Financial Services Alert: Narrow Win For Spokeo at The U.S. Supreme Court: Plaintiffs Must Demonstrate Concrete Harm Even For Statutory Violations

In a highly-anticipated opinion, this morning the U.S. Supreme Court overturned the Ninth Circuit Court of Appeals’ decision in Spokeo, Inc. v. Robins. In a 6-2 decision, with Justice Alito writing for the majority, the Supreme Court held that:

Article III standing requires a concrete injury even in the context of a statutory violation; and
The Ninth Circuit Court of Appeals failed to address the independent concreteness requirement when it decided that Plaintiff had sufficiently alleged an “injury-in-fact” under the FRCA.

Click here to read the decision.

Background

Defendant Spokeo, Inc. operates a “people search engine” that allows users to search for information about other individuals and populates a “profile” that contains information about the individual such as their address, phone number, marital status, approximate age, occupation, hobbies, finances, shopping habits, and even musical preferences. Plaintiff Thomas Robins alleged that someone made a Spokeo search of him and the resulting profile contained inaccurate information including misstatements that he is married, has children, is in his 50’s, has a job, is relatively affluent, and holds a graduate degree.

Plaintiff filed a putative class action complaint in the U.S. District Court for the Central District of California, alleging that Spokeo was a “consumer reporting agency” for purposes of the FCRA and willfully failed to comply with FCRA’s requirements, including, without limitation, following reasonable procedures to ensure the maximum possible accuracy of consumer reports.

The District Court ultimately dismissed the case for lack of subject matter jurisdiction, holding that Plaintiff had not alleged an injury-in-fact because he had not alleged “any actual or imminent harm.” On appeal, the Ninth Circuit reversed, finding that Plaintiff’s alleged violations of his statutory rights under the FCRA were sufficient to convey Article III standing.

DECISION

The Supreme Court held that the Ninth Circuit failed to sufficiently analyze the dual requirement that an alleged injury-in-fact be both “particularized” as well as “concrete.” The Court reaffirmed its prior holdings that intangible injuries, including “the risk of real harm,” can be “concrete” in some cases for purposes of Article III standing. The Court further recognized that, in determining whether an injury is concrete, Congress is “well positioned to identify intangible harms that meet minimum Article III requirements[.]”

The Supreme Court concluded, however, that an allegation of a mere procedural violation is insufficient to satisfy the injury-in-fact requirement of Article III if it is “divorced from any concrete harm[.]” Although the Court recognized that “[t]he violation of a procedural right granted by statute can be sufficient in some circumstances to constitute an injury in fact,” it nonetheless held that “Robins cannot satisfy the demands of Article III by alleging a bare procedural violation.” The Court reasoned that Congress’ “role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Because a “violation of one of FCRA’s procedural requirements may result in no harm,” a statutory violation does not, in and of itself, necessarily convey Article III standing. By way of example, the Court noted that it would be difficult for a plaintiff to show how disseminating an incorrect zip code, without more, could cause any concrete harm.

The Court remanded the case to the Ninth Circuit to decide the issue of whether the particular procedural violations alleged by Plaintiff were sufficient to meet the concreteness requirement for purposes of Article III standing.

implications

Spokeo has been widely followed for its potential impact on not only FCRA litigation, but other privacy-related litigation such as cases brought under the Telephone Consumer Protection Act, the Video Privacy Protection Act, and the Stored Communications Act, which provide for automatic statutory damages. The case was also followed for its potential impact on data breach related litigation, where Article III standing continues to be intensely litigated, with many companies successfully defending the litigation on standing grounds, despite the fact that these case generally do not allege statutory damages. Some district courts in the midst of litigation under these statutes have even stayed the cases to await further guidance from the Supreme Court pending the Spokeo decision.

Although this appears to be a narrow victory for Spokeo and companies facing privacy-related class actions, the Court did not close the door on plaintiffs bringing class actions involving statutory violations. In many ways the Court decided not to decide the case: the ultimate question—whether Plaintiff alleged sufficient facts to establish standing—remains unanswered. The Court made clear that, even under a purely statutory cause of action, a plaintiff must allege both a concrete and particularized injury. However, it provided little practical guidance on how lower courts are to apply that test to determine whether a particular alleged harm is sufficiently concrete. As a result, litigation over this question is likely to continue for the foreseeable future.