Supreme Court to Decide Whether Victim of Privacy Breach Can Recover Damages Without Showing Harm

The Supreme Court will hear a case this fall, Spokeo, Inc. v. Robins, that will settle this important issue. The Court’s decision in Spokeo, expected in 2016, will likely have far-reaching implications for consumer privacy and data breach lawsuits filed under a number of federal statutes.

Plaintiff Thomas Robins filed a putative class action against Spokeo in federal court in California under the Fair Credit Reporting Act (FCRA), claiming that Spokeo willfully violated the FCRA by disseminating inaccurate information about him on its website. The district court dismissed Robins’s complaint for lack of standing, reasoning that Robins failed to allege any actual harm that was traceable to Spokeo’s alleged statutory violations.

The Ninth Circuit reversed, holding that the FCRA created a cause of action that does not require a showing of actual harm, and therefore, a violation of the statute is itself a sufficient injury to confer standing. Because Robins’s complaint alleged that “Spokeo violated his statutory rights, and not just the rights of other people,” and because his “personal interests in the handling of his credit information are individualized, rather than collective,” Robins satisfied the requirements for Article III standing.

Spokeo’s petition for certiorari asks the Court to resolve the following question: “Whether Congress may confer Article III standing upon a plaintiff who suffers no concrete harm and who therefore could not otherwise invoke the jurisdiction of a federal court, by authorizing a private right of action based on a bare violation of a federal statute.” Spokeo’s petition noted the division of authority among lower courts on this issue and emphasized the potential for a proliferation of class action lawsuits seeking huge damages awards based on a bare statutory violation if the issue is not settled.

How the Supreme Court resolves this issue will dramatically impact the viability of class action and individual lawsuits filed under the FCRA and a host of other federal privacy statutes that allow plaintiffs to recover statutory damages where actual damages for violations may be difficult to prove or quantify.