Recent decisions by the Sixth, Eighth, Eleventh and District of Columbia Circuits interpreting Spokeo, Inc. v. Robins1 have led to early (seemingly) conflicting interpretations of whether a violation of a right created by Congress, without more, could be sufficient for Article III standing. Since this issue impacts so many areas of law, especially consumer protection-type minimum statutory damage class action lawsuits, many pending and new cases will be substantially impacted by the reach given to the holding in Spokeo by the lower courts.
Spokeo’s Emphasis on a Concrete Injury for Constitutional Standing
In Spokeo, the Supreme Court reiterated Article III’s injury-in-fact requirement, which demands that an injury be both particularized, i.e., “affect[ing] the plaintiff in a personal and individual way,” and concrete, meaning that it “actually exist[s].”2 The Court declined to address whether the plaintiff’s allegation that the defendant reported inaccurate information about him in violation of the Fair Credit Reporting Act (“FCRA”) stated a concrete injury and, instead remanded the case back to the Ninth Circuit.3 The Court acknowledged that the plaintiff’s statutory rights made his injury particularized, but stated that the Ninth Circuit failed to separately analyze whether the injury resulting from the violation of those rights was also concrete.4 In dicta, the Court explained that a concrete injury can be both tangible and intangible, but an allegation of a “bare procedural violation divorced from any concrete harm” is insufficient to establish standing.5 In determining whether an intangible harm constitutes injury in fact, the Court stated that “both history and the judgment of Congress play important roles.”6
Brewing Circuit Split?
Eleventh Circuit: In an unpublished decision dated July 6, 2016,7 the Eleventh Circuit, the first circuit to address standing after Spokeo, took an expansive view of what the Supreme Court meant when it said that Congress’ creation of a statutory right can be sufficient to confer standing. In Church v. Accretive Health, Inc., the plaintiff sued under the Fair Debt Collection Practices Act alleging that the defendant sent her a letter that omitted certain disclosures required by the statute.8 The plaintiff did not allege any actual damages from the defendant’s failure to include the required disclosures, but rather alleged that upon receiving the letter, she “was very angry” and “cried a lot.”9 Relying on Spokeo, the Eleventh Circuit held this was sufficient because Congress created a statutory right in the statute to receive the required disclosures, and the invasion of that right created an injury sufficient for standing.10 The Eleventh Circuit concluded that, since the statute provided plaintiff with “a substantive right to receive certain disclosures,” the violation of the statute was not merely a “bare procedural violation.”11
D.C. Circuit: A few days later on July 26, 2016, the D.C. Circuit – in a published decision – held just the opposite and took a more restrictive view of Spokeo by denying standing to plaintiffs who merely alleged a statutory violation without identifying any additional harm. In Hancock v. Urban Outfitters, Inc., the plaintiffs filed a putative class action alleging that the defendant violated D.C.’s Consumer Identification Information Act when it requested zip codes from the plaintiffs in connection with their credit card purchases.12 The plaintiffs argued that they had standing to sue simply by virtue of the defendant’s violation of a statutorily conferred right.13 Relying on Spokeo, the D.C. Circuit rejected this argument, finding that the plaintiffs must allege concrete injury stemming from the statutory violations.14 The D.C. Circuit concluded that the plaintiff’s “naked assertion that a zip code was requested and recorded” without any concrete consequence was not sufficient to satisfy Article III’s injury-in-fact requirement.15
Eighth Circuit: On September 8, 2016, the Eighth Circuit – in another published decision – followed the D.C. Circuit’s approach and concluded that the plaintiff’s assertion of “a bare procedural violation, divorced from any concrete harm” was insufficient to establish Article III standing.16 In Braitberg v. Charter Communications, Inc., the plaintiff filed a putative class action alleging that the defendant retained his personally identifiable information in violation of the Cable Communications Policy Act.17 He claimed that the defendant’s failure to destroy his information injured him by invading his federally protected privacy rights and by depriving him of the full value of the services he purchased from the defendant.18 The Eighth Circuit found both these allegations of injury to be insufficient. With respect to the purported invasion of his federally protected privacy rights, the Eighth Circuit noted that the plaintiff did not identify any material risk of harm from the defendant’s retention of his personal information and did not allege that the defendant had disclosed the information to a third party, or that it had used the information in any way.19 Nor was the Eighth Circuit convinced that the plaintiff was deprived of the full value of the defendant’s services since the plaintiff failed to allege that the defendant’s retention of his information caused any concrete harm to the value of that information.20
Sixth Circuit: And on September 12, 2016, the Sixth Circuit – in an unpublished decision – held that allegations of a substantial risk of harm, coupled with reasonably incurred mitigation costs, are sufficient to establish a cognizable Article III injury at the pleading stage.21 In Galaria v. Nationwide Mutual Ins. Co., the plaintiffs filed a putative class action alleging claims for invasion of privacy, negligence, bailment, and violations of the FCRA after hackers breached the defendant’s computer network and stole the plaintiffs’ personal information.22 Relying on Spokeo and the Supreme Court’s decision in Clapper v. Amnesty Int’l,23 the Sixth Circuit reversed the district court’s holding that the plaintiffs lacked Article III standing, finding instead that the plaintiffs had alleged a cognizable injury because the theft of their personal data placed them at a continuing, increased risk of fraud and identity theft.24 The Sixth Circuit held that the plaintiffs had suffered a concrete injury sufficient to satisfy Article III standing because “a reasonable inference can be drawn that the hackers will use the victims’ data for the fraudulent purposes” alleged in the complaint and plaintiffs must now expend time and money to monitor their credit, check their bank statements, and modify their financial accounts.25
The circuits’ rulings to date have led to divergent applications of Spokeo. Given Spokeo’s widespread potential impact on litigation throughout the federal courts, companies should pay close attention to the new decisions coming down almost daily as they can have a potentially outcome determinative effect on existing and new cases. With the circuits already coming to some differing views on how to interpret Spokeo, it should be no surprise if additional circuit rulings come out inconsistently, leading to another effort to get the Supreme Court to clarify this important standing requirement once and for all.
This alert was originally published as a Law360 Expert Analysis article on September 15, 2016.