In its recent decision in Spokeo, Inc. v. Robins, the Supreme Court reiterated that federal courts must defer to Congress’s intentions when determining whether a private citizen has constitutional standing to bring a lawsuit in federal court over a violation of statutory rights.[i] But what about state statutes—do federal courts owe state legislatures the same level of deference?

The question is especially relevant when litigants seek compensation in federal court under state laws that protect individuals’ rights in ways that federal laws do not. The number of federal lawsuits in this category has ballooned in the past decade thanks to the Class Action Fairness Act of 2005 (“CAFA”). CAFA gives federal courts jurisdiction over most multi-plaintiff class actions filed in state courts under state law,[ii]but only if the plaintiffs have standing—i.e., the right to sue—under Article III of the U.S. Constitution.

Although Spokeo demands deference to Congress, it makes no corresponding pronouncement urging deference to state legislatures. Now some creative defense lawyers are arguing that federal lawsuits based upon state-law claims should be dismissed for lack of Article III standing. While clever, this argument is short-sighted, as it undermines CAFA’s intent to protect defendants from the vicissitudes of state courts.

The tendency to rely on state-law statutes in federal lawsuits is perhaps most noticeable in data breach litigations. The largest data breaches occur when identity-thieving hackers circumvent the computer security of a major merchant or employer, and steal the business’s vast repository of customer or employee personal information. When victims of a data breach seek to bring suit, they quickly find that there is no federal statute setting the standard for data security. However, many states have statutes requiring a minimum standard of data-breach prevention, enabling data breach victims to pursue state-law remedies.[iii] Because these cases wind up in federal court pursuant to CAFA,[iv] these lawsuits can succeed or fail there depending on whether a federal judge thinks the injury from a state-law violation passes the Article III standing test.[v]

In addition to the data breach cases, plaintiffs’ reliance on state statutes is also apparent in federal lawsuits over mass-scale privacy intrusions[vi] and mortgage recordation abuses.[vii]

In most federal judges’ minds, the answer to all of this is clear: violations of state law lead to Article III injuries just as readily as those of federal law do.[viii] However, a minority have ruled that the violation of a state privacy or consumer protection statute does not give rise to an Article III injury, because state legislators do not deserve the same level of deference as their federal counterparts.[ix] Post-Spokeo, this minority position has been advocated by at least one federal judge, from the District of Maryland.[x]

Some defense attorneys have been quick to call attention to this perceived distinction in order to try to get their cases kicked out of federal court.[xi] But cooler heads within the defense bar recognize such arguments as being penny-wise, pound-foolish. In a commentary published shortly after Spokeo was issued, Hunton & Williams’s privacy law team called on fellow defense lawyers to avoid undermining CAFA by taking potshots at state-law claimants’ ability to litigate in federal court.[xii]

Any attempt by the defense bar to fight CAFA’s original-jurisdiction provisions is laden with irony. CAFA was heavily lobbied for by the business community, which had long pursued strategies for avoiding the jurisdiction of state courts perceived to be plaintiff-friendly. As Hunton & Williams put it, CAFA was meant to keep out of state court “exactly the types of cases that defendants most want in federal court.”[xiii] Prior to CAFA, defense attorneys feared nothing more than the prospect of having to defend a wealthy corporation in a so-called “judicial hellhole,” a disparaging term for state-court jurisdictions in which the majority of potential jurors are believed to be unduly plaintiff-friendly.[xiv] In post-CAFA complex litigations in which the relevant state-court jurisdiction is seen as plaintiff-friendly, the plaintiffs are as desperate to figure out a way to somehow litigate their claims in state court as the defendants are to have the case removed to federal court (and kept there).[xv]

            Defense attorneys can’t really be faulted for seeking to squeeze as much leverage out of Spokeo as possible. But they do so at great risk to their client base.