The Supreme Court released its highly anticipated decision in Spokeo v. Robins Monday. Corporate interest groups pushed the Spokeo case as a vehicle to kill consumer class actions based on privacy invasions (i.e. data breach cases), with an eye towards attacking other consumer class actions in the future. The Supreme Court on Monday dashed those hopes for Spokeo, instead issuing a narrow ruling, and remanding the case to the Ninth Circuit to consider whether the Plaintiff satisfied the requirement of “concreteness” in the two pronged test for Article III standing, while making clear that intangible injuries or the increased risk of future injury could satisfy the test. The decision not only failed to destroy privacy class actions, it may ultimately serve to bolster consumer’s claims in these important cases.
The complaint in Spokeo alleged claims under the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681, et seq. Defendant, Spokeo, Inc. operates a “people search engine” which permits a user to input a person’s name, phone number or email address, and after completing a search of various databases Spokeo returns a report about the person searched. Spokeo markets its services to a number of different people, including employers doing background checks on prospective employees. The Plaintiff, Thomas Robins, was an unemployed man who was looking for work. He found out that Spokeo had produced a profile about him which indicated that he was married, had children, was in his 50s, had a job, was relatively affluent and held a graduate degree, it also included a picture which it claimed was of Mr. Robins. None of that information was true. Mr. Robins alleged that as a result of the incorrect profile Spokeo created of him hurt his chances of getting a job (for which he was actively searching) by making him appear overqualified, expectant of a higher salary than employers wanted to play, or less mobile because of family responsibilities. As a result, Mr. Robins filed a class-action complaint against Spokeo alleging willful violations of the FCRA.
The FCRA requires companies like Spokeo which regularly disseminate information relating to an individual’s “credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living.” It requires companies dealing in such information to (1) follow reasonable procedures to assure the maximum accuracy of the reports; (2) notify providers and users of the information of their responsibilities under the FCRA; (3) to limit the circumstances in which the company provides reports for employment purposes; and (4) to post a toll free number for consumers to request their reports. Companies which willfully violate the FCRA with respect to any individual are liable to that individual for (among other things) actual damages or statutory damages of $100 to $1000 per violation, as well as attorneys fees, costs of suit, and potentially punitive damages.
The District Court dismissed Mr. Robins’ complaint, finding that the complaint did not adequately plead an injury in fact, and therefore Mr. Robins had no standing to bring claims under the FCRA. The Ninth Circuit reversed that ruling, finding that Mr. Robins had adequately pled an injury in fact. The Supreme Court granted certification on the question of standing.
The Supreme Court has previously held that “to establish injury in fact, a plaintiff must show that he or she suffered an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical.” Spokeo v. Robins, 578 U.S. ____, (2016) (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992) (internal quotations omitted).
In Spokeo, the Court focused on the requirements of particularization and concreteness, and the real work in the opinion addresses the question of concreteness. It has long been the rule that in order for an injury to be particularized it “must affect the plaintiff in a personal and individual way.” Id. (citing DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 342 (2006)). With regard to “concrete” injury the Court held that the term concrete is meant to convey “the usual meaning of the term – ‘real’ and not ‘abstract.’” However, the Court cautioned that the term concrete is not synonymous with “tangible”, and that intangible harms may constitute concrete, but that determining whether intangible injuries are injuries in fact, “both history and the judgment of Congress play important roles.” Id. With regard to the role of history in the analysis, the Court noted that in considering whether an intangible harm constitutes an injury in fact a court should consider whether it has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American Courts. The Court also noted that Congress is well positioned to determine intangible harms that meet the Article III requirement of standing and therefore, and may “elevate to the status of legally cognizable injuries …injuries that were previously inadequate at law” and therefore its decision to give standing to a wrong is important, although not dispositive as to the question of Article III standing. Id. (quoting Lujan at 578).
The Court expressly noted that the “risk of real harm” can satisfy the requirement of concreteness. Id. (Giving examples including Clapper v. Amnesty Int’l USA, 568 U.S. ___, 133 S. Ct. 1138 (2013)). In the context of the FCRA claims brought by Robins, the Court held that in the FCRA (1) congress sought to curb the dissemination of false information; and (2) a “bare procedural violation” will not satisfy the requirements of Article III as it may result in no harm. (Giving the example of an incorrect zip code).
The Court’s citation of Clapper is of particular interest for firms which handle data breach litigation. Defendants regularly argue that data breach victims, who cannot further allege specific allegations of actual identity theft have no standing to bring claims for the increased risk of future identity theft. In Clapper, the Supreme Court held that risk of harm or “threatened injury must be certainly impending to constitute injury in fact” in order to provide Art. III standing. 133 S. Ct. at 1148 (citations omitted). While certain district courts have questioned whether an increased risk of harm provides Article III standing, the Supreme Court in Spokeo has reaffirmed that an increased risk of harm can form an actionable injury for Article III purposes. This reaffirmation comports with the most recent decisions on the increased risk of harm associated with data breaches from the Seventh Circuit, Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688 (7th Cir. 2015) and Lewert v. P.F. Chang’s China Bistro, Inc., 2016 U.S. App. LEXIS 6766 (7th Cir. 2016). It also comports with the longstanding law in the Ninth Circuit, Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010); In re Adobe Sys Privacy Litig., 66 F. Supp. 3d 1197 (N.D. Cal. 2014).
Ultimately, the Spokeo decision did not accomplish what corporate interest groups hoped, and ultimately, it may well serve to bolster consumer’s rights in claims for breach of privacy claims like those brought in data breach class actions.
