The class action lawsuit filed on April 30, 2026, in Michigan federal court against Thomson Reuters isn’t just another legal skirmish—it is a direct strike at the heart of the multibillion-dollar data brokerage industry. While much of the legal conversation in recent years has focused on broad “privacy rights,” this case rests on a razor-sharp technical violation of a twenty-year-old state law: the Michigan Social Security Number Privacy Act (MSSNPA). At the center of the dispute is a single, missing digit. By allegedly displaying five sequential digits of Social Security numbers (SSNs) on its research platforms like CLEAR and Westlaw People Map, Thomson Reuters has allegedly crossed a legal “bright line” that carries catastrophic financial consequences.
The Architecture of the Michigan Social Security Number Privacy Act
To understand why this case is so dangerous for Thomson Reuters, one must look at the history of the MSSNPA (MCL 445.81 et seq.). Enacted in late 2004 and effective as of March 1, 2005, Michigan was the first state in the nation to pass a comprehensive law requiring every entity—from small businesses to global conglomerates—to adopt a formal policy for safeguarding SSNs.
The “Four-Digit” Bright Line
The Act’s primary mechanism is its strict prohibition on the “public display” of SSNs. Specifically, MCL 445.83 prohibits any person or entity from publicly displaying “all or more than 4 sequential digits of a social security number.”
In 2004, this was a revolutionary standard. While the federal government was still grappling with how to handle data in the digital age, Michigan lawmakers recognized that the last four digits of an SSN had become a “de facto” verification tool. They decided that while four digits were a necessary evil for identity confirmation, a fifth digit was an unacceptable security risk.
The Definition of “Public Display”
A critical point in the upcoming litigation will be the definition of “publicly display.” Under the Act, this means to make a number visible “to members of the public or in a public manner.” Thomson Reuters will likely argue that its platforms are proprietary tools for “vetted professionals.” However, the plaintiffs argue that since CLEAR and Westlaw are commercially available to almost any business or law firm with the means to pay, they are effectively “publicly” available.
Historical Litigation: A Roadmap of Risk
The history of the MSSNPA is marked by several landmark cases that have shaped how businesses handle data in Michigan. These cases serve as a warning for the current Thomson Reuters litigation:
-
Bell v. Michigan Council 25 AFSCME (2005): This is perhaps the most significant case in the Act’s history. The Michigan Court of Appeals affirmed a $275,000 jury verdict against a union after a treasurer’s daughter stole member information. The court found that the union had a “special relationship” with its members and was negligent in failing to safeguard their SSNs. This established that even without a direct data breach, failing to protect data leads to liability.
-
Averill v. Gleaner Life Insurance Society (2009): This case further clarified that the Act provides a private right of action. It confirmed that individuals could sue for violations of the SSN Privacy Act, though it initially left open the question of “actual damages.”
-
The Thomson Reuters California Settlement (2024): While not under the Michigan Act, Thomson Reuters recently agreed to a $27.5 million settlement involving its CLEAR platform in California. That case focused on the “misappropriation” of identities. The new Michigan case is arguably more dangerous because it relies on a specific statutory violation rather than broader, harder-to-prove privacy theories.
The Financial Math: Why It’s a “Billion-Dollar” Crisis
The most terrifying aspect of the MSSNPA for a defendant is its penalty structure. Under MCL 445.86, a person who knowingly violates the Act is liable for:
-
Actual damages OR $1,000 per violation, whichever is greater.
-
Reasonable attorney fees and court costs.
For a company like Thomson Reuters, which maintains a database of millions of records, the math is simple and devastating. If a class of 1,000,000 Michigan residents is certified, and the court finds that displaying five digits was a “knowing” violation of a 21-year-old law, the potential exposure starts at $1 billion ($1,000 x 1,000,000), plus attorney fees.
Cybersecurity Implications: The Power of the Fifth Digit
From a cybersecurity perspective, the difference between four and five digits is not linear; it is exponential.
-
Brute-Force Reduction: An SSN consists of nine digits. If a hacker has four digits, they must guess five ($10^5$ combinations). If they have five digits, they only need to guess four ($10^4$). This reduces the computational effort required to “crack” a full SSN by 90%.
-
Credential Stuffing: In 2026, AI-driven tools can use five sequential digits to cross-reference leaked databases (from past breaches like Equifax) and verify identities with near-total accuracy in milliseconds.
By providing five digits, the lawsuit alleges that Thomson Reuters essentially provided a “skeleton key” to identity thieves, making it significantly easier to reconstruct a victim’s full identity.
The Defense Strategy
Thomson Reuters is not expected to settle quickly. Their defense will likely rely on three pillars:
-
Preemption: Arguing that federal laws (like the Fair Credit Reporting Act) override Michigan’s state-level restrictions.
-
Professional Use: Asserting that CLEAR is a tool for law enforcement and licensed investigators, and therefore the display is “authorized by law” under the Act’s exceptions.
-
Lack of Intent: Claiming that the five-digit display was a technical error or a misinterpretation of the statute, not a “knowing” violation meant to cause harm.
Conclusion: A Turning Point for Data Sovereignty
The Thomson Reuters class action represents a new era of privacy litigation. It is no longer about “big ideas” like the right to be forgotten; it is about strict compliance with data-minimization statutes. As this case moves through the Michigan federal court, it will serve as a bellwether for the entire data industry. If a global giant can be brought to its knees over a single sequential digit, it sends a clear message to every company in America: In the age of AI and automated identity theft, “good enough” data masking is no longer a defense.
Key Violations Alleged in SSN Privacy Lawsuits
When entities are sued under the MSSNPA, the allegations typically fall into one of these categories:
-
Excessive Masking Failures: Displaying more than 4 sequential digits (as seen in the Thomson Reuters case).
-
Mailing Violations: Sending documents where the SSN is visible through the window of an envelope.
-
Internet Transmission: Requiring a person to transmit an unencrypted SSN over the internet without a secure connection.
-
ID Card Usage: Printing an SSN on an employee ID badge, membership card, or student ID.
-
Policy Failures: Failing to create or publish a mandatory privacy policy regarding the possession of SSNs.
-
Negligent Safeguarding: Failing to protect data from internal “insider threats” (as seen in the Bell v. AFSCME case).
