On May 16, 2016, the U.S. Supreme Court issued its opinion in Spokeo v. Robins , a highly-contested circuit court split over the question of how to establish standing in federal courts under Article III. In ruling for the data-gathering company, Spokeo, the Court established that while federal standing requires “injury in fact,” such injury must be both “particular and concrete.” In essence, the Spokeo decision may cause plaintiffs to think twice before filing a complaint based on nothing more than speculation of their damages.
While Spokeo did not involve data breach litigation, many commentators have already wondered if the Spokeo Court’s reasoning would be applied to data breach class actions.
The Spokeo decision potentially has far-reaching consequences as a number of plaintiffs in data breach cases have found establishing standing to be a difficult hurdle  to litigating their cases in federal court. And, the impact of the Spokeo decision on some plaintiffs in data breach class action cases has already begun to show.
For example, on May 18, 2016, two days following the Spokeo decision, the U.S. District Court for the District of Maryland applied the “particular and concrete” test to dismiss a privacy class action in Kahn v. Children’s National Health System  (CNHS). CNHS maintains private health care records and personal information for those to whom it provides treatment. In July 2014, hackers gained access to the accounts of such individuals, accessing information including names, addresses, birthdates, Social Security numbers and other private health care information. While Kahn – representative to a putative class action – brought claims pursuant to FRCA, she failed to allege any concrete injury. In its decision, the District Court applied the Spokeo test as follows:
“Article III standing requires concrete injury even in the context of a statutory violation.” Although Congress may “elevate the status of legally cognizable injuries that are concrete, de facto injuries that were previously inadequate in law, or a ‘bare procedural harm’ under federal statute which are ‘divorced from any concrete harm,’ would not satisfy the injury in-fact requirement.”
As seen in the Kahn decision, the impact of Spokeo may be immediate and become a slight disincentive for some plaintiffs to file complaints without specific allegations to meet the threshold of “particularized and concrete.” Consequently, while the impact of Spokeo may be limited, it should initially cause a decline in the number of speculative data breach class action lawsuits filed and cause an increase in the number of data breach cases that may be dismissed via defendants’ motions to dismiss. The full impact of Spokeo will not be known until the 9th U.S. Circuit Court of Appeals has applied the test in the manner required by the U.S. Supreme Court.
Tressler LLP law clerk Spencer Lee contributed to this post.