Spokeo Makes Privacy Class Action Plaintiffs Swim with “Concrete” Shoes

Share |

Article III of the U.S. Constitution gives the federal courts jurisdiction over “cases or controversies.” In plain English, courts are only supposed to decide real fights between adverse interests—if they don’t, they are setting policy (which is the legislative branch’s job).  The presence of such a genuine dispute is called “standing,” and it has three parts.  The plaintiff has to (1) have suffered an injury-in-fact; (2) that is fairly traceable to the defendant; and (3) that is likely to be redressed by a court decision in the plaintiff’s favor. 

The injury-in-fact requirement is particularly important in certain kinds of class action suits.   For example, the Fair Credit Reporting Act imposes a series of obligations on “consumer reporting agencies”—essentially, credit bureaus, background screeners, and others who sell information about consumers for purposes like credit, employment or insurance decisions.  The law requires consumer reporting agencies to post 1-800 numbers, to have reasonable procedures in place to ensure the “maximum possible accuracy” of consumer information, and to comply with a variety of notice requirements.  Willful violation of the law carries with it a price tag of between $100 and $1000 per consumer affected, making a “bare violation” of the statute potentially ruinous for defendants.

Enterprising members of the plaintiffs’ bar have brought class actions under federal statutes like the Fair Credit Reporting Act (FCRA) based on nothing more than a bare violation of the statute, such as not having a 1-800-number.  Spokeo involved such claims against what the Court called a “people search engine.”  The information that Spokeo had culled from public sources made the plaintiff out to be better off than he actually was, stating that he was married with a graduate degree, wealthy, and had children—none of which was accurate.  Robins sued Spokeo for violating the FCRA, claiming that its procedures to ensure accuracy did not meet the statutory standard, failing to send out statutorily required notices, and failing to have a toll-free number. 

When confronted with class actions under those kinds of statutes, some courts of appeals (including the Ninth Circuit) had held that if an individual complains that his rights under the statute have been violated, then standing existed as a matter of law.  For example, in this case, the Ninth Circuit had found that because the plaintiff alleged that Spokeo had violated his statutory rights standing (specifically, injury-in-fact) existed.

The Difference Between Concrete and Particularized

Six of the eight sitting Supreme Court justices rejected that approach to standing questions and sent the case back to the Ninth Circuit for further consideration.  In order for an injury-in-fact to exist, the Court explained, the plaintiff must have suffered a “concrete” and “particularized” injury.  The error that the Ninth Circuit made was that it collapsed those two requirements together, and they mean different things.  The Supreme Court accepted that the complaint alleged “particularized” injury with respect to the plaintiff’s particular statutory rights.

A “concrete” injury, the Court emphasized, is a different animal.  In determining whether or not an alleged FCRA-based harm is sufficiently “concrete,” the Spokeo majority instructed the court of appeals to examine the relationship of the alleged intangible harm to harm that has been historically recognized at common law.  Under this analysis, bare procedural violations (such as failing to have a 1-800 number) cannot cause harm in the absence of some other injury.  Moreover, the Court noted, not all inaccuracies are actionable—bad zip codes by themselves do not give rise to FCRA liability.  It instructed the court of appeals to re-examine its decision in light of these principles.

Spokeo’s Implications Reach Well Beyond FCRA Litigation

Although these issues arise in an FCRA case, Article III applies to all cases in federal courts, and a number of class actions have been brought alleging “bare” violations of different statutes.    Spokeo affects all of these cases.

For example, SIIA just filed an amicus in support of rehearing in Yershov v. Gannett, a Video Protection Privacy Act class action arising out of the plaintiff’s use of the advertising-supported free USA Today mobile app.  (Yershov was, ironically enough, filed by the same firm that brought the Spokeo litigation). In Yershov, the plaintiff alleged that Gannett received his anonymous Android ID, a GPS location, and the name of the video he watched on USA Today.  That information was passed on to an analytics firm, where Yershov alleges it could be combined with other information to identify him without his consent.  That possibility could cost Gannett $2500 per app download. 

Under Spokeo, there now exists a strong argument that standing does not exist, and the brief (filed the same day as the issuance of the Spokeo opinion) urges the en banc panel to examine jurisdictional questions.  The VPPA was passed because a video rental store leaked Judge Bork’s viewing list to the media during his confirmation hearings—a classic example of a privacy violation.  In Yershov, in contrast, there is no evidence that his identity was tied to a particular video transaction, no “private fact” has been revealed, and no common law liability would lie.  As a result, a concrete injury seems to be lacking.   Spokeo has given Yershov (and other similar class action plaintiffs) concrete shoes with which they will now have to swim. 



Christopher Christopher Mohr is General Counsel and VP, Intellectual Property Policy & Enforcement at SIIA.