Daniel Rivera v. Allstate Insurance Company

Sykes, Circuit Judge. *606 In 2009 Allstate Insurance Company launched an internal investigation into suspicious trading on its equity desk. The initial inquiry unearthed email evidence suggesting that several portfolio managers might be timing trades to inflate their bonuses at the expense of their portfolios, which included two pension funds to which Allstate owed fiduciary duties. Allstate retained attorneys from Steptoe & Johnson to investigate further, and they in turn hired an economic consulting firm to calculate potential losses. Based on the email evidence, the consulting firm found reason to believe that timed trading had potentially cost the portfolios $8 million and possibly much more. Because actual losses could not be established, the consultants used an algorithm to estimate a potential adverse impact of $91 million on the pension funds. Everyone understood that this estimate was wildly unrealistic, but in an abundance of caution, Allstate poured $91 million into the pension portfolios. When the investigation wrapped up, Steptoe lawyers delivered oral findings to Allstate. The company thereafter determined that four portfolio managers-Daniel Rivera, Stephen Kensinger, Deborah Meacock, and Rebecca Scheuneman-had violated the company's conflict-of-interest policy by timing trades to improve their bonuses. On December 3, 2009, Allstate fired them for cause. On February 25, 2010, Allstate filed its annual Form 10-K for 2009. The report explained that: (1) in 2009 the company had received information about possible timed trading and retained counsel to investigate; (2) counsel hired an economic consulting firm to estimate the potential impact on the portfolios; and (3) based on this outside investigation, Allstate paid $91 million into the two pension funds to cover the potential adverse impact. That same day Allstate sent a memo to employees in its Investment Department describing the information disclosed in the 10-K. Neither document mentioned the four fired portfolio managers. Three weeks later the four former employees sued Allstate in federal court for defamation based on the 10-K and the internal memo. They also alleged that Allstate violated 15 U.S.C. § 1681a(y)(2), a provision in the Fair Credit Reporting Act ("FCRA or the Act"), by failing to give them a summary of Steptoe's findings after they were fired. The defamation claim was the main event in the litigation; the FCRA claim received comparatively little attention. A jury returned a verdict in the plaintiffs' favor, awarding more than $27 million in compensatory and punitive damages, and statutory damages on the FCRA claim (there are no actual damages on that claim). The district judge tacked on additional punitive damages and attorney's fees under the FCRA. Allstate attacks the defamation awards on multiple grounds and also argues that the FCRA awards must be vacated for lack of standing under Spokeo, Inc. v. Robins , --- U.S. ----, 136 S.Ct. 1540 , 194 L.Ed.2d 635 (2016). We agree that the plaintiffs lack a concrete injury to support Article III standing on the FCRA claim. So that claim must be dismissed on jurisdictional grounds. And that ends our review. Because the FCRA claim provided the sole basis for federal jurisdiction-and thus the only basis for the district court to exercise supplemental jurisdiction over the state-law claim under 28 U.S.C. § 1367 (a) -the district court was without power to adjudicate the defamation claim, and it too must be dismissed for lack of jurisdiction. The parties did not identify the § 1367(a) jurisdictional problem in their initial briefing, but that does not matter; defects in subject-matter jurisdiction *607 must always be addressed. Accordingly, we vacate the judgment and remand with instructions to dismiss the action in its entirety for lack of subject-matter jurisdiction. See FED. R. CIV. P. 12(h)(3). I. Background Plaintiffs Rivera, Kensinger, Meacock, and Scheuneman were employed as securities analysts in the Equity Division of Allstate's Investment Department. Rivera was the Division director, and Kensinger, Meacock, and Scheuneman were analysts on the growth team. During their time with the company, the Equity Division managed and invested $10 billion in assets on behalf of various funds, including two defined-benefit pension plans. Because the plaintiffs helped manage two pension portfolios, they occupied positions of trust and owed a duty of loyalty to plan beneficiaries under the Employee Retirement Income Security Act. See 29 U.S.C. § 1104 (a)(1). They were also bound by Allstate's code of ethics, which required them to avoid conflicts of interest. In addition to their salaries, the plaintiffs were eligible to receive bonus compensation under Allstate's "pay-for-performance" plan. The plan relied on a formula called the "Dietz method" to estimate portfolio returns and evaluate performance accordingly. The Dietz method assumes that all cash flows in a portfolio occur at the same time of day; high transaction volume makes it impractical to use actual trade times. The particular formula in use at Allstate assumed all cash flows occurred at midday. While practical, Allstate's formula had two drawbacks. First, it distorted a portfolio's actual performance, both positive and negative. The midday Dietz method inflated measured performance for sales on up days and buys on down days; conversely, it understated measured performance when sales were made on down days and buys on up days. Allstate's traders referred to this discrepancy as the "Dietz effect." Second, the formula could be manipulated. Because it assumed that all cash flows occurred midday, portfolio managers could wait until the end of day to calculate the Dietz effect before deciding to execute a trade. The system consequently rewarded portfolio managers who waited to make trades even if the portfolio suffered as a result. Moreover, Allstate's bonus structure measured performance relative to a daily benchmark; it didn't consider market movement in the preceding days. This feature also pitted the interests of the manager against those of the portfolio. A manager could improve his performance by delaying a sale over several down days before selling on an up day even if the portfolio would have been better off if he sold earlier. In sum, under Allstate's pay-for-performance plan, portfolio managers could boost their bonus pay by timing trades-potentially at the expense of their portfolios. In mid-2009 Allstate received troubling information that its portfolio managers were doing just that. Peter Hecht, a member of Allstate's Performance Management Group, reported to Chief Compliance Officer Trond Odegaard that members of the Equity Division were delaying trades to maximize their bonuses at the expense of their portfolios. Odegaard passed these concerns along to Chief Investment Officer Judy Greffin, who ordered him to investigate. Odegaard and a team of Allstate employees soon discovered signs of timed trading. The team noted several trading patterns that suggested portfolio managers had delayed trades to take advantage of the Dietz effect. The investigation also uncovered emails suggesting that the managers were aware of the Dietz effect and *608 actively considered it when trading. Though not conclusive, the investigation raised concerns that personnel in the Equity Division had timed trades to increase bonuses at the expense of their portfolios; as a result, Allstate may have reported inaccurate financial information to the public. Allstate accordingly retained the law firm Steptoe & Johnson to investigate further. Steptoe attorneys interviewed Rivera and Scheuneman regarding their trading practices and hired NERA Economic Consulting, Inc., an independent economic consulting firm, to determine if timed trading had harmed the portfolios, especially the pension funds. Beginning with the trades mentioned in the suspicious emails and eventually reviewing six years of trading data, NERA preliminarily estimated a potential adverse portfolio impact of $8.2 million. But NERA had reason to believe that the actual impact may be much higher. Several suspicious emails could not be tied to particular trades, and other evidence suggested that portfolio managers routinely considered Dietz in the course of trading. Based on Allstate's records, however, it was not possible to calculate actual losses with any precision. So NERA devised an algorithm that would capture every Dietz-favorable trade from June 2003 to May 2009 that was executed after a series of days where the Dietz effect would have harmed the trader's performance. Based on these parameters, NERA estimated that over the six years surveyed, the potential adverse impact on the pension plans was $91 million and the potential adverse impact on the company's other portfolios was $116 million. It was clear to everyone that these estimates vastly overstated the potential effect of timed trading. Erring on the side of caution, however, in mid-December Allstate paid $91 million into the two pension plans to compensate for any potential losses. While the investigation was ongoing, Allstate disbanded the Equity Division and outsourced its work to Goldman Sachs. On October 6, 2009, Greffin met first with Rivera and then the rest of the division and explained that every member, save those who managed convertible portfolios, would be let go effective December 31, 2009. The laid-off employees would, however, receive severance pay. Later that day Steptoe attorneys conducted off-site interviews with Equity Division managers concerning Dietz trading. The outside investigation soon wrapped up, and Steptoe attorneys orally reported the findings to Allstate. Based on the internal and external investigations, Allstate concluded that Rivera, Meacock, Scheuneman, and Kensinger had violated the company's conflict-of-interest policy by timing trades. On December 3, 2009, Brett Winchell, the Director of Human Resources, informed each of the four analysts that they were fired for cause effective immediately. Winchell delivered the bad news by reading from a short script that reminded the four managers of the investigation into timed trading, noted that each of them had been interviewed by outside counsel, and explained that they were being fired because they violated Allstate's conflict-of-interest policy. All four asked Winchell for additional explanation; they later asked the same questions in writing. No further explanation, oral or written, was forthcoming. Allstate immediately escorted them off the premises and disconnected their phone and email service the next day. On December 16 Steptoe attorneys met with regulators in the Department of Labor's Employee Benefits Security Administration to discuss the investigation as it related to the pension funds. At the Department's request, Steptoe sent a follow-up *609 letter summarizing the allegations of timed trading and the subsequent investigation. The letter-dated January 29, 2010-advised the Department that the employees in Allstate's Equity Division had denied that they improperly delayed trades but that several emails "could support a contrary conclusion." The letter further explained that NERA's algorithm "estimate[d] potential disadvantage to the plans" but that "there is little question that the algorithm overstate[d] any disadvantages that the plans might have suffered." Finally, the letter explained that "taking into account returns recalculated by NERA," the estimated "increase in the aggregate bonuses for the entire group" was "approximately $1.2 million." Fast-forward to October 14, 2010. On that day Allstate's in-house counsel sent another letter to the Labor Department clarifying that the $1.2 million figure "roughly approximate[d] the potential increase in bonuses, ... assum[ing] the algorithm used by NERA ... reflected actual trading activity." This letter emphasized that NERA's calculations estimated "a possible maximum impact" and explained that "[n]o one believed, then or now, that this was an accurate description of the activity on the equity desk, nor that any actual impact on the portfolios was anywhere near the result produced by using the NERA algorithm." The October letter also stated that if the analysis had been limited to the trades mentioned in the suspicious emails, "there would have been virtually no effect on bonuses." Returning now to our chronology, on February 25, 2010, Allstate filed its annual 10-K report for 2009 in which it disclosed the allegations of timed trades and explained in general terms the subsequent investigation and the company's decision to reimburse the two pension plans. As relevant here, the 10-K stated: In 2009, we became aware of allegations that some employees responsible for trading equity securities in certain portfolios of two [Allstate Insurance Company] defined benefit pension plans and certain portfolios of [Allstate Insurance Company] and an [Allstate Insurance Company] subsidiary may have timed the execution of certain trades in order to enhance their individual performance under incentive compensation plans, without regard to whether such timing adversely impacted the actual investment performance of the portfolios. We retained outside counsel, who in turn engaged an independent economic consulting firm to conduct a review and assist us in understanding the facts surrounding, and the potential implications of, the alleged timing of these trades for the period from June 2003 to May 2009. The consulting firm reported that it was unable to determine from our records the precise amounts by which portfolio performance might have been adversely impacted during that period. Accordingly, the economic consultant applied economic modeling techniques and assumptions reasonably designed to estimate the potential adverse impact on the pension plans and the company accounts, taking into account, among other things, the distinctions between the pension plans and the company portfolios. Based on their work, the economic consultants estimated that the performance of the pension plans' portfolios could have been adversely impacted by approximately $91 million (including interest) and that the performance of the company portfolios could have been adversely impacted by approximately $116 million (including interest) in the aggregate over the six-year period under review. We believe that our financial statements and those for the pension plans *610 properly reflected the portfolios' actual investment performance results during the entire period that was reviewed. In December 2009, based on the economic consultant's modeled estimates, we paid an aggregate of $91 million into the two defined benefit pension plans. These payments had no material impact on our reported earnings or shareholders' equity, but reduced our assets, operating cash flows, and unfunded pension liability to the plans.... At all times during this period, the plans were adequately funded pursuant to applicable regulatory and actuarial requirements. As a result of these additional funds in the plans, our future contributions to the plans, based on actuarial analysis, may be reduced. Using the economic consultant's calculation of the potential adverse impact on the portfolios, we currently estimate that the additional compensation paid to all the employees working in the affected group was approximately $1.2 million over the six-year period as a result of these activities. In late 2009, we retained an independent investment firm to conduct portfolio management and trading activity for the specific portfolios impacted by these activities. That same day Greffin sent a memo to all employees in the Investment Department alerting them to the information in the 10-K filing. In full, the Greffin memo states: Allstate released its annual financial report on Form 10-K today. Within that filing, we disclosed details around allegations regarding trading practices within our equity portfolios that came to light in the past year. We took this matter very seriously and launched an investigation as soon as we became aware of the allegations. Outside counsel was retained to assist us in understanding the facts surrounding, and the potential implications of, these activities. As part of their analysis, an independent economic consulting firm was retained to estimate the potential adverse impact to the performance of our portfolios. The consultant determined that the performance on some of our portfolios, as well as our two pension plan portfolios, could have been adversely impacted by the activities. As a result, Allstate made a contribution to the pension plans during the 4th quarter which is disclosed in the 10-K. We believe that our financial statements and those of the pension plans properly reflected the portfolios' actual investment performance and the pension plans were adequately funded during this entire period. This matter did not affect the plans' ability to continue to provide benefits to plan participants. Situations like this can be unsettling and can reflect poorly on our organization. However, I believe organizations are also defined by how they respond to events like this. We were transparent in reporting this matter to the U.S. Department of Labor and the S.E.C., and disclosed it to our investors. We're taking steps to improve our governance, compliance practices and training. We remain committed to the highest levels of ethics and integrity in the stewardship of Allstate's assets. Three weeks later the four fired portfolio managers sued Allstate and Greffin in federal court for defamation based on the 10-K and Greffin's internal memo. They also asserted a claim against Allstate for violation of § 1681a(y)(2) of the FCRA and a claim against Greffin for tortious interference with prospective economic advantage. The district judge dismissed the tortious-interference claim, and the plaintiffs *611 then amended their complaint to add an age-discrimination claim against Allstate. They later dismissed the discrimination claim as well as the defamation claim against Greffin. Lengthy discovery ensued and in due course Allstate moved for summary judgment. Judge Feinerman ruled that the statements in the 10-K and the Greffin memo were not defamatory per se. Rivera v. Allstate Ins. Co. , 140 F.Supp.3d 722 , 729-30 (N.D. Ill. 2015). But he permitted the case to go forward on a theory of defamation per quod and on the FCRA claim. Id. at 730-37 . As narrowed, the case proceeded to a jury trial with Judge Hart presiding. The jury found for the plaintiffs across the board and awarded more than $27 million in compensatory and punitive damages, broken down roughly as follows: Rivera : $7.1 million (defamation compensatory damages) $4 million (defamation punitive damages) $1,000 (FCRA statutory damages) Kensinger : $2.9 million (defamation compensatory damages) $2 million (defamation punitive damages) $1,000 (FCRA statutory damages) Meacock : $3.6 million (defamation compensatory damages) $3 million (defamation punitive damages) $1,000 (FCRA statutory damages) Scheuneman : $3.4 million (defamation compensatory damages) $1 million (defamation punitive damages) $1,000 (FCRA statutory damages) Allstate moved for judgment as a matter of law, or alternatively, for a new trial. The plaintiffs separately asked the judge for an award of punitive damages and attorney's fees under the FCRA. 15 U.S.C. § 1681n(a)(2), (3) (authorizing "such amount of punitive damages as the court may allow" and attorney's fees for willful violations of the FCRA). Judge Hart denied Allstate's motion and granted the plaintiffs' requests, awarding each plaintiff an additional $3,000 in punitive damages under the FCRA and approving their request for $357,716.25 in attorney's fees associated with the statutory claim. II. Discussion Allstate attacks this large judgment on many grounds. In brief, the company argues that the defamation awards must be set aside because: (1) the statements in the 10-K and the Greffin memo were substantially true; (2) neither the 10-K nor the Greffin memo identified the plaintiffs, and no evidence supports a finding that these documents could be reasonably understood to refer to them; (3) the statements in the 10-K and the Greffin memo were privileged; and (4) the plaintiffs failed to prove special damages as required for recovery for defamation per quod. Regarding the FCRA awards, Allstate argues that the plaintiffs lack standing under Spokeo , and secondarily, that the record does not support the jury's finding of a willful violation of the statute as required for statutory and punitive damages. (There are no actual damages.) Finally, Allstate attacks the award of FCRA attorney's fees as excessive and disproportionate considering the relative insignificance of the statutory claim to this litigation. *612 The state-law defamation claim predominated over the federal claim in this long-running litigation-both in the district court and here. The FCRA claim occupied very little of the parties' appellate briefing and received only modest attention below. Our initial opinion vacated the defamation awards based on the plaintiffs' failure to prove special damages. We also vacated the FCRA awards for lack of standing under Spokeo and remanded with instructions to dismiss the federal claim for lack of jurisdiction. The plaintiffs petitioned for rehearing, raising for the first time a probable jurisdictional defect under § 1367 if we found-as we did-that they failed to establish an injury in fact sufficient to support Article III standing to litigate the FCRA claim. The petition noted that the FCRA claim provided the only jurisdictional basis for litigating this entire dispute in federal court. The district court's jurisdiction rested solely on federal-question jurisdiction, see 28 U.S.C. § 1331 ; the parties are not diverse, so 28 U.S.C. § 1332 does not apply. And the court's supplemental jurisdiction under § 1367(a) to adjudicate the state-law defamation claim evaporates if the claim on which federal jurisdiction rests is dismissed on jurisdictional grounds. We accordingly withdraw our original opinion and in its place substitute this amended opinion. Although the parties spent most of their energy on the merits of the defamation claim, our analysis begins and ends with the jurisdictional basis for the FCRA claim. Relying on Spokeo , Allstate maintains that the FCRA awards must be tossed out for lack of standing. A bit of statutory background is required to understand the FCRA claim in this case. We note for starters that the case represents an odd application of the Act. The FCRA regulates the activities of consumer reporting agencies and the permissible uses of consumer reports by third parties. Among many other regulatory requirements, the Act imposes certain procedures for the use of consumer reports for employment purposes. For example, the Act prohibits an employer from procuring a consumer report about an employee or job applicant without first giving that person a stand-alone written notice that "clear[ly] and conspicuous[ly]" discloses the employer's request for permission to access the report and the person signs a written consent to release the report to the employer. See 15 U.S.C. § 1681b(b)(2)(A) (establishing the disclosure and consent requirements); see id. § 1681a(d)(1) (defining "consumer report" to include reports about a consumer's creditworthiness and personal background compiled by a "consumer reporting agency" and "used or expected to be used ... for the purpose of serving as a factor in establishing the consumer's eligibility for" credit, insurance, or "employment purposes"). The Act further requires that before taking any adverse action against an employee or job applicant "based in whole or in part" on such a report, the employer must give the employee or applicant a copy of the report and a written description of the person's rights under the Act. Id. § 1681b(b)(3)(A). The FCRA provision at issue here appears in § 1681a, which contains the Act's definitions and rules of construction. (The statutory scheme is reticulated and complex, so bear with us.) Subsection (d)(2)(D) of § 1681a excludes from the definition of "consumer report" any "communication described in subsection (o) or (x)." The reference to "subsection (x)" is an error; it should read "subsection (y)." The error was introduced in the Dodd-Frank Act of *613 2010, 1 which redesignated the former subsection (x) as subsection (y) but neglected to update the cross-reference in § 1681a(d)(2)(D). See Pub. L. No. 111-203, § 1988(a)(1)(A), 124 Stat. 1376 , 2086. Subsection (y), the cross-referenced provision, was enacted as part of the Fair and Accurate Credit Transactions Act of 2003, Pub. L. No. 108-159, § 611, 117 Stat. 1952 , 2010. It reads in pertinent part: (1) Communications described in this subsection A communication is described in this subsection if- ( A ) but for subsection (d)(2)(D), the communication would be a consumer report; ( B ) the communication is made to an employer in connection with an investigation of- ( i ) suspected misconduct relating to employment; or ( ii ) compliance with Federal, State, or local laws and regulations, the rules of a self-regulatory organization, or any preexisting written policies of the employer; ( C ) the communication is not made for the purpose of investigating a consumer's credit worthiness, credit standing, or credit capacity; and ( D ) the communication is not provided to any person except- ( i ) to the employer or an agent of the employer; ( ii ) to any Federal or State officer, agency, or department, or any officer, agency, or department of a unit of general local government; ( iii ) to any self-regulatory organization with regulatory authority over the activities of the employer or employee; ( iv ) as otherwise required by law; or ( v ) pursuant to section 1681f of this title. (2) Subsequent disclosure After taking any adverse action based in whole or in part on a communication described in paragraph (1), the employer shall disclose to the consumer a summary containing the nature and substance of the communication upon which the adverse action is based , except that the sources of information acquired solely for use in preparing what would be but for subsection (d)(2)(D) an investigative consumer report need not be disclosed. 15 U.S.C. § 1681a(y) (emphasis added). So in sum, and to radically simplify: By operation of the cross-reference in subsection (d)(2)(D) of § 1681a (and adjusting for the Dodd-Frank mistake), the effect of subsection (y) is to exclude from the definition of "consumer report"-and thus from the myriad regulatory requirements applicable to consumer reports-any communication that: (1) otherwise qualifies as a consumer report (but for subsection (d)(2)(D) ); (2) was made to an employer in connection with an investigation of employee misconduct; (3) was not made to the employer for purposes of investigating an employee's creditworthiness; and (4) is not disclosed to anyone other than the employer, a regulatory agency or authority, or as otherwise required by law. *614 And although § 1681a simply defines statutory terms and rules of construction, subsection (y) goes on to say that "[a]fter taking any adverse action based in whole or in part on" a communication of this type, the employer "shall disclose to the consumer a summary containing the nature and substance" of the communication. Id. § 1681a(y)(2). Needless to say, this is an odd place to find a regulatory mandate on employer investigations into workplace misconduct. Indeed, the provision is so obscure that in its 15-year existence, subsection (y)(2) of § 1681a appears in no published opinion save the district court's decision in this case. Still, taking § 1681a(y)(2) at face value, we understand it to mean that when an employer procures what would otherwise qualify as a consumer report in connection with an investigation into employee misconduct, the report is not considered a consumer report under the Act and thus is not subject to either § 1681b(b)(2)(A) (requiring the employer to give a stand-alone written notice and obtain written consent before procuring the report) or § 1681b(b)(3)(A) (requiring the employer to give the employee or job applicant a copy of the report and a description of his FCRA rights before taking an adverse action based on it). Instead, the employer need only provide a summary-an oral summary apparently suffices (subsection (y)(2) does not require anything in writing)-and then only after taking an adverse action based in whole or in part on the report. The FCRA claim in this case rests on the premise that Allstate was required under subsection (y)(2) to provide a summary of Steptoe's investigation after firing the plaintiffs but failed to do so. It's not at all clear, though, that the Steptoe investigation would otherwise qualify as a "consumer report" but for the subsection (d)(2)(D) exclusion. And if the Steptoe investigation isn't a "consumer report" in the first place, then subsection (y)(2) does not come into play and the FCRA simply does not apply. Here is the Act's full definition of the term "consumer report": The term "consumer report" means any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for- ( A ) credit or insurance to be used primarily for personal, family, or household purposes; ( B ) employment purposes; or ( C ) any other purpose authorized under section 1681b of this title. § 1681a(d)(1) (emphasis added). The Steptoe investigation thus cannot be a "consumer report" unless Steptoe qualifies under the Act as a "consumer reporting agency." Here, in turn, is how the Act defines a "consumer reporting agency": The term "consumer reporting agency" means any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports. 15 U.S.C. § 1681a(f). Steptoe & Johnson is a law firm. Nothing in the record suggests that it *615 "regularly engages" in "assembling or evaluating consumer credit information" or "furnishing consumer reports to third parties." The parties have not explained how Steptoe qualifies as a consumer reporting agency or how its investigation into timed trading at Allstate qualifies as a consumer report. That's probably because Allstate never disputed these points, choosing instead to contest the FCRA claim on other grounds. As we explain in a moment, the plaintiffs' FCRA awards must be vacated on jurisdictional grounds based on the lack of any concrete injury to support Article III standing to sue. This opinion should not be construed as endorsing the position that a law-firm investigation of this type qualifies as a consumer report within the meaning of the Act or that subsection (y)(2) applies in a like situation. With that reservation out of the way, we move to the question of the plaintiffs' standing. In Spokeo the Supreme Court reinforced the principle that the "injury in fact" element of Article III standing requires an injury that is both "concrete and particularized," and that to be "concrete," the injury must be "real" and "not abstract"-"that is, it must actually exist." 136 S.Ct. at 1548 . The injury need not be tangible; Congress may identify intangible harms and authorize litigants to seek their redress in court. Id. at 1549 . But a plaintiff does not "automatically satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right." Id. In Spokeo the plaintiff filed a proposed class action alleging violations of the FCRA-specifically, several provisions imposing procedural requirements on consumer reporting agencies. Id. at 1545-46 . The Court explained that a plaintiff "cannot satisfy the demands of Article III by alleging a bare procedural violation" of the Act because "[a] violation of one of the FCRA's procedural requirements may result in no harm." Id. at 1550 . The Court said that "a bare procedural violation [of the Act], divorced from any concrete harm," is not an injury in fact sufficient to confer standing to sue. Id. at 1549 . On the other hand, the Court observed that some statutory violations present a risk of real harm to a litigant and that "a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified." Id. So standing questions in cases of this type sometimes require us to identify the particular interest Congress sought to protect and to determine if the plaintiff has suffered a concrete injury to that interest. Our recent decisions in Groshek v. Time Warner Cable, Inc. , 865 F.3d 884 (7th Cir. 2017), and Robertson v. Allied Solutions, LLC, 902 F.3d 690 (7th Cir. 2018), are illustrative. The plaintiff in Groshek signed a form authorizing a prospective employer to obtain a consumer report about him in connection with his job application; he alleged that the disclosure form was not a stand-alone document as required by § 1681b(b)(2)(A). 865 F.3d at 885-86 . Applying Spokeo , we held that this claim rested on "a statutory violation completely removed from any concrete harm or appreciable risk of harm." Id. at 887 . We explained that the requirement of a stand-alone disclosure "does not seek to protect [the plaintiff] from the kind of harm he claims he has suffered, i.e. , receipt of a non-compliant disclosure." Id. at 888 . That is, "Congress did not enact § 1681b(b)(2)(A)(i) to protect job applicants from disclosures that do not satisfy the requirements of that section; it did so to decrease the risk that a job applicant would unknowingly consent to allowing a *616 prospective employer to procure a consumer report." Id. Because the plaintiff acknowledged that he read and signed the employer's disclosure form, he had not suffered an injury to any interest protected by the Act. Id. at 888-89 . In Robertson the plaintiff applied for a job with the defendant, and the defendant procured a background check in the process of considering her application. The background check qualified as a consumer report under the FCRA, and the employer asked the plaintiff to sign a consent form giving it permission to obtain the report. She did so. The employer initially offered her a job but then rescinded the offer when the background check turned up negative information. 902 F.3d at 693-94 . She sued for two FCRA violations: (1) the employer violated § 1681b(b)(2)(A) because the consent form was not a stand-alone document and did not contain "clear and conspicuous" disclosures, and (2) the employer violated § 1681b(b)(3)(A) by failing to give her a copy of the report before rescinding the job offer. Id. at 693 . We referred to the first claim as a "notice claim" and the second as an "adverse-action claim." Id. The district court dismissed the entire case for lack of standing, and we affirmed in part and reversed in part. The first claim, we said, was squarely controlled by our decision in Groshek , which held that "an injury functionally indistinguishable from the one underpinning [the plaintiff's] notice claim was not concrete and did not confer standing." Robertson , 902 F.3d at 694 . Our conclusion in Groshek applied with equal force in Robertson , so we affirmed the dismissal of the plaintiff's notice claim. Id. The adverse-action claim, however, was a different matter. Recall that § 1681b(b)(3)(A) states that when an employer procures a consumer report about an employee or job applicant, the employer must disclose a copy of the report to the employee or applicant before taking any adverse action against him based on it either in whole or in part. In Robertson we held that this disclosure obligation protects the employee's (or applicant's) interest in the information needed to correct mistakes and respond to the employer's potential concerns before the adverse action occurs, perhaps averting it altogether. Id. at 696-97 . Testing the plaintiff's claim against that interest, we held that she suffered a concrete injury because she "was denied information that could have helped her craft a response to [the defendant's] concerns" about the content of her consumer report before the defendant rescinded the job offer. Id. at 697 . The question we confront here is whether subsection (y)(2) is sufficiently similar to § 1681b(b)(3)(A) to require the same outcome. The answer is no. Subsection (y)(2) requires only that the employer disclose a "summary" of "the nature and substance" of a "communication" (i.e., a consumer report) obtained from a third party in connection with an investigation into employee misconduct. The summary need not be in writing, and specificity is not required. Finally, the summary is required only after the employer takes an adverse action, not before. A postdecision, summary-only disclosure obligation like this one is a far cry from § 1681b(b)(3)(A), which (to repeat) requires the employer to give an employee or job applicant a complete copy of the consumer report and a written explanation of his FCRA rights before taking any adverse action against the employee or job applicant. That robust disclosure requirement, we held in Robertson , provides substantive protection: it gives the employee or applicant important information at a time and in a form that allows him to *617 correct errors and address the employer's concerns before any adverse action is taken. And that, we said, brought the case within the line of Supreme Court precedents dealing with informational injuries. 902 F.3d at 694 (citing Fed. Election Comm'n v. Akins , 524 U.S. 11 , 118 S.Ct. 1777 , 141 L.Ed.2d 10 (1998) ; Pub. Citizen v. U.S. Dep't of Justice , 491 U.S. 440 , 109 S.Ct. 2558 , 105 L.Ed.2d 377 (1989) ). Subsection (y)(2), in contrast, performs a mere post hoc notice function; it does little more. In that sense this case is closer to Groshek than to Robertson. Indeed, the disclosure requirement at issue in Groshek applies before the employer may access an employee's or job applicant's consumer report and thus provides the entire basis for the statutory informed-consent procedure. If anything, the disclosure requirement in Groshek serves a far stronger notice purpose than does subsection (y)(2), which operates entirely after the fact. And the post hoc summary required by subsection (y)(2) may be quite generalized. It does not provide information at a time or in a form that allows the employee to meaningfully respond and possibly avert an adverse employment action. If the employer's failure to provide a compliant disclosure in Groshek was a bare procedural violation insufficient to confer standing, then the plaintiffs here have likewise suffered a mere procedural violation unaccompanied by any concrete injury. The plaintiffs insist that Allstate's failure to comply with subsection (y)(2) left them "hampered in defending themselves before Allstate or potential employers." But subsection (y)(2) doesn't protect a substantive "defense" interest. At most it serves a minimal notice function. And the plaintiffs have not explained how the modest, post hoc summary required by subsection (y)-again, a brief oral summary suffices-could possibly have informed a "defense" against Allstate after the fact. We note, moreover, that they failed to identify any prospective employer that refused to hire them based on the 10-K or the Greffin memo, so they have not established that they suffered a concrete informational injury. Nor have they identified any other tangible or intangible harm arising from Allstate's failure to comply. In short, the FCRA claim rests on a bare procedural violation of subsection (y)(2) unaccompanied by any concrete and particularized harm or risk of harm to an interest protected by the statute. The FCRA awards must be vacated and the claim dismissed for lack of standing. Our ruling on the plaintiffs' standing to sue under the FCRA has implications for the defamation awards. As we've explained, the FCRA claim was the sole basis for federal jurisdiction. The district court adjudicated the defamation claim under the supplemental jurisdiction provision, which provides: [I]n any civil action of which the district courts have original jurisdiction, the district courts shall have supplemental jurisdiction over all other claims that are so related to claims in the action within such original jurisdiction that they form part of the same case or controversy under Article III of the United States Constitution. 28 U.S.C. § 1367 (a). By its plain terms, § 1367(a)"makes clear that supplemental jurisdiction may only be invoked when the district court has a hook of original jurisdiction on which to hang it." Herman Family Revocable Tr. v. Teddy Bear , 254 F.3d 802 , 805 (9th Cir. 2001). Because the plaintiffs lack Article III standing to bring the FCRA claim, there is no original jurisdictional "hook" to support an assertion of § 1367(a) supplemental jurisdiction over the defamation *618 claim, and the district court was without power to hear it. [I]f the federal claim [is] dismissed for lack of subject matter jurisdiction, a district court has no discretion to retain the supplemental claims for adjudication. The dismissal means that there never was a valid claim within the court's original jurisdiction to which the state claims may be supplemental. Therefore, the district court has no discretion to exceed the scope of its Article III power and must dismiss the state law claims without prejudice. 16 JAMES WM. MOORE, MOORE'S FEDERAL PRACTICE § 106.66[1] (Daniel R. Coquillette et al. eds., 3d ed. 2018). In notable contrast, when the court dismisses the federal claim on the merits , it has the discretion under § 1367(c)(3) to decline to hear related state-law claims or to retain them, though there is a general presumption that the court will relinquish supplemental jurisdiction and dismiss the state-law claims without prejudice. RWJ Mgmt. Co. v. BP Prods. N. Am., Inc. , 672 F.3d 476 , 479-80 (7th Cir. 2012). But that's not this case. Here the plaintiffs failed to establish Article III standing to bring the federal claim that supported the exercise of § 1367(a) jurisdiction. "[W]here there is no underlying original federal subject matter jurisdiction, the court has no authority to adjudicate supplemental claims under § 1367." Herman Family Revocable Tr. , 254 F.3d at 805 ; see also Textile Prods., Inc. v. Mead Corp. , 134 F.3d 1481 , 1485-86 (Fed. Cir. 1998) ; Saksenasingh v. Sec'y of Educ. , 126 F.3d 347 , 351 (D.C. Cir. 1997) ; Musson Theatrical, Inc. v. Fed. Express Corp. , 89 F.3d 1244 , 1255 (6th Cir. 1996) ; Nowak v. Ironworkers Local 6 Pension Fund , 81 F.3d 1182 , 1187 (2d Cir. 1996). We are not unmindful of the costs of a jurisdictional dismissal at this late stage, after a full trial on the merits and an appeal. Regrettably, the federal courts have sunk considerable resources into resolving the parties' dispute when the case belonged in state court. But the jurisdictional defect leaves us with no choice. Accordingly, the judgment is vacated and the case is remanded with instructions to dismiss the entire action for lack of subject-matter jurisdiction. See FED. R. CIV. P. 12(h)(3) ("If the court determines at any time that it lacks subject-matter jurisdiction, the court must dismiss the action."). VACATED AND REMANDED WITH INSTRUCTIONS . Footnotes [*] Of the Central District of Illinois, sitting by designation. [1] Technically, the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010.