The United States Supreme Court recently issued its opinion in a case known as Spokeo v. Robins, _U.S._, 136 S.Ct. 1540 (2016), holding that a website operator's alleged violations of the Fair Credit Reporting Act of 1970 ("FCRA") did not, absent demonstrating "actual harm," provide a basis for a party to sue the operator. The FCRA requires consumer reporting agencies to follow reasonable procedures to assure maximum accuracy of consumer reports and imposes liability on any person who willfully fails to comply with any requirement of the Act, which Spokeo, Inc. ("Spokeo") was alleged to have violated.
Spokeo operates a "people search engine." If someone visits the Web site and inputs a person's name, a phone number, or an e-mail address, Spokeo conducts a computerized search in a wide variety of databases and provides information about the subject of the search. When Spokeo performed a search about Robins, some of the information it gathered and disseminated was incorrect. When Robins learned about the inaccuracies, he filed a class action alleging, among other things, that Spokeo (i) posted a picture purporting to be an image of him that was not in fact of him, (ii) incorrectly reported that he was in his 50's, married, employed in a professional or technical field and has children, and (iii) misrepresented that he had a graduate degree, and that his wealth level was in the top 10%. Robins alleged that he was out of work and actively seeking employment and, because of the misinformation, he has encountered imminent and ongoing actual harm to his employment prospects. Moreover, he contended that Spokeo's report made him appear overqualified for jobs that he might have gained, made it appear that he expected a higher salary than employers would be willing to pay, and less mobile because of family responsibilities.
Federal jurisdiction is limited to "cases and controversies" and requires a party to show that it suffered an "injury in fact" that is (i) fairly traceable to the challenged conduct of the defendant and (ii) likely to be redressed by a favorable judicial decision. The party must also show that it personally suffered some actual or threatened real injury. Note, however, the requisite injury alleged need not be tangible to satisfy this standard. Because the lower court had failed to fully appreciate these distinct requirements, its standing analysis was held to be incomplete by the Supreme Court. The case was remanded to the lower court to address and consider whether the particular violations alleged in the complaint entail a degree of risk sufficient to meet the federal standing requirement.
The decision is likely to be helpful to companies trying to defend a data breach in so far as providing that a mere statutory violation is not sufficient for commencing litigation. Rather, a party must show "actual damage" to bring an action, thereby making the pursuit of class actions more difficult. The Court noted, however, that in some instances the breach of a "procedural right" may establish a sufficient injury to confer standing on a plaintiff. The Court did note that not all violations or, in this case, the alleged inaccuracies, cause or present any material risk of harm (such as publishing an inaccurate zip code). What is less clear is what types of procedural violations will be enough to confer federal court standing. Clearly, some actual harm must be shown, but the nature and extent of the actual harm necessary to confer standing was not clearly delineated by the Court.
From a practical perspective, this new ruling will certainly make it more difficult for plaintiffs to establish a basis to pursue businesses that encounter a data breach in federal court as, absent being able to demonstrate "actual harm," the plaintiff will not be able to satisfy the standard articulated by the Court in Spokeo. That does not mean, however, that a plaintiff, absent such showing, cannot proceed in a state court. If the plaintiff can demonstrate "actual harm," the question then will be whether a certain level of harm or injury must be shown to justify standing to pursue the alleged violation and how you calculate or measure the damage at issue.