9th Circuit Says Plaintiff Had Standing to Sue Spokeo for Fair Credit Reporting Violations

February 6, 2014 · by Venkat Balasubramani · in Content Regulation, Privacy/Security, Publicity/Privacy Rights

Robins sued Spokeo alleging that Spokeo reported incorrect information about him—that he held a graduate degree and was wealthy—and this caused him difficulty in his job search and other harm. He alleged claims under the Fair Credit Reporting Act and the California unfair competition statute. The district court dismissed the initial complaint, found that the amended complaint adequately alleged standing, then revisited its second ruling and dismissed the case on the basis of Article III Standing. (Previous posts here and here.) The trial court’s eventual dismissal of Robins’s claim was premised on the conclusion that Robins did not adequately plead “injury in fact” and any injuries were not “fairly traceable” to Spokeo’s allegedly wrongful conduct. The Ninth Circuit reverses and says Robins adequately alleged standing because he alleged his statutory rights were violated. (There’s an interesting Section 230 defense lurking in the background, but the district court treated it in a cursory manner and it’s not discussed at all in the appellate ruling.)

The court affirms that violations of statutory rights supported by private causes of action are typically enough to confer Article III standing. The court also affirms that all statutory violations do not necessarily require a showing of actual damages—it’s up to Congress to determine what level of damage a plaintiff is required to show.

Of course, there are constitutional limits on Congress’ ability to confer standing. Congress may turn otherwise unrecognized injuries into causes of action subject to two limitations: (1) plaintiff has to be “among the injured,” and (2) the statutory right has to remedy some individual, rather than collective, harm. The court says this standard is easily satisfied here. The injury at issue dealt with Robins’s own personal information, and Congress is not trying to remedy any collective harm.

Finally, almost as an afterthought, the court addresses causation and redressability, two other elements of standing. The court says that where there’s a statutory right enforced via a private right of action, these two elements “will usually be satisfied.”

This lawsuit is in the very early stages, but it could have wide-ranging implications affecting a number of companies who trade in personal data. It’s a creative way to go after a data broker, using a creative but possibly unforeseen use of the fair credit reporting statute.

It’s tough to know what to make of this ruling. That Congress can create statutory rights isn’t exactly earth-shattering. That this ability is subject to certain limitations is also not surprising. In the sphere of legal issues addressed by this blog, it seems it difficult to conceive of a right created by Congress that would bump into these limitations. Certainly, when it comes to informational injury, the court’s ruling shows that if Congress wants to create statutory injuries, Article III requirements are not going to be much of a limitation. And to the extent the statute confers a private right of action without specifying any required damage showing, plaintiffs will be able to easily get past a standing challenge by alleging credible facts that amount to a statutory violation.

Maybe the district court took too narrow of a view of Article III standing. On the other hand, the result may be specific to the nature of the statute. What result if the injury at issue were defined by state statutory or common law? Krottner v. Starbucks is an older data point that points in the direction of a broad understanding of Article III standing by the Ninth Circuit. It’s tough to tell, but as a defendant I would no longer bank on getting these types of lawsuits thrown out on Article III standing grounds. (See also Sneed v. AEI/Aaron’s, 1:13-cv-982-TWT (N.D. Ga. Dec. 18, 2013) (declining to dismiss invasion of privacy claims notwithstanding plaintiff’s allegation of improper tracking and information collection on information and belief).) It’s too early to say that there’s a reversal in the trend, but courts have typically tossed privacy plaintiffs out of court. Lately we’ve seen a smattering of cases that survive.

Case citation: Robins v. Spokeo, Inc., 11-56843 (9th Cir. Feb. 4, 2014) [pdf]

Court Dismisses Class Action Against Spokeo for Lack of Standing — Robins v. Spokeo

Class Action Against Path Over Cellphone Address Book Access Keeps Going

Judge Koh Whittles Down iPhone App Privacy Lawsuit

Data Breach Claim Survives Based on Allegation of Misuse of Personal Information — Burrows v. Purchasing Power

Sony Network Data Breach Class Action Suffers Setback — In re Sony Gaming Network

Starbucks Data Breach Plaintiffs Rebuffed by Ninth Circuit — Krottner v. Starbucks

9th Circuit Affirms Rejection of Data Breach Claims Against Gap — Ruiz v. Gap

LinkedIn Beats Referrer URL Privacy Class Action on Article III Standing Grounds–Low v. LinkedIn

Third Circuit Says Data Breach Plaintiffs Lack Standing Absent Misuse of Data — Reilly v. Ceridian

First Circuit Rejects Data Insecurity Claims on the Basis of Article III Standing–Katz v Pershing

New Essay: The Irony of Privacy Class Action Lawsuits