Early Spokeo fallout: Privacy defendants try to capitalize
Pincus, of course, argued the case at the Supreme Court for Spokeo, a data broker accused of violating the Fair Credit Reporting Act by publishing inaccurate information about Thomas Robins, the lead plaintiff in a FCRA class action. Spokeo contended that Robins had suffered no concrete injury and that a mere statutory violation is not enough of an injury to give plaintiffs constitutional standing to sue in federal court. The Supreme Court agreed that plaintiffs have to show more than a technical violation of consumer protection law to establish standing – but also said that, in some circumstances, the breach of a “procedural right” amounts to a concrete injury.
Confusing, right? And even more so because after the decision, both Spokeo and the class action bar claimed – with convincing quotations! – that the opinion was a huge victory for their side. (George Washington University law professor Daniel Solove blogged semi-humorously about the M.C. Escher-like qualities of the ruling.)
To respond to consumer class action proponents such as Paul Bland of Public Justice, who led off his post about the ruling with a taunt to Spokeo’s many backers in the business lobby, Pincus posted Wednesday at Mayer Brown’s Class Defense Blog, calling out what he considers to be unjustified spin from the plaintiffs’ bar. “The bottom line: The legal theory on which standing had been upheld in dozens of no-injury class actions is no longer valid and plaintiffs will have to find new arguments to justify standing to sue in these cases,” Pincus wrote.
It will be a long while until the lower courts decide who won Spokeo – but it is already clear that defendants in privacy class actions are going to wield the Supreme Court ruling like a weed wacker. In just the first few days after its issuance, the decision is already an issue in three privacy breach cases.
U.S. District Judge Theodore Chuang of Greenbelt, Maryland, cited Spokeo in an opinion Thursday remanding a data breach class action against the Children’s National Health System to Maryland state court. (I first saw the case reported by Law360.) Judge Chuang’s decision, which includes an insightful analysis of the circuit split on constitutional standing and injury in data breach cases, pulled the most salient Spokeo quotes in a single sentence that attempts to capture the essence of the ruling: “Although ‘Congress may ‘elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law,’ a ‘bare procedural harm’ under a federal statute, ‘divorced from any concrete harm,’ would not ‘satisfy the injury-in-fact requirement,'” the judge wrote. In this case, in which the lead plaintiff’s only alleged injury is a violation of state law, she does not meet the Spokeo standard to sue in federal court, Judge Chuang said. (The hospital is represented by Baker & Hostetler.)
At the 3rd U.S. Circuit Court of Appeals, which already takes a hard line on intangible injuries for data breach class action plaintiffs, the payroll company Paytime’s lawyers at Lewis Brisbois Bisgaard & Smith argue in a new brief that the Supreme Court’s Spokeo decision should encourage the appeals court to continue to dismiss cases in which the only injury is prospective misuse of stolen data. “The (3rd Circuit) standard requiring a plaintiff to allege that his information was misused by a hacker after a data breach should be upheld not only because it is the binding law of this jurisdiction, but also because it is the only standard that comports with the purpose of Article III, which is to limit the power of the judiciary to actual cases and controversies,” the Paytime brief said, citing Spokeo.
Meanwhile, in federal court in Manhattan, Conde Nast is using Spokeo to bolster its arguments for the dismissal of a class action alleging violations of a Michigan law protecting subscribers’ personal information. “Because plaintiff here alleges no concrete harm whatsoever, she ‘cannot satisfy the demands of Article III by alleging a bare procedural violation,” wrote the publisher’s Dentons lawyers in a letter to U.S. District Judge Naomi Reice Buchwald.
It’s a good sign of the confusion surrounding Spokeo’s true meaning that the plaintiffs in the Conde Nast case, represented by Bursor & Fisher, also quote from the opinion in their own letter, arguing against dismissal of the case. As you might guess, plaintiffs noted Spokeo’s holding that injuries need not be tangible to qualify as concrete, as well as the justices’ assurance that the violation of a statutory right “can be sufficient in some circumstances to constitute injury in fact.”
Early predictions about how Supreme Court rulings will impact class action law have been wrong before. (I’m looking at you, Comcast v. Behrend.) And with plaintiffs and defendants pushing radically different interpretations of Spokeo, one set of analysts will inevitably turn out to be wrong here as well. These three data privacy cases will be leading indicators of which set that will be.
For more of my posts, please go to WestlawNext Practitioner Insights