Five months have passed since the Supreme Court’s decision in Spokeo, Inc. v. Robins, where the Court held (on the one hand) that a “violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact,” but also (on the other hand) that a plaintiff cannot establish standing by alleging a “bare procedural violation” because “Article III standing requires a concrete injury even in the context of a statutory violation.” In the intervening time period, Spokeo has been cited by almost 200 federal district courts attempting to apply the Supreme Court’s directives. However, only a handful of federal courts of appeal have waded into the fray. A review of these appellate decisions provides helpful insights into how the lower federal courts are (or should be) applying the Supreme Court’s opinion. In fact, three general rules can be gleaned from these decisions:

First, a plaintiff may have standing to sue based solely on a defendant’s failure to disclose information when such disclosure is statutorily mandated.

In Church v. Accretive Health, Inc., the Eleventh Circuit found that the plaintiff had standing to assert a claim for violation of the Fair Debt Collections Practices Act based solely on the defendant’s alleged failure to include in its letter to the plaintiff certain disclosures required by the Act. For example, the letter did not expressly state that it was sent by a “debt collector ... attempting to collect a debt and that any information obtained will be used for that purpose,” nor did it alert the plaintiff that “unless the consumer, within thirty days after receipt of notice, disputes the (Continued) validity of the debt, or any portion thereof, the debt will be assumed to be valid by the debt collector.” The plaintiffs alleged no actual damages aside from the defendant’s alleged failure to include the required disclosures. However, the court noted that, in certain instances, a plaintiff can rest on the deprivation of a Congressionally-created right to satisfy the standing inquiry. Because Congress had created “a new right—to receive the required disclosures in communications governed by the FDCPA—and a new injury—not receiving such disclosures,” the plaintiff satisfied Article III’s injury-in-fact requirement.

Though at first glance this decision may appear discordant with Spokeo’s admonition that “a bare procedural violation” cannot confer standing, the Spokeo Court also noted that “the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact,” and pointed by way of example to two decisions involving failures to provide statutorily-required disclosures of information. In other words, the Supreme Court expressly identified the failure to disclose information required by statute as an injury that could, in and of itself, satisfy Article III. Thus, it appears that the Eleventh Circuit was invoking that exception in holding that the plaintiff in Church need not allege any injury beyond the denial of a statutory right to receive information.

This informational right was also addressed by the D.C. Circuit’s decision in Friends of Animals v. Jewell, where the plaintiffs sought to challenge the Department of Interior’s alleged failure to timely respond to reclassification petitions under the Endangered Species Act. The district court held that the plaintiffs had failed to establish standing because they were seeking merely to enforce a statutory deadline that did “not obligate the Secretary to disclose information.” The Court of Appeals agreed, contrasting the conduct at issue to other cases in which plaintiffs had standing because they “sought to enforce a statutory disclosure requirement.” In other words, statutory disclosure requirements appear to be recognized as sufficiently substantive to provide standing at least in certain contexts.

Second, the statutorily prohibited collection or retention of protected information does not in and of itself give rise to a concrete injury sufficient to confer standing, but the disclosure (or threatened disclosure) of such information may establish standing to sue. Challenges to the collection and/or dissemination of protected information have been addressed in four appellate court decisions, which have split evenly on the question of standing.

In Braitberg v. Charter Communications, Inc. and Hancock v. Urban Outfitters, Inc., the Eighth and D.C. Circuits held that the plaintiffs had failed to establish standing based solely on allegations that the defendants sought and/or retained protected information in contravention of statutory directives. In Charter, the plaintiff claimed that the defendant had failed to destroy his personally identifiable information in violation of the Cable Communications Policy Act (“CCPA”), which requires cable providers to destroy certain personally identifiable information after its retention is no longer necessary. In Urban Outfitters, the plaintiffs claimed that the defendant’s practice of requesting customers’ zip codes in connection with credit card purchases violated the District of Columbia Consumer Identification Information Act, which prohibits retailers from recording an address in connection with a customer purchase. In both cases, the courts found that the plaintiffs had failed to establish a concrete injury because they alleged no disclosure of the protected information, nor did they allege any material risks of harm (e.g., an increased risk of identity theft or fraud).

In In re: Nickelodeon Consumer Privacy Litigation and Galaria v. Nationwide Mutual Insurance Company, on the other hand, the Third and Sixth Circuits held that the plaintiffs had successfully established standing where the defendants had disseminated (or failed to protect) the plaintiffs’ information in violation of the applicable statutory mandates. In Nickelodeon, the plaintiffs claimed that the defendant violated the Video Privacy Protection Act by disclosing to Google personally identifying information related to children’s consumption of online videos, the collection of which is prohibited under the Act. In Nationwide, following a hack into Nationwide’s computer system that resulted in the theft of plaintiffs’ personal information, the plaintiffs sued the defendants for their alleged failure to adopt the data protection procedures required under the Fair Credit Reporting Act. In finding that the plaintiffs had standing to pursue both cases, the courts focused on the fact that third parties had accessed the information at issue, which created a material risk of harm and was precisely what the statutes sought to protect against.

Third, a procedural violation does not give rise to standing when the alleged violation does not implicate the interest the statute is intended to protect vis-à-vis the plaintiff. In other words, a plaintiff cannot challenge a defendant’s statutory violation if that violation does not impact the protections provided to the plaintiff under the statute. This rule is reminiscent of the “zone of interest” test, which requires that in order to have standing a plaintiff’s injury must be the kind of injury intended to be protected by the law. The Fifth and Eleventh Circuits have both addressed this issue and found standing lacking in each case.

In Lee v. Verizon Communications, Inc., the Fifth Circuit found that the plaintiff lacked standing to challenge the defendant’s alleged fiduciary misconduct under the Employee Retirement Income Security Act (“ERISA”), because the plaintiff’s concrete interest under the statute (i.e., the “zone of interest”) was the payment of benefits, and he failed to claim that the purportedly improper plan management affected his defined-benefit-plan payments. Similarly, in Nicklaw v. Citimortgage, Inc., the Eleventh Circuit found that the plaintiff lacked standing to challenge the defendant’s failure to comply with New York Real Property law based solely on the defendant’s dilatory filing of a certificate of discharge after the plaintiff satisfied his mortgage. The complaint alleged no harm separate and apart from the late filing, and by the time the plaintiff brought suit the filing had been completed. The court held that the plaintiff lacked concrete injury because he alleged neither that his credit suffered during the defendant’s delay, nor that anyone was aware that his title was wrongfully clouded during the intervening time period (which was the harm the law was designed to prevent).

There is evidence that these general rules are also playing out at the federal district court level. Just yesterday, the District of New Jersey applied Verizon in dismissing the complaint in Hecht v. The Hertz Corporation. There, the plaintiff sought to hold Hertz liable for violations of New Jersey’s Truth-in-Consumer Contract, Warranty and Notice Act (“TCCWNA”), which states that “No consumer contract, notice or sign shall state that any of its provisions is or may be void, unenforceable or inapplicable in some jurisdictions without specifying which provisions are or are not void, unenforceable or inapplicable within the State of New Jersey[.]” The plaintiff alleged that provisions in Hertz’s agreements stating that rental car prices, rates, and availability are subject to change without notice “[e]xcept as otherwise provided by law,” and that Hertz’s Gold Plus Rewards offers are “void where prohibited by law,” violated the TCCWNA because the agreements did not specify whether New Jersey was one of the jurisdictions where such exceptions applied. The court found that the plaintiff lacked standing to sue as he had failed to allege that any of the provisions were in fact invalid in New Jersey, and thus there was no indication that he had been unable to “access the full panoply of benefits offered.” In other words, as in Verizon, the plaintiff had not alleged that he suffered any of the harm the statute sought to protect against. Jenner & Block represented Hertz in its successful motion to dismiss.

Taken together, these decisions shed some light on how the federal courts of appeal have interpreted Spokeo thus far. But it remains to be seen whether other Circuits will follow suit, or whether a Circuit split will force the Court to clarify its directive.