Yesterday, in a case that has already spanned five years, the U.S. Supreme Court ruled in favor of data broker Spokeo, overturning a lower court’s ruling by a 6-2 vote. The case has generated attention because of its potential to shift the balance one way or another in privacy cases, specifically those in which plaintiffs allege they've been "harmed" by a company's data protection practices (or lack thereof).
There is some debate, however, as to whether the ruling is actually "in favor" of Spokeo at all.
The Spokeo case in significant because plaintiffs have thus far struggled in many cases to reach the harm threshold, though lower courts have come down with varying rulings. In some cases, courts have ruled that a mere violation of a legal statute is enough to prove "injury-in-fact" and allow a case to proceed, others have said that's not enough.
Essentially: At tension here is that the U.S. Constitution says individuals have a right to sue if they've suffered a concrete injury as a result of someone else's actions, whereas the law under which the plaintiff is suing says consumers have the right to sue simply if their statutory rights are violated, i.e., if a company breaks the rules. And that's where the Spokeo case and ones like it get tricky. Some say the court's Monday ruling is a total win for defendants in cases like this, while others say the ruling has no impact whatsoever on the future of privacy litigation.
Quick background
The plaintiff in this case, Thomas Robins, alleged he’d suffered harm when Spokeo reported false information about him, a violation of the Fair Credit Reporting Act. Robins said Spokeo's profile of him claimed he had a graduate degree, was employed in a technical or professional field, was in his 50s and had children. None of those things were true. Further, the photo included in Spokeo's report was of someone other than Robins.
Robins initially made the claim that such inaccuracies affected him because companies doing background checks could see the profile and make decisions based on false information, potentially affecting his credit, employment or insurance. The operative word being "could." Spokeo said there wasn't actual harm, so Robins didn't have a case.
The 9th Circuit Court said Spokeo's violation of statutory rights was enough for Robins to meet the "injury-in-fact" threshold and therefore, Robins had standing to sue.
But the Supreme Court said the 9th Circuit's analysis in determining injury-in-fact was incomplete. There are three prongs to the injury-in-fact claim that the plaintiff must meet to prove harm: the plaintiff has to have suffered "an invasion of a legally protected interest" that is "concrete and particularized" and "actual or imminent, nor conjectural or hypothetical."
The ruling
In the court's opinion, Justice Samuel Alito said the 9th Circuit "failed to fully appreciate the distinction between concreteness and particularization," and therefore "its standing analysis was incomplete."
However, the court did not take a position on whether the 9th Circuit's "ultimate conclusion -- that Robins adequately alleged an injury in fact -- was correct."
And that's why Robins's lead counsel, Jay Edelson, says the ruling doesn't worry him. Initially the ruling was seen by some as a win for Spokeo, but Edelson doesn't see it that way. While Spokeo might have gotten a "minor procedural win" in which the Supreme Court asked the 9th Circuit to "show its work," it's not the Spokeo win some may have thought.
"This is a 90 percent win for consumers and privacy advocates," he said. "Spokeo was trying to fundamentally change the law on standing. Specifically, they asked the court to adopt what they called a 'real-world injury' test -- i.e., there must be some tangible harm before a person can bring suit. This test posed an existential threat to many privacy cases, because generally privacy harms aren't tangible. The court rejected that test. Indeed, not a single justice endorsed it. Instead, the court explained that tangible and intangible harms count. It went even further and said that future harms can count, too, so long as there is a material risk of something negative happening in the future."
Because of that, the ruling doesn't have him worried about the ruling's impact "on the Spokeo case or on privacy cases more generally," he said.
The ruling really isn't a game-changer for privacy and data-security class actions, said attorney Jeff Kosseff, CIPP/US, of the United States Naval Academy. The court "merely sent the case back to the 9th Circuit with instructions to more thoroughly apply the standing analysis that the court had already articulated in previous opinions," so, no big deal. But his enthusiasm is more tempered than Edelson's.
"It's not a complete disaster for consumers, but it's definitely not a 90 percent win," he said.
Attorney Timothy Yim, CIPP/US, CIPP/E, CIPM, CIPT, of Start Up Policy Lab, thinks the ruling opens the door for consumers and privacy advocates in the future.
"The court has expressly left open the possibility that the risk of real harm from inaccurate privacy disclosures can meet the concrete injury requirements necessary for standing," he said. "It is highly likely that's exactly what the 9th Circuit will find."
Kirk Nahra, CIPP/US, of Wiley Rein, says the decision is "essentially hitting the pause button on the injury element of standing," and said while it's no big win for the plaintiff's bar, they'll still push this issue aggressively. He thinks the ruling pushes things a bit in the defense bar's favor.
That's surely welcome news to defense attorney Dominique Shelton of Alston & Bird.
She said the ruling affirms that "just because a statute has statutory damages available does not mean there's a de-facto or concrete injury-in-fact that's been established," she said. "That's still a component that needs to be addressed."
While there's some discrimination on the issue of concreteness, concreteness and injury-in-fact can't be too speculative, she said. "I think here the message is: In the privacy realm, the court needs to be able to establish that a party has actually suffered harm. On the defense side, this is an encouraging decision because it allows a sort of continued growth of digital technologies, advertising analytics and technologies that were not envisioned by many statutes at play on the privacy side."
Rather than fear plaintiff's actions as a result, perhaps the ruling encourages a future in which tech companies can continue to innovate without fear of plaintiffs like in Spokeo.
"Plaintiffs have been focusing on particularized injury, as in Spokeo originally," she said. "It seems pretty clear that more needs to be done to establish Article III standing. Not just particularized injury but a concrete one that is imminent and not so far off that it's too hard to quantify," she said.
Whether Edelson is right and this case works in plaintiffs' favor or Shelton is right and this is a win for defense bar remains to be seen. But one thing's for sure.
"I don't think it's over from here, "Shelton said, adding she'll be watching the 9th Circuit closely for what it does on remand.
Edelson thinks it's more over than that.
"Spokeo itself essentially concedes it will lose in the 9th," he said, adding the company was looking for a substantive win.
"That didn't happen," he said.
Photo credit: Nobody Knows What Lies Ahead via photopin (license)