The Supreme Court’s Decision and Remand in Spokeo, Inc. v. Robins Postpones the Difficult Standing Issues in Statutory Standing and Identity Theft Cases

On May 16, 2016, the U.S. Supreme Court in Spokeo, Inc. v. Robins, a six to two decision by Justice Alito, held that a plaintiff alleging a statutory injury in violation of a federal statute must allege not only an individualized injury, but also a concrete injury to satisfy the U.S. Constitution’s Article III standing requirement for an injury in fact. In her dissenting opinion, Justice Ginsburg, who was joined by Justice Sotomayor, argued that the plaintiff’s, Thomas Robins, particularized allegations that petitioner Spokeo, Inc. had misreported information about his employment and financial status satisfied the concrete injury requirement because his complaint alleged that the misinformation harmed his employment prospects, and, therefore, his allegations did not constitute an abstract or generalized injury that is outside the scope of the federal courts’ jurisdiction. The majority decision did not resolve what exactly constitutes a concrete injury other than to exclude harmless errors such as an “incorrect zip code.” Slip op. at 11. The Court did state that a plaintiff enforcing a statutory right “need not allege any additional harm beyond the one Congress has identified.” Id. at 10(emphasis in original). That conclusion likely means that a plaintiff seeking information pursuant to the Freedom of Information Act (FOIA), 5 U.S.C. § 552, may have standing based solely upon their statutory right to information held by federal agencies without alleging that he will suffer additional harms if he does not obtain that information. The Spokeo decision does not resolve the split in the lower courts about how much financial harm must a plaintiff allege to have standing in data breach or identity theft cases. See generally Bradford C. Mank, Data Breaches, IdentityTheft and Article III Standing: Will the Supreme Court Resolve the Split in the Circuits?, 92 Notre Dame L. Rev. (forthcoming 2016), http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2730798.

Spokeo, Inc., operates a ‘people search engine,‘ which searches a wide number of databases to gather and provide personal information about individuals for a variety of users, including employers seeking to evaluate prospective employees. After Robins discovered that his Spokeo-created profile contained inaccurate information, he filed a federal class-action complaint against Spokeo, alleging that the company willfully failed to comply with The Fair Credit Reporting Act of 1970 (FCRA), which requires consumer reporting agencies to ‘follow reasonable procedures to assure maximum possible accuracy of‘ consumer reports, 15 U. S. C. §1681e(b), and imposes liability on ‘[a]ny person who willfully fails to comply with any requirement [of the Act] with respect to any‘ individual, §1681n(a).

The District Court dismissed Robins’ complaint and held that he had not properly pleaded injury in fact as required by Article III. The Ninth Circuit reversed. Because Robins’ alleged that ‘Spokeo violated his statutory rights‘ and the fact that Robins’ ‘personal interests in the handling of his credit information are individualized,‘ the court of appeals held that Robins had adequately alleged an injury in fact. However, the Supreme Court reversed the Ninth Circuit’s decision because the court of appeals had only considered whether Robins had a particularized or individualized injury, but had failed to address whether he had a concrete injury.

The Court acknowledged “that intangible injuries can nevertheless be concrete.” Id. at 9. The majority explained, “In determining whether an intangible harm constitutes injury in fact, both history and the judgment of Congress play important roles.” Justice Alito observed that the Court examines the history of the English or American common law in determining what is an injury. Id. Additionally, Congress’ “judgment is also instructive and important” in deciding when an intangible injury is sufficient for Article III standing. Id. The Court clarified that a statutory right does not automatically confer standing unless a plaintiff can allege a concrete injury. Id. at 9-10. Yet the Court conceded “risk of real harm” can satisfy the concreteness requirement so that tort victims may recover “even if their harms may be difficult to prove or measure.” Id. at 10.

Some attorneys and scholars had feared that an adverse decision against Robins might limit FOIA suits and thus limit the ability of citizens to gain access to information from the government. Rebecca Wilhelm, Standing Case Could Affect Environmental Plaintiffs, 211 Daily Environment Report (BNA-Bloomberg) A-13, Nov. 2, 2015. This author was more skeptical that an adverse decision in Spokeo v. Robinswould lead to a significant reduction in FOIA rights and standing, but there was a genuine fear that the Court might require plaintiffs to prove an additional personal harm beyond the statutory right to information. Id. Fortunately, the Court in Spokeo explicitly stated that a harm need not allege any additional harm beyond the one Congress has identified.” Id. at 10 (emphasis in original). The Court favorably cited its decision in Public Citizen v. Department of Justice, 491 U. S. 440, 449 (1989), which held that two advocacy organizations’ failure to obtain information subject to disclosure under the Federal Advisory Committee Act ‘constitutes a sufficiently distinct injury to provide standing to sue‘. The Court’s rejection of an additional harm requirement in Spokeo preserves the right of citizens to have standing to sue if a federal agency denies them documents sought pursuant to FOIA.

In most, but not all data breach or identity theft cases, a plaintiff whose personal information has been stolen by a computer hacker cannot prove that a hacker or thief has actually used or sold the data to the plaintiff’s detriment. If a plaintiff can prove fraudulent use of a credit card or bank account then standing is clear. Resnick v. AvMed, Inc., 693 F.3d 1317, 1322-23 (11th Cir. 2012). Courts have divided over whether a plaintiff has standing to sue when a bank or other company reimburses his direct losses, but plaintiffs allege that they have suffered serious indirect or incidental costs from significant time spent correcting fraudulent charges or where they could not access their credit or bank accounts for a period of time as a result of a breach. CompareRemijas v. Neiman Marcus Group, 794 F. 3d 688, 692-97 (7th Cir. 2015) (concluding 9,200 plaintiffs who were later reimbursed for fraudulent charges had alleged an adequate injury-in-fact for standing where they alleged that they had “suffered the aggravation and loss of value of the time needed to set things straight, to reset payment associations after credit card numbers are changed, and to pursue relief for unauthorized charges”) with Burton v. MAPCO Express, Inc., 47 F. Supp. 3d 1279, 1284-85 (N.D. Ala. 2014) (concluding plaintiff must incur actual unreimbursed damages to have either standing or a ripe claim). Courts have disagreed whether a plaintiff has standing to sue when is merely at an increased risk of identity theft, but has incurred no actual losses. Compare Reilly v. Ceridian, 664 F.3d 38 (3rd Cir. 2011) (holding a plaintiff does not have standing to sue when a data breach merely increases his risk of identity theft but it is less than a fifty percent risk of harm) with In re Sony Gaming Networks And Customer Data Security Breach Litigation, 2014 WL 223677 (S.D. Cal. Jan. 21, 2014). The Ninth Circuit has been especially generous in allowing plaintiffs to sue for data breaches based solely upon allegations of an increased risk of harm. Krottner v. Starbucks Corp. 628 F.3d 1139 (9th Cir. 2010). The Supreme Court’s reversal of the Ninth Circuit in Spokeo could lead that Circuit to apply a stricter approach of what constitutes a concrete injury could lead that court of appeals to reassess its lenient approach in data breach cases, but the Supreme Court’s stricter approach to standing does not compel the Ninth Circuit to change its approach. Lower court judges who favor standing in data breach cases might argue that such breaches constitute both a concrete and particularized injury.

The Supreme Court’s decision in Spokeoleft unresolved many difficult questions concerning statutory standing. The Court likely foreclosed efforts to limit standing in FOIA cases. But more complicated standing questions are likely to remain open until the Court returns to a full complement of nine justices.