Courts will grapple with injury in privacy, data-breach cases after Spokeo ruling

Supreme Court

🔊 Podcast: Privacy & Data Security in the USA: Spokeo & Yahoo

It's a busy time in the US for legal issues around privacy and data security, with major developments in both the Robins-Spokeo privacy and Yahoo data breach cases. Listen in as MLex Chief Digital Risk Correspondent Mike Swift and Privacy & Data Security Correspondent Amy Miller discuss these cases and their ramifications from our San Francisco bureau.


22 August 2017. By Amy Miller.

The issue of when plaintiffs have the right to sue for damages over alleged violations of federal privacy and data breach laws is far from resolved, even after recent rulings from the US Supreme Court and a federal appeals court.

Federal judges will still have much discretion to decide if plaintiffs have alleged sufficient injury and harm to let their cases move forward using a two-part test created by the Supreme Court and the US Court of Appeals for the Ninth Circuit in Spokeo v. Robins.

Thomas Robins, a Virginia resident, sued Spokeo in federal court in 2010 under the Fair Credit Reporting Act after discovering that the company's online profile of him inaccurately described him as a married, wealthy, 50-year-old man with a graduate degree and technical background. The FCRA provides damages of between $100 and $1,000

In a 6-2 ruling last June, the Supreme Court held in Spokeo that plaintiffs like Robins must show evidence of "concrete" injury to successfully sue in federal court. The high court sent the case back to the US Court of Appeals for the Ninth Circuit, saying the lower court had failed to consider whether Robins had suffered concrete, particularized harm.

District court judges have been grappling with the issue of standing and harm in a wide range of cases ever since. The issue of standing has been particularly problematic in data breach class actions if there's only been potential, but no actual, harm resulting from the theft of personal information.

On Aug. 15, a three-judge panel at the Ninth Circuit in San Francisco ruled for Robins, finding that alleged violations of a federal law designed to protect privacy rights can be enough to establish harm and the right to sue in federal court. Robins' fear that a mistake on Spokeo's report could harm his job prospects was sufficient harm, the court said.

But even though the Ninth Circuit laid out a test for determining standing, much remains unsettled, and district court judges will still have much discretion to decide whether a case should move forward.

First, the appeals court said district courts have to determine whether the statutory provisions at issue in a particular case protect consumers' procedural rights or their "concrete" interests. The Supreme Court held in Spoke that an injury must be real, concrete and not "abstract" or merely "procedural."

The Ninth Circuit found in Spokeo that Congress did intend the FCRA to protect Robins' concrete interests in having accurate credit reporting about himself. "We have little difficulty concluding that these interests protected by FCRA's procedural requirements are 'real,' rather than purely legal creations," the panel wrote.

Next courts will have to determine if an alleged violation actually harms the plaintiffs' concrete interest, the appeals court said.

But the Ninth Circuit offered little guidance on the best way to reach that determination, saying in Spokeo that the panel "need not conduct a searching review for where that line should be drawn" because it's clear that Spokeo's incorrect information harmed Robins. "It does not take much imagination to understand how inaccurate reports on such a broad range of material facts about Robins's life could be deemed a real harm," the court said.

As a result, district courts still have much discretion to decide harm and standing issues on a case-by-case basis, which could lead to conflicting court decisions. A circuit split had already emerged, particularly in FCRA cases, as to what constitutes standing, after the Supreme Court's decision in Spokeo.

And that has led some legal experts to predict that the issue of what constitutes harm in federal court will eventually make its way to the Supreme Court again.

Privacy report