Are You Sitting Down? Standing in Privacy Cases After Spokeo

In May of this year, in Robins v. Spokeo, the Supreme Court ruled on the important issue of standing for plaintiffs asserting statutory claims for damages in federal court. Some observers thought the decision would guide courts hearing privacy and data breach cases in determining whether a given plaintiff could establish standing to be in federal court with their dispute. In the few months since Spokeo, several federal appellate courts have already weighed in, reaching different outcomes when applying the ruling. Based on these early results, a potential split is brewing among the federal circuit courts which could signal a return to the Supreme Court.

In Braitberg v. Charter Commc’ns, Inc., No. 14-1737 (8th Cir. Sept. 8, 2016), the Eighth Circuit addressed an alleged violation of the Cable Communications Policy Act (CCPA), 47 U.S.C. § 551(e), and whether the purported retention of personal information by a cable company met the standard for Article III injury under Spokeo. The plaintiff asserted that the defendant cable company retained his address, telephone and Social Security numbers after he cancelled the services. The CCPA requires cable operators to “destroy personally identifiable information [PII] if the information is no longer necessary for the purpose for which it was collected.” The plaintiff alleged that this retention of his PII deprived him of the “full value of services” he purchased, and invaded his “federally protected privacy rights.” Noting that Spokeo requires a “concrete” injury even in the context of a statutory violation, the appellate court concluded that the plaintiff alleged only a “bare procedural violation, divorced from any concrete harm,” and affirmed dismissal of his claims. The court noted that there were no allegations that the defendant disclosed the information to a third party or used the information in any other way, and the plaintiff did not identify any “material risk of harm from the retention.”

Just days later, the Sixth Circuit reached the opposite result in a data breach case. In Galaria v. Nationwide Mut. Ins. Co., No. 15-3386 (6th Cir. Sept. 12, 2016), the Sixth Circuit reversed the dismissal of data breach claims under state law and the Fair Credit Reporting Act. The court held that where the plaintiffs alleged that their personal information had already been stolen and was “in the hands of ill-intentioned criminals,” the alleged injury was not speculative. The plaintiffs alleged “substantial risk of harm, coupled with reasonably incurred mitigation costs” from the alleged breach, which was sufficient to establish Article III standing at the pleading stage under Spokeo.

Other federal courts have reached divergent results following Spokeo. In Church v. Accretive Health, Inc., No. 15-15708 (11th Cir. Jul. 6, 2016), the Eleventh Circuit found standing for a Fair Debt Collection Practices Act claim where the plaintiff alleged that she received a letter that failed to include certain disclosures required by the statute. The court ruled that the plaintiff sufficiently alleged a concrete injury through an “invasion of [her] right to receive the disclosures,” because Congress “created a new right” to those disclosures in the statute.

In contrast, the District of Columbia Circuit Court vacated a trial court judgment for statutory violations resulting from point-of-sale zip code collection under Spokeo. Hancock v. Urban Outfitters, Inc., No. 14-7047 (D.C. Cir. Jul. 26, 2016). In that case, the court held that the “naked assertion that a zip code was requested and recorded without any concrete consequence” was insufficient and therefore plaintiffs failed to allege an Article III injury. See also Duqum v. Scotttrade, Inc., No. 4:15-CV-1537 (E.D. Mo. Jul. 12, 2016) (threat of harm in data breach claims “too speculative” to provide standing under Article III and Clapper).

Spokeo provides only limited guidance as to the standard for Article III standing in actions in which statutory damages are alleged, which is often the situation in data breach and other privacy class actions. As illustrated by the above cases, that lack of specific direction has provided ample fodder for litigants to dispute Article III standing for privacy claims alleging statutory violations and damages. Based on the varying applications by federal courts in the first few months, Spokeo will likely not be the last word from the Supreme Court on this issue.

Molly McGinnis Stine is a Partner and John F. Kloecker is Of Counsel in Locke Lord’s Chicago office. They can be reached at mmstine@lockelord.com and jkloecker@lockelord.com.