On April 27, 2015, the United States Supreme Court granted certiorari in Spokeo v. Robins and will soon decide whether a plaintiff must allege more than just the bare violation of a federal statute in order to invoke Article III jurisdiction. Some of Silicon Valley’s top companies have observed in a brief to the Court in support of cert. that if the Ninth Circuit’s ruling stands, “plaintiffs may pursue suits against [companies] even where they are not actually harmed by an alleged statutory violation.” While single-plaintiff lawsuits are problematic, the real problem arises when these types of cases are brought as class actions, seeking “billions” in statutory damages creating an “immense pressure to settle” even the cases that may be “baseless on the merits.” Silicon Valley companies are monitoring this case carefully because of the impact it will have on data breach and privacy-related class actions, which are often brought by plaintiffs alleging violations of federal statutes that are enforced through statutory damages. It is not an understatement to say that the Supreme Court’s decision could radically change the landscape for these types of class actions for years to come. Put simply, if the Supreme Court does not reverse the Ninth Circuit, it is likely that there will be a significant increase in the volume of data breach and other privacy-related lawsuits filed in moving forward. Conversely, if the Ninth Circuit is affirmed then the volume of privacy class action lawsuits may decline. If the Supreme Court’s decision in Clapper v. Amnesty International USA, 133 S.Ct. 1138 (2013) is any indication, then the latter may be true.
- The Underlying Litigation
In the underlying lawsuit, Thomas Robins brought a class action lawsuit against Spokeo for allegedly violating the Fair Credit Reporting Act (“FCRA”), 15 U.S.C § 1681. Specifically, Mr. Robins alleged that Spokeo, a website “that provides users with information about other individuals, including contact data, marital status, age, occupation, economic health, and wealth level,” generates reports containing “inaccurate consumer information that is marketed to entities performing background checks.” Mr. Robins alleged that, as a result of Spokeo’s FCRA violations, he was “concerned that his ability to obtain credit, employment, insurance and the like will be adversely affected.” Notably, Mr. Robins did not allege that, at the time of the filing of the lawsuit, he had been denied credit, a job, or insurance because of the alleged inaccurate information. Spokeo moved to dismiss based on Mr. Robins lack of standing to sue, among other reasons.
In federal court, a plaintiff must have Article III standing to sue, which requires a showing that he or she has suffered an “injury in fact” that is “fairly traceable” to the defendant’s conduct at issue. The injury must also be “concrete and particularized,” meaning no hypotheticals, or what ifs. Importantly, because Article III standing is constitutional, “[i]t is settled that Congress cannot erase Article III’s standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.” Raines v. Byrd, 521 U.S. 811, 820 n. 3 (1997).
Mr. Robins argued that he met the requirements of standing simply by alleging that Spokeo is in violation of the FCRA, which grants individuals a private right of action to sue for statutory damages without any proof of injury. 15 U.S.C. § 1681n(a). The district court disagreed, ruling that Mr. Robins did not have standing to sue because his “concern that he will be adversely affected by [Spokeo’s] website in the future, is an insufficient injury to confer standing” (emphasis in original).
The Ninth Circuit reversed. The Ninth Circuit ruled that Mr. Robins did have standing to sue because (1) the “violation of a statutory right is usually a sufficient injury in fact to confer standing”, and (2) the FCRA does not require a showing of actual harm when a plaintiff sues for statutory damages in certain circumstances. Spokeo subsequently petitioned the Supreme Court for cert. on the standing issues, and, on April 27, 2015, Spokeo’s request was granted.
- The Issue
In Spokeo, the Supreme Court will decide “[w]hether Congress may confer Article III standing upon a plaintiff who suffers no concrete harm, and who therefore could not otherwise invoke the jurisdiction of federal court, by authorizing a private right of action based on a bare violation of a federal statute.” In other words, can Congress authorize an individual to sue by alleging that a company violated a federal statute without also alleging that he or she has actually suffered any injury? This question affects not only cases brought under the FCRA, but other privacy-related cases as well, which are often brought under statutes passed by Congress authorizing statutory damages without requiring a plaintiff to demonstrate harm, such as the Telephone Consumer Protection Act, 47 U.S.C. § 227 et seq. and Electronic Communications Privacy Act, 18 U.S.C. § 2510, et seq.
- What Is The Likely Outcome?
To support his position that he does have standing to sue, Robins cited Warth v. Seldin, a 1975 Supreme Court decision which states: “The actual or threatened injury required by Art. III may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing.” Interestingly, the Ninth Circuit quoted the above portion of Warth in its opinion holding that Robins did have Article III standing, despite the fact that six sentences later, Warth states: “Of course, Art. III’s requirement remains: the plaintiff still must allege a distinct and palpable injury to himself….” Given that one of the opening lines in the Ninth Circuit’s opinion was “Robins’s allegations of injury were sparse”, the above-quoted portion of Warth – puzzlingly absent from the Ninth Circuit opinion – may not bode well for Robins’ chances before the Supreme Court.
Additionally, an important footnote on the final page of the Ninth Circuit opinion states: “Because we determine that Robins has standing by virtue of the alleged violations of his statutory rights, we do not decide whether harm to his employment prospects or related anxiety could be sufficient injuries in fact.” Given that Warth states a plaintiff must allege a “distinct and palpable injury to himself,” this case will most likely ultimately hinge on the Supreme Court’s 2013 defendant-friendly Clapper v. Amnesty International USA decision. In Clapper, a case that is virtually always cited by defendants in motions to dismiss data breach and privacy-related lawsuits, the Supreme Court held that mere concern or fear of future harm cannot manufacture standing. Under Clapper, Mr. Robins’ alleged future harm to his employment prospects and related anxiety – similar to plaintiffs’ fear that they could be harmed by a bad actor who may utilize their financial information post-data breach – will likely not suffice to confer standing.
Whether the Supreme Court decides the case along the lines of previous opinions like Warth and Clapper or decides to go a different direction, Spokeo will most certainly be one of the most closely watched cases in Silicon Valley.