(Reuters) — The U.S. Supreme Court on Friday narrowed the scope of a class-action lawsuit against TransUnion in which thousands of people sought damages after the credit reporting company flagged their names as matching those on a government list of suspected terrorists and drug traffickers.

TransUnion had appealed a lower court ruling that had upheld a jury verdict against the Chicago-based company in the lawsuit and had ordered it to pay $40 million in damages. The Supreme Court, in a 5-4 ruling, stopped short of tossing out the jury verdict, but found there was insufficient evidence to show that all of the plaintiffs had been harmed by TransUnion’s conduct, meaning the amount of damages will be reduced.

The court, in a ruling by Justice Brett Kavanaugh, said that not all the plaintiffs had suffered a “concrete injury” as required when filing such a lawsuit.

“No concrete harm, no standing,” Justice  Kavanaugh wrote.

There were 8,185 class members in the litigation whose names matched names on the government list. At trial, it was established only that TransUnion had revealed that information publicly on 1,853 of them. The other 6,332 therefore do not have standing, Justice Kavanaugh wrote.

The court also found that on two other claims in the lawsuit none of the plaintiffs aside from the lead plaintiff, California-based Sergio Ramirez, could show they had suffered any harm.

The court’s three liberal justices were joined by conservative Justice Clarence Thomas in dissent.

Justice Thomas wrote that “despite Congress’ judgment that such misdeeds deserve redress, the majority decides that TransUnion’s actions are so insignificant that the Constitution prohibits consumers from vindicating their rights in federal court. The Constitution does no such thing.”

Credit reporting companies provide information on an individual’s borrowing and bill-paying history to lenders and other businesses.

TransUnion argued that the lawsuit, which focused on a federal law called the Fair Credit Reporting Act that requires consumer reporting agencies to provide correct information, should never have been certified as a class action.

Mr. Ramirez and other consumers were incorrectly identified by TransUnion as possible security threats.

Mr. Ramirez sued in federal court in 2012 after an incident the previous year at a Nissan automobile dealership. When the dealership performed a credit check using TransUnion, the report noted that Mr. Ramirez’s name appeared to partially match two names included on a federal government list of people barred from conducting business in the United States because of national security concerns. Neither person was Mr. Ramirez.

Although his wife was able to purchase a vehicle, Mr. Ramirez said he was embarrassed and shocked and ended up canceling an overseas vacation over concern about the list. After requesting a copy of his credit file, TransUnion sent him a separate mailing stating that his name was matched with two on the list.

The lawsuit noted that the mailing that mentioned the match incorrectly stated that such notification was not part of the actual credit report that creditors or employers would see when, in fact, it was part of it. TransUnion argued that merely being sent the mailings was not a concrete injury.

A jury in 2017 awarded damages of around $60 million to the class as a whole, including $52 million in punitive damages. The San Francisco-based 9th U.S. Circuit Court of Appeals in 2020 upheld the jury verdict but reduced the damages to about $40 million.

The business community has long sought to curb class-action lawsuits, which can lead to big payouts to plaintiffs and their lawyers. TransUnion was backed in the case by various business groups such as the U.S. Chamber of Commerce as well as companies including The Home Depot Inc., eBay Inc., Facebook Inc. and Alphabet Inc.’s Google LLC.