Just as the industrial age generated air and water pollution that could harm people and property, so the Internet age generates data whose misuse may cause harm. And just as Congress passed laws enabling individual citizens to enforce environmental laws on behalf of themselves and others, Congress has also passed laws empowering people to bring lawsuits in federal courts against companies that cause privacy harms.
In each case, however, courts must ask themselves if the lawsuit before them involves an actual “case or controversy” triggering the judiciary’s constitutional authority under Article III of the U.S. Constitution. For U.S. courts cannot hear every case filed, but only ones in which the party bringing the lawsuit has suffered an injury that the courts can redress. Even a federal statute passed by Congress creating a private right of action may not always be sufficient for courts to hear a case; sometimes the party bringing the lawsuit must still demonstrate they personally have suffered harm as a result of the defendant’s actions.
The Spokeo, Inc. v. Robins case involves the Fair Credit Reporting Act and the duties it imposes on private companies engaged in credit reporting to maintain accurate records of the people whose reports they generate. In that regard, it is a privacy case. At its core, however, the Supreme Court’s decision on May 16 is quite simply another in a long string of constitutional law cases establishing the metes and bounds of the federal judiciary’s authority.
Background
Congress enacted the FCRA in 1980 “to prevent consumers from being unjustly damaged because of inaccurate or arbitrary information in a credit report” and “to prevent an undue invasion of the individual’s right to privacy in the collection and dissemination of credit information.” The FCRA imposes several duties on consumer reporting agencies to ensure consumer reports are fair and equitable to consumers, such as requirements regarding the confidentiality, accuracy, relevancy and proper utilization of consumer report information. Among other duties, CRAs are required to follow “reasonable procedures to assure the maximum possible accuracy of the information concerning the individual about whom the report relates.” Consumers about whom reports are generated are entitled to be notified of the CRA’s statutory obligations, as well as free annual copies of their reports.
Under the FCRA, a consumer may bring a cause of action against a CRA who negligently or willfully violates any requirement imposed under the FCRA with respect to that consumer. For willful violations, a consumer may be entitled to actual damages or statutory damages, as well as punitive damages.
Spokeo operates a “people search engine” that, in response to a user’s query, gathers information from a variety of databases to provide information about a person. The types of information reported include the individual’s address, phone number, marital status, occupation, finances, and approximate age, as well as hobbies, shopping habits, and musical preferences. Thomas Robins was the subject of a Spokeo query that, he alleges, resulted in dissemination of inaccurate information about him. In particular, Robins claims that his Spokeo-generated profile states — falsely — that he is “married, has children, is in his 50s, has a job, is relatively affluent, and holds a graduate degree.”
Robins filed a putative class-action complaint in federal court alleging that Spokeo is a CRA under the FCRA; Spokeo’s website displayed a consumer report about him that was inaccurate; and the erroneous report about Robins was disseminated when he was “out of work and seeking employment, causing both past and continuing actual harm to his employment prospects,” as well as monetary and emotional injury.
Procedural History
Spokeo moved to dismiss Robins’ case on the basis that Robins lacked standing to bring a claim under Article III of the U.S. Constitution. In the U.S., the judiciary’s power is limited to “cases and controversies of the sort traditionally amendable to, and resolved by, the judicial process.” Limitations on judicial powers prevents courts from getting entangled in disputes that are primarily political in nature and directs them instead to cases where a private party seeks to enforce personal rights against another private party.
In this case, Spokeo argued that the FCRA creates duties that Spokeo owes to everyone — not just Robins — and that Robins could not therefore bring a lawsuit on behalf of everyone unless he was personally injured. The mere existence of a federal law requiring Spokeo to follow certain procedures did not, in and of itself, provide adequate basis for Robins to sue Spokeo in federal court.
The district court agreed with Spokeo and dismissed Robins’ case, holding a mere violation of FCRA did not confer Article III standing “where no injury in fact is properly pled,” and that the alleged harm to Robins' employment prospects was “too speculative, attenuated and implausible” to meet constitutional standing requirements.
The U.S. Court of Appeals for the 9th Circuit disagreed and reversed. It framed the question as whether Robins had standing to sue Spokeo under the FCRA for publishing inaccurate information about Robins, and noted that Congress had created a private cause of action to enforce the FCRA’s accuracy requirements against CRAs. The 9th Circuit held that Congress was empowered to create a legally cognizable injury and that violation of the statute alone was “a sufficient injury in fact to confer standing.”
Spokeo appealed and the U.S. Supreme Court agreed to hear the case. Several amici filed briefs with the Court, including attorneys for big data companies like Google and eBay (urging the Court to reverse) as well as attorneys for the Consumer Financial Protection Bureau and the Department of Justice (whose brief encouraged the Court to affirm the 9th Circuit).
U.S. Supreme Court opinion
In its petition for certiorari, Spokeo framed the issue as one of Congress’s power to “confer Article III standing upon a plaintiff who suffers no concrete harm … by authorizing a private right of action based on a bare violation of a federal statute.”
In the 6-2 opinion reversing the 9th Circuit, authored by Justice Alito, the Court approached the issue from the perspective of constitutional limitations on the judiciary’s powers, rather than focusing on Congress. It noted that courts do not have standing to consider a case unless the plaintiff has suffered an “injury in fact” as demonstrated with facts clearly alleged in the plaintiff’s complaint. More precisely, the plaintiff must show that he suffered “an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical.”
Here, the Supreme Court held, the 9th Circuit found that Robins had suffered a “particularlized” injury because he alleged Spokeo violated his personal statutory rights under the FCRA, and not just those of other people. But the 9th Circuit failed to find that Robins’ injury was concrete as well.
The Supreme Court acknowledged that Congress has the ability in passing laws to define injuries “that will give rise to a case or controversy where none existed before.” This allows Congress to create causes of action for privacy harms that perhaps previously existed only in common law, or were not well acknowledged at all. But, SCOTUS held, an act of Congress identifying and elevating intangible harms by creating a statutory right and cause of action is not necessarily enough: “Article III standing requires a concrete injury even in the context of a statutory violation.”
While noting that in some cases a plaintiff need not allege additional harm beyond the one Congress identified, here the Supreme Court found violations of the FCRA’s procedural requirements alone were not sufficient to confer standing. Indeed, the court noted: “A violation of one of the FCRA’s procedural requirements may result in no harm.” As an example, SCOTUS cited a CRA’s failure to give a consumer the required notice as potentially involving no harm. Even inaccuracies in the CRA’s consumer report may not “cause harm or present any material risk of harm” to the consumer. The Supreme Court explicitly stated that dissemination of an inaccurate ZIP code alone would not produce a cognizable, concrete injury.
In order for Robins’ case to proceed, therefore, the 9th Circuit must on remand apply the facts alleged in Robins' complaint to the “concreteness” prong of the “injury in fact” standing element. The Supreme Court emphasized, however, that “concrete” injury may be intangible, but it must be “real and not abstract.” In his concurring opinion, Justice Thomas illustrated how in the violation of some “private rights” courts have presumed injury, citing as an example a violation of “personal security (including security of reputation).”
Were it up to the dissent, authored by Justice Ginsburg and joined by Justice Sotomayor, the remand would be unnecessary. The dissent would skip the step of remand and turn directly to Robins’ allegations which, they wrote, demonstrate that Spokeo’s misinformation about Robins “could affect his fortune in the job market” and reflect precisely the harm the FCRA’s procedural requirements aimed to prevent.
Conclusion
Merely pleading that a CRA uses inaccurate information in generating reports is not enough to establish injury and therefore have standing to sue under the FCRA in federal court. A plaintiff must show how the inaccuracies create harm in personal or professional life. Put differently, the Court in Spokeo does not find that Congress has created a completely cognizable injury merely by requiring CRAs to follow a variety of procedures including notice to consumers and opportunities to correct inaccuracies. Plaintiffs’ attorneys are now obliged to “clearly allege facts demonstrating” how parties are harmed by FCRA violations, and courts must find not only that plaintiffs were personally affected, but as well that they suffered “concrete” harm.