The case that the Supreme Court will review is Spokeo, Inc. v. Thomas Robins. Robins complained in a class-action lawsuit that Spokeo, a provider of personal information online, willfully violated the FCRA by posting inaccurate information about him. Also, Spokeo allegedly failed to follow “reasonable procedures” to ensure that its information was accurate, failed to provide proper notices about the use of its information, and failed to post toll-free telephone numbers that sources can use to address inaccurate information. Robins claimed that the inaccurate information impacted his ability to find a job, but in filing his lawsuit as a class-action lawsuit—representing not only himself but all others “similarly situated”—he focused more on the violations of the law rather than the injuries he suffered.

The standing rule is based on language in Article III of the U.S. Constitution that says courts can only resolve “cases and controversies”—a controversy means that there has to be a specific dispute between the parties that would result in an actual or imminent injury to one of the parties. (“Injury” is in the legal sense, and is not necessarily a physical injury.) The rule has often come up in similar situations, in which some violation of the law or a person’s legal rights is asserted to have occurred, but the person filing the claim has not specifically been harmed by the violation.

A recent example of this is a case involving a new intelligence-gathering law that allows the surveillance of individuals who are not U.S. citizens and are outside the U.S. Amnesty International and other organizations that communicated with people they felt might be subject to surveillance under the law filed a suit claiming that the law was unconstitutional. However, because Amnesty International had not been impacted by the law specifically and only alleged a possible future injury, the court ruled it did not have standing to sue.

The ‘Injury-in-Fact’ Requirement

The keys to asserting that someone has standing to sue are finding that a person has suffered an actual or imminent “injury-in-fact,” that the injury is traceable to the defendant, and that it is likely a favorable decision by the court will resolve the controversy. In the Robins case, the question of standing was based not on Spokeo’s alleged posting of inaccurate information, but on whether Robins had suffered an actual injury-in-fact as a result of the inaccurate information. Robins claimed that the information—which indicated he had greater wealth and a more advanced college degree than he actually had—contributed to his inability to find a job.

The trial court dismissed Robins’ allegation of actual injury, which it described as “sparse.” Robins’ outcome is similar to the Amnesty International case in that the court determined he only alleged a possible future injury and did not have standing to sue. However, a federal appeals court disagreed, in large part because unlike the surveillance law that was at issue in the Amnesty International case, the FCRA includes a monetary penalty for a violation of at least $100 and as much as $1,000 to be paid to the consumer. The FCRA states, “Any person who willfully fails to comply with any requirement … is liable to that consumer in an amount equal to … damages of not less than $100 and not more than $1,000. …” The appellate court found that the availability of these damages met the injury-in-fact requirement for standing.

Safeguarding Against Violations

Spokeo’s appeal of this case to the Supreme Court was supported by the U.S. Chamber of Commerce; businesses such as Facebook, Google, Yahoo, and eBay; and the financial industry. Spokeo’s concern was that if a person can file a lawsuit—particularly a class-action lawsuit—by showing only that some legal violation occurred without being required to show that the violation actually caused harm, then businesses could be subject to potentially massive lawsuits for incidents that caused no or little actual harm. For example, I could arguably sue Spokeo for its violation of the FCRA in posting inaccurate information about me. In using Spokeo’s white pages feature and searching for my name, I found that it does not have my current address, there are inaccurate past addresses, and one listing has me living in a city that I left in 1986. Yet, I’ve not really been harmed (to my knowledge) by any of these inaccuracies and would not have noticed them but for my research for this NewsBreak.

A similar outcome could apply to data breaches and other privacy violations. If a data breach takes place, but there is no resulting impact on consumers, those consumers might still have standing to pursue a personal or class-action lawsuit because the breach violated their privacy rights or violated a right created by a state or federal statute. Under current law, most consumers have limited rights in the case of data breaches—mainly the right to be notified of the breach, to have consumer reporting services notified of the breach, and/or to get compensated for credit protection services. Only actual victims of identity theft can file a lawsuit (under some but not all circumstances, depending on the specific law covering the breach), and then only to recover the costs associated with the breach.

Consumer advocates argue that consumers must have the right to pursue litigation for data breaches or violations of privacy laws—not only to protect their rights, but also so the threat of lawsuits or liability serves as a balance against corporate excess or neglect in managing their data. A more stringent requirement for standing, they argue, would upset that balance.

The Supreme Court will be considering arguments on the Robins case and the standing required for privacy, data, consumer reporting, and similar violations later in 2015.