Spokeo v. Robins: A Dangerous Case for Privacy Plaintiffs
Spokeo is a people search engine that allows its users to view a profile of the searched individual that includes information such as: age, employer, address, relatives, marital status, and economic status.1 Spokeo does not retrieve all of its information from one particular source, nor does Spokeo search for the data. Instead, Spokeo aggregates data from a multitude of online and offline sources and provides users with the option of removing any inaccurate information. Using deep web crawlers, 2 Spokeo gathers and combines different sources of publicly available information that can be obtained from individuals’ Facebook check-ins, Pandora playlists, Flickr images and even dating sites. 3
In 2003, Thomas Robins brought a class action suit alleging that Spokeo had violated the Fair Credit Reporting Act (FCRA) by publishing inaccurate information about him, including inaccurate information about his education and economic status. 4 Robins claimed that Spokeo’s publication of this falsified information precluded him from employment opportunities he would have received if potential employers were provided with the correct information about Robins on Spokeo’s website. 5 When the case reached the Supreme Court, the issue was whether the harms Robins’ claimed satisfied Article III standing requirements. 6
The district court dismissed the claim, finding that Robins had failed to allege an injury-in-fact because he argued that the false information might affect his future job prospects rather than demonstrating that Spokeo’s actions had in fact resulted in the loss of job offers. Robins appealed, and the Ninth Circuit reversed. 7 The Supreme Court granted certiorari. 8 Upon review, the Supreme Court held that the Article III analysis performed by the Ninth Circuit was incomplete and remanded the case to consider the separate elements of harm that it held the Ninth Circuit had conflated—concreteness and particularity. 9
This comment analyzes the Supreme Court’s decision and concludes that the Court should have affirmed the Ninth Circuit’s finding of injury-in-fact, as the harm was both particularized and concrete. By remanding, the Court weakened the ability of individuals to protect their right to privacy created by Congress in the FCRA.
Article III of the United States Constitution requires that a plaintiff must demonstrate “irreducible constitutional minimum standing by illustrating, among other factors, that she suffered an injury in fact” 10 to pursue legal redress. Within injury-in-fact, a plaintiff is further required to show that she suffered an “invasion of a legally protected interest that is both concrete and particularized.” 11 If a plaintiff is unable to demonstrate concreteness or particularization, she lacks standing. 12 Without standing a court lacks subject-matter jurisdiction, and cannot hear the plaintiff’s claim. 13
Particularization demonstrates that an injury has affected a plaintiff in a personal and individual way. In addressing whether Robins had standing, the Ninth Circuit found that he had an individualized interest in handling his financial information, which was both particular and concrete. This comment argues that the harm suffered by Robins was both particular and concrete, and was therefore unnecessarily remanded by the Supreme Court.
Treatment of Standing
In Lujan v. Defenders of Wildlife, the Court held that in order to have standing, a plaintiff must demonstrate harm specific to the plaintiff, rather than to the public at large. 14 Here, the Ninth Circuit and the Court agree that Robins alleged a particularized injury: Robins asserted that he suffered individual harm to his employment prospects as a result of Spokeo publishing false information about his education, financial, and familial status. 15 Robins argued that this misinformation would cause employers to believe that he was overqualified, expected a higher salary than employers would be willing to pay, and was less mobile due to family commitments; 16 thereby impairing his ability to find employment.
However, the Court found that the Ninth Circuit had not adequately analyzed whether the harm was also concrete. 17 The court distinguishes concreteness from particularization by stating that a concrete harm must be “real,” rather than “abstract.” 18 Further, while both the history and judgment of Congress play an important role in determining whether an intangible harm constitutes injury in fact, 19 a statutory violation by itself does not necessarily satisfy the concreteness requirement if it is only a bare procedural violation. 20 The Court left it to the Ninth Circuit to determine whether the harm in this case is more than a bare procedural violation of the FCRA.
While the Court did not explicitly determine that the alleged injury is not concrete enough to warrant standing, by leaving the door open for the determination that a violation of a federal statute protecting privacy is insufficient, the Court is not adequately acknowledging the value Congress placed on consumer privacy when it enacted the FCRA21—weakening all consumers’ right to privacy. The primary purposes of the FCRA are to protect the privacy of consumers and ensure the veracity of consumers’ published financial information. footnote]See 15 U.S.C. § 1681(b)(2016) (defining the purpose of the FCRA as “requiring that consumer reporting agencies adopt reasonable procedures” to ensure that credit reporting is “fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization” of consumer information).[/footnote] The Court itself has previously recognized those goals as primary to the enactment of the FCRA. 22
Moreover, Robins’s injury was more than a “bare procedural violation” of the FCRA. The majority offers the example of an incorrect zip code as a procedural violation of the FCRA that does not create harm. 23 As Justice Ginsburg notes in her dissent, the impact of the violation here clearly goes farther and creates a real harm, as the inaccurate representations of Robins’ financial status and family situation impaired his ability to find employment. 24 She further states that remand is not necessary. In addition to the harm being concrete, Ginsburg notes that prior cases do not distinguish particularization and concreteness from one another. One example cited is Summers v. Earth Island Institution, where the Court does not separately address concreteness and particularization. Instead, they are considered as one factor. 25 In trying to parse out the difference between a particular harm and a concrete harm, the Court loses sight of the need to maintain the remedy provided by Congress.
Future Considerations and Data Breaches
Spokeo now warns its users that information obtained should not be used “to make decisions about employment, tenant screening, or any purpose covered by the FCRA”. 26 Disclosures such as these are meant to protect companies from further lawsuits. However, users are not restricted from using the gathered information for illegal purposes, rather they are merely advised or discouraged from doing so by such notices. Companies like Spokeo may therefore continue to provide the information necessary for third parties to violate the FCRA by simply subscribing to their membership and paying a monthly fee. The continuous supply of information that companies such as Spokeo make available for others to use illegally poses a serious threat for individual privacy rights, and the holding in Spokeo advances such abuse.
The Court’s decision has already impacted courts across the nation. footnote]See generally Khan v. Children’s National Health, 2016 WL 2946165(D. Md. May 19, 2016).[/footnote] Prior to Spokeo, data breach cases involving misuse of information faced a high bar to establish standing, and Spokeo has raised that bar even higher. 27 Courts must now turn to Spokeo when deciding whether data-breach claims sufficiently demonstrate an injury-in-fact that is both particularized and concrete. 28 In Gubala v. Time Warner Cable, Inc., the plaintiff alleged that Time Warner violated the Cable Communications Policy Act by retaining the plaintiff’s personal information after the service contract had been terminated. 29 When addressing the issue of concreteness, the Court turned to “the clear directive [given by] Spokeo” to conclude that the plaintiff only sufficiently alleged a particularized injury, without addressing concreteness. 30 Just as the Court found that Robins did not show a particularized injury by simply alleging possible employment loss, the Court agreed that Gubala had similarly failed to claim such an injury. 31 While Spokeo’s decision may not appear to have been revolutionary, the decision has already provided courts with a more stringent threshold for analyzing Article III standing questions.
Privacy protections under American law consist of a combination of sector-specific protections, rather than any omnibus privacy regulation. Privacy is protected in the Federal Constitution under the Fourth Amendment, 32 and under many state Constitutions. 33 The majority of states further recognize legal redress for invasions of privacy under applicable tort statutes. 34 But the vast majority of privacy protections under American law are created by statute. The Privacy Act of 1974 sets out requirements that government agencies must abide by in order to protect individual privacy rights. 35 HIPAA protects an individual’s health privacy, 36 and GINA protects the privacy of individual’s genetic information. 37 The VPPA affords protection for an individual’s video rental information, 38 ECPA the content of electronic communications, 39 and FERPA affords specific privacy protections for students. 40 This constellation of individual protections are all significantly affected by Spokeo—the way the lower courts apply the decision will determine whether individuals will have standing to pursue the legal redress these statutes are intended to provide. If there is no legally recognized harm as an element of injury-in-fact, the plaintiff does not have standing, and cannot receive redress from a court, and those protections become meaningless.
The Supreme Court should have affirmed the Ninth Circuit’s decision. Both the Ninth Circuit and the Supreme Court acknowledge that the harm suffered by Robins from the publication of inaccurate information by Spokeo was a sufficiently particularized enough harm to warrant injury-in-fact. While the majority did not find the Ninth Circuit’s standing analysis complete, as Justice Ginsburg notes in her dissent, remand was unnecessary. The harm alleged was concrete and particularized, and the need to protect consumer privacy is too important to make it more difficult for individuals to hold corporations accountable in court when they violate a federal statute. This decision, and the result from remand, has substantially impacted the future of consumers’ ability to bring privacy and data-breach claims in federal courts.
Amanda Rodriguez and Caroline Zitin
Amanda Rodriguez is a GLTR Staff Member; Georgetown Law, J.D. expected 2018; Texas A&M International University, B.A. 2015. Caroline Zitin is a GLTR Staff Member; Georgetown Law, J.D. expected 2018; Middlebury College, B.A. 2014.