insufficient to confer standing, then the plaintiffs here have likewise suffered a mere procedural violation unaccompanied by any concrete injury.
The plaintiffs insist that Allstate's failure to comply with subsection (y)(2) left them "hampered in defending themselves before Allstate or potential employers." But subsection (y)(2) doesn't protect a substantive "defense" interest. At most it serves a minimal notice function. And the plaintiffs have not explained how the modest, post hoc summary required by subsection (y)-again, a brief oral summary suffices-could possibly have informed a "defense" against Allstate after the fact. We reiterate, moreover, that they failed to identify any prospective employer that refused to hire them based on the 10-K or the Greffin memo, so they have not established that they suffered a concrete informational injury. Nor have they identified any other tangible or intangible harm arising from Allstate's failure to comply.
In short, the FCRA claims rest on a bare procedural violation of subsection (y)(2) unaccompanied by any concrete and particularized harm or risk of harm to an interest protected by the statute. We therefore vacate the FCRA awards and remand with instructions to dismiss these claims for lack of standing.
VACATED AND REMANDED WITH INSTRUCTIONS .