Standing to Assert Claims for Online Privacy Breaches

The significance of the case, Spokeo v. Robins, No. 13-1339 (U.S.) (the court heard arguments on Nov. 2, 2015), on writ of certiorari from the U.S. Court of Appeals for the Ninth Circuit, Robins v. Spokeo, 742 F.3d 409 (9th Cir. 2014), can be seen from the broad range of amicus briefs that have been filed, including by the U.S. Chamber of Commerce, various banking organizations, publishers, the defense bar, and law professors, among others. Media and technology companies that provide a wide variety of services via the Internet, including eBay, Facebook, Google, LinkedIn, Netflix, Twitter, and Yahoo!, together with several trade associations, filed their own, separate amicus brief (the Media and Technology Brief).

The specific issue in Spokeo, filed as a putative class action, is whether an individual has standing under Article III of the U.S. Constitution to sue a website's operator under the Fair Credit Reporting Act (FCRA), 15 U.S.C. '1681 et seq, merely for publishing inaccurate personal information about that individual. (The FCRA imposes various requirements on certain entities that regularly compile and disseminate personal information about individual consumers. Congress enacted the FCRA to address developments in “computer technology [that] facilitated the storage and interchange of information” and “open[ed] the possibility of a nationwide data bank covering every citizen.” S. Rep. No. 517, 91st Cong., 1st Sess. 2 (1969).) Should the Supreme Court affirm the Ninth Circuit's conclusion that the statutory cause of action under the FCRA does “not require a showing of actual harm” when a plaintiff sues for willful violations of the law, Web-based companies may face a flood of class suits under the Telephone Consumer Protection Act (TCPA), the Video Privacy Protection Act (VPPA), 18 U.S.C. '2710 (2013), and the Cable Communications Privacy Act, 47 U.S.C. '551(f)(1)-(2), among other federal and state laws, without plaintiffs having to demonstrate that they suffered any actual harm at all. The decision also may have broad application as to parallel concerns raised in cases of data breach, where the absence of demonstrable harm caused by the breach has impeded the recovery of non-speculative damages by data breach plaintiffs.