                                      In the

        United States Court of Appeals
                       For the Seventh Circuit
                           ____________________
Nos. 17-1310 & 17-1649
DANIEL RIVERA, et al.,
                                                         Plaintiffs-Appellees.
                                         v.

ALLSTATE INSURANCE COMPANY,
                                                       Defendant-Appellant.
                           ____________________

                  Appeals from the United States District Court for the
                    Northern District of Illinois, Eastern Division.
                   No. 10 C 1733 — William T. Hart, Judge.
                           ____________________

     ARGUED OCTOBER 25, 2017 — DECIDED OCTOBER 31, 2018
    AS AMENDED ON PETITION FOR REHEARING JANUARY 14, 2019
                   ____________________

   Before KANNE and SYKES, Circuit Judges, and DARROW,
District Judge. *
    SYKES, Circuit Judge. In 2009 Allstate Insurance Company
launched an internal investigation into suspicious trading on
its equity desk. The initial inquiry unearthed email evidence
suggesting that several portfolio managers might be timing

*   Of the Central District of Illinois, sitting by designation.
2                                      Nos. 17-1310 & 17-1649

trades to inflate their bonuses at the expense of their portfo-
lios, which included two pension funds to which Allstate
owed fiduciary duties. Allstate retained attorneys from
Steptoe & Johnson to investigate further, and they in turn
hired an economic consulting firm to calculate potential
losses. Based on the email evidence, the consulting firm
found reason to believe that timed trading had potentially
cost the portfolios $8 million and possibly much more.
Because actual losses could not be established, the consult-
ants used an algorithm to estimate a potential adverse
impact of $91 million on the pension funds. Everyone under-
stood that this estimate was wildly unrealistic, but in an
abundance of caution, Allstate poured $91 million into the
pension portfolios.
    When the investigation wrapped up, Steptoe lawyers de-
livered oral findings to Allstate. The company thereafter
determined that four portfolio managers—Daniel Rivera,
Stephen Kensinger, Deborah Meacock, and Rebecca
Scheuneman—had violated the company’s conflict-of-
interest policy by timing trades to improve their bonuses. On
December 3, 2009, Allstate fired them for cause.
    On February 25, 2010, Allstate filed its annual Form 10-K
for 2009. The report explained that: (1) in 2009 the company
had received information about possible timed trading and
retained counsel to investigate; (2) counsel hired an econom-
ic consulting firm to estimate the potential impact on the
portfolios; and (3) based on this outside investigation,
Allstate paid $91 million into the two pension funds to cover
the potential adverse impact. That same day Allstate sent a
memo to employees in its Investment Department describ-
ing the information disclosed in the 10-K. Neither document
mentioned the four fired portfolio managers.
Nos. 17-1310 & 17-1649                                        3

    Three weeks later the four former employees sued All-
state in federal court for defamation based on the 10-K and
the internal memo. They also alleged that Allstate violated
15 U.S.C. § 1681a(y)(2), a provision in the Fair Credit Report-
ing Act (“FCRA or the Act”), by failing to give them a sum-
mary of Steptoe’s findings after they were fired. The
defamation claim was the main event in the litigation; the
FCRA claim received comparatively little attention. A jury
returned a verdict in the plaintiffs’ favor, awarding more
than $27 million in compensatory and punitive damages,
and statutory damages on the FCRA claim (there are no
actual damages on that claim). The district judge tacked on
additional punitive damages and attorney’s fees under the
FCRA.
    Allstate attacks the defamation awards on multiple
grounds and also argues that the FCRA awards must be
vacated for lack of standing under Spokeo, Inc. v. Robbins,
136 S. Ct. 1540 (2016). We agree that the plaintiffs lack a
concrete injury to support Article III standing on the FCRA
claim. So that claim must be dismissed on jurisdictional
grounds. And that ends our review. Because the FCRA claim
provided the sole basis for federal jurisdiction—and thus the
only basis for the district court to exercise supplemental
jurisdiction over the state-law claim under 28 U.S.C.
§ 1367(a)—the district court was without power to adjudi-
cate the defamation claim, and it too must be dismissed for
lack of jurisdiction. The parties did not identify the § 1367(a)
jurisdictional problem in their initial briefing, but that does
not matter; defects in subject-matter jurisdiction must al-
ways be addressed. Accordingly, we vacate the judgment
and remand with instructions to dismiss the action in its
4                                       Nos. 17-1310 & 17-1649

entirety for lack of subject-matter jurisdiction. See FED. R.
CIV. P. 12(h)(3).
                        I. Background
    Plaintiffs Rivera, Kensinger, Meacock, and Scheuneman
were employed as securities analysts in the Equity Division
of Allstate’s Investment Department. Rivera was the Division
director, and Kensinger, Meacock, and Scheuneman were
analysts on the growth team. During their time with the
company, the Equity Division managed and invested
$10 billion in assets on behalf of various funds, including
two defined-benefit pension plans. Because the plaintiffs
helped manage two pension portfolios, they occupied posi-
tions of trust and owed a duty of loyalty to plan beneficiaries
under the Employee Retirement Income Security Act. See
29 U.S.C. § 1104(a)(1). They were also bound by Allstate’s
code of ethics, which required them to avoid conflicts of
interest.
   In addition to their salaries, the plaintiffs were eligible to
receive bonus compensation under Allstate’s “pay-for-
performance” plan. The plan relied on a formula called the
“Dietz method” to estimate portfolio returns and evaluate
performance accordingly. The Dietz method assumes that all
cash flows in a portfolio occur at the same time of day; high
transaction volume makes it impractical to use actual trade
times. The particular formula in use at Allstate assumed all
cash flows occurred at midday.
    While practical, Allstate’s formula had two drawbacks.
First, it distorted a portfolio’s actual performance, both
positive and negative. The midday Dietz method inflated
measured performance for sales on up days and buys on
down days; conversely, it understated measured perfor-
Nos. 17-1310 & 17-1649                                     5

mance when sales were made on down days and buys on up
days. Allstate’s traders referred to this discrepancy as the
“Dietz effect.”
    Second, the formula could be manipulated. Because it as-
sumed that all cash flows occurred midday, portfolio man-
agers could wait until the end of day to calculate the Dietz
effect before deciding to execute a trade. The system conse-
quently rewarded portfolio managers who waited to make
trades even if the portfolio suffered as a result. Moreover,
Allstate’s bonus structure measured performance relative to
a daily benchmark; it didn’t consider market movement in
the preceding days. This feature also pitted the interests of
the manager against those of the portfolio. A manager could
improve his performance by delaying a sale over several
down days before selling on an up day even if the portfolio
would have been better off if he sold earlier. In sum, under
Allstate’s pay-for-performance plan, portfolio managers
could boost their bonus pay by timing trades—potentially at
the expense of their portfolios.
    In mid-2009 Allstate received troubling information that
its portfolio managers were doing just that. Peter Hecht, a
member of Allstate’s Performance Management Group,
reported to Chief Compliance Officer Trond Odegaard that
members of the Equity Division were delaying trades to
maximize their bonuses at the expense of their portfolios.
Odegaard passed these concerns along to Chief Investment
Officer Judy Greffin, who ordered him to investigate.
   Odegaard and a team of Allstate employees soon discov-
ered signs of timed trading. The team noted several trading
patterns that suggested portfolio managers had delayed
trades to take advantage of the Dietz effect. The investiga-
6                                      Nos. 17-1310 & 17-1649

tion also uncovered emails suggesting that the managers
were aware of the Dietz effect and actively considered it
when trading. Though not conclusive, the investigation
raised concerns that personnel in the Equity Division had
timed trades to increase bonuses at the expense of their
portfolios; as a result, Allstate may have reported inaccurate
financial information to the public.
    Allstate accordingly retained the law firm Steptoe &
Johnson to investigate further. Steptoe attorneys interviewed
Rivera and Scheuneman regarding their trading practices
and hired NERA Economic Consulting, Inc., an independent
economic consulting firm, to determine if timed trading had
harmed the portfolios, especially the pension funds. Begin-
ning with the trades mentioned in the suspicious emails and
eventually reviewing six years of trading data, NERA pre-
liminarily estimated a potential adverse portfolio impact of
$8.2 million.
    But NERA had reason to believe that the actual impact
may be much higher. Several suspicious emails could not be
tied to particular trades, and other evidence suggested that
portfolio managers routinely considered Dietz in the course
of trading. Based on Allstate’s records, however, it was not
possible to calculate actual losses with any precision. So
NERA devised an algorithm that would capture every Dietz-
favorable trade from June 2003 to May 2009 that was execut-
ed after a series of days where the Dietz effect would have
harmed the trader’s performance. Based on these parame-
ters, NERA estimated that over the six years surveyed, the
potential adverse impact on the pension plans was
$91 million and the potential adverse impact on the compa-
ny’s other portfolios was $116 million. It was clear to every-
one that these estimates vastly overstated the potential effect
Nos. 17-1310 & 17-1649                                         7

of timed trading. Erring on the side of caution, however, in
mid-December Allstate paid $91 million into the two pension
plans to compensate for any potential losses.
    While the investigation was ongoing, Allstate disbanded
the Equity Division and outsourced its work to Goldman
Sachs. On October 6, 2009, Greffin met first with Rivera and
then the rest of the division and explained that every mem-
ber, save those who managed convertible portfolios, would
be let go effective December 31, 2009. The laid-off employees
would, however, receive severance pay. Later that day
Steptoe attorneys conducted off-site interviews with Equity
Division managers concerning Dietz trading.
    The outside investigation soon wrapped up, and Steptoe
attorneys orally reported the findings to Allstate. Based on
the internal and external investigations, Allstate concluded
that Rivera, Meacock, Scheuneman, and Kensinger had
violated the company’s conflict-of-interest policy by timing
trades. On December 3, 2009, Brett Winchell, the Director of
Human Resources, informed each of the four analysts that
they were fired for cause effective immediately. Winchell
delivered the bad news by reading from a short script that
reminded the four managers of the investigation into timed
trading, noted that each of them had been interviewed by
outside counsel, and explained that they were being fired
because they violated Allstate’s conflict-of-interest policy. All
four asked Winchell for additional explanation; they later
asked the same questions in writing. No further explanation,
oral or written, was forthcoming. Allstate immediately
escorted them off the premises and disconnected their phone
and email service the next day.
8                                      Nos. 17-1310 & 17-1649

    On December 16 Steptoe attorneys met with regulators in
the Department of Labor’s Employee Benefits Security
Administration to discuss the investigation as it related to
the pension funds. At the Department’s request, Steptoe sent
a follow-up letter summarizing the allegations of timed
trading and the subsequent investigation. The letter—dated
January 29, 2010—advised the Department that the employ-
ees in Allstate’s Equity Division had denied that they im-
properly delayed trades but that several emails “could
support a contrary conclusion.” The letter further explained
that NERA’s algorithm “estimate[d] potential disadvantage
to the plans” but that “there is little question that the algo-
rithm overstate[d] any disadvantages that the plans might
have suffered.” Finally, the letter explained that “taking into
account returns recalculated by NERA,” the estimated
“increase in the aggregate bonuses for the entire group” was
“approximately $1.2 million.”
    Fast-forward to October 14, 2010. On that day Allstate’s
in-house counsel sent another letter to the Labor Department
clarifying that the $1.2 million figure “roughly approxi-
mate[d] the potential increase in bonuses, … assum[ing] the
algorithm used by NERA … reflected actual trading activi-
ty.” This letter emphasized that NERA’s calculations estimat-
ed “a possible maximum impact” and explained that “[n]o
one believed, then or now, that this was an accurate descrip-
tion of the activity on the equity desk, nor that any actual
impact on the portfolios was anywhere near the result
produced by using the NERA algorithm.” The October letter
also stated that if the analysis had been limited to the trades
mentioned in the suspicious emails, “there would have been
virtually no effect on bonuses.”
Nos. 17-1310 & 17-1649                                  9

   Returning now to our chronology, on February 25, 2010,
Allstate filed its annual 10-K report for 2009 in which it
disclosed the allegations of timed trades and explained in
general terms the subsequent investigation and the compa-
ny’s decision to reimburse the two pension plans. As rele-
vant here, the 10-K stated:
          In 2009, we became aware of allegations
      that some employees responsible for trading
      equity securities in certain portfolios of two
      [Allstate Insurance Company] defined benefit
      pension plans and certain portfolios of [All-
      state Insurance Company] and an [Allstate In-
      surance Company] subsidiary may have timed
      the execution of certain trades in order to en-
      hance their individual performance under in-
      centive compensation plans, without regard to
      whether such timing adversely impacted the
      actual investment performance of the portfoli-
      os.
          We retained outside counsel, who in turn
      engaged an independent economic consulting
      firm to conduct a review and assist us in un-
      derstanding the facts surrounding, and the po-
      tential implications of, the alleged timing of
      these trades for the period from June 2003 to
      May 2009. The consulting firm reported that it
      was unable to determine from our records the
      precise amounts by which portfolio perfor-
      mance might have been adversely impacted
      during that period. Accordingly, the economic
      consultant applied economic modeling tech-
      niques and assumptions reasonably designed
10                                   Nos. 17-1310 & 17-1649

     to estimate the potential adverse impact on the
     pension plans and the company accounts, tak-
     ing into account, among other things, the dis-
     tinctions between the pension plans and the
     company portfolios.
         Based on their work, the economic consult-
     ants estimated that the performance of the
     pension plans’ portfolios could have been ad-
     versely impacted by approximately $91 million
     (including interest) and that the performance
     of the company portfolios could have been ad-
     versely impacted by approximately $116 mil-
     lion (including interest) in the aggregate over
     the six-year period under review. We believe
     that our financial statements and those for the
     pension plans properly reflected the portfolios’
     actual investment performance results during
     the entire period that was reviewed.
         In December 2009, based on the economic
     consultant’s modeled estimates, we paid an ag-
     gregate of $91 million into the two defined
     benefit pension plans. These payments had no
     material impact on our reported earnings or
     shareholders’ equity, but reduced our assets,
     operating cash flows, and unfunded pension
     liability to the plans. … At all times during this
     period, the plans were adequately funded pur-
     suant to applicable regulatory and actuarial re-
     quirements. As a result of these additional
     funds in the plans, our future contributions to
     the plans, based on actuarial analysis, may be
     reduced. Using the economic consultant’s cal-
Nos. 17-1310 & 17-1649                                     11

      culation of the potential adverse impact on the
      portfolios, we currently estimate that the addi-
      tional compensation paid to all the employees
      working in the affected group was approxi-
      mately $1.2 million over the six-year period as
      a result of these activities. In late 2009, we re-
      tained an independent investment firm to con-
      duct portfolio management and trading
      activity for the specific portfolios impacted by
      these activities.
    That same day Greffin sent a memo to all employees in
the Investment Department alerting them to the information
in the 10-K filing. In full, the Greffin memo states:
          Allstate released its annual financial report
      on Form 10–K today. Within that filing, we dis-
      closed details around allegations regarding
      trading practices within our equity portfolios
      that came to light in the past year. We took this
      matter very seriously and launched an investi-
      gation as soon as we became aware of the alle-
      gations.
          Outside counsel was retained to assist us in
      understanding the facts surrounding, and the
      potential implications of, these activities. As
      part of their analysis, an independent econom-
      ic consulting firm was retained to estimate the
      potential adverse impact to the performance of
      our portfolios. The consultant determined that
      the performance on some of our portfolios, as
      well as our two pension plan portfolios, could
      have been adversely impacted by the activities.
12                                    Nos. 17-1310 & 17-1649

      As a result, Allstate made a contribution to the
      pension plans during the 4th quarter which is
      disclosed in the 10–K.
          We believe that our financial statements
      and those of the pension plans properly re-
      flected the portfolios’ actual investment per-
      formance and the pension plans were
      adequately funded during this entire period.
      This matter did not affect the plans’ ability to
      continue to provide benefits to plan partici-
      pants.
          Situations like this can be unsettling and
      can reflect poorly on our organization. Howev-
      er, I believe organizations are also defined by
      how they respond to events like this. We were
      transparent in reporting this matter to the
      U.S. Department of Labor and the S.E.C., and
      disclosed it to our investors. We’re taking steps
      to improve our governance, compliance prac-
      tices and training.
         We remain committed to the highest levels
      of ethics and integrity in the stewardship
      of Allstate’s assets.
    Three weeks later the four fired portfolio managers sued
Allstate and Greffin in federal court for defamation based on
the 10-K and Greffin’s internal memo. They also asserted a
claim against Allstate for violation of § 1681a(y)(2) of the
FCRA and a claim against Greffin for tortious interference
with prospective economic advantage. The district judge
dismissed the tortious-interference claim, and the plaintiffs
then amended their complaint to add an age-discrimination
Nos. 17-1310 & 17-1649                                      13

claim against Allstate. They later dismissed the discrimina-
tion claim as well as the defamation claim against Greffin.
   Lengthy discovery ensued and in due course Allstate
moved for summary judgment. Judge Feinerman ruled that
the statements in the 10-K and the Greffin memo were not
defamatory per se. Rivera v. Allstate Ins. Co., 140 F. Supp. 3d
722, 729–30 (N.D. Ill. 2015). But he permitted the case to go
forward on a theory of defamation per quod and on the
FCRA claim. Id. at 730–37.
   As narrowed, the case proceeded to a jury trial with
Judge Hart presiding. The jury found for the plaintiffs across
the board and awarded more than $27 million in compensa-
tory and punitive damages, broken down roughly as fol-
lows:
   Rivera:
      $7.1 million (defamation compensatory damages)
      $4 million (defamation punitive damages)
      $1,000 (FCRA statutory damages)
   Kensinger:
      $2.9 million (defamation compensatory damages)
      $2 million (defamation punitive damages)
      $1,000 (FCRA statutory damages)
   Meacock:
      $3.6 million (defamation compensatory damages)
      $3 million (defamation punitive damages)
      $1,000 (FCRA statutory damages)
14                                       Nos. 17-1310 & 17-1649

     Scheuneman:
       $3.4 million (defamation compensatory damages)
       $1 million (defamation punitive damages)
       $1,000 (FCRA statutory damages)
   Allstate moved for judgment as a matter of law, or alter-
natively, for a new trial. The plaintiffs separately asked the
judge for an award of punitive damages and attorney’s fees
under the FCRA. 15 U.S.C. § 1681n(a)(2), (3) (authorizing
“such amount of punitive damages as the court may allow”
and attorney’s fees for willful violations of the FCRA).
    Judge Hart denied Allstate’s motion and granted the
plaintiffs’ requests, awarding each plaintiff an additional
$3,000 in punitive damages under the FCRA and approving
their request for $357,716.25 in attorney’s fees associated
with the statutory claim.
                        II. Discussion
    Allstate attacks this large judgment on many grounds. In
brief, the company argues that the defamation awards must
be set aside because: (1) the statements in the 10-K and the
Greffin memo were substantially true; (2) neither the 10-K
nor the Greffin memo identified the plaintiffs, and no evi-
dence supports a finding that these documents could be
reasonably understood to refer to them; (3) the statements in
the 10-K and the Greffin memo were privileged; and (4) the
plaintiffs failed to prove special damages as required for
recovery for defamation per quod. Regarding the FCRA
awards, Allstate argues that the plaintiffs lack standing
under Spokeo, and secondarily, that the record does not
support the jury’s finding of a willful violation of the statute
as required for statutory and punitive damages. (There are
Nos. 17-1310 & 17-1649                                         15

no actual damages.) Finally, Allstate attacks the award of
FCRA attorney’s fees as excessive and disproportionate
considering the relative insignificance of the statutory claim
to this litigation.
    The state-law defamation claim predominated over the
federal claim in this long-running litigation—both in the
district court and here. The FCRA claim occupied very little
of the parties’ appellate briefing and received only modest
attention below. Our initial opinion vacated the defamation
awards based on the plaintiffs’ failure to prove special
damages. We also vacated the FCRA awards for lack of
standing under Spokeo and remanded with instructions to
dismiss the federal claim for lack of jurisdiction.
    The plaintiffs petitioned for rehearing, raising for the first
time a probable jurisdictional defect under § 1367 if we
found—as we did—that they failed to establish an injury in
fact sufficient to support Article III standing to litigate the
FCRA claim. The petition noted that the FCRA claim pro-
vided the only jurisdictional basis for litigating this entire
dispute in federal court. The district court’s jurisdiction
rested solely on federal-question jurisdiction, see 28 U.S.C.
§ 1331; the parties are not diverse, so 28 U.S.C. § 1332 does
not apply. And the court’s supplemental jurisdiction under
§ 1367(a) to adjudicate the state-law defamation claim evap-
orates if the claim on which federal jurisdiction rests is
dismissed on jurisdictional grounds.
    We accordingly withdraw our original opinion and in its
place substitute this amended opinion. Although the parties
spent most of their energy on the merits of the defamation
claim, our analysis begins and ends with the jurisdictional
basis for the FCRA claim.
16                                    Nos. 17-1310 & 17-1649

    Relying on Spokeo, Allstate maintains that the FCRA
awards must be tossed out for lack of standing. A bit of
statutory background is required to understand the FCRA
claim in this case. We note for starters that the case repre-
sents an odd application of the Act. The FCRA regulates the
activities of consumer reporting agencies and the permissi-
ble uses of consumer reports by third parties. Among many
other regulatory requirements, the Act imposes certain
procedures for the use of consumer reports for employment
purposes.
   For example, the Act prohibits an employer from procur-
ing a consumer report about an employee or job applicant
without first giving that person a stand-alone written notice
that “clear[ly] and conspicuous[ly]” discloses the employer’s
request for permission to access the report and the person
signs a written consent to release the report to the employer.
See 15 U.S.C. § 1681b(b)(2)(A) (establishing the disclosure
and consent requirements); see id. § 1681a(d)(1) (defining
“consumer report” to include reports about a consumer’s
creditworthiness and personal background compiled by a
“consumer reporting agency” and “used or expected to be
used … for the purpose of serving as a factor in establishing
the consumer’s eligibility for” credit, insurance, or “em-
ployment purposes”).
    The Act further requires that before taking any adverse
action against an employee or job applicant “based in whole
or in part” on such a report, the employer must give the
employee or applicant a copy of the report and a written
description of the person’s rights under the Act. Id.
§ 1681b(b)(3)(A).
Nos. 17-1310 & 17-1649                                      17

    The FCRA provision at issue here appears in § 1681a,
which contains the Act’s definitions and rules of construc-
tion. (The statutory scheme is reticulated and complex, so
bear with us.) Subsection (d)(2)(D) of § 1681a excludes from
the definition of “consumer report” any “communication
described in subsection (o) or (x).” The reference to “subsec-
tion (x)” is an error; it should read “subsection (y).” The
error was introduced in the Dodd–Frank Act of 2010, 1 which
redesignated the former subsection (x) as subsection (y) but
neglected to update the cross-reference in § 1681a(d)(2)(D).
See Pub. L. No. 111-203, § 1988(a)(1)(A), 124 Stat. 1376, 2086.
   Subsection (y), the cross-referenced provision, was enact-
ed as part of the Fair and Accurate Credit Transactions Act
of 2003, Pub. L. No. 108-159, § 611, 117 Stat. 1952, 2010. It
reads in pertinent part:
      (1) Communications described in this subsec-
      tion
      A communication is described in this subsec-
      tion if–
        (A) but for subsection (d)(2)(D), the com-
      munication would be a consumer report;
         (B) the communication is made to an em-
      ployer in connection with an investigation of—
            (i) suspected misconduct relating to
          employment; or



1 Technically, the Dodd–Frank Wall Street Reform and Consumer
Protection Act of 2010.
18                                    Nos. 17-1310 & 17-1649

            (ii) compliance with Federal, State, or
        local laws and regulations, the rules of a
        self-regulatory organization, or any preex-
        isting written policies of the employer;
        (C) the communication is not made for the
     purpose of investigating a consumer’s credit
     worthiness, credit standing, or credit capacity;
     and
        (D) the communication is not provided to
     any person except–
          (i) to the employer or an agent of the
        employer;
            (ii) to any Federal or State officer, agen-
        cy, or department, or any officer, agency, or
        department of a unit of general local gov-
        ernment;
            (iii) to any self-regulatory organization
        with regulatory authority over the activities
        of the employer or employee;
            (iv) as otherwise required by law; or
            (v) pursuant to section 1681f of this title.
     (2) Subsequent disclosure
     After taking any adverse action based in whole
     or in part on a communication described in
     paragraph (1), the employer shall disclose to the
     consumer a summary containing the nature and
     substance of the communication upon which the
     adverse action is based, except that the sources of
     information acquired solely for use in prepar-
Nos. 17-1310 & 17-1649                                      19

      ing what would be but for subsection (d)(2)(D)
      an investigative consumer report need not be
      disclosed.
15 U.S.C. § 1681a(y) (emphasis added).
    So in sum, and to radically simplify: By operation of the
cross-reference in subsection (d)(2)(D) of § 1681a (and adjust-
ing for the Dodd–Frank mistake), the effect of subsection (y)
is to exclude from the definition of “consumer report”—and
thus from the myriad regulatory requirements applicable to
consumer reports—any communication that:
   (1) otherwise qualifies as a consumer report (but for sub-
   section (d)(2)(D));
   (2) was made to an employer in connection with an in-
   vestigation of employee misconduct;
   (3) was not made to the employer for purposes of inves-
   tigating an employee’s creditworthiness; and
   (4) is not disclosed to anyone other than the employer, a
   regulatory agency or authority, or as otherwise required
   by law.
    And although § 1681a simply defines statutory terms and
rules of construction, subsection (y) goes on to say that
“[a]fter taking any adverse action based in whole or in part
on” a communication of this type, the employer “shall
disclose to the consumer a summary containing the nature
and substance” of the communication. Id. § 1681a(y)(2).
   Needless to say, this is an odd place to find a regulatory
mandate on employer investigations into workplace mis-
conduct. Indeed, the provision is so obscure that in its
15-year existence, subsection (y)(2) of § 1681a appears in no
20                                     Nos. 17-1310 & 17-1649

published opinion save the district court’s decision in this
case.
    Still, taking § 1681a(y)(2) at face value, we understand it
to mean that when an employer procures what would other-
wise qualify as a consumer report in connection with an inves-
tigation into employee misconduct, the report is not
considered a consumer report under the Act and thus is not
subject to either § 1681b(b)(2)(A) (requiring the employer to
give a stand-alone written notice and obtain written consent
before procuring the report) or § 1681b(b)(3)(A) (requiring
the employer to give the employee or job applicant a copy of
the report and a description of his FCRA rights before taking
an adverse action based on it). Instead, the employer need
only provide a summary—an oral summary apparently
suffices (subsection (y)(2) does not require anything in
writing)—and then only after taking an adverse action based
in whole or in part on the report.
   The FCRA claim in this case rests on the premise that
Allstate was required under subsection (y)(2) to provide a
summary of Steptoe’s investigation after firing the plaintiffs
but failed to do so. It’s not at all clear, though, that the
Steptoe investigation would otherwise qualify as a “con-
sumer report” but for the subsection (d)(2)(D) exclusion.
And if the Steptoe investigation isn’t a “consumer report” in
the first place, then subsection (y)(2) does not come into play
and the FCRA simply does not apply.
   Here is the Act’s full definition of the term “consumer
report”:
          The term “consumer report” means any
      written, oral, or other communication of any
      information by a consumer reporting agency bear-
Nos. 17-1310 & 17-1649                                     21

       ing on a consumer’s credit worthiness, credit
       standing, credit capacity, character, general
       reputation, personal characteristics, or mode of
       living which is used or expected to be used or
       collected in whole or in part for the purpose of
       serving as a factor in establishing the consum-
       er’s eligibility for—
           (A) credit or insurance to be used primarily
       for personal, family, or household purposes;
          (B) employment purposes; or
          (C) any other purpose authorized under
       section 1681b of this title.
§ 1681a(d)(1) (emphasis added).
    The Steptoe investigation thus cannot be a “consumer
report” unless Steptoe qualifies under the Act as a “consum-
er reporting agency.” Here, in turn, is how the Act defines a
“consumer reporting agency”:
           The term “consumer reporting agency”
       means any person which, for monetary fees,
       dues, or on a cooperative nonprofit basis, regu-
       larly engages in whole or in part in the practice
       of assembling or evaluating consumer credit
       information or other information on consumers
       for the purpose of furnishing consumer reports
       to third parties, and which uses any means or
       facility of interstate commerce for the purpose
       of preparing or furnishing consumer reports.
15 U.S.C. § 1681a(f).
22                                     Nos. 17-1310 & 17-1649

   Steptoe & Johnson is a law firm. Nothing in the record
suggests that it “regularly engages” in “assembling or
evaluating consumer credit information” or “furnishing
consumer reports to third parties.” The parties have not
explained how Steptoe qualifies as a consumer reporting
agency or how its investigation into timed trading at Allstate
qualifies as a consumer report. That’s probably because
Allstate never disputed these points, choosing instead to
contest the FCRA claim on other grounds.
    As we explain in a moment, the plaintiffs’ FCRA awards
must be vacated on jurisdictional grounds based on the lack
of any concrete injury to support Article III standing to sue.
This opinion should not be construed as endorsing the
position that a law-firm investigation of this type qualifies as
a consumer report within the meaning of the Act or that
subsection (y)(2) applies in a like situation.
    With that reservation out of the way, we move to the
question of the plaintiffs’ standing. In Spokeo the Supreme
Court reinforced the principle that the “injury in fact”
element of Article III standing requires an injury that is both
“concrete and particularized,” and that to be “concrete,” the
injury must be “real” and “not abstract”—“that is, it must
actually exist.” 136 S. Ct. at 1548. The injury need not be
tangible; Congress may identify intangible harms and author-
ize litigants to seek their redress in court. Id. at 1549. But a
plaintiff does not “automatically satisf[y] the injury-in-fact
requirement whenever a statute grants a person a statutory
right and purports to authorize that person to sue to vindi-
cate that right.” Id.
   In Spokeo the plaintiff filed a proposed class action alleg-
ing violations of the FCRA—specifically, several provisions
Nos. 17-1310 & 17-1649                                         23

imposing procedural requirements on consumer reporting
agencies. Id. at 1545–46. The Court explained that a plaintiff
“cannot satisfy the demands of Article III by alleging a bare
procedural violation” of the Act because “[a] violation of one
of the FCRA’s procedural requirements may result in no
harm.” Id. at 1550. The Court said that “a bare procedural
violation [of the Act], divorced from any concrete harm,” is
not an injury in fact sufficient to confer standing to sue. Id. at
1549. On the other hand, the Court observed that some
statutory violations present a risk of real harm to a litigant
and that “a plaintiff in such a case need not allege any
additional harm beyond the one Congress has identified.” Id.
   So standing questions in cases of this type sometimes re-
quire us to identify the particular interest Congress sought
to protect and to determine if the plaintiff has suffered a
concrete injury to that interest. Our recent decisions in
Groshek v. Time Warner Cable, Inc., 865 F.3d 884 (7th Cir.
2017), and Robertson v. Allied Solutions, LLC, 902 F.3d 690 (7th
Cir. 2018), are illustrative.
     The plaintiff in Groshek signed a form authorizing a pro-
spective employer to obtain a consumer report about him in
connection with his job application; he alleged that the
disclosure form was not a stand-alone document as required
by § 1681b(b)(2)(A). 865 F.3d at 885–86. Applying Spokeo, we
held that this claim rested on “a statutory violation com-
pletely removed from any concrete harm or appreciable risk
of harm.” Id. at 887. We explained that the requirement of a
stand-alone disclosure “does not seek to protect [the plain-
tiff] from the kind of harm he claims he has suffered, i.e.,
receipt of a non-compliant disclosure.” Id. at 888. That is,
“Congress did not enact § 1681b(b)(2)(A)(i) to protect job
applicants from disclosures that do not satisfy the require-
24                                     Nos. 17-1310 & 17-1649

ments of that section; it did so to decrease the risk that a job
applicant would unknowingly consent to allowing a pro-
spective employer to procure a consumer report.” Id. Be-
cause the plaintiff acknowledged that he read and signed the
employer’s disclosure form, he had not suffered an injury to
any interest protected by the Act. Id. at 888–89.
    In Robertson the plaintiff applied for a job with the de-
fendant, and the defendant procured a background check in
the process of considering her application. The background
check qualified as a consumer report under the FCRA, and
the employer asked the plaintiff to sign a consent form
giving it permission to obtain the report. She did so. The
employer initially offered her a job but then rescinded the
offer when the background check turned up negative infor-
mation. 902 F.3d at 693–94. She sued for two FCRA viola-
tions: (1) the employer violated § 1681b(b)(2)(A) because the
consent form was not a stand-alone document and did not
contain “clear and conspicuous” disclosures, and (2) the
employer violated § 1681b(b)(3)(A) by failing to give her a
copy of the report before rescinding the job offer. Id. at 693.
We referred to the first claim as a “notice claim” and the
second as an “adverse-action claim.” Id.
    The district court dismissed the entire case for lack of
standing, and we affirmed in part and reversed in part. The
first claim, we said, was squarely controlled by our decision
in Groshek, which held that “an injury functionally indistin-
guishable from the one underpinning [the plaintiff’s] notice
claim was not concrete and did not confer standing.”
Robertson, 902 F.3d at 694. Our conclusion in Groshek applied
with equal force in Robertson, so we affirmed the dismissal of
the plaintiff’s notice claim. Id.
Nos. 17-1310 & 17-1649                                         25

    The adverse-action claim, however, was a different mat-
ter. Recall that § 1681b(b)(3)(A) states that when an employer
procures a consumer report about an employee or job appli-
cant, the employer must disclose a copy of the report to the
employee or applicant before taking any adverse action
against him based on it either in whole or in part. In
Robertson we held that this disclosure obligation protects the
employee’s (or applicant’s) interest in the information
needed to correct mistakes and respond to the employer’s
potential concerns before the adverse action occurs, perhaps
averting it altogether. Id. at 696–97. Testing the plaintiff’s
claim against that interest, we held that she suffered a
concrete injury because she “was denied information that
could have helped her craft a response to [the defendant’s]
concerns” about the content of her consumer report before
the defendant rescinded the job offer. Id. at 697.
    The question we confront here is whether subsec-
tion (y)(2) is sufficiently similar to § 1681b(b)(3)(A) to require
the same outcome. The answer is no. Subsection (y)(2)
requires only that the employer disclose a “summary” of
“the nature and substance” of a “communication” (i.e., a
consumer report) obtained from a third party in connection
with an investigation into employee misconduct. The sum-
mary need not be in writing, and specificity is not required.
Finally, the summary is required only after the employer
takes an adverse action, not before.
    A postdecision, summary-only disclosure obligation like
this one is a far cry from § 1681b(b)(3)(A), which (to repeat)
requires the employer to give an employee or job applicant a
complete copy of the consumer report and a written explana-
tion of his FCRA rights before taking any adverse action
against the employee or job applicant. That robust disclosure
26                                     Nos. 17-1310 & 17-1649

requirement, we held in Robertson, provides substantive
protection: it gives the employee or applicant important
information at a time and in a form that allows him to
correct errors and address the employer’s concerns before
any adverse action is taken. And that, we said, brought the
case within the line of Supreme Court precedents dealing
with informational injuries. 902 F.3d at 694 (citing Fed.
Election Comm’n v. Akins, 524 U.S. 11 (1998); Pub. Citizen v.
U.S. Dep’t of Justice, 491 U.S. 440 (1989)).
    Subsection (y)(2), in contrast, performs a mere post hoc
notice function; it does little more. In that sense this case is
closer to Groshek than to Robertson. Indeed, the disclosure
requirement at issue in Groshek applies before the employer
may access an employee’s or job applicant’s consumer report
and thus provides the entire basis for the statutory
informed-consent procedure. If anything, the disclosure
requirement in Groshek serves a far stronger notice purpose
than does subsection (y)(2), which operates entirely after the
fact.
    And the post hoc summary required by subsection (y)(2)
may be quite generalized. It does not provide information at
a time or in a form that allows the employee to meaningfully
respond and possibly avert an adverse employment action.
If the employer’s failure to provide a compliant disclosure in
Groshek was a bare procedural violation insufficient to confer
standing, then the plaintiffs here have likewise suffered a
mere procedural violation unaccompanied by any concrete
injury.
    The plaintiffs insist that Allstate’s failure to comply with
subsection (y)(2) left them “hampered in defending them-
selves before Allstate or potential employers.” But subsec-
Nos. 17-1310 & 17-1649                                      27

tion (y)(2) doesn’t protect a substantive “defense” interest.
At most it serves a minimal notice function. And the plain-
tiffs have not explained how the modest, post hoc summary
required by subsection (y)—again, a brief oral summary
suffices—could possibly have informed a “defense” against
Allstate after the fact. We note, moreover, that they failed to
identify any prospective employer that refused to hire them
based on the 10-K or the Greffin memo, so they have not
established that they suffered a concrete informational
injury. Nor have they identified any other tangible or intan-
gible harm arising from Allstate’s failure to comply.
    In short, the FCRA claim rests on a bare procedural viola-
tion of subsection (y)(2) unaccompanied by any concrete and
particularized harm or risk of harm to an interest protected
by the statute. The FCRA awards must be vacated and the
claim dismissed for lack of standing.
    Our ruling on the plaintiffs’ standing to sue under the
FCRA has implications for the defamation awards. As we’ve
explained, the FCRA claim was the sole basis for federal
jurisdiction. The district court adjudicated the defamation
claim under the supplemental jurisdiction provision, which
provides:
       [I]n any civil action of which the district courts
       have original jurisdiction, the district courts
       shall have supplemental jurisdiction over all
       other claims that are so related to claims in the
       action within such original jurisdiction that
       they form part of the same case or controversy
       under Article III of the United States Constitu-
       tion.
28 U.S.C. § 1367(a).
28                                      Nos. 17-1310 & 17-1649

    By its plain terms, § 1367(a) “makes clear that supple-
mental jurisdiction may only be invoked when the district
court has a hook of original jurisdiction on which to hang it.”
Herman Family Revocable Tr. v. Teddy Bear, 254 F.3d 802, 805
(9th Cir. 2001). Because the plaintiffs lack Article III standing
to bring the FCRA claim, there is no original jurisdictional
“hook” to support an assertion of § 1367(a) supplemental
jurisdiction over the defamation claim, and the district court
was without power to hear it.
       [I]f the federal claim [is] dismissed for lack of
       subject matter jurisdiction, a district court has
       no discretion to retain the supplemental claims
       for adjudication. The dismissal means that
       there never was a valid claim within the court’s
       original jurisdiction to which the state claims
       may be supplemental. Therefore, the district
       court has no discretion to exceed the scope of
       its Article III power and must dismiss the state
       law claims without prejudice.
16 JAMES WM. MOORE, MOORE’S FEDERAL PRACTICE § 106.66[1]
(Daniel R. Coquillette et al. eds., 3d ed. 2018).
    In notable contrast, when the court dismisses the federal
claim on the merits, it has the discretion under § 1367(c)(3) to
decline to hear related state-law claims or to retain them,
though there is a general presumption that the court will
relinquish supplemental jurisdiction and dismiss the state-
law claims without prejudice. RWJ Mgmt. Co. v. BP Prods. N.
Am., Inc., 672 F.3d 476, 479–80 (7th Cir. 2012). But that’s not
this case. Here the plaintiffs failed to establish Article III
standing to bring the federal claim that supported the exer-
cise of § 1367(a) jurisdiction. “[W]here there is no underlying
Nos. 17-1310 & 17-1649                                         29

original federal subject matter jurisdiction, the court has no
authority to adjudicate supplemental claims under § 1367.”
Herman Family Revocable Tr., 254 F.3d at 805; see also Textile
Prods., Inc. v. Mead Corp., 134 F.3d 1481, 1485–86 (Fed. Cir.
1998); Saksenasingh v. Sec’y of Educ., 126 F.3d 347, 351 (D.C.
Cir. 1997); Musson Theatrical, Inc. v. Fed. Express Corp., 89 F.3d
1244, 1255 (6th Cir. 1996); Nowak v. Ironworkers Local 6 Pen-
sion Fund, 81 F.3d 1182, 1187 (2d Cir. 1996).
   We are not unmindful of the costs of a jurisdictional dis-
missal at this late stage, after a full trial on the merits and an
appeal. Regrettably, the federal courts have sunk considera-
ble resources into resolving the parties’ dispute when the
case belonged in state court. But the jurisdictional defect
leaves us with no choice. Accordingly, the judgment is
vacated and the case is remanded with instructions to dis-
miss the entire action for lack of subject-matter jurisdiction.
See FED. R. CIV. P. 12(h)(3) (“If the court determines at any
time that it lacks subject-matter jurisdiction, the court must
dismiss the action.”).
                VACATED AND REMANDED WITH INSTRUCTIONS.
