Supreme Court Grants Cert in Spokeo v. Robins

In a case that may have vast consequences for online privacy cases, the high court will weigh whether plaintiffs need to point to cognizable harm to sustain claims of federal statutory violations or whether a violation of a statute alone is enough to confer standing

On April 27 the United States Supreme Court granted certiorari in Spokeo, Inc. v. Robins, setting the stage for the high court to resolve a critical standing question that is an issue in almost all online privacy cases: namely, whether Congress may confer Article III standing on plaintiffs that do not suffer concrete and tangible harms, and therefore would otherwise not be able to invoke federal court jurisdiction, by authorizing a private right of action based on a statutory violation of federal law.

The Supreme Court’s decision to grant certiorari in Spokeo is significant in two ways: first, its ruling should determine whether plaintiffs whose personal information is exposed may be able to sustain legal action against defendants under certain federal information privacy laws, even when the plaintiffs suffer no real harm yet can allege a statutory violation. Second, the Supreme Court granted cert in Spokeo despite the Solicitor General’s recommendation against it.

Sometime next term the Supreme Court will review the 9th Circuit’s ruling that the plaintiff had sufficient Article III standing to bring a putative class action against Spokeo, Inc. under the Fair Credit Reporting Act (FCRA), despite the fact that the plaintiff did not suffer actual and cognizable harm. The plaintiff alleged that Spokeo willfully violated the FCRA by publishing factually incorrect personal information about him on its website. Importantly, the 9th Circuit ruled that the FCRA created a statutory cause of action that did not require the plaintiff to show that he had suffered any actual harm, and that “the violation of a statutory right is usually a sufficient injury in fact to confer standing.”

In its briefs arguing for certiorari, Spokeo advocated that the Supreme Court’s intervention was necessary to resolve a split amongst the federal appellate courts on whether a claim of a federal statutory violation is in-and-of itself sufficient to sustain an allegation, even when no actual injury is suffered.

Please revisit the Privacy & Security Law Blog later this week for a more detailed analysis of Spokeo v. Robins and how the Supreme Court’s eventual decision may affect the ability of plaintiffs to wage legal action in data breaches and other privacy scenarios even when no concrete harm is suffered.