Standing to Assert Claims for Online Privacy Breaches

Background

Spokeo operates a website that provides users with information about individuals, including contact data, marital status, age, occupation, economic health, and wealth level. It describes itself as a “people search engine” that organizes white pages listings, public records, and social network information “to help you safely find & learn about people.” See, www.spokeo.com.

Thomas Robins sued Spokeo in the U.S. District Court for the Central District of California for willful violations of FCRA related to its website, asserting that Spokeo's website contained false information about him that impaired his ability to find a job.

Initially, Spokeo's motion to dismiss the complaint for lack of subject matter jurisdiction on the ground that Robins lacked Article III standing was granted. The district court concluded that Robins had not alleged an injury in fact in connection with Robins' allegations. The district court noted that “[a]llegations of possible future injury do not satisfy the [standing] requirements” of Article III and dismissed the complaint without prejudice.

Robins subsequently filed an amended complaint that again alleged willful violations of the FCRA. For example, he asserted that Spokeo's website described Robins as holding a graduate degree and as wealthy, both of which he alleged were untrue. Robins said he was unemployed and he described the misinformation as “caus[ing] actual harm to [his] employment prospects.” Robins alleged that his continued unemployment cost him money and caused “anxiety, stress, concern, and/or worry about his diminished employment prospects.”

Spokeo again moved to dismiss for lack of subject matter jurisdiction. (Spokeo has not conceded that it is a consumer reporting agency subject to the FCRA or that it actually had violated the FCRA.) The district court initially denied the motion because Spokeo's alleged “marketing of inaccurate consumer reporting information about” Robins alleged a sufficient injury in fact, “that the injury was traceable to Spokeo's alleged violations of the FCRA and that the injury was redressable through a favorable court decision.”

After Spokeo moved to certify an interlocutory appeal, the district court reconsidered its ruling on standing and reverted to its earlier conclusion that Robins had not pleaded an injury in fact and that any injuries pleaded were not traceable to Spokeo's alleged violations. It dismissed the action.

Robins appealed to the Ninth Circuit. He contended that his complaint alleged willful violations of various statutory provisions (see, 15 U.S.C. '1681b(b)(1) (listing the circumstances in which consumer reporting agencies (CRAs) may provide “consumer reports for employment purposes”); 15 U.S.C. '1681e(b) (requiring CRAs to “follow reasonable procedures to assure maximum possible accuracy of” consumer reports); 15 U.S.C. '1681e(d) (requiring CRAs to issue notices to providers and users of information); and 15 U.S.C. '1681j(a) (requiring CRAs to post toll-free telephone numbers to allow consumers to request consumer reports), and that, because these provisions were enforceable through a private cause of action, they created statutory rights that he had standing to vindicate in court. See, 15 U.S.C. '1681n. Spokeo countered that Robins could not sue under the FCRA without showing actual harm.

The Ninth Circuit's Decision

The circuit court reversed the district court.

In its decision, the Ninth Circuit declared that Congress' creation of a private cause of action to enforce a statutory provision implied that Congress intended the enforceable provision to create a statutory right, and that the violation of a statutory right usually was a sufficient injury in fact to confer standing. The Ninth Circuit declared that a cause of action under the FCRA did not require a showing of actual harm when a plaintiff sued for “willful violations,” as Robins had done here.

The circuit court rejected Spokeo's request that the circuit court adopt the Eighth Circuit dicta that a reasonable interpretation of the FCRA might still require the plaintiff to suffer actual harm, but substitute statutory rather than actual damages in order to calculate any damage award. See, Dowell v. Wells Fargo Bank, N.A., 517 F.3d 1024, 1026 (8th Cir. 2008).

The Ninth Circuit acknowledged that “the Constitution limits the power of Congress to confer standing,” but observed that this limit did not prohibit Congress from “elevating to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.” It then found that violations of statutory rights created by the FCRA were “concrete, de facto injuries” that Congress could so elevate.

Importantly, the circuit court said, Robins alleged that Spokeo had violated his statutory rights, not just the statutory rights of other people, so that he was “among the injured.” Moreover, it ruled, the interests protected by the statutory rights ' Robins' personal interests in the handling of information about him ' were “sufficiently concrete and particularized” that Congress could elevate them, the Ninth Circuit said.

Therefore, the circuit court concluded, the alleged violations of Robins' statutory rights were sufficient to satisfy the injury in fact requirement of Article III. Moreover, because the harm claimed was the violation of a statutory right, the causation and redressability prongs of the standing analysis were satisfied as well.

The Supreme Court Argument

Spokeo's petition for writ of certiorari was granted. The question presented, as framed by Spokeo, was “[w]hether Congress may confer Article III standing upon a plaintiff who suffers no concrete harm and who therefore could not otherwise invoke the jurisdiction of a federal court, by authorizing a private right of action based on a bare violation of a federal statute.” Spokeo v. Robins, 2013 U.S. Briefs 1339 (U.S. May 1, 2014).

Repeating many arguments it made below, Spokeo asserted that the Constitution's standing requirement was not satisfied when the plaintiff allegedly suffered an injury in law unaccompanied by an injury in fact. At argument held Nov. 2, 2015, both sides predicted dire consequences if the other side's position was adopted.

Spokeo asserted that finding Article III standing in the absence of an injury in fact would open the floodgates to massive class action litigation spearheaded by parties who had suffered no injury in fact.

Robins argued that denying standing to pursue those who had willfully violated the statutory rights of others would shut the courthouse doors to those seeking redress for violations of their privacy and civil rights, particularly in the Internet environment, where such violations were claimed to be rampant.

A middle ground position that may have appealed to some justices was that, in the case before them, Robins had alleged an injury in fact as well as at law, in the impairment of his credit rating, which would be sufficiently concrete for purposes of standing. See, Amy Howe, “Argument analysis: Second time around no easier for Justices in standing case,” SCOTUSBLOG (Nov. 2, 2015). Unaddressed, however, was whether such an individualized analysis would impact the viability of the class action vehicle to address multiparty claims.

Conclusion

The Supreme Court, in essence, is being asked to determine whether a person who claims to have had his or her privacy invaded but who asserts no specific damages can bring a federal class action lawsuit on behalf of others similarly situated with a potential cost to the defendant company of millions of dollars ' and with monetary recovery primarily limited to attorney fees for class counsel.

As the Media and Technology Brief pointed out, Internet companies “are frequently targeted by opportunistic lawsuits based on alleged violations” of federal laws in which “the only alleged harm is a bare statutory violation ' an injury-in-law, not an injury-in-fact.” In one instance highlighted in the Media and Technology Brief, Netflix settled a lawsuit with a class estimated to exceed 60 million individuals and potential statutory damages exceeding $150 billion that alleged that Netflix had unlawfully disclosed personal information to analytics companies it had hired and impermissibly retained viewing information in violation of the VPPA ' in the absence of any allegation of actual harm and where the plaintiffs estimated that their “'unlawful disclosure' claim would have a 5% chance of success on the merits.” See, In re Netflix Privacy Litig. (N.D. Cal. March 18, 2013).

The Supreme Court will determine whether these injury at law claims will succeed against Internet companies or any company accused of violating the privacy interests of others.

Shari Claire Lewis, a partner in the Long Island office of Rivkin Radler, can be reached at [email protected].

Many believe that we are on the precipice of a deluge of litigation ' both individual and multiparty/class action ' concerning how an individual's data is handled and the remedy, if any, if that data is misused or wrongfully disclosed. A case recently argued before the U.S. Supreme Court involves the intersection of the Internet and privacy laws and may affect the future of litigation against companies that operate on the Web as well as traditional brick-and-mortar businesses.

The significance of the case, Spokeo v. Robins, No. 13-1339 (U.S.) (the court heard arguments on Nov. 2, 2015), on writ of certiorari from the U.S. Court of Appeals for the Ninth Circuit, Robins v. Spokeo, 742 F.3d 409 (9th Cir. 2014), can be seen from the broad range of amicus briefs that have been filed, including by the U.S. Chamber of Commerce, various banking organizations, publishers, the defense bar, and law professors, among others. Media and technology companies that provide a wide variety of services via the Internet, including eBay, Facebook, Google, LinkedIn, Netflix, Twitter, and Yahoo!, together with several trade associations, filed their own, separate amicus brief (the Media and Technology Brief).

The specific issue in Spokeo, filed as a putative class action, is whether an individual has standing under Article III of the U.S. Constitution to sue a website's operator under the Fair Credit Reporting Act (FCRA), 15 U.S.C. '1681 et seq, merely for publishing inaccurate personal information about that individual. (The FCRA imposes various requirements on certain entities that regularly compile and disseminate personal information about individual consumers. Congress enacted the FCRA to address developments in “computer technology [that] facilitated the storage and interchange of information” and “open[ed] the possibility of a nationwide data bank covering every citizen.” S. Rep. No. 517, 91st Cong., 1st Sess. 2 (1969).) Should the Supreme Court affirm the Ninth Circuit's conclusion that the statutory cause of action under the FCRA does “not require a showing of actual harm” when a plaintiff sues for willful violations of the law, Web-based companies may face a flood of class suits under the Telephone Consumer Protection Act (TCPA), the Video Privacy Protection Act (VPPA), 18 U.S.C. '2710 (2013), and the Cable Communications Privacy Act, 47 U.S.C. '551(f)(1)-(2), among other federal and state laws, without plaintiffs having to demonstrate that they suffered any actual harm at all. The decision also may have broad application as to parallel concerns raised in cases of data breach, where the absence of demonstrable harm caused by the breach has impeded the recovery of non-speculative damages by data breach plaintiffs.

Background

Spokeo operates a website that provides users with information about individuals, including contact data, marital status, age, occupation, economic health, and wealth level. It describes itself as a “people search engine” that organizes white pages listings, public records, and social network information “to help you safely find & learn about people.” See, www.spokeo.com.

Thomas Robins sued Spokeo in the U.S. District Court for the Central District of California for willful violations of FCRA related to its website, asserting that Spokeo's website contained false information about him that impaired his ability to find a job.

Initially, Spokeo's motion to dismiss the complaint for lack of subject matter jurisdiction on the ground that Robins lacked Article III standing was granted. The district court concluded that Robins had not alleged an injury in fact in connection with Robins' allegations. The district court noted that “[a]llegations of possible future injury do not satisfy the [standing] requirements” of Article III and dismissed the complaint without prejudice.

Robins subsequently filed an amended complaint that again alleged willful violations of the FCRA. For example, he asserted that Spokeo's website described Robins as holding a graduate degree and as wealthy, both of which he alleged were untrue. Robins said he was unemployed and he described the misinformation as “caus[ing] actual harm to [his] employment prospects.” Robins alleged that his continued unemployment cost him money and caused “anxiety, stress, concern, and/or worry about his diminished employment prospects.”

Spokeo again moved to dismiss for lack of subject matter jurisdiction. (Spokeo has not conceded that it is a consumer reporting agency subject to the FCRA or that it actually had violated the FCRA.) The district court initially denied the motion because Spokeo's alleged “marketing of inaccurate consumer reporting information about” Robins alleged a sufficient injury in fact, “that the injury was traceable to Spokeo's alleged violations of the FCRA and that the injury was redressable through a favorable court decision.”

After Spokeo moved to certify an interlocutory appeal, the district court reconsidered its ruling on standing and reverted to its earlier conclusion that Robins had not pleaded an injury in fact and that any injuries pleaded were not traceable to Spokeo's alleged violations. It dismissed the action.

Robins appealed to the Ninth Circuit. He contended that his complaint alleged willful violations of various statutory provisions (see, 15 U.S.C. '1681b(b)(1) (listing the circumstances in which consumer reporting agencies (CRAs) may provide “consumer reports for employment purposes”); 15 U.S.C. '1681e(b) (requiring CRAs to “follow reasonable procedures to assure maximum possible accuracy of” consumer reports); 15 U.S.C. '1681e(d) (requiring CRAs to issue notices to providers and users of information); and 15 U.S.C. '1681j(a) (requiring CRAs to post toll-free telephone numbers to allow consumers to request consumer reports), and that, because these provisions were enforceable through a private cause of action, they created statutory rights that he had standing to vindicate in court. See, 15 U.S.C. '1681n. Spokeo countered that Robins could not sue under the FCRA without showing actual harm.

The Ninth Circuit's Decision

The circuit court reversed the district court.

In its decision, the Ninth Circuit declared that Congress' creation of a private cause of action to enforce a statutory provision implied that Congress intended the enforceable provision to create a statutory right, and that the violation of a statutory right usually was a sufficient injury in fact to confer standing. The Ninth Circuit declared that a cause of action under the FCRA did not require a showing of actual harm when a plaintiff sued for “willful violations,” as Robins had done here.

The circuit court rejected Spokeo's request that the circuit court adopt the Eighth Circuit dicta that a reasonable interpretation of the FCRA might still require the plaintiff to suffer actual harm, but substitute statutory rather than actual damages in order to calculate any damage award. See, Dowell v. Wells Fargo Bank, N.A., 517 F.3d 1024, 1026 (8th Cir. 2008).

The Ninth Circuit acknowledged that “the Constitution limits the power of Congress to confer standing,” but observed that this limit did not prohibit Congress from “elevating to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.” It then found that violations of statutory rights created by the FCRA were “concrete, de facto injuries” that Congress could so elevate.

Importantly, the circuit court said, Robins alleged that Spokeo had violated his statutory rights, not just the statutory rights of other people, so that he was “among the injured.” Moreover, it ruled, the interests protected by the statutory rights ' Robins' personal interests in the handling of information about him ' were “sufficiently concrete and particularized” that Congress could elevate them, the Ninth Circuit said.

Therefore, the circuit court concluded, the alleged violations of Robins' statutory rights were sufficient to satisfy the injury in fact requirement of Article III. Moreover, because the harm claimed was the violation of a statutory right, the causation and redressability prongs of the standing analysis were satisfied as well.

The Supreme Court Argument

Spokeo's petition for writ of certiorari was granted. The question presented, as framed by Spokeo, was “[w]hether Congress may confer Article III standing upon a plaintiff who suffers no concrete harm and who therefore could not otherwise invoke the jurisdiction of a federal court, by authorizing a private right of action based on a bare violation of a federal statute.” Spokeo v. Robins, 2013 U.S. Briefs 1339 (U.S. May 1, 2014).

Repeating many arguments it made below, Spokeo asserted that the Constitution's standing requirement was not satisfied when the plaintiff allegedly suffered an injury in law unaccompanied by an injury in fact. At argument held Nov. 2, 2015, both sides predicted dire consequences if the other side's position was adopted.

Spokeo asserted that finding Article III standing in the absence of an injury in fact would open the floodgates to massive class action litigation spearheaded by parties who had suffered no injury in fact.

Robins argued that denying standing to pursue those who had willfully violated the statutory rights of others would shut the courthouse doors to those seeking redress for violations of their privacy and civil rights, particularly in the Internet environment, where such violations were claimed to be rampant.

A middle ground position that may have appealed to some justices was that, in the case before them, Robins had alleged an injury in fact as well as at law, in the impairment of his credit rating, which would be sufficiently concrete for purposes of standing. See, Amy Howe, “Argument analysis: Second time around no easier for Justices in standing case,” SCOTUSBLOG (Nov. 2, 2015). Unaddressed, however, was whether such an individualized analysis would impact the viability of the class action vehicle to address multiparty claims.

Conclusion

The Supreme Court, in essence, is being asked to determine whether a person who claims to have had his or her privacy invaded but who asserts no specific damages can bring a federal class action lawsuit on behalf of others similarly situated with a potential cost to the defendant company of millions of dollars ' and with monetary recovery primarily limited to attorney fees for class counsel.

As the Media and Technology Brief pointed out, Internet companies “are frequently targeted by opportunistic lawsuits based on alleged violations” of federal laws in which “the only alleged harm is a bare statutory violation ' an injury-in-law, not an injury-in-fact.” In one instance highlighted in the Media and Technology Brief, Netflix settled a lawsuit with a class estimated to exceed 60 million individuals and potential statutory damages exceeding $150 billion that alleged that Netflix had unlawfully disclosed personal information to analytics companies it had hired and impermissibly retained viewing information in violation of the VPPA ' in the absence of any allegation of actual harm and where the plaintiffs estimated that their “'unlawful disclosure' claim would have a 5% chance of success on the merits.” See, In re Netflix Privacy Litig. (N.D. Cal. March 18, 2013).

The Supreme Court will determine whether these injury at law claims will succeed against Internet companies or any company accused of violating the privacy interests of others.

Shari Claire Lewis, a partner in the Long Island office of Rivkin Radler, can be reached at [email protected].