U.S. Supreme Court to decide whether “no-injury” classes have Article III standing

On April 27, 2015, the U.S. Supreme Court accepted jurisdiction over Spokeo, Inc. v. Robins, 742 F.3d 409 (9th Cir. 2014), to answer this question: May Congress confer Article III standing upon a plaintiff who suffers no concrete harm and who could, therefore, not otherwise invoke the jurisdiction of a federal court by authorizing a private right of action based on a bare violation of a federal statute?

Court watchers will recall that two years ago, SCOTUS accepted jurisdiction over the same issue in another case from the Ninth Circuit, First American Corp v. Edwards, 132 S. Ct. 2536 (2012). There, the Court was to determine whether a class action could be maintained for an alleged violation of the Real Estate Settlement Procedures Act (RESPA), despite the fact that none of the class members had suffered any actual injury. The case was of enormous consequence since Congress has passed dozens of statutes that grant private rights of action for their mere violation, whether or not there has been an actual harm of any sort.

But the Edwards case was dismissed before decision, and it left many wondering why. The dismissal also left unanswered whether “no-injury” classes can be maintained consistent with Article III.

Spokeo raises the same issues. The plaintiff brought suit against the people-search website for an alleged violation of the Fair Credit Reporting Act (FCRA). The plaintiff, who was unemployed, claimed that erroneous information posted by Spokeo hurt his employment opportunities. He sued for economic loss and emotional distress. The district court found the plaintiff’s injury to be speculative and dismissed his claims. But the Ninth Circuit reversed, despite Spokeo’s argument that the plaintiff lacked standing since he suffered no specific, concrete injury.

Spokeo, like Edwards, is of enormous practical importance far beyond the world of websites. From banks to credit collection companies to telecom providers, Congress has used the concept of statutory standing — and punitive fines — to empower class action lawyers to bring claims worth billions of dollars against companies on behalf of clients who suffered literally no injury at all.

Yet “[f]rom Article III’s limitation of the judicial power to resolving ‘Cases’ and ‘Controversies,’ and the separation-of-powers principles underlying that limitation,” the Supreme Court has deduced a set of requirements that together make up the irreducible constitutional minimum of standing.” Lexmark Int’l, Inc. v. Static Control Components, Inc., 134 S. Ct. 1377, 1386 (2014) (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). “Concrete injury, whether actual or threatened, is that indispensable element of a dispute which serves in part to cast it in a form traditionally capable of judicial resolution.” Schlesinger v. Reservists Comm. to Stop the War, 418 U.S. 208, 220-21 (1974).

Can Congress create standing for the mere violation of a statute without any corresponding harm, consistent with the requirement of constitutional standing contained in Article III? Will the Congressional enforcement power be curtailed? Or will the Court rule that a technical violation of a statute is concrete enough to meet the test for standing under Article III?

We will be watching.

Standing, U.S. Supreme Court

Data breaches: will any plaintiffs be left standing?

As previously discussed here and here, standing is the current hot topic when it comes to data breach class actions. The bar for demonstrating a sufficient injury to be able to bring suit in a data breach case seems to be fairly high: plaintiffs have to show that a data breach actually caused them some sort of injury. In other words, it’s not enough to say that the act of a breach in and of itself is the injury. A recent federal court decision out of Pennsylvania continued the federal courts’ trend in setting a high bar for data breach standing.

In Storm v. Paytime, a putative class of plaintiffs brought suit in the middle district of Pennsylvania following a security breach of Paytime, Inc.’s (a national payroll service company) computer systems, “in which an unknown third party allegedly accessed Plaintiffs’ confidential personal and financial information.” The plaintiffs alleged claims of negligence, breach of contract and violations of Pennsylvania’s Unfair Trade Practices and Consumer Protection Law. Paytime eventually moved to dismiss the complaint, primarily on the argument that the plaintiffs lacked standing to bring suit.

Judge John E. Jones III agreed. Here is how his opinion begins: “There are only two types of companies left in the United States, according to data security experts: ‘those that have been hacked and those that don’t know they’ve been hacked.’ . . . Further, when a data breach occurs, especially one intentionally done by a hacker, it is not unreasonable for the victims to feel that a wrong has clearly been committed. But has there been an actionable harm that is cognizable in federal court? This is the question with which we must grapple in the matter sub judice.”

In discussing whether or not the plaintiffs in this particular case had standing, Judge Jones looked to the Third Circuit, which has held that plaintiffs in data breach cases “do[] not have standing to sue” unless they “allege[] actual ‘misuse’ of the information, or that such misuse is imminent.” In this case, however, the plaintiffs’ “credit information and bank accounts look the same today as they did prior to Paytime’s data breach.” Judge Jones concluded with a strong restatement of the high standard for standing, while also providing some encouraging words for potential data breach plaintiffs:

There is simply no compensable injury yet, and courts cannot be in the business of prognosticating whether a particular hacker was sophisticated or malicious enough to both be able to successfully read and manipulate the data and engage in identity theft. Once a hacker does misuse a person’s personal information for personal gain, however, there is a clear injury and one that can be fully compensated with money damages. . . . In that situation, a plaintiff would be free to return to court and would have standing to recover his or her losses.

Read Judge Jones’ full opinion here.

Data Privacy and Cyber Security, Standing