- Privacy Risk Report - https://privacyriskreport.com -

U.S Supreme Court to Hear Case That May Have Major Implications on Data Breach Cases

On April 27, 2015 the U.S. Supreme Court granted Spokeo, Inc.’s Petition for a Writ of Certiorari appealing an opinion from the U.S. Court of Appeals for the Ninth Circuit. The Ninth Circuit decision [1] held that the Plaintiff, Thomas Robins, had standing to bring claims under the Fair Credit Reporting Act (FCRA) on behalf of a purported class. A number of plaintiffs have had their data breach cases dismissed based on findings that they lacked standing [2] because they were incapable of showing they were injured [3].

In his First Amended Complaint, Robins, an unemployed individual, brought a purported class action under FCRA and California’s Unfair Competition Law based on a consumer report that Spokeo allegedly prepared indicating that he had a graduate degree, his economic health was “very strong” and he was in the top 10% wealth level. Robins alleged that these reported facts were false. He claimed that Spokeo’s marketing of inaccurate consumer reporting information caused him actual and/or imminent harm sufficient enough to confer upon him standing to sue Spokeo. The trial court ultimately held that Robins did not have standing to bring suit because a mere violation of the statute was insufficient to confer standing absent an injury in fact. The trial court considered Robins’ diminished employment prospects on account of the false information contained in the report to be too speculative to constitute a cognizable injury.

The Ninth Circuit issued an opinion reversing the trial court’s decision to dismiss the case for lack of standing. The court held where Congress permits a private party to sue for violations of a statute, the statutory violation is sufficient to constitute a concrete injury for standing if that individual’s statutory rights were violated. Given that FCRA does not require a showing of actual harm for willful violations of the statute, Robins was not required to show any cognizable injury other than the violation itself.

The Supreme Court will address the standing issue, and likely resolve a split among the U.S. Courts of Appeal. The decision in this matter will likely have implications on standing for other plaintiffs’ data breach and privacy class actions where sometimes the only cognizable injury is a violation of a statute. If the U.S. Supreme Court were to rule in Robins’ favor on this matter, it may lower the threshold for plaintiffs to establish standing in data breach claims.