Spokeo decision potentially limits privacy class actions

Blog Post

The United States Supreme Court recently issued its decision in Spokeo finding the Ninth Circuit was not complete in its Article III standing analysis – it failed to consider both aspects of the injury in fact requirements. (Spokeo, Inc. v. Robins, 578 U.S. ____ (2016)). In its Spokeo decision, the Supreme Court found that both concrete and particularized are required to determine if the plaintiff has sufficient injury in fact for the case to proceed. The Supreme Court found the Ninth Circuit’s Article III Standing analysis incomplete – that the Ninth Circuit only analyzed whether the plaintiff’s injury in fact was particularized, and erroneously ignored the concrete analysis. 

The Supreme Court vacated the Ninth Circuit’s decision and remanded. The Supreme Court’s decision was 6-2; Justice Alito wrote the opinion and Thomas concurred. Justice Ginsberg dissented, joined by Sotomayor. The dissent argued further standing analysis was not necessary, that Robins had sufficient injury, which was that Spokeo’s misinformation caused actual harm to employment prospects.

The Supreme Court sent the case back to the Ninth Circuit to take another look at the injury – whether Robins had alleged the kind of concrete injury that would allow the case to go forward. The Ninth Circuit found Robins had alleged sufficient particularized injury. At issue in the case is whether a person may bring a lawsuit when a company violates a federal privacy law (the federal Fair Credit Reporting Act). Robins alleged that Spokeo, a company that operates a people search engine that publishes personal information from a number of databases, published false information that Robins was wealthy, married with children and worked in a professional or technical position. Robins was unmarried, no children, and out of work, looking for a job. Robins alleged injuries included that Spokeo’s inaccuracies caused harm to his employment prospects.

The Supreme Court made clear that the requirement of concrete is not necessarily synonymous with tangible. It stated “intangible injuries can nevertheless be concrete.” The Supreme Court stated “bare procedural violation” is not sufficient. The purpose of the Fair Credit Reporting Act (FRCA) is to curb companies from publishing inaccurate information. The question then becomes how to draw the line. The Supreme Court stated that not all violations of the FCRA will automatically result in the kind of concrete harm the Constitution requires for standing, for example, the Supreme Court stated it was hard to imagine that getting a zip code wrong, without something more, would result in concrete harm. “Concrete” injury must be “real” and not abstract.

We may very well see the Spokeo case back at the Supreme Court once the Ninth Circuit completes the concrete part of the Standing analysis. 

The Supreme Court’s Spokeo decision likely will affect data privacy class actions in that plaintiffs’ pleadings must allege both concrete and particularized injuries. There may be fewer successful privacy and data security class actions since many plaintiffs allege injuries that are technical or procedural violations without concrete or particularized injury. This will not, however, stop the actions from being filed.

An example of the potential limiting effects of Spokeo may be seen in the Matera v. Google, Inc. case (Case No. 15-CV-04062-LHK, United States District Court, Northern District of California). In the Google case, the plaintiff filed a class action alleging violation of the Electronic Communications Privacy Act by Google scanning emails for advertising purposes. This case was stayed in February 2016, pending the Spokeo decision. On Monday, June 13, 2016, Google filed a motion to dismiss based on the Spokeo decision stating that the plaintiff did not allege concrete injuries. The plaintiff in Google had alleged that the “private intrusion inherent in the interception of email content . . . is the injury itself.” The plaintiff had not alleged that he suffered any purported harm, for example, that the violation led to disclosure of confidential information to third parties. The plaintiff only alleged violations of the Act as the injury. The Google case may be the beginning of the aftermath of Spokeo for privacy plaintiffs.