A divided U.S. Supreme Court on Friday limited the ability of consumers who allege harm from privacy and data security breaches to seek class action damages under a key federal statute.

In the case TransUnion v. Ramirez, the 5-4 majority, led by Justice Brett Kavanaugh, ruled that plaintiffs who proved three violations of the federal Fair Credit Reporting Act failed to show “concrete” injuries caused by those violations, and so lacked “standing” or the right to sue for damages in federal court.