Information Today, Inc. Corporate Site KMWorld CRM Media Streaming Media Faulkner Speech Technology Unisphere/DBTA
Other ITI Websites
American Library Directory Boardwalk Empire Database Trends and Applications DestinationCRM Faulkner Information Services Fulltext Sources Online InfoToday Europe KMWorld Literary Market Place Plexus Publishing Smart Customer Service Speech Technology Streaming Media Streaming Media Europe Streaming Media Producer Unisphere Research

News & Events > NewsBreaks
Back Index Forward
Twitter RSS Feed

Supreme Court to Address Standing to Sue for Data Breaches and Privacy Violations
Posted On May 12, 2015
The ability of individuals to seek legal recovery for data breaches or the posting of inaccurate information or to defend their privacy rights may soon be impacted by the Supreme Court of the United States. It has agreed to consider whether a person can sue for the posting of incorrect information—in violation of the Fair Credit Reporting Act (FCRA)—in the absence of proof that the person was specifically harmed by the incorrect information. The court will explore whether the absence of specific harm means that the person does not have “standing” to file a lawsuit, even though the poster of the information clearly violated the FCRA. Standing is a legal requirement that applies in each and every lawsuit filed in the U.S. It states that in order to file a lawsuit against another person, business, organization, or agency, the person filing the suit must have suffered some legally recognized harm as a result of the other party’s actions.

The case that the Supreme Court will review is Spokeo, Inc. v. Thomas Robins. Robins complained in a class-action lawsuit that Spokeo, a provider of personal information online, willfully violated the FCRA by posting inaccurate information about him. Also, Spokeo allegedly failed to follow “reasonable procedures” to ensure that its information was accurate, failed to provide proper notices about the use of its information, and failed to post toll-free telephone numbers that sources can use to address inaccurate information. Robins claimed that the inaccurate information impacted his ability to find a job, but in filing his lawsuit as a class-action lawsuit—representing not only himself but all others “similarly situated”—he focused more on the violations of the law rather than the injuries he suffered.

The standing rule is based on language in Article III of the U.S. Constitution that says courts can only resolve “cases and controversies”—a controversy means that there has to be a specific dispute between the parties that would result in an actual or imminent injury to one of the parties. (“Injury” is in the legal sense, and is not necessarily a physical injury.) The rule has often come up in similar situations, in which some violation of the law or a person’s legal rights is asserted to have occurred, but the person filing the claim has not specifically been harmed by the violation.

A recent example of this is a case involving a new intelligence-gathering law that allows the surveillance of individuals who are not U.S. citizens and are outside the U.S. Amnesty International and other organizations that communicated with people they felt might be subject to surveillance under the law filed a suit claiming that the law was unconstitutional. However, because Amnesty International had not been impacted by the law specifically and only alleged a possible future injury, the court ruled it did not have standing to sue.

The ‘Injury-in-Fact’ Requirement

The keys to asserting that someone has standing to sue are finding that a person has suffered an actual or imminent “injury-in-fact,” that the injury is traceable to the defendant, and that it is likely a favorable decision by the court will resolve the controversy. In the Robins case, the question of standing was based not on Spokeo’s alleged posting of inaccurate information, but on whether Robins had suffered an actual injury-in-fact as a result of the inaccurate information. Robins claimed that the information—which indicated he had greater wealth and a more advanced college degree than he actually had—contributed to his inability to find a job.

The trial court dismissed Robins’ allegation of actual injury, which it described as “sparse.” Robins’ outcome is similar to the Amnesty International case in that the court determined he only alleged a possible future injury and did not have standing to sue. However, a federal appeals court disagreed, in large part because unlike the surveillance law that was at issue in the Amnesty International case, the FCRA includes a monetary penalty for a violation of at least $100 and as much as $1,000 to be paid to the consumer. The FCRA states, “Any person who willfully fails to comply with any requirement … is liable to that consumer in an amount equal to … damages of not less than $100 and not more than $1,000. …” The appellate court found that the availability of these damages met the injury-in-fact requirement for standing.

Safeguarding Against Violations

Spokeo’s appeal of this case to the Supreme Court was supported by the U.S. Chamber of Commerce; businesses such as Facebook, Google, Yahoo, and eBay; and the financial industry. Spokeo’s concern was that if a person can file a lawsuit—particularly a class-action lawsuit—by showing only that some legal violation occurred without being required to show that the violation actually caused harm, then businesses could be subject to potentially massive lawsuits for incidents that caused no or little actual harm. For example, I could arguably sue Spokeo for its violation of the FCRA in posting inaccurate information about me. In using Spokeo’s white pages feature and searching for my name, I found that it does not have my current address, there are inaccurate past addresses, and one listing has me living in a city that I left in 1986. Yet, I’ve not really been harmed (to my knowledge) by any of these inaccuracies and would not have noticed them but for my research for this NewsBreak.

A similar outcome could apply to data breaches and other privacy violations. If a data breach takes place, but there is no resulting impact on consumers, those consumers might still have standing to pursue a personal or class-action lawsuit because the breach violated their privacy rights or violated a right created by a state or federal statute. Under current law, most consumers have limited rights in the case of data breaches—mainly the right to be notified of the breach, to have consumer reporting services notified of the breach, and/or to get compensated for credit protection services. Only actual victims of identity theft can file a lawsuit (under some but not all circumstances, depending on the specific law covering the breach), and then only to recover the costs associated with the breach.

Consumer advocates argue that consumers must have the right to pursue litigation for data breaches or violations of privacy laws—not only to protect their rights, but also so the threat of lawsuits or liability serves as a balance against corporate excess or neglect in managing their data. A more stringent requirement for standing, they argue, would upset that balance.

The Supreme Court will be considering arguments on the Robins case and the standing required for privacy, data, consumer reporting, and similar violations later in 2015.

George H. Pike is the director of the Pritzker Legal Research Center and a senior lecturer at the Northwestern University School of Law. He teaches legal research, intellectual property, and privacy courses at the School of Law in both the J.D. and Northwestern’s innovative Master of Science in Law program. Prof. Pike is a frequent lecturer on issues of First Amendment, copyright, and Internet law for library and information professionals. He is also a regular columnist and writer for Information Today, publishing a monthly column on legal issues confronting information producers and consumers. Previously, Prof. Pike was director of the Law Library at the University of Pittsburgh School of Law, and held professional positions at the Lewis and Clark Law School and at the University of Idaho School of Law, and was a practicing attorney in Idaho Falls, Idaho. Prof. Pike received his B.A. degree from the College of Idaho, his law degree from the University of Idaho, and his Masters in Library Science from the University of Washington. He is a member of the American and Idaho State Bar Associations, the American Association of Law Libraries, and the American Intellectual Property Lawyers Association.

Email George H. Pike

Related Articles

8/11/ Offers Free Access to Criminal Records
6/24/2014First Sale Hearing Raises Questions on Kirtsaeng and Digital Goods
7/1/2014Supreme Court Ruling Upholds Individual Privacy
9/16/2014Federal Court Holds 'Browsewrap' Agreement Unenforceable
2/3/2015New U.S. Laws Impact Information Gathering and Security
6/16/2015The FCC's New Open Internet Order Faces the Realities of Implementation
10/10/2017The Supreme Court Review of Gerrymandering

Comments Add A Comment

              Back to top