Multiple recent decisions have applied the U.S. Supreme Court's injury-in-fact analysis from Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), to dispose of claims based on lack of standing. In Spokeo, plaintiff Robins alleged that Spokeo, which operates a web service that compiles general background and contact information about individuals, violated the Fair Credit Reporting Act ("FCRA") by publishing false information about Robins. Id. at 1544-46. Robins alleged that the publication of this false information—including, for example, that he had a graduate degree and was employed, affluent, and married with children—both violated his statutory rights and injured his job prospects by making him appear overqualified and too highly compensated for the jobs he desired. Id. at 1546, 1554.
The Ninth Circuit held that the plaintiff had standing to pursue his FCRA claim, but the Supreme Court vacated the Ninth Circuit's opinion and remanded the case for further consideration. Id. at 1545. The Supreme Court held that the Court of Appeals overlooked the requirement under Article III that a plaintiff must plead an injury in fact that is not only particularized but also sufficiently "concrete" to support standing. Id. at 1544-45, 1550. Among other things, Spokeo stands for the proposition that "Article III standing requires a concrete injury even in the context of a statutory violation." Id. at 1549. A "bare procedural violation, divorced from any concrete harm does not satisfy the injury-in-fact requirement of Article III." Id.
Several federal courts have relied on the Supreme Court's analysis in Spokeo to dispose of claims where plaintiffs failed to allege adequately concrete injuries. Recently, a Wisconsin federal judge granted Time Warner Cable's ("TWC") motion to dismiss a putative class action based on the plaintiff's failure to allege a "concrete" injury and resulting lack of Article III standing. Gubula v. Time Warner Cable, No. 15-cv-1078, 2016 WL 3390415, at *5 (E.D. Wis. June 17, 2016), appeal docketed, No. 16-2613 (7th Cir.). Gubala accused TWC of retaining customers' personal identification information after the termination of their cable services, asserting that doing so violated the Cable Communications Policy Act ("CCPA"), which requires cable operators to destroy customers' personally identifiable information when the information is no longer required for the purpose for which it was collected.
The court accepted TWC's argument that Gubala lacked Article III standing under Spokeo because he claimed only a procedural violation of the CCPA, finding that Gubala did not allege a "concrete" injury and, as a result, lacked standing to sue. Id. at *4-5. While Gubala's complaint cited media articles discussing that consumers value the privacy of their personal information, Gubala failed to show how TWC's retention of his personal information caused him any concrete harm. He claimed only that the CCPA required TWC to destroy his personal information and that TWC had not done so.
The court found that Gubala's allegations were "almost identical to the allegations the plaintiff made in Spokeo," which were even "a bit closer to alleging a concrete injury." The decision explained that in Spokeo, "the defendant wasn't just keeping [the plaintiff's] information; it was publishing, to anyone who viewed [Spokeo's] website, inaccurate information." Id. at *4. "Given the clear directive in Spokeo, the court [found] that while the second amended complaint allege[d] a particularized injury, it [did] not allege a concrete harm, and therefore that the plaintiff [did] not have Article III standing to bring [the] suit." Id. at *5.
Another federal court recently remanded a putative class action to state court based on Spokeo. See Smith v. The Ohio State University, No. 2:15-CV-3030, 2016 WL 3182675 (S.D. Ohio June 8, 2016). In that case, after The Ohio State University removed the case to federal court, the United States District Court for the Southern District of Ohio considered whether the plaintiffs had standing to pursue claims under the FCRA. The plaintiffs alleged that, during the process of applying for jobs at The Ohio State University, the University provided a disclosure and authorization to plaintiffs that improperly included extraneous information, such as a liability release, in violation of the FCRA. Id. at *1. Although they were hired, the plaintiffs claimed that they "suffered harm when their 'privacy was invaded and they were misled as to their rights under the FCRA.'" Id. at *1, 4.
Noting the Supreme Court's statement in Spokeo that a "violation of one of the FCRA's procedural requirements may result in no harm," the court explained that the plaintiffs "admitted that they did not suffer a concrete consequential damage as a result of OSU's alleged breach of the FCRA." Id. at *4. The court held that "[w]ithout a concrete and particularized injury-in-fact, there is no Article III standing in this Court" and remanded the matter to the Ohio Court of Claims for further adjudication. Id.
Finally, in Khan v. Children's National Health System, No. TDC-15-2125, 2016 WL 2946165 (D. Md. May 19, 2016), the United States District Court for the District of Maryland remanded a putative class action to state court based on Spokeo. In Khan, the plaintiff received treatment at a hospital in Washington, D.C., where hackers gained access to several employee email accounts through a "phishing" scam and obtained access to "patient information, such as names, addresses, dates of birth, Social Security numbers, and telephone numbers, as well as private health care information." Id. at *1. The plaintiff brought claims in state court against the hospital under the Maryland and District of Columbia Consumer Protection Acts as well as common law claims for negligence, breach of implied contract, and unjust enrichment. Id.
The defendant removed the case to federal court under the Class Action Fairness Act and then filed a motion to dismiss. Id. The plaintiff asserted several bases for injury in fact, including an "imminent threat of identity theft," a "loss of privacy," and that "the value of her personally identifiable information ha[d] been diminished by the data breach." Id. at *3-6.
Relying on Spokeo, the court rejected these theories of standing and concluded that "Khan has failed to connect the alleged statutory … violations to a concrete harm." Id. at *7. Because Khan lacked standing to sue in federal court, the district court remanded her claims back to state court. Id. at *7.
These cases suggest that plaintiffs must clearly state how an alleged "intangible" injury, such as the retention or unauthorized disclosure of personal information, has resulted in a "concrete" injury in fact, even in the context of statutory violations. They also demonstrate that courts are willing to analyze pending claims under Spokeo and reject them where no concrete harm has been alleged.