In Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), the Supreme Court held that to have standing to sue, a plaintiff must complain of injury that is both “particularized” and “concrete.”  In that case, plaintiff complained Spokeo violated the Fair Credit Reporting Act (FCRA) by incorrectly reporting facts as to plaintiff.  FCRA permits plaintiffs to recover liquidated damages without a showing of harm.  The Supreme Court remanded to determine whether, notwithstanding Congress’ determination that a false report may give rise to a claim, plaintiff suffered a concrete injury.  In recent decisions, three courts of appeals have addressed that question.

The Ninth Circuit decided Robins v. Spokeo, Inc., 867 F.3d 1108 (9th Cir. 2017) (No. 11-56843), on remand.  It held the fact that Congress passed a law providing that a consumer may sue does not mean that plaintiff has standing.  Still, Congressional judgment plays a role in deciding standing.  Thus, the Ninth Circuit asked whether the statutory provision was established to protect a concrete interest, as opposed to a procedural right, and whether the alleged violation presented a material risk of harm to such interests.  Applying that standard, the court found FCRA was passed to protect concrete consumer interests.  The court relied on, among other things, legislative statements that consumers have an interest in eliminating the transmission of inaccurate information.  The court then examined the nature of the alleged inaccuracies to ensure they presented a real risk of harm to concrete interests.  It found that Robins alleged factual inaccuracies in the Spokeo report that could lead to actual harm.  The court thus concluded the allegations of harm were sufficient to establish concrete injury, and thereby standing.

In Groshek v. Time Warner Cable, Inc., 865 F.3d 884 (7th Cir. 2017) (No. 16-3355), the Seventh Circuit addressed standing under a different FCRA provision.  In applying the Supreme Court’s Spokeo test, the court noted that history and Congress’ judgment are important: Congress is “well positioned to identify intangible harms that will give rise to concrete injuries,” for which prior remedies were “inadequate in law.”  In enacting FCRA, Congress identified a need to ensure accurate consumer reporting and to avoid improper invasions of privacy.  Groshek alleged he authorized the disclosure of some information but defendant disclosed additional extraneous information.  He claimed the disclosure went beyond his “standalone” authorization. The court held this disclosure may have been an informational injury, but did not create a concrete harm because FCRA does not protect individuals from the harm alleged.  Therefore, plaintiff lacked standing.

The D.C. Circuit addressed standing in Attias v. CareFirst, Inc., 865 F.3d 620  (D.C. Cir. 2017) (No. 16-7108).  Plaintiffs brought a class action alleging defendant’s carelessness and negligence permitted a cyberattack in which customers’ personal information was stolen.  The district court dismissed the case, finding plaintiffs had failed to allege injury in fact.  The D.C. Circuit reversed.  To demonstrate standing, plaintiff must show an injury in fact fairly traceable to the defendant’s actions that is likely to be redressed.  Surveying the cases, the court concluded standing is proper based on allegations of a “substantial risk” of future harm.  Here, plaintiffs’ claims were based on the risk of future injury.  Identity theft, should it occur, would constitute a concrete and particularized injury.  The complaint plausibly alleged plaintiffs faced substantial risk of identity theft, thereby satisfying the Spokeo test.