On May 16, 2016, the Supreme Court of the United States rejected the standing argument of a “bare procedural violation” advanced by the plaintiff in Spokeo, Inc. v. Robins. The Court reaffirmed that the injury-in-fact requirement means a plaintiff must allege an injury that is both “concrete and particularized” and “actual or imminent, not conjectural or hypothetical” — even in the context of a statutory violation. A plaintiff cannot satisfy the demands of Article III by alleging a bare procedural violation unaccompanied by “concrete harm” or “the risk of real harm” as articulated in Clapper v. Amnesty Int’l USA.
The plaintiff alleged a violation of the Fair Credit Reporting Act (“FCRA”), which lets consumers claim damages if a company publishes a false report about them. Spokeo argued the plaintiff should have to show an injury in fact, while the plaintiff argued it’s enough to show the company violated the statutory law. The district court dismissed the plaintiff’s complaint ruling that he had not properly pled an injury in fact as required by Article III.
The Court, reversing the Ninth Circuit, ruled that a violation of the FCRA may result in no harm. It gave the example of publishing an incorrect zip code, stating that “[i]t is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.” Courts deciding motions to dismiss at the pleading stage must determine whether plaintiffs clearly allege facts demonstrating an injury in fact.
This opinion should have a significant effect on the standing arguments typically advanced by businesses in data breach class action lawsuits, i.e., a data breach alone is insufficient to meet the standing requirement. It could also have an important impact on lawsuits alleging violations of the Fair Debt Collection Practices Act, the Telephone Consumer Protection Act, and state deceptive trade practices statutes.