Standing in privacy lawsuits: Is the tide turning in favor of consumers?

Spokeo: What is at stake?

One man vs. the data brokers: This is the tag line that sums up a high-stakes privacy saga five years in the making that has made its way up to the U.S. Supreme Court. Spokeo, Inc. v. Robins involves a contentious dispute over whether or not Robins has the right to sue (i.e. standing to bring a class-action against) Spokeo, an online data broker, for reporting false information about him in violation of the federal Fair Credit Reporting Act. With the Court’s decision pending, more than twenty-five federal district courts dealing with claims for standing (based on violation of statutes such as TCPA, ECPA, FCRA) have recently stayed action until this case is decided.

This controversy between Robins and Spokeo represents a scenario now commonplace for Internet users. Data brokers are the modern equivalent of the Yellow Book, except at the scale of the Internet. Awareness of privacy harm to consumers from the alleged misuse or disclosure of their personal information by data brokers (a largely unregulated industry) has been rising recently. In 2014, the Federal Trade Commission reported on nine data brokers that collect, compile and sell vast amounts of personal information. At the same time, the FTC noted that most consumers have no way to check or confirm the information, and there is very limited, if any, historical precedent for consumers’ ability to challenge the inappropriate aggregation and disclosure of their personal information.

The standing to sue, therefore, is part of an important framework to enable individuals allegedly harmed by data brokers to protect their right of privacy. The requirement to show sufficient harm for standing, however, has emerged as one of the most significant procedural obstacles to data privacy plaintiffs, with one court aptly describing the situation as follows: “[E]ven though [this requirement] may not generally be Mount Everest, … in data privacy cases [it] might still reasonably be described as Kilimanjaro.”

Issue: What is this case about?

In his original suit, Robins alleged that Spokeo created and made available for purchase an inaccurate report of his personal information. He further alleged that Spokeo was aware of the inadequacies in its processes, yet failed to follow reasonable procedures required by FCRA to ensure its accuracy, and, as a result, had willfully violated FCRA.

In particular, Spokeo falsely reported that Robins (1) had a graduate degree (he does not); (2) was employed in a professional or technical field, his “economic health” was “very strong,” and his wealth level was in the “Top 10 percent” (he is out of work and seeking employment); and (3) was in his 50s, was married, and has children (he is not in his 50s, is unmarried, and has no children). The report also included a photograph purporting to be of Robins that was not, in fact, of him.

Robins claims that reports generated by Spokeo contained inaccurate consumer information that is marketed to entities performing background checks, and as a result, he is concerned that his ability to obtain credit, employment and insurance will be adversely affected. Spokeo claimed that Robins did not have standing to bring such a claim because he did not suffer any actual or imminent harm.

The claim was originally filed in 2010, the standing was denied by the district court and then subsequently granted by the 9^th U.S. Circuit in 2014. Spokeo appealed that ruling in favor of Robins, and the case is now pending final decision by the Supreme Court.

What Constitutes Standing? Court Split

The requirement for standing in lawsuits for an alleged harm is based on Article III of the Constitution, but the Congress by statute may also grant individuals a private right to sue. The lower courts are split regarding whether a plaintiff must show injury sufficient to meet constitutional requirements even where a statutorily created private right of action exists.

According to the Supreme Court in Warth v. Seldin, the actual or threatened injury required by Article III (referred to as injury-in-fact) may exist solely by virtue of statutes creating legal rights, but plaintiffs still must allege a distinct and palpable injury to themselves, even if that right is statutorily created. Different circuits have reached different results on the issue of interpreting this requirement.

On one side, the 2^nd and 4^th U.S. Circuits have narrowly interpreted the standing requirement to demand a higher threshold of injury – not mere violation of the statute. Each of these circuits held (respectively in Kendall v. Employees Retirement Plan of Avon Products and David v. Alphin) that deprivation of a statutory right (in the context of the ERISA statute) alone does not confer standing.

On the other hand, according to the 3^rd, 6^th and 9^th U.S. Circuits, the alleged violation of a statutory right is, by itself, an injury sufficient to establish Article III standing. The 9^th U.S. Circuit not only granted standing to Robins in the current case when it came up on appeal from the district court but has also applied this principle in regards to various claims based on statutory rights, including financial industry statutes (such as Real Estate Settlement Procedures Act in Edwards v. First American Corp. and surveillance statutes such as Stored Communications Act and Wire Tap Act in Jewel v. National Security Agency. Similarly, the 3^rd U.S. Circuit in the Google Inc. line of cases has held that allegations of violation of surveillance statutes, including the Stored Communications Act and the Wire Tap Act, established a concrete injury with respect to the Article III injury-in-fact requirement, without a showing of actual damages.

In Beaudry v. TeleCheck Services, Inc ,a case most relevant to Spokeo, Inc. v. Robins, the 6^th U.S. Circuit, in held that a consumer was not required to allege that violations of the FCRA caused injury to the consumer in the form of consequential damages in order to state a claim for willful violations of the statute. More recently, the 8^th U.S. Circuit in Hammer v. Sam's E., Inc. held that a violation of Fair and Accurate Credit Transactions Act was sufficient to allege an injury-in-fact, even though no injury would exist without the statute.

Resolution: How Should the Court Rule?

The U.S. Supreme Court now faces the task of reconciling the different interpretations used by the lower courts (and in turn by Spokeo and Robins in each of their arguments in front of the Court) of how should it answer the two key questions presented by the case:

1. Could a violation of statutory rights alone be sufficient to meet Article III requirement, and grant standing in privacy claims, where there is no actual harm? And,
2. Did Robins suffer a harm sufficient to meet the injury-in-fact requirement when his information was inaccurately reported by Spokeo?

There are arguments both for and against standing to be granted in the case, with corporations urging the Court to “close the courthouse door” to floodgates of class action litigation in their opposition to such a decision and consumer advocates insisting that the Court should not “make it harder [for consumers] to bring [class-action] lawsuits” which can force data brokers to do more to ensure their profiles of people are accurate.

Spokeo and Robins offer conflicting interpretations of the applicable law, which is central to the resolution of the dispute. Spokeo’s argument is that a plaintiff who suffers no concrete harm lacks standing to sue, even where Congress creates a private right of action based on a bare violation of a federal statute. Robins argues that he should be allowed standing because the statutory violation he suffered inflicts an injury that is sufficiently individualized and concrete to accord him a personal stake in the outcome of the controversy.

Opinion:

The Court should reject the rigid formulation of standing requirement by Spokeo.

Supreme Court precedent does not bar standing

Spokeo’s reliance on several past cases in support of its argument is misplaced, because it conflates Robins’ claim with prior decisions of the Court that were limited to cases based on deprivation of statutory rights without any sufficiently individualized and personal injury to the plaintiff. Two examples of such cases are:

1. Summers v. Earth Island Inst, where the Court denied standing for plaintiffs seeking to enjoin the U.S. government from alleged procedural violations of an environmental protection statute that otherwise inflicted no personal harm on them, and
2. Vermont Agency of Natural Res. v. United States ex rel. Stevens, where the Court denied standing for plaintiff seeking damages, on behalf of the U.S. government, from an alleged statutory violation by a state agency in which he was found to have no private interest.

Not only is Spokeo’s interpretation of the law based on trying to fit an unrelated precedent to the current case, but it is also a misguided attempt to distinguish this case from past precedent granting standing in privacy suits for informational injuries. There are two notable examples:

1. In Havens Realty Corp. v. Coleman, two plaintiffs claimed alleged racial discrimination in violation of FHA, but the Court granted standing to only one of them who also made allegations of being provided untruthful information.
2. Similarly, in Pub. Citizen v. Dep't of Justice, the Court granted standing to a plaintiff who suffered an informational injury in the context of a statutory violation, namely failure to disclose under Freedom of Information Act.

Both of the above two cases turned on whether or not the violation deprived the plaintiffs of their statutory rights to receive truthful information in violation of the statute (and not merely the fact that there was a violation), and that itself was an injury sufficient to support standing.

Split in circuit courts overwhelmingly favors Robins

Furthermore, there is no court of appeals decision denying standing in an FCRA violation claim that would support Spokeo’s argument, a fact that was also stressed by the U.S. government in its amicus-curie brief in support of Robins. As discussed above, majority of U.S. circuit court decisions favor standing in such cases. And though the 4^th U.S. Circuit in David and 2^nd U.S. Circuit in Kendall denied standing in claims of statutory violations, neither of those claims involved either FCRA or the release of inaccurate personal information about the plaintiff; rather both were concerned with ERISA. They both held that an injury in fact may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing; their decisions merely reflect the conclusion that ERISA did not create a statutory right for the plaintiffs to sue without showing that they were injured. That, however, does not apply to Robins in this case, who was personally injured because of the publication of the inaccurate report about him.

Ruling for Robins is not inconsistent with Clapper decision

Finally, granting standing to Robins is not inconsistent with the standard most recently articulated by the Supreme Court in Clapper v. Amnesty Int'l USA. Clapper was a case involving the constitutionality of surveillance of non-U.S. citizens, in which the Court found that a speculative chain of possibilities is not sufficient to establish that an injury based on potential future surveillance is certainly impending. Unlike in Clapper, where the alleged harm from surveillance actually depended on the speculative action of an independent party to authorize such a surveillance, the alleged harm in the current case flows from the data about Robins that is already inaccurately reported by Spokeo, and hence the action that gave rise to the alleged harm is itself not speculative. The allegation of possible harm to Robins’ employment prospects, therefore, does meet the Clapper standard and is sufficient to demonstrate injury in fact.

Based on the foregoing analysis, an interpretation by the Court favoring Robins should control. The Court should:

1. Rule that a violation of statutory rights alone, without more, is not sufficient to meet Article III requirement, and to grant standing in privacy claims, and
2. narrowly allow standing for Robins in this case because he suffered a harm sufficient to meet the injury-in-fact requirement when his information was inaccurately reported by Spokeo.

Standing for such a claim when the statutory violations are accompanied by an injury that is sufficiently individualized and concrete to accord the plaintiff a personal stake in the outcome of the controversy reaffirms the principle laid out in Warth. Moreover, the idea that Robins was actually injured when Spokeo published false information about him is, according to the oral arguments in the case, consistent with the Court’s precedent that injury in fact is the breach of a legally-recognized right.

Such an approach would allow the Court to balance the interests at stake, particularly in cases involving informational injuries. It allows legally valid claims to be brought without forcing the Court to choose between opening the federal courts to frivolous but possibly massive class-action lawsuits and closing the courthouse doors to important privacy and civil rights lawsuits that are essential for strong policy reasons related to consumer protection. Prematurely foreclosing the possibility of standing for privacy plaintiffs who are injured by being deprived of a legally-protected right would remove the keystone of the FCRA and other privacy statutes – the ability of consumers to seek redress when a company fails to safeguard their personal information, which is precisely what Congress sought to avoid when it enacted the FCRA and other federal privacy laws. Moreover, the deterrent effect of class-action suits and federal privacy laws would help enforce federal privacy protections and force companies to enact better protections for consumer data.

In conclusion, as we await the Court’s forthcoming decision in this case – which is due any day now – we hope that the Court grants standing to Robins, thereby bringing down a major obstacle in the way of consumers to seek redress for violation of their legally protected rights. This high stakes privacy battle may be between one man and a data broker, but a victory for Robins will help turn the tide in the favor of all consumers.

Editor’s Note: A more detailed analysis on this issue is available here.

photo credit: David and Goliath via photopin (license)