Georgetown Law
Technology Review

Introduction

Spokeo is a people search engine that allows its users to view a profile of the searched individual that includes information such as: age, employer, address, relatives, marital status, and economic status.1Spokeo, http://www.spokeo.com (last visited Oct. 21, 2016). Spokeo does not retrieve all of its information from one particular source, nor does Spokeo search for the data. Instead, Spokeo aggregates data from a multitude of online and offline sources and provides users with the option of removing any inaccurate information. Using deep web crawlers, 2Agrawal, Smita & Kriti Agrawal, Deep Web Crawler: A Review, 1 Int’l J. of Innovative Research in Computer Sci. & Tech. 1, 2 (2013) (Deep web crawlers are web crawlers that specific collect data from the deep web. Web crawlers search web documents, collect their information, and save their indices for search engines to process in a fast manner). Spokeo gathers and combines different sources of publicly available information that can be obtained from individuals’ Facebook check-ins, Pandora playlists, Flickr images and even dating sites. 3Spokeo, supra note 1.

In 2003, Thomas Robins brought a class action suit alleging that Spokeo had violated the Fair Credit Reporting Act (FCRA) by publishing inaccurate information about him, including inaccurate information about his education and economic status. 4Robins v. Spokeo, Inc. 742. 3d 409, 410 (9th Cir. 2014). Robins claimed that Spokeo’s publication of this falsified information precluded him from employment opportunities he would have received if potential employers were provided with the correct information about Robins on Spokeo’s website. 5Id. When the case reached the Supreme Court, the issue was whether the harms Robins’ claimed satisfied Article III standing requirements. 6Id.

The district court dismissed the claim, finding that Robins had failed to allege an injury-in-fact because he argued that the false information might affect his future job prospects rather than demonstrating that Spokeo’s actions had in fact resulted in the loss of job offers. Robins appealed, and the Ninth Circuit reversed. 7See id. at 411. The Supreme Court granted certiorari. 8See id. at 410. Upon review, the Supreme Court held that the Article III analysis performed by the Ninth Circuit was incomplete and remanded the case to consider the separate elements of harm that it held the Ninth Circuit had conflated—concreteness and particularity. 9Spokeo, Inc., v. Robins. 136 U.S. 1542, 1547 (2016).

This comment analyzes the Supreme Court’s decision and concludes that the Court should have affirmed the Ninth Circuit’s finding of injury-in-fact, as the harm was both particularized and concrete. By remanding, the Court weakened the ability of individuals to protect their right to privacy created by Congress in the FCRA.

Analysis

Article III of the United States Constitution requires that a plaintiff must demonstrate “irreducible constitutional minimum standing by illustrating, among other factors, that she suffered an injury in fact” 10Lujan v. Defenders of Wildlife, et.al., 504 U.S., 555, 556 (1992). to pursue legal redress. Within injury-in-fact, a plaintiff is further required to show that she suffered an “invasion of a legally protected interest that is both concrete and particularized.” 11Id. at 560. If a plaintiff is unable to demonstrate concreteness or particularization, she lacks standing. 12Id. Without standing a court lacks subject-matter jurisdiction, and cannot hear the plaintiff’s claim. 13Allen v. Wright, 468 U.S. 737, 750-751 (1984).

Particularization demonstrates that an injury has affected a plaintiff in a personal and individual way. In addressing whether Robins had standing, the Ninth Circuit found that he had an individualized interest in handling his financial information, which was both particular and concrete. This comment argues that the harm suffered by Robins was both particular and concrete, and was therefore unnecessarily remanded by the Supreme Court.

Treatment of Standing

In Lujan v. Defenders of Wildlife, the Court held that in order to have standing, a plaintiff must demonstrate harm specific to the plaintiff, rather than to the public at large. 14See id. at 579. Here, the Ninth Circuit and the Court agree that Robins alleged a particularized injury: Robins asserted that he suffered individual harm to his employment prospects as a result of Spokeo publishing false information about his education, financial, and familial status. 15Spokeo, 136 U.S. at 1548. Robins argued that this misinformation would cause employers to believe that he was overqualified, expected a higher salary than employers would be willing to pay, and was less mobile due to family commitments; 16Id. at 1554. thereby impairing his ability to find employment.

However, the Court found that the Ninth Circuit had not adequately analyzed whether the harm was also concrete. 17Id. at 1548. The court distinguishes concreteness from particularization by stating that a concrete harm must be “real,” rather than “abstract.” 18Id. Further, while both the history and judgment of Congress play an important role in determining whether an intangible harm constitutes injury in fact, 19Id. a statutory violation by itself does not necessarily satisfy the concreteness requirement if it is only a bare procedural violation. 20Id. at 1549. (Here the majority suggests that a bare procedural violation is a violation of the statute that would cause no actual harm; the example offered is an incorrect zip code). The Court left it to the Ninth Circuit to determine whether the harm in this case is more than a bare procedural violation of the FCRA.

While the Court did not explicitly determine that the alleged injury is not concrete enough to warrant standing, by leaving the door open for the determination that a violation of a federal statute protecting privacy is insufficient, the Court is not adequately acknowledging the value Congress placed on consumer privacy when it enacted the FCRA21See 15 U.S.C. § 1681(a)(4) (2016).—weakening all consumers’ right to privacy. The primary purposes of the FCRA are to protect the privacy of consumers and ensure the veracity of consumers’ published financial information. footnote]See 15 U.S.C. § 1681(b)(2016) (defining the purpose of the FCRA as “requiring that consumer reporting agencies adopt reasonable procedures” to ensure that credit reporting is “fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization” of consumer information).[/footnote] The Court itself has previously recognized those goals as primary to the enactment of the FCRA. 22Safeco Ins. Co. of America v. Burr, 551 U.S. 47, 52 (2007) (“Congress enacted the FCRA in 1970 to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy.”)

Moreover, Robins’s injury was more than a “bare procedural violation” of the FCRA. The majority offers the example of an incorrect zip code as a procedural violation of the FCRA that does not create harm. 23See Spokeo, 136 U.S. at 1550. As Justice Ginsburg notes in her dissent, the impact of the violation here clearly goes farther and creates a real harm, as the inaccurate representations of Robins’ financial status and family situation impaired his ability to find employment. 24Id. at 1556. She further states that remand is not necessary. In addition to the harm being concrete, Ginsburg notes that prior cases do not distinguish particularization and concreteness from one another. One example cited is Summers v. Earth Island Institution, where the Court does not separately address concreteness and particularization. Instead, they are considered as one factor. 25See Summers v. Earth Inst., 555 U.S. 488, 494 (2009) (“To establish concrete and particularized injury that standing requires, respondents point to their member’ recreational interests in the national forests. While generalized harm to the forest or the environment will not alone support standing, if that harm in fact affects the recreational or even the mere esthetic interest of the plaintiff, that will suffice.”) In trying to parse out the difference between a particular harm and a concrete harm, the Court loses sight of the need to maintain the remedy provided by Congress.

Future Considerations and Data Breaches

Spokeo now warns its users that information obtained should not be used “to make decisions about employment, tenant screening, or any purpose covered by the FCRA”. 26Id. Disclosures such as these are meant to protect companies from further lawsuits. However, users are not restricted from using the gathered information for illegal purposes, rather they are merely advised or discouraged from doing so by such notices. Companies like Spokeo may therefore continue to provide the information necessary for third parties to violate the FCRA by simply subscribing to their membership and paying a monthly fee. The continuous supply of information that companies such as Spokeo make available for others to use illegally poses a serious threat for individual privacy rights, and the holding in Spokeo advances such abuse.

The Court’s decision has already impacted courts across the nation. footnote]See generally Khan v. Children’s National Health, 2016 WL 2946165(D. Md. May 19, 2016).[/footnote] Prior to Spokeo, data breach cases involving misuse of information faced a high bar to establish standing, and Spokeo has raised that bar even higher. 27Jeryn Crabb, Data-Breach Class Actions Feel the Effects of “Spokeo v. Robins.” Wash. Legal Found. (July 1, 2016), http:wlflegalpulse.com/2016/ 07/01/data-breach-class-actions-feel-the-effects-of-spokeo-v-robins. Courts must now turn to Spokeo when deciding whether data-breach claims sufficiently demonstrate an injury-in-fact that is both particularized and concrete. 28Id. In Gubala v. Time Warner Cable, Inc., the plaintiff alleged that Time Warner violated the Cable Communications Policy Act by retaining the plaintiff’s personal information after the service contract had been terminated. 29Gubala v. Time Warner Cable Inc., 2016 WL 3390415 at n.1 (E.D. Wis. June 17, 2016). When addressing the issue of concreteness, the Court turned to “the clear directive [given by] Spokeo” to conclude that the plaintiff only sufficiently alleged a particularized injury, without addressing concreteness. 30Id. at 5. Just as the Court found that Robins did not show a particularized injury by simply alleging possible employment loss, the Court agreed that Gubala had similarly failed to claim such an injury. 31Id. While Spokeo’s decision may not appear to have been revolutionary, the decision has already provided courts with a more stringent threshold for analyzing Article III standing questions.

Privacy protections under American law consist of a combination of sector-specific protections, rather than any omnibus privacy regulation. Privacy is protected in the Federal Constitution under the Fourth Amendment, 32U.S. Const., amend. IV. and under many state Constitutions. 33Cal. Const. Art. I, §1. The majority of states further recognize legal redress for invasions of privacy under applicable tort statutes. 34Restatement (Second) of Torts §28 (Am. Law. Inst. 2016). But the vast majority of privacy protections under American law are created by statute. The Privacy Act of 1974 sets out requirements that government agencies must abide by in order to protect individual privacy rights. 35Privacy Act of 1974, Pub. L. No. 93-579 (1974). HIPAA protects an individual’s health privacy, 36Health Insurance Portability and Accountability Act, Pub. L. No. 104-191 (1996). and GINA protects the privacy of individual’s genetic information. 37Genetic Information Nondiscrimination Act of 2008, 42 U.S.C. § 2000ff (2012). The VPPA affords protection for an individual’s video rental information, 38Video Privacy Protection Act of 1988, 18 U.S.C. § 2710 (2012). ECPA the content of electronic communications, 39Electronic Communications Privacy Act of 1986, 18 U.S.C. §§ 2701–12 (2012). and FERPA affords specific privacy protections for students. 40Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232g (2012). This constellation of individual protections are all significantly affected by Spokeo—the way the lower courts apply the decision will determine whether individuals will have standing to pursue the legal redress these statutes are intended to provide. If there is no legally recognized harm as an element of injury-in-fact, the plaintiff does not have standing, and cannot receive redress from a court, and those protections become meaningless.

Conclusion

The Supreme Court should have affirmed the Ninth Circuit’s decision. Both the Ninth Circuit and the Supreme Court acknowledge that the harm suffered by Robins from the publication of inaccurate information by Spokeo was a sufficiently particularized enough harm to warrant injury-in-fact. While the majority did not find the Ninth Circuit’s standing analysis complete, as Justice Ginsburg notes in her dissent, remand was unnecessary. The harm alleged was concrete and particularized, and the need to protect consumer privacy is too important to make it more difficult for individuals to hold corporations accountable in court when they violate a federal statute. This decision, and the result from remand, has substantially impacted the future of consumers’ ability to bring privacy and data-breach claims in federal courts.