On remand from the Supreme Court, the U.S. Court of Appeals for the Ninth Circuit has held for the second time that the plaintiff in Robins v. Spokeo, Inc. has standing to proceed in federal court with claims under the Fair Credit Reporting Act (“FCRA”). As standing is often a crucial threshold issue in statutory data privacy litigation, this closely watched decision provides insight as to how some courts are analyzing jurisdictional challenges to statutory claims with allegations of only intangible harm. This OnPoint discusses the Ninth Circuit’s opinion.
Spokeo operates a website that aggregates consumer data and makes it publicly available in a searchable format. The company markets its services to businesses as a way to research prospective employees. After learning that Spokeo had published alleged inaccuracies regarding his age, marital status, educational background, and employment status, plaintiff Thomas Robins sued Spokeo for willful violations of the FCRA.1 The plaintiff alleged that Spokeo violated certain of the FCRA’s procedural requirements, including the allegation that Spokeo failed to “follow reasonable procedures to assure maximum possible accuracy” of the information, and that the inaccuracies negatively affected the plaintiff’s employment prospects.2
The district court dismissed the claims for lack of standing, reasoning that the plaintiff had alleged statutory violations but not that those violations had caused an “injury in fact.”3 When the Ninth Circuit first reviewed the case (Spokeo I), it reversed the district court, focusing on the fact that the alleged violations that were sufficiently specific to the plaintiff to establish standing.4
The Supreme Court granted certiorari, and ultimately remanded the case to the Ninth Circuit to consider further whether the plaintiff had adequately pleaded any “real” harm.5 Drawing on its well established standing jurisprudence, the Supreme Court’s opinion (Spokeo II) explained that the standing doctrine generally limits the category of plaintiffs who may maintain a lawsuit in federal court, and requires a plaintiff to establish (i) an “injury in fact,” that is (ii) fairly traceable to the alleged conduct, and (iii) redressable by a favorable decision. To satisfy the “injury in fact” prong, the plaintiff must establish that it suffered “an invasion of a legally protected interest” that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.”6 The Court did not take issue with the Ninth Circuit’s analysis as to whether the plaintiff’s claims were sufficiently particularized, but decided that the circuit court had failed to consider whether the plaintiff had alleged harm that was sufficiently “concrete.”
The Court noted that to establish a “concrete” injury, a plaintiff was not in all cases required to allege “tangible” harm. Both historical practice and the judgment of Congress should be considered, the Court explained, when determining whether an intangible harm constitutes an injury in fact. With regard to historical practice, the Court instructed, a court should consider “whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.”7 In addition, the Court ruled, since Congress is “well-positioned to identify intangible harms that meet minimum Article III requirements,” its judgment as to what harms are concrete enough to support a court’s exercise of jurisdiction is also “instructive and important.”8 But while Congress plays an important role in identifying and elevating intangible harms that may satisfy the concreteness inquiry, the Court maintained that this “does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.”9 Indeed, the Court made clear that “[the plaintiff] could not . . . allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement . . . .”10 The Court also offered that “the real risk of harm” may sometimes satisfy the concreteness requirement. In such cases, the plaintiff “need not allege any additional harm beyond the one Congress has identified.”11
As to the plaintiff’s allegations in Spokeo, the Court observed that while “Congress plainly sought to curb the dissemination of false information by adopting procedures [in the FCRA] designed to decrease that risk, . . . not all inaccuracies cause harm or present any material risk of harm.”12 The Court noted, for example, that “[i]t [would be] difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.”13 Ultimately, the Court ordered the Ninth Circuit to determine “whether the particular procedural violations alleged in this case entail a degree of risk sufficient to meet the concreteness requirement.”14
On remand (Spokeo III), the Ninth Circuit again held that the plaintiff had standing.15 As the court acknowledged, since Spokeo II a number of circuits have grappled with identifying statutory claims that sufficiently establish concrete harm. Ultimately borrowing a framework from the Second Circuit, the court explained that to determine whether the plaintiff’s claims were sufficiently concrete, it would ask: (i) “whether the statutory provisions at issue were established to protect [the plaintiff’s] concrete interests (as opposed to purely procedural rights)”; and (ii) “if so . . . whether the specific procedural violations alleged in this case actually harm, or present a material risk of harm to, such interests.”16
First, the court concluded that Congress established the relevant FCRA provisions to safeguard consumers’ concrete interests in accurate credit reporting. Emphasizing the “ubiquity and importance” of reports containing consumer information, the court had “little difficulty” concluding that the relevant FCRA’s requirements are “real” rather than “purely legal.”17 In particular, the court drew upon the FCRA’s legislative history, which emphasized the increasing importance of consumer information and the potential harm from inaccuracies in that data. The court also noted that these reputational and privacy interests are similar in kind to interests long protected by the common law through causes of action like defamation.
Second, in a largely fact-driven analysis, the court found that the alleged FCRA violations presented a “material risk of harm” sufficient to confer standing.18 Interpreting the Supreme Court’s mandate in Spokeo II, the Ninth Circuit explained that it had to examine the “nature of the specific alleged reporting inaccuracies” to determine whether they presented a “real risk of harm to the concrete interests that [the statute] protects.”19 The court noted that the plaintiff was unemployed and seeking a job when he discovered reporting inaccuracies about his age, marital status, educational background, and employment status, and reasoned that this is the type of information prospective employers may seek from a consumer report.
Impact and Future Considerations
The Ninth Circuit’s decision in Spokeo III adds to a growing mosaic of decisions around the country taking direction from Spokeo II as to the standing inquiry for statutory consumer protection or data privacy claims—often associated with intangible harm.20 Going forward, the plaintiffs’ bar likely will seek to rely on Spokeo III to survive jurisdictional challenges when alleging statutory violations in a variety of contexts, such as under the FCRA or the Telephone Consaumer Protection Act. Importantly, however, the Ninth Circuit’s recent decision acknowledged that “in many instances, a plaintiff will not be able to show a concrete injury simply by alleging that a consumer-reporting agency failed to comply with one of FCRA’s procedures,” and expressly declined to adopt any bright line rule.21 Only time will tell if the largely fact-driven inquiry in Spokeo III will dampen the usefulness of this decision for plaintiffs in future jurisdictional challenges.