The Supreme Court of the United States granted certiorari late last month in a case with important implications for consumer privacy and for the ability of Congress generally to create wholly new protections for consumers. Plaintiffs must always show that they have standing – a legally-protected interest that allegedly has been violated – before a federal court can hear their case. To do this, they must show that they have suffered or will suffer a concrete harm (an injury-in-fact), not just a statutory violation (an injury-in-law). In this case, the Court has agreed to consider whether a statute that establishes a payment due to anyone who is the victim of a violation of the law has standing.
The case involves a suit against Spokeo, a “people search engine” that aggregates information about individuals from online and offline sources. Thomas Robins sued Spokeo in a putative class action, alleging that Spokeo disseminated inaccurate information about his education, professional experience and marital status to employers and others. Robins asserted that Spokeo was a “consumer reporting agency” within the meaning of the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., and that Spokeo violated several of the FCRA’s requirements, entitling him to seek statutory damages, which he requested. The FCRA limits the circumstances in which consumer reporting agencies may provide consumer reports for employment purposes, requiring agencies to follow procedures to ensure the accuracy of those reports, give notice to providers and users of the consumer information, and to allow consumers to request their information. Negligent violation of these requirements with respect to consumers subjects consumer reporting agencies to actual damages, attorney’s fees, and costs. Willful violations allow consumers to seek statutory damages of $100 to $1,000, plus punitive damages.
The district court agreed with Spokeo that Robins had not suffered any actual or imminent harm and dismissed his case. The United States Court of Appeals for the Ninth Circuit reversed. It held that “creation of a private cause of action to enforce a statutory provision implies that Congress intended the enforceable provision to create a statutory right,” and that “the violation of a statutory right is usually a sufficient injury in fact to confer standing.” Spokeo appealed to the Supreme Court.
The Supreme Court previously granted certiorari in a similar case, but ended up dismissing the case, likely because it did not present the same question here “cleanly” enough (in other words, without extraneous issues). The Court’s decision grant of certiorari is discretionary and requires the agreement of at least four members of the Court. Claims similar to the ones pursued under the FCRA here could be pursued under the Telephone Consumer Protection Act (TCPA) (statutory damages for telephone solicitations), and the Video Privacy Protection Act (VPPA) (consumer lawsuits for knowingly disclosing personally identifiable information), among others. If the Court rules against the claim here (and depending on the breadth of the ruling), claims about violations of privacy that lack any allegations concrete injury could have to be dismissed. Given the proliferation of such claims, businesses covered by such laws should pay close attention to the proceedings in this case, which is Spokeo, Inc. v. Robins, No. 13–1339 (cert. granted Apr. 27, 2015). Oral argument will be held next term, in early fall 2015, and a decision some time before summer 2016.
Ultimately a ruling could have implications for ongoing discussions about new data privacy and security legislation.