The Eighth Circuit recently became the one of the first federal Courts of Appeals to apply the U.S. Supreme Court’s Article III standing decision in Spokeo Inc. v. Robins to a data privacy case. The Eighth Circuit affirmed the dismissal of a putative class action complaint on the basis that the plaintiff failed to allege a concrete injury that “actually exist[s],” is “real,” and is not “abstract.” [1] The lawsuit alleged that Charter Communications, Inc. (“Charter”), a company providing cable services, retained the personally identifiable information (“PII”) of its former customers well after the customers’ cancellation of their services. Because the plaintiff asserted only a technical violation of the statute, without alleging how that violation had actually injured him, the Eighth Circuit found that, under Spokeo, the plaintiff failed to plead a concrete and particularized injury sufficient to establish standing to file suit in federal court. [2]

Standing to Bring Suit in Federal Court

Standing under Article III of the U.S. Constitution is a prerequisite to maintaining suit in federal court. [3] To establish standing, a plaintiff must have an injury that is “concrete, particularized, and actual or imminent,” “fairly traceable to the challenged action,” and “redressable by a favorable ruling.” [4] In Spokeo, the Supreme Court explained that Article III “requires a concrete injury even in the context of a statutory violation,” and that the injury must not be abstract. [5] Although the violation of a statute in some circumstances can be sufficient to constitute an injury-in-fact, a plaintiff cannot “allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III.” [6]

Standing in Place

In Braitberg v. Charter Communications, Inc., the plaintiff alleged that Charter’s storage of his PII, including his address, telephone number, and social security number, long after the date he terminated his cable contract, violated the Cable Communications Policy Act, 47 U.S.C. § 551(e) (the “Cable Act”). [7] The Cable Act states that a “cable operator shall destroy personally identifiable information if the information is no longer necessary for the purpose for which it was collected and there are no pending requests or orders for access to such information.” [8] Braitberg alleged that Charter’s uniform policy of indefinitely retaining customers’ PII after such information was no longer needed to provide services, collect payments, or satisfy tax, accounting, or other legal obligations, violated his rights, and those of a putative class of Charter’s customers, causing injury (1) through the invasion of the customers’ “federally protected privacy rights,” and (2) by depriving customers of the “full value of the services they purchased from Charter.” [9]

Charter successfully moved to dismiss on, among other bases, that Braitberg lacked standing to sue. [10] On appeal, Braitberg argued that “a violation of a statutory right constitutes an injury in fact that is sufficient by itself to establish standing under Article III [of the Constitution]” and that he need not allege or show any “actual injury” caused by Charter’s retention of his PII. [11] While acknowledging that prior decisions of the Court supported Braitberg’s position, in an opinion issued on September 8, 2016, the Eighth Circuit made clear that under the Supreme Court’s ruling in Spokeo, Braitberg did not have standing to sue for a bare procedural violation of a statute in the absence of a concrete, non-speculative, injury-in-fact. [12]

The Eighth Circuit highlighted the Supreme Court’s identification of scenarios where a statutory violation does not give rise to a concrete injury because there is no real harm or material risk of harm. These scenarios included, in the context of violation of the Fair Credit Reporting Act (the statute at issue in Spokeo), (1) a credit agency’s failure to provide a requisite notice to a user where the agency’s report is otherwise completely accurate, or (2) the issuance of a credit report with minor inaccuracies such as an incorrect zip code. [13] In both instances, those procedural violations, by themselves, would be insufficient to establish standing because there is no concrete harm caused by the statutory violations. [14]

Relying on Spokeo, the Eighth Circuit concluded that whatever statutory violation may have occurred under the Cable Act, Braitberg failed to establish standing to sue because his complaint did not allege an injury-in-fact. [15] Rather, Braitberg only asserted that Charter violated a duty to destroy PII by retaining information longer than it should have. Braitberg did not allege that Charter disclosed his PII to a third party, that a third party accessed his PII, or that Charter used his PII in any way during the period in question. [16] Likewise, the Eighth Circuit concluded that Braitberg did not identify a material risk of harm from the retention of the PII, and noted that “a speculative or hypothetical risk is insufficient.” [17] The Eighth Circuit also found Braitberg’s purported economic injuries, allegedly the diminution in the value of the services he purchased from Charter, were insufficient to establish standing. In short, Braitberg failed to allege that the company’s retention of the PII “caused any concrete and particularized harm to the value of that information.” [18]

The Eighth Circuit’s decision is a positive development for companies facing privacy and data security litigation. To the extent a plaintiff’s claim is predicated on a technical or “bare procedural” violation of a statutory obligation alone, courts following the reasoning of Spokeo and Braitberg will require plaintiffs to allege actual, cognizable harm arising from an alleged data security issue in order to establish legal standing to bring a lawsuit.