A month after the Supreme Court’s much-anticipated decision in Spokeo, Inc. v. Robins, the aftershocks of the ruling have already rumbled through numerous district and appellate courts. As we previously discussed, the Supreme Court held in Spokeo that a plaintiff must show both particularized and concrete injury to establish standing under Article III. In so holding, the Court made clear that a concrete injury must be “real” and not merely “abstract,” and that a “bare procedural violation” of a statute would not suffice.
Some courts have already applied Spokeo to dismiss claims lacking sufficient allegations of concrete injury under the Supreme Court’s rationale. In Gubala v. Time Warner Cable, Inc., for example, where the plaintiff claimed that the defendant retained customers’ personal information in violation of the Cable Communications Policy Act, the Eastern District of Wisconsin invoked Spokeo to dismiss the plaintiff’s claims for lack of Article III standing. The court noted that the plaintiff had not alleged “disclos[ure of] his information to a third party,” or that he had been “contacted by marketers who obtained his information from the defendant, or that he ha[d] been the victim of fraud or identity theft.” Thus, “[g]iven the clear directive in Spokeo,” the court found that the complaint must be dismissed for failure to allege a concrete harm.
Other courts, including the Third Circuit in In re Nickelodeon Consumer Privacy Litigation, have rejected defendants’ attempts to invoke Spokeo as a tool of dismissal. In Nickelodeon, the court found that the plaintiffs, a group of children, had standing to bring claims against Viacom for Viacom’s collection (and disclosure to Google) of the children’s personal identifying information, along with information regarding which webpages they visited and what videos they watched. The court rejected the defendants’ challenge to the plaintiffs’ Article III standing under Spokeo, holding that the children had adequately pled concrete injury in the form of “the unlawful disclosure . . . of information that, in Congress’s judgment, ought to remain private.”
Just yesterday, Facebook told the Northern District of California that Spokeo requires dismissal of a putative class action alleging that Facebook’s facial-recognition and tagging features violate Illinois’ Biometric Information Privacy Act because, as Facebook argued, the plaintiffs have alleged only “bare violations” of the statute. The outcome of that case is yet to be seen.