“Injury-in-fact is not Mount Everest,” Supreme Court Justice Samuel Alito once opined. The threshold to establish constitutional standing — which requires that plaintiffs establish an “injury-in-fact” — is low; so low that in most types of lawsuits, plaintiffs have no trouble scaling the requirement. While standing may not be Mount Everest, in consumer privacy lawsuits, particularly those involving internet privacy, it can be more than a molehill. Indeed, in some cases, plaintiffs alleging harm based on alleged privacy violations have found standing to be an insurmountable defense. In particular, plaintiffs bringing claims based on the online collection, sharing, or dissemination of their personal information without more have been unable to show any “actual or imminent” harm (rather than purely speculative or possible future injury) from the allegedly unlawful conduct. See e.g., In Re Iphone Application Litig., No. 11-MD-2250, 2011 U.S. Dist. LEXIS 106865 (N.D. Cal. Sept. 20, 2011) (granting defendant’s motion to dismiss for lack of Article III standing).
Are privacy violations sufficient to constitute an injury-in-fact under the Fair Credit Reporting Act (“FCRA”)? This is one of the nuanced issues that the Ninth Circuit is pondering in connection with the appeal in Robins v. Spokeo, Inc., No. 11-56843 (9th Cir. 2012). Although Judges Diarmund O’Scannlain, Susan P. Graber or Carlos T. Bea likely should base their ruling on narrow, well-settled standing principles, it is possible that they may stretch the concept of standing under the FCRA to include harm resulting from violations of privacy interests.
Proceedings At The District Court Level
Spokeo is a website that describes itself as an aggregator of information. Unlike traditional search engines like Yahoo!, Google, or Bing, Spokeo’s search engine focuses on finding people.
Spokeo issues prominent disclaimers to users that it is not a consumer reporting agency. See Spokeo, No. 11-56843, ECF No. 26 (Brief of Appellee Spokeo, Inc.), at 4-6. It also requires users to agree that information they obtain from Spokeo cannot “be considered for purposes of determining a consumer’s eligibility for credit, insurance, employment, or for any other purpose authorized by the FCRA.” See id. Nevertheless, Plaintiff claims Spokeo is a consumer reporting agency as defined under the FCRA. In fact, he contends that Spokeo not only “assembles” data from a variety of sources, it also creates data not available from other sources, including information that allegedly bears on individuals’ economic wealth and purported creditworthiness. See Spokeo, No. 11-56843, ECF No. 8 (Appellant’s Opening Brief), at 8.
Plaintiff filed a complaint against Spokeo for violation of the FCRA, arguing that the “reports generated by Spokeo.com contain inaccurate consumer information that is marketed to entities performing background checks.” According to Plaintiff, Spokeo’s search results stated that Plaintiff had more education and professional experience that he actually has, stated he was married when in fact he is not, and inflated his financial position. Though the inaccuracies favored Plaintiff, he allegedly was concerned that Spokeo’s search results would affect his ability to obtain credit, employment, or insurance.
Spokeo moved to dismiss the complaint for lack of standing. After flip-flopping on the standing issue, the district court ultimately agreed with Spokeo. Initially, Plaintiff argued that a statutory violation (i.e., FCRA violation) is sufficient to constitute an injury-in-fact. But because the district court was unconvinced (it granted Spokeo’s first motion to dismiss), Plaintiff added allegations to his amended complaint that Spokeo’s dissemination of inaccurate information about him caused him actual harm in the form of diminished employment prospects, as well as anxiety, stress, and concern. The district court initially accepted these allegations as sufficient and denied Spokeo’s second motion to dismiss but when Spokeo sought interlocutory appeal the district court dismissed the Plaintiff’s amended complaint.
Issues On Appeal
In this post, we focus on the standing issues raised in the Spokeo case. However, we note that Plaintiff in this case is pushing the envelope on other arguments as well: he is alleging that Spokeo, an internet search engine, is a consumer reporting agency, and he is arguing that Spokeo is not entitled to a defense that it is an “aggregator” merely passing through publicly available information and, thus, immune from FCRA liability.
On appeal, the Plaintiff urges the Ninth Circuit to find standing and revive his complaint. According to Plaintiff, Article III’s requirements are met when a plaintiff alleges a statutory violation where the statute creates legal rights. Borrowing from arguments plaintiffs have made (with limited success) in internet privacy cases, he argues, the injury-in-fact is the statutory violation itself and not the harmful consequences that may ultimately result. Plaintiff claims that the FCRA is a “privacy statute designed to protect consumers from unlawful or inaccurate dissemination of their confidential consumer credit information.” Even if the FCRA required actual harm, according to Plaintiff, the harm at issue here is the “invasion of consumer’s right of privacy” arising from Spokeo’s dissemination of inaccurate information that arguably bears on creditworthiness even absent any allegations of a specific economic injury. Thus, Plaintiff claims he adequately alleged an injury because Spokeo violated Plaintiff’s FCRA rights to be free from inaccurate dissemination of consumer information.
Spokeo counters that the concept of standing is a “screen” that is meant to limit the individuals who can enforce statutory and regulatory requirements. It contends that although the FCRA creates a cause of action for statutory damages, only those individuals who can establish a concrete injury (actual harm) have standing to pursue a cause of action. Spokeo points out that Plaintiff failed to allege any consequence resulting from Spokeo’s allegedly harmful conduct; and although he is concerned that incorrect information appears in a Spokeo search might affect his job prospects, he alleges no facts to substantiate his concern.
Defendants can be on the hook for millions of dollars in consumer class actions filed in the wake of data breaches or other privacy violations. Given the stakes, standing arguments have been a primary defense in internet privacy class actions. However, in some privacy cases, courts have held that plaintiffs have standing by virtue of asserting claims under certain statutes, such as those that provide civil relief to persons whose electronic communications are intercepted or accessed without their authorization. In Spokeo, the Plaintiff is attempting to advance a similar argument to assert standing under the FCRA. It remains to be seen whether the Ninth Circuit will accept this argument and in so doing lower the standing bar so much so that it is no more than a speed bump for FCRA plaintiffs.