Multiple recent decisions have applied the U.S. Supreme
Court's injury-in-fact analysis from Spokeo, Inc. v.
Robins, 136 S. Ct. 1540 (2016), to dispose of claims based on
lack of standing. In Spokeo, plaintiff Robins alleged that
Spokeo, which operates a web service that compiles general
background and contact information about individuals, violated the
Fair Credit Reporting Act ("FCRA") by publishing false
information about Robins. Id. at 1544-46. Robins alleged
that the publication of this false information—including, for
example, that he had a graduate degree and was employed, affluent,
and married with children—both violated his statutory rights
and injured his job prospects by making him appear overqualified
and too highly compensated for the jobs he desired. Id. at
1546, 1554.
The Ninth Circuit held that the plaintiff had standing to pursue
his FCRA claim, but the Supreme Court vacated the Ninth
Circuit's opinion and remanded the case for further
consideration. Id. at 1545. The Supreme Court held that
the Court of Appeals overlooked the requirement under Article III
that a plaintiff must plead an injury in fact that is not only
particularized but also sufficiently "concrete" to
support standing. Id. at 1544-45, 1550. Among other
things, Spokeo stands for the proposition that
"Article III standing requires a concrete injury even in the
context of a statutory violation." Id. at 1549. A
"bare procedural violation, divorced from any concrete harm
does not satisfy the injury-in-fact requirement of Article
III." Id.
Several federal courts have relied on the Supreme Court's
analysis in Spokeo to dispose of claims where plaintiffs
failed to allege adequately concrete injuries. Recently, a
Wisconsin federal judge granted Time Warner Cable's
("TWC") motion to dismiss a putative class action based
on the plaintiff's failure to allege a "concrete"
injury and resulting lack of Article III standing. Gubula v.
Time Warner Cable, No. 15-cv-1078, 2016 WL 3390415, at *5
(E.D. Wis. June 17, 2016), appeal docketed, No. 16-2613
(7th Cir.). Gubala accused TWC of retaining customers' personal
identification information after the termination of their cable
services, asserting that doing so violated the Cable Communications
Policy Act ("CCPA"), which requires cable operators to
destroy customers' personally identifiable information when the
information is no longer required for the purpose for which it was
collected.
The court accepted TWC's argument that Gubala lacked Article
III standing under Spokeo because he claimed only a
procedural violation of the CCPA, finding that Gubala did not
allege a "concrete" injury and, as a result, lacked
standing to sue. Id. at *4-5. While Gubala's complaint
cited media articles discussing that consumers value the privacy of
their personal information, Gubala failed to show how TWC's
retention of his personal information caused him any concrete harm.
He claimed only that the CCPA required TWC to destroy his personal
information and that TWC had not done so.
The court found that Gubala's allegations were "almost
identical to the allegations the plaintiff made in
Spokeo," which were even "a bit closer to
alleging a concrete injury." The decision explained that in
Spokeo, "the defendant wasn't just keeping [the
plaintiff's] information; it was publishing, to anyone who
viewed [Spokeo's] website, inaccurate information."
Id. at *4. "Given the clear directive in
Spokeo, the court [found] that while the second amended
complaint allege[d] a particularized injury, it [did] not allege a
concrete harm, and therefore that the plaintiff [did] not have
Article III standing to bring [the] suit." Id. at
*5.
Another federal court recently remanded a putative class action to
state court based on Spokeo. See Smith v. The Ohio
State University, No. 2:15-CV-3030, 2016 WL 3182675 (S.D. Ohio
June 8, 2016). In that case, after The Ohio State University
removed the case to federal court, the United States District Court
for the Southern District of Ohio considered whether the plaintiffs
had standing to pursue claims under the FCRA. The plaintiffs
alleged that, during the process of applying for jobs at The Ohio
State University, the University provided a disclosure and
authorization to plaintiffs that improperly included extraneous
information, such as a liability release, in violation of the FCRA.
Id. at *1. Although they were hired, the plaintiffs
claimed that they "suffered harm when their 'privacy was
invaded and they were misled as to their rights under the
FCRA.'" Id. at *1, 4.
Noting the Supreme Court's statement in Spokeo that a
"violation of one of the FCRA's procedural requirements
may result in no harm," the court explained that the
plaintiffs "admitted that they did not suffer a concrete
consequential damage as a result of OSU's alleged breach of the
FCRA." Id. at *4. The court held that "[w]ithout
a concrete and particularized injury-in-fact, there is no Article
III standing in this Court" and remanded the matter to the
Ohio Court of Claims for further adjudication. Id.
Finally, in Khan v. Children's National Health System,
No. TDC-15-2125, 2016 WL 2946165 (D. Md. May 19, 2016), the United
States District Court for the District of Maryland remanded a
putative class action to state court based on Spokeo. In
Khan, the plaintiff received treatment at a hospital in
Washington, D.C., where hackers gained access to several employee
email accounts through a "phishing" scam and obtained
access to "patient information, such as names, addresses,
dates of birth, Social Security numbers, and telephone numbers, as
well as private health care information." Id. at *1.
The plaintiff brought claims in state court against the hospital
under the Maryland and District of Columbia Consumer Protection
Acts as well as common law claims for negligence, breach of implied
contract, and unjust enrichment. Id.
The defendant removed the case to federal court under the Class
Action Fairness Act and then filed a motion to dismiss.
Id. The plaintiff asserted several bases for injury in
fact, including an "imminent threat of identity theft," a
"loss of privacy," and that "the value of her
personally identifiable information ha[d] been diminished by the
data breach." Id. at *3-6.
Relying on Spokeo, the court rejected these theories of
standing and concluded that "Khan has failed to connect the
alleged statutory ... violations to a concrete harm."
Id. at *7. Because Khan lacked standing to sue in federal
court, the district court remanded her claims back to state court.
Id. at *7.
These cases suggest that plaintiffs must clearly state how an
alleged "intangible" injury, such as the retention or
unauthorized disclosure of personal information, has resulted in a
"concrete" injury in fact, even in the context of
statutory violations. They also demonstrate that courts are willing
to analyze pending claims under Spokeo and reject them
where no concrete harm has been alleged.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.