Spokeo v. Robins, at its simplest, asks whether someone has to suffer harm to sue. And no matter which way it goes, it’s going to be big.
The case started with Thomas Robins, who complained that the “people search engine” Spokeo was disseminating false information about him on their site, harming his employment prospects. His complaint was filed on behalf of himself and others under the Fair Credit Reporting Act, which requires consumer reporting agencies to reporting agencies to provide the correct information. The website, which aggregates publicly available information on a person, claims that Robins claim has no basis: they are not a credit reporting agency, and he had no proof of economic harm.
And that’s what this all comes down to: Is it enough to show that something was wrong or do you need to show quantifiable harm? Whatever the justices decide could extend far beyond just credit reporting.
The District Court sided with Spokeo, agreeing that under Article III of the U.S. Constitution that requires a plaintiff to suffer an “injury-in-fact” there was no grounds for a lawsuit. But on appeal to the Ninth Circuit in 2011 that decision was reversed, and the Ninth Circuit found that—on “standing by virtue of alleged violations of his statutory rights” alone—Robins had satisfied Article III.
By agreeing to hear this case, SCOTUS will no doubt make a divisive decision: in favor of Spokeo would be a blow against consumers, but in favor of Robins would be a huge win for corporations—and with far-reaching consequences, notes Barbara Mishkin for the CFPB Monitor:
A Supreme Court decision in favor of the defendant in Spokeo could have far-reaching consequences because numerous statutes allow plaintiffs to recover statutory damages where actual damages for violations are often difficult to prove or nonexistent. In addition to the FCRA and RESPA, such statutes include the TCPA, TILA, EFTA , FDCPA, and FHA. The FCRA, RESPA and many of the other statutes that allow recovery of statutory damages can be enforced by the CFPB.
A ruling in favor of the defendant would affect state law statutory damages claims that are filed in federal court. And in addition to affecting statutory damages claims under a wide array of statutes, a ruling for the defendant could discourage the filing of class actions under those statutes.
As such, Spokeo has attracted quite the roaster of supporters amongst larger companies, such as Facebook, Google, Yahoo, and eBay. They, and others, joined together and filed an amicus brief with the Supreme Court asking them to take the case and overturn the decision.
What could cause such fierce competitors to come together? Well, the threat of stakes at play in Spokeo v. Robins: any privacy case down the line could cite Spokeo in an internet privacy class action, leaving defendants (tech companies) on the hook for millions in wake of a data breach or other privacy violation.
As the Huffington Post notes, these companies feel that a verdict for Spokeo in this case could shore up a lot of current and future complaints against them:
The companies complain that they process so much data about so many people that the decision opens them up to liability from too many people if they violate the law– as if their control of so much personal data in the first place is not part of the problem. The brief is fascinating since it details the large number of lawsuits the companies are already facing that they hope a favorable Supreme Court decision could just make go away. […]
Despite the fact that Congress made it clear in these laws that private actors could enforce the law when those laws were violated, whether concrete economic harm was demonstrated or not, the companies are arguing that the Constitution under Article III bars such lawsuits unless the plaintiff can demonstrate specific economic harm– essentially gutting most private enforcement of statutes especially in the privacy arena. While violating privacy laws no doubt causes harm to consumers, the effect is often diffuse and hard to prove, but if the companies have their way, the laws will be effectively unenforceable except by underfunded public agencies — who corporate forces seek to further underfund during budgetary proceedings in Congress.
Even though we’ve been looking at it from purely a privacy perspective—which alone gives these companies a lot of incentive to keep this case on their side—the actual result of a verdict in favor of Robins wouldn’t be limited to just internet privacy class actions. SCOTUS could potentially limit the power of Congress to require plaintiffs to plead and establish actual injury, not just a violation of underlying statute.
Say Facebook experienced their own data breach, and hundreds of millions of individuals’ personal information was stolen and subsequently sold to someone who could target your information without you knowing. Something obviously went wrong on the side of Facebook, and there’s still a chance regulators will step in and fix the solution down the line. But that could take years, if ever in our current legislative climate. What other recourse do you have, if you can’t definitively prove it? I guess we’ll find out in the fall.