Header graphic for print
HL Chronicle of Data Protection Privacy & Information Security News & Trends
Posted in Consumer Privacy, Privacy & Security Litigation

Justices Rule That Injury In Fact Must Be Concrete, Requiring More Than A Statutory Violation

for-blogOn Monday, May 16, 2016, the Supreme Court of the United States issued its highly anticipated opinion in Spokeo, Inc. v. Robins, a case that examined the question of whether a plaintiff who sued for a technical violation of the Fair Credit Reporting Act (FCRA) could maintain Article III standing for a class action without claiming any real-world injury.  The case before the Court involved a putative class action brought against petitioner Spokeo, Inc., a company that generates profiles about people based on information obtained though computerized searches.  Respondent Thomas Robins was one of the people with a profile on Spokeo’s website.  According to Robins, the information on that profile was inaccurate.  Robins filed a class-action complaint against Spokeo in federal court, alleging violations of the FCRA, which requires consumer reporting agencies to “follow reasonable procedures to assure maximum possible accuracy of” consumer reports.  The Ninth Circuit held that by alleging the violation of a statutory right Robins had satisfied the injury-in-fact requirement of Article III standing.

In a 6-2 decision, the Court held that an injury in fact must be not only “particularized” to the plaintiff, but also concrete, and that bare allegations of a statutory violation do not automatically satisfy that concreteness requirement.  Defendants in cases where a plaintiff has suffered no concrete harm can, and already are using this decision to dismiss claims based on a lack of Article III standing.  Defendants can also use the holding when defending against class actions where the issue of concrete harm is individualized.

The implications of this decision may depend on whether courts choose to adopt a narrow or broad interpretation of the case. On the one hand, a narrow reading would provide that Spokeo applies only to the question of Art. III standing of private plaintiffs bringing actions under particular consumer protection statutes and, therefore, by its literal terms would not apply to privacy cases brought by the FTC. In addition, because Art. III jurisprudence does not apply to states, Spokeo would similarly not apply to actions brought under “mini FTC Acts” by state attorneys general or private plaintiffs.

A broad reading, on the other hand, may focus on the Court’s discussion of “concrete harm,” and its potential applicability to the contours of “harm” under Section 5 of the FTC Act and other, related statutes. If so, the Spokeo decision may prove influential in regulators’ and others’ determination of whether certain activities would amount to unfair practices under consumer protection statutes. The forthcoming FTC LabMD decision may provide some insight into whether the FTC is adopting a broad or narrow interpretation of the decision.

For more information, please see a Hogan Lovells client alert on the ruling, available here.

Hogan Lovells attorneys Theresa House and Andrew Leff also recently wrote an article for the American Bar Association’s Privacy and Data Privacy Committee that discusses in detail the background of the Spokeo litigation, the proceedings leading up to and before the Court, and the Court’s decision.  Access the full report here (subscription only).