A California federal district court judge found last week that plaintiffs must establish a cognizable injury even when minimum statutory damages are available under a California state statute.  This could prove to be a significant win for the defense bar.  As I discussed here, the recent First Circuit decision in Hannaford could signal a changing tide in favor of plaintiffs when at least some of the class members are able to establish actual harm even though others in the class cannot make the same showing.  Most courts have previously rejected lawsuits brought by plaintiffs who cannot show they have been harmed.  Not surprisingly, in an attempt to circumvent the need to show actual harm, the putative class action du jour has been one brought by those asserting claims under laws that provide for an award of statutory damages.

In Cohen v. Facebook, Inc., No. C 10-5282 (N.D. Calif.),  the plaintiffs accused Facebook of using their images without consent and in violation of a California state publicity rights statute, California Civil Code Section 3344.  That law provides in part:  “. . . in any action brought under this section, the person who violated the section shall be liable to the injured party or parties in an amount equal to the greater of seven hundred fifty dollars ($750) or the actual damages suffered by him or her as a result of the unauthorized use . . . .”  The plaintiffs’ position that no injury needs to be established was firmly rejected.  The decision seems reasonable because, otherwise, statutes similar to the one used against Facebook would allow for recovery by anyone who is casually related to the activity of the company violating that statute. 

There is another similar case currently pending in the U.S. Supreme Court–First American Financial Corporation v. Denise P. Edwards, No. 10-708.  That case could change the way federal privacy statutory damage statutes are viewed in federal court because of a similar argument.  In fact, even though the case does not address social media or privacy issues, Facebook, LinkedIn, Yahoo!, and Zynga have supported the petitioners with an amici curiae brief.  The arguments are slightly different from the Facebook case because the First American lawsuit deals with a federal statute and traditional notions of Article III standing apply.  Still, an adverse ruling to First American could open the floodgates to putative class actions by plaintiffs with no specific harm because they are relying on statutes that provide for an award of statutory damages. 

The way that damages are calculated under a statute that provides for a minimum amount of recovery should not be interpreted as repudiating a requirement for proof that a plaintiff has been injured.  Rather, a statutory minimum amount provision should only be interpreted as a legislative attempt to ensure that plaintiffs who suffer actual harm can recover something–however small–despite not being able to quantify the damages suffered.  Holding otherwise would abrogate the constitutionally required showing of a concrete and particularized injury to bring a lawsuit.

Photo of Theodore J. Kobus III Theodore J. Kobus III

Ted Kobus stands at the forefront of cyber protection — no small role in an era defined by crippling data breaches and daily digital threats. He has earned authority in the areas of privacy, data security and cybersecurity, leading clients to entrust him…

Ted Kobus stands at the forefront of cyber protection — no small role in an era defined by crippling data breaches and daily digital threats. He has earned authority in the areas of privacy, data security and cybersecurity, leading clients to entrust him with more than 6,000 data breach responses. Businesses, government and other organizations turn to Ted for sound advice on compliance, developing response strategies, breaches implicating domestic and international laws, and defense of both class action litigation and regulatory actions. Notably, he has developed key relationships with the U.S. Department of Justice (DOJ), where he and his team have helped to establish protocols to protect corporate victims following a data breach. He knows the most proactive regulators involved in this space and interacts with them regularly.

Ted has led the defense to hundreds of regulatory investigations, including those brought by the Attorney General Multi-State, Department of Health and Human Services Office for Civil Rights, Departments of Insurance, SEC and FTC. In the healthcare space, Ted has defended more than 200 OCR investigations and has negotiated more privacy/security-related resolution agreements than any other lawyer.

Ted is consistently ranked in Chambers USA: America’s Leading Lawyers for Business, and he is one of only a handful of attorneys nationwide named an MVP by Law360 for Privacy and Consumer Protection. He is a regular contributor to BakerHostetler’s Data Counsel blog, and he frequently speaks at major industry events regarding data breach response, risk management and litigation issues affecting privacy. Ted has spoken at the National Association of Attorneys General on data security issues in a closed session, as well as the National Security Cyber Specialist’s Training Conference organized by the DOJ.

Ted is the firmwide chair of BakerHostetler’s Digital Assets and Data Management Group and a member of the firm’s Policy Committee.