Last week, the Supreme Court remanded a privacy class action settlement to the Ninth Circuit over concerns about the named plaintiffs’ standing. Specifically, the Court ordered the Ninth Circuit to conduct a Spokeo analysis to determine whether any of the three named plaintiff’s suffered a concrete injury as a result of Google’s alleged violation of the Stored Communications Act. As a brief reminder, the Court held in Spokeo v. Robbins in 2015 that a technical or procedural violation of a statute is insufficient to meet the “concrete injury” requirement of Article III standing absent actual harm to the plaintiff. Even in cases where Congress has created a private right of action for plaintiffs to pursue violations of a statute, the Court held that does not mean the plaintiff has automatically suffered actual harm or an actual injury due to a statutory violation. In the case at bar, the Court said it could not rule on the validity of the class action settlement before these standing issues presented by Spokeo were addressed by the Ninth Circuit, which issues it also declined to decide.
In another branch of government, freshman Representative Katie Porter highlighted the Spokeo standard without naming it last month in a hearing of the Financial Services Committee, and also seemed to call its conclusion into question. During a round of questioning of a CEO facing a data breach class action lawsuit, Rep. Porter asked him why the company’s lawyers were arguing in court filings that the data breach did not cause harm to consumers, when the CEO himself was clearly uncomfortable with the idea of sharing his own personal information with the Committee.
And although Spokeo has scant federal jurisprudence, the Illinois Supreme Court ruled in January of this year that the Illinois’ Biometric Information Privacy Act (BIPA) does not require an allegation of actual injury for a plaintiff to pursue the private right of action written into the statute. That ruling is thought to have opened the door for recovery under the BIPA to many more potential plaintiffs, though it is expected that defendants will continue to lean on Spokeo in defending such suits.
The Ninth Circuit’s decision on remand on the question of standing will provide some insight into how courts are interpreting allegations of harm in the context of statutory violations, at least for the Stored Communications Act. More broadly, however, it is clear that the issue of whether a breach of personal information, without any associated nefarious use of that information, causes harm to an individual is a question that will continue to be asked by lawmakers and courts alike. And Rep. Porter’s line of questioning may also give some preview of an issue that could rear its head as Congress supposedly tries to pass a federal privacy law, while some states have already begun to settle the issue themselves.