The U.S. Supreme Court recently issued its much-anticipated ruling in Spokeo v. Robins, in which the Court considered whether Congress can confer Article III standing on a plaintiff to bring an action based on an alleged violation of a statute where that plaintiff has not otherwise suffered concrete injury. In a 6-2 decision, the Court held that whatever statutory violation may have occurred, a plaintiff must suffer an injury-in-fact that is concrete and particularized to satisfy Article III standing. Although “intangible” injuries can be concrete, and the “violation of a procedural right” can be sufficient in some circumstances, the Supreme Court noted that even an intangible injury must have actually occurred, such that “a bare procedural violation, divorced from any concrete harm” to the plaintiff cannot satisfy the injury-in-fact requirement.
However, the Court offered little additional guidance. Instead, in reversing, it narrowly focused on the Ninth Circuit’s standing analysis, holding that the court failed to properly address whether the procedural violations alleged by the plaintiff satisfied the concreteness requirement, and that particularization and concreteness must each be satisfied.
The impact of the Court’s decision is thus likely to be more limited than many observers and class action defendants initially hoped. While Spokeo arose under the Fair Credit Reporting Act (“FCRA”), the case had the potential to have wide implications for putative privacy class actions brought under a host of federal laws, including the Video Privacy Protection Act (“VPPA”), the Telephone Consumer Protection Act (“TCPA”), and other statutes where Congress created private rights of action and provided statutory damages to compel compliance by those regulated.
Plaintiffs have been successful in raising claims under these and other statutes without identifying cognizable harm flowing from alleged statutory violations. Standing has thus become a major issue in privacy litigation. Whether plaintiffs can satisfy this elemental requirement to have their claims survive a motion to dismiss often determines whether the parties engage in years of costly litigation or choose to settle, frequently for substantial sums.
Spokeo may ultimately have a muted impact on the issue of standing in some privacy class actions, doing little more than creating an additional hurdle for plaintiffs to clear by requiring them to demonstrate both a statutory violation and, where not apparent from or intrinsic to that violation, injury-in-fact that is both concrete and particularized. That said, the Court’s focus on an alleged harm being individualized to a plaintiff – i.e. by requiring it to be “concrete and particularized” – may make the bar for class certification harder for plaintiffs to clear. For a class to be certified, questions common to the class must predominate over questions affecting individual members and a class representative’s claims must be typical of the class. Spokeo could potentially preclude class certification when each plaintiff must show individualized harm to establish standing and not just for quantifying damages. Indeed, the Supreme Court previewed this potential argument for defendants in another case decided earlier this term, Tyson Foods v. Bouaphakeo, which examined whether a class can be certified that includes members who do not have standing, having not suffered a concrete and particularized injury.
Robins’ Problem with What Spokeo Did
The central issue in Spokeo was whether the plaintiff, Robins, suing on a FCRA claim, established the requisite constitutional standing to sue in federal court on the private right created by that federal statute. Robins alleged that Spokeo willfully violated the FCRA by publishing factually incorrect personal information about him on its website, including that he was married, had children, was employed, earned a high wage, and held a graduate degree. The Ninth Circuit ruled that the FCRA statutory cause of action that did not require plaintiffs to show that they had suffered any actual harm, and that “the violation of a statutory right is usually a sufficient injury in fact to confer standing.”
In vacating that decision and remanding to the Ninth Circuit, the Supreme Court held that a concrete injury must be “real” and not “abstract,” but that the injury suffered does not necessarily have to be “tangible.” Instead “intangible” harms – like violations of the First Amendment, injury to reputation due to slander, or being barred from accessing information Congress required to be public – or even a risk of harm – may still qualify as a “concrete” injury. And in some instances, violation of a procedural right granted by a statute affecting an intangible harm – such as being denied information Congress required to be publicly available – “can be sufficient . . . to constitute an injury in fact.”
However, the Court continued, while Congress has the power to define new injuries – including intangible harms – and new rights under a statute, a plaintiff does not automatically satisfy injury-in-fact merely by suing to enforce or vindicate that statutory right. Instead, if the statutory violation is more “procedural” in nature but itself causes no harm or risk of harm – e.g., failure to provide a required notice – the plaintiff must establish some more concrete injury resulting from the violation for there to be injury-in-fact and thus standing. In the FCRA context, where the law seeks to curb dissemination of false information by requiring consumer reporting agencies to follow particular procedures, the Court noted there may be some bare procedural violations – such as dissemination of an incorrect zip code – that could not without more cause actual harm or a risk of harm and therefore could not alone suffice to establish standing. The Supreme Court remanded the case to allow the Ninth Circuit to complete that inquiry with respect to the incorrect information about Robins that was published, but the Court took “no position” on whether Robins adequately alleged injury-in-fact leaving that entirely to the Ninth Circuit.
Is There a Valid “Public Right” versus “Private Right” Distinction?
Justice Thomas’ concurrence elaborated on the majority’s distinction between bare procedural violations “divorced from any concrete harm,” which do not satisfy standing, and intangible injuries or risks to harm that can alone constitute injury-in-fact. In Justice Thomas’ view, where a statute creates a “public right” – i.e. requirements and/or prohibitions meant to benefit the public generally –the plaintiff must still suffer some concrete, individual harm from violation of the statute, distinct from the general public, to sue individually or to serve as the representative for a class action. Alternatively, if Congress adopts a statute and creates a “private right” – i.e. a requirement/prohibition meant to benefit the individual – the plaintiff need not allege any additional harm beyond the invasion of that right.
Justice Thomas clarified that courts historically presumed a de facto injury when a plaintiff sued for invasion of a private right – therefore, a property owner would not have to show anything more than that the defendant entered his or her land to assert a claim for trespass. However, “when a plaintiff seeks to vindicate a public right, the plaintiff must allege that he has suffered a “concrete” injury particular to himself.” Statutes that provide a series of regulatory duties to protect consumers at large thus would require a plaintiff to separately demonstrate that he or she suffered a concrete and particularized harm to assert a viable cause of action.
Spokeo’s Impact on Privacy Class Actions
Spokeo may not give defendants a lot to work with, at least at the 12(b)(6) phase where defendants have their best chance at gaining dismissal of actions for lack of standing. Instead, the distinction between procedural violations “divorced from any concrete harm” that do not qualify as injuries for Article III standing purposes, and those intangible injuries or risks to harm that can alone constitute injury-in-fact, will allow plaintiffs in some cases to simply allege “concrete” harm that is sufficiently plausible to withstand a motion to dismiss. Even without such an allegation, Spokeo invites plaintiffs to argue that bare violation of a “right” protected under a given statute is not merely “procedural” but instead directly affects the plaintiff and requires no further proof of a concrete harm.
Spokeo’s greatest impact may potentially be the class certification phase. Spokeo’s emphasis on plaintiffs demonstrating both a concrete and particularized harm in order to survive the standing inquiry may create problems for certifying a class under Rule 23(b)(3), which requires a class may only be certified if questions common to class members predominate over those affecting individual members and requires the class representative’s claims to be typical of the class members. In Robins’ case under the FCRA, Justice Thomas noted in his concurring opinion an approach that may help in future standing analyses (with emphasis added here):
Section 1681e(b) [of the FCRA] requires Spokeo to follow reasonable procedures to assure maximum possible accuracy concerning the individual about whom the report relates. If Congress has created a private duty owed to Robins to protect his information, then the violation . . . suffices for Article III injury in fact. If that provision, however, vests any and all consumers with the power to police the “reasonable procedures” of Spokeo, without more, then Robins has no standing to sue . . . absent an allegation that he has suffered an individualized harm.
It is questionable whether Robins or another plaintiff could successfully show that publishing inaccurate information alone is an injury. But even if such allegation were possible, if each putative class representative and class member must first prove injury from publication of inaccurate information about that would-be plaintiff or class member to establish liability, those individual questions may well predominate over common issues and Robins’ claims may well not be typical of the class, so as to preclude certification.
Further, the combined effect of Spokeo and Tyson Foods may have a significant impact. In Tyson Foods, the Court held that statistical evidence may suffice to prove liability for the class in narrow and specific circumstances where permitted by the statute at issue, and where the exact same statistical evidence would be used to establish or defeat liability for each individual class member. The majority opinion in Tyson Foods held that Tyson Foods invited the error of potentially compensating uninjured class members because it refused to bifurcate the trial. However, Chief Justice Roberts and Justice Alito’s concurrence questioned whether the Court could rely on “invited error” to overcome the Article III injury-in-fact requirement. The Tyson Food’s majority’s ambiguity and reliance on invited error to justify compensating potentially uninjured class members is now seemingly untenable alongside Spokeo’s concrete-and-particularized injury requirement. Although some harms or injuries can be established with little more than reference to a procedural violation, this may prove to be an unintended but important silver lining for businesses defending themselves against class actions asserting procedural violations of privacy statutes.
The Future
Time will tell how the Ninth Circuit and other lower courts will resolve these questions. There are dozens of FCRA, TCPA, and other privacy cases that were stayed pending the decision in Spokeo, and the Ninth Circuit still must decide on remand whether the FCRA violations that Robins claimed are sufficiently “concrete” to satisfy standing. Even if the Ninth Circuit allows Robins to proceed, whether a class could be certified in his case is hard to predict. Meanwhile, plaintiffs and defendants in other privacy cases are sparring over Spokeo’s meaning: on May 20, defense counsel in In re Nickelodeon Consumer Privacy Litigation wrote a FRAP 28j letter to the Third Circuit arguing that Spokeo precludes reviving plaintiffs’ claim that defendants violated the VPPA, stating that plaintiffs had not alleged any concrete injury to assert standing, as Spokeo now requires. Some lower courts have previously accepted the argument that a bare violation is enough to find injury in the VPPA context.
More recently, one federal court in a TCPA case found injury because the challenged calls “required Plaintiffs to waste time answering or otherwise addressing widespread robocalls.” However, the analysis on this point was brief, and did not delve into the question whether the alleged violations involved in the challenged calls were “procedural,” such as technical failures in documenting consent, or substantive as might be the case where there is a complete lack of consent.
How courts will resolve whether a plaintiff has suffered a concrete injury in light of Spokeo, and whether the Court’s decision erects and higher barriers to class certification where concrete injury is a must to show standing, bear close watch.
