Privacy & Cybersecurity Law Blog

On May 16, 2016, the United States Supreme Court issued a decision in Spokeo Inc. v. Thomas Robins, holding 6-2 that the Ninth Circuit’s ruling applied an incomplete analysis when it failed to consider both aspects of the injury-in-fact requirement under Article III. Writing for the Court, Justice Samuel Alito found that a consumer could not sue Spokeo, Inc., an alleged consumer reporting agency that operates a “people search engine,” for a mere statutory violation without alleging actual injury.

In this case, after discovering that his Spokeo-generated profile contained inaccurate information, the respondent filed a federal class-action complaint against Spokeo, alleging that the company willfully failed to comply with the requirements of the Fair Credit Reporting Act of 1970 (“FCRA”). The FCRA regulates the creation and use of consumer reports by consumer reporting agencies for certain specified purposes. The District Court dismissed the respondents’ complaint, holding that he had not properly pleaded injury-in-fact as required by Article III. The Ninth Circuit reversed the District Court’s decision, finding that because Spokeo allegedly violated the respondent’s statutory rights and that the respondents’ “personal interests in the handling of his credit information are individualized,” the respondent had adequately alleged an injury in fact.

According to the Supreme Court opinion, the injury-in-fact requirement requires a plaintiff to show that he or she suffered “an invasion of a legally protected interest” that is “concrete and particularized.” The Court found that the Ninth Circuit’s injury-in-fact analysis failed to address the “concreteness” requirement, which is distinct from an injury being “particularized” (i.e., affects a plaintiff in a personal and individual way).

The Court also reasoned that the Ninth Circuit failed to address whether the alleged procedural violations involved a degree of risk sufficient to meet the “concreteness” requirement. While a “concrete” injury need not be tangible, the Court indicated that a statutory violation alone does not automatically satisfy the injury-in-fact requirement. According to the Court, “[t]his does not mean, however, that the risk of real harm cannot satisfy that requirement.”