Whether they would admit it or not, most people have probably at some point searched for their own name in a search engine. Often the results illustrate how much personal information has been scraped and aggregated by websites who thereafter provide this information to interested parties, usually for a fee. Spokeo Inc. ("Spokeo") is one of these websites. Unsurprisingly, the possibility that personal information can be accessed by a few clicks has raised questions about privacy and security. Recently, Spokeo settled allegations of a violation of the Fair Credit Reporting Act ("FCRA") with the Federal Trade Commission ("FTC") that required it to pay a significant monetary penalty. In the last month, as detailed below, Spokeo has also suffered a setback in the Ninth Circuit concerning alleged violations of the FCRA.
In Robins v. Spokeo, Inc., --- F. 3d ----, 2014 WL 407366 (9th Cir. 2014), Robins had sued Spokeo for willful violations of the FCRA, 15 U.S.C. § 1681 et seq. Specifically, Robins alleged that Spokeo violated the FCRA by describing him untruthfully as holding a graduate degree and as wealthy, untruths that ended up hindering his employment prospects, thereby causing actual harm. The case ascended all the way to the ruling discussed infra in this post, though not without an interesting antecedent procedural history. Initially, the district court held for Spokeo in dismissing the claim for lack of subject-matter jurisdiction since Robins had not alleged any actual or imminent harm. However, once Robins filed an amended complaint detailing the detrimental developments arising from Spokeo's decision to post his personal information as detailed above, the same district court then denied Spokeo's motion to dismiss on subject-matter jurisdiction grounds. The district court concluded that Robins had alleged sufficient injury in fact in the amended complaint when he expanded on the connection between Spokeo's publication of false information and the subsequent injury (unemployment and anxiety resulting therein). A few months later, in another reversal, the same district court concluded during consideration of Spokeo's interlocutory appeal that its previous ruling that granted Robins standing was incorrect. It concluded that Robins failed to plead injury in fact. Robins then timely appealed.
In considering Robins' appeal, the Ninth Circuit initially noted that since Congress had created a private cause of action within the FCRA, it intended for this provision to create a statutory right. A violation of a statutory right is "usually a sufficient injury in fact" to confer standing. Spokeo then argued that even if Robins possessed a statutory cause of action under the FCRA, it must fail due to lack of actual harm. In disagreeing, the Ninth Circuit held that a statutory cause of action does not require a showing of actual harm when a plaintiff sues for willful violations of the FCRA, as Robins had.
The court considered another impediment for Robins, that is, the Constitutional limits on the power of Congress to confer standing, and thus statutory rights. In citing to the Sixth Circuit, the court identified two requirements in order for a court to confer standing on Robins: (1) the plaintiff must be among the injured insofar as it is literally the plaintiff's statutory rights that were violated; and (2) the statutory right at issue must protect against individual, rather than collective harm. See Beaudry v. TeleCheck Servs., Inc., 579 F.3d 702 (6th Cir. 2009). The court held that Robins satisfied both of these requirements. First, he was alleging that Spokeo violated his statutory rights, not just the statutory rights of the other people. Second, Robins possessed a "concrete and particularized" interest in not having false personal information exist on the internet, an interest easily distinguishable from an interest rooted in collective harm. Therefore, Robins had sufficiently alleged Article III standing.