The Supreme Court yesterday provided some instruction as to whether statutory violations alone could confer Article III standing. The Court, in a 6-2 decision in Spokeo v. Robins, vacated the Ninth Circuit’s ruling in favor of Thomas Robins, who had brought a claim that incorrect information about him in Spokeo’s online people-search database was a violation of the Fair Credit Reporting Act (“FCRA”). The district court dismissed Robins’ complaint for failure to allege “any actual or imminent harm,” but the Ninth Circuit determined that Robins’ alleged violations of statutory rights under the FCRA were enough to satisfy the “injury-in-fact” requirement to grant standing.
The Supreme Court disagreed. Writing for the majority, Justice Alito explained that under Article III’s “injury-in-fact” requirement, a plaintiff must allege a harm that is both concrete and particularized. The Court held that the Ninth Circuit had addressed only the particularization requirement. In what will likely be the key takeaway of the opinion, the Court analyzed what may constitute a sufficiently concrete harm where statutory violations are concerned.
First, the Court explained that “concrete” harms need not always be “tangible” harms. Second, to determine whether an intangible harm may constitute an injury-in-fact, “both history and the judgment of Congress play important roles.” The Court cited as examples of intangible harms both reputational harms addressed by common law torts and other actions involving voters’ “inability to obtain information” as an injury sufficiently concrete to confer standing. However, the opinion provides few definitive rules as to what other types of intangible injuries may gave rise to sufficiently concrete harms.
Importantly, the Court held that a plaintiff cannot automatically satisfy “the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” In short, Robin’s allegation of “a bare procedural violation, divorced from any concrete harm” was insufficient to meet the concreteness requirement.
This is significant because much existing privacy litigation focuses on statutory violations to establish harm. Many federal privacy statutes provide private rights of action coupled with the ability to obtain statutory damages. In addition to the Fair Credit Reporting Act here, privacy class actions frequently rest on claims of basic violations of privacy laws ranging from the Electronic Communications Privacy Act and Stored Communications Act to the Telephone Consumer Protection Act and Video Privacy Protection Act (“VPPA”). Claims may also be brought under similar state laws. These federal statutes were passed decades ago to address very specific privacy intrusions and have been stretched to capture modern methods of collecting and using digital data. For example, the VPPA was written to establish rules around the disclosure of video rental history and is now frequently used in actions involving online streaming video that are far outside the context of the statute’s original purpose.
In Spokeo, the Court explained that “[a] violation of one of the FCRA’s procedural requirements may result in no harm,” either because no false information was disseminated or because “not all inaccuracies cause harm or present any material risk of harm.” Ultimately, the Court did not actually evaluate whether Robins’ had alleged a sufficiently concrete injury stemming from violations of the FCRA. Instead, that task has been left to the Ninth Circuit on remand, and the Supreme Court made clear that it took “no position as to whether the Ninth Circuit’s ultimate conclusion—that Robins adequately alleged an injury in fact—was correct.”
As litigants consider the impact of Spokeo going forward, it is important to remember the class action context in which the case arises (and which is often at issue in privacy actions). Plaintiffs are often incentivized to seek statutory damages for bare procedural violations involving large classes because the lack of individualized harm makes class certification easier. After Spokeo, such plaintiffs will have to allege additional facts beyond a procedural violation in many cases. Defendants may, therefore, have significant new opportunities to challenge class standing or to narrow class definitions and sizes based at the initial stages of litigation and at the class certification stage.
