Spokeo IV: Cert Denied and the Circuit Splits Left Behind

by Bryan Cave

On January 22, 2018, the United States Supreme Court denied a petition for writ of certiorari in Spokeo v. Robins – bringing an end to an appellate saga that started in the Ninth Circuit Court of Appeals before heading up to the Supreme Court, back to the Ninth Circuit on remand, and then finally back to the Supreme Court on Spokeo’s petition.

Spokeo, Inc. (“Spokeo”), a consumer reporting agency, filed the writ petition after the Ninth Circuit, considering the case on remand from the Supreme Court, decided in 867 F.3d 1108 (9th Cir. 2017) (“Spokeo III”) (see Client Alert here), that Spokeo’s publication of inaccurate information about the plaintiff in violation of the Fair Credit Reporting Act, 15 U.S.C. § 1681, et seq. (“FCRA”), constituted concrete injuries to the plaintiff’s interest in accurate credit reporting for purposes of standing under Article III of the Constitution.

In denying Spokeo’s petition, the Supreme Court declined to provide further clarity around its decision in 136 S. Ct. 1540 (2016) (“Spokeo II”) regarding the standard for determining what constitutes a “concrete harm,” which must be established in addition to a particularized harm, as part of the injury-in-fact requirement for Article III standing. While the loop is now closed on the Ninth Circuit’s evaluation of this plaintiff’s standing, Spokeo I-IV left federal district and appellate courts split over how the “concreteness” standard is properly applied when analyzing a plaintiff’s Article III standing, particularly under federal consumer protection statutes such as the FCRA, the Fair Debt Collection Practices Act (“FDCPA”), and the Telephone Consumer Protection Act (“TCPA”).

Spokeo I – The First Ninth Circuit Decision

The Spokeo dispute arose when Thomas Robins (“Robins”) sued Spokeo after discovering that Spokeo had allegedly published a report on its website that contained inaccurate (but suggestively positive) information about Robins’ age, marital status, wealth, education level, and profession. Robins sought to recover statutory damages provided by the FCRA, alleging that the inaccuracy harmed his employment prospects at a time when he was unemployed, and that Spokeo had willfully violated Section 1681e(b) of the FCRA, which imposes requirements on credit reporting agencies to ensure the accuracy of their credit reports. Robins did not allege that he had suffered any actual, tangible harm. Judge Otis D. Wright II of the U.S. District Court for the Central District of California dismissed the case for lack of standing, and Robins appealed.

The Ninth Circuit reversed in 742 F.3d 409 (9th Cir. 2014) (“Spokeo I”), holding that Robins had pled an injury-in-fact to satisfy Article III standing because he had alleged a particularized harm that involved Robins’ personal interests in the handling of his credit information. Spokeo appealed that decision to the Supreme Court.

Spokeo II – The Supreme Court Decision

In Spokeo II, which was entered on May 16, 2016, and revised on May 24, 2016, the Supreme Court – with eight justices, prior to the appointment and confirmation of Justice Neil Gorsuch – explained that Congress cannot legislate Article III standing by merely inserting into a federal statute, such as the FCRA, a private right of action. Article III standing requires the “irreducible constitutional minimum” of (1) an injury-in-fact, (2) fairly traceable to the challenged conduct, (3) that is likely to be redressed by a favorable judgment. To establish an injury-in-fact, a plaintiff must have suffered “an invasion of a legally protected interest” that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.”

The Supreme Court reiterated that the injury-in-fact element of Article III standing requires that the plaintiff’s injury be concrete and particularized, and that these are separate types of injuries that need to be evaluated independently, “even in the context of a statutory violation.” See 136 S. Ct. at 1547-48. The Supreme Court instructed that a “concrete” injury must be real, not abstract, though the harm can be tangible or intangible. Id. A plaintiff that alleges a statutory violation without suffering any tangible harm can prove a concrete injury for purposes of Article III standing if the intangible injury “has a close relationship” to harms that were traditionally regarded as providing the basis for a lawsuit at common law. Id. at 1549. The Supreme Court noted that Congress can elevate an intangible harm to a concrete injury, but cautioned that “Congress’ role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Id. at 1550. The plaintiff’s injury must still be real, and a plaintiff does not satisfy Article III standing by alleging a “bare procedural violation, divorced from any concrete harm.” Id. at 1549-50. The Supreme Court remanded the case to the Ninth Circuit to evaluate, in light of these instructions, whether Robins had suffered a concrete injury.

Spokeo III – Ninth Circuit’s Decision on Remand

In Spokeo III, which was entered on August 15, 2017, the Ninth Circuit considered whether Robins had suffered a concrete injury, in addition to an injury that was particularized to him, and concluded that he had.

First, the Ninth Circuit considered whether the procedural mechanisms of the FCRA’s Section 1681e(b) were established to protect Robins’ concrete interests. The Ninth Circuit answered that question in the affirmative, holding that Section 1681e(b) was enacted to protect consumers’ concrete interest in accurate credit reporting. The Ninth Circuit interpreted Spokeo II to hold that “some” statutory violations alone can constitute concrete harms, and that, in making that determination, Congress’ judgment as to what injuries constitute concrete harms can be instructive, but is not dispositive. In the context of Section 1681e(b), the Ninth Circuit held that a violation could be a concrete harm for purposes of Article III standing because the FCRA was adopted to protect consumers from the transmission of inaccurate credit information, credit reports are of growing importance in modern life, and Section 1681e(b)’s protections resemble common law protections against defamation and the publication of defamatory statements. In doing so, the Ninth Circuit recognized that, while the harms protected against by Section 1681e(b) and common law defamation are not identical, they have a “close relationship” to a degree that meets the concreteness standard set forth by the Supreme Court.

Second, the Ninth Circuit considered whether Spokeo’s alleged violations of Section 1681e(b) harmed, or presented a risk of harm to, Robins’ concrete interests in accurate credit reporting. The Ninth Circuit also answered this question in the affirmative. It recognized that a violation of Section 1681e(b) would not result in a concrete harm if the violation did not result in the dissemination of an inaccurate consumer report because, if there was no dissemination or publication of the information, the alleged violation would not materially affect the consumer’s protected interest in accurate credit reporting. The Ninth Circuit further recognized that not all violations based on the dissemination of false information would result in a concrete harm for purposes of standing because the Supreme Court had expressly recognized that certain violations, such as the publication of an incorrect zip code, would not cause any concrete injury. The Ninth Circuit therefore concluded that determination of whether Robins had asserted a concrete injury based on the violation of Section 1681e(b) required examination of the alleged inaccuracies. The Ninth Circuit then analyzed Robins’ specific claims and concluded that he had pled the existence of a concrete injury because the inaccurate facts Spokeo had published about him were a “real harm” to his employment prospects. The Ninth Circuit limited its holding in two ways: first, by cautioning that this analysis is highly factual and not every inaccurate reporting of the characteristics alleged by Robins – age, wealth, and marital status – would establish a concrete injury under the FCRA; and second, by declining to consider whether its holding would apply to cases that did not involve the publication or dissemination of the inaccurate credit reporting.

Finally, the Ninth Circuit evaluated whether Robins’ allegations of harm were too speculative to establish concrete injury, and concluded that they were not. Because Spokeo’s conduct and Robins’ injury had “already occurred,” they were outside the scope of the “certainly impending” standard set forth in Clapper v. Amnesty International USA, 133 S. Ct. 1138 (2013).

Spokeo IV – The Supreme Court Denies Spokeo’s Petition

Spokeo sought Supreme Court review of the Ninth Circuit’s decision in a writ petition filed on December 4, 2017. Spokeo pointed to the circuit splits that had resulted from Spokeo II, and argued that the Supreme Court’s review and further guidance was required to quell “widespread confusion” over how and when intangible injuries would constitute “concrete” harms for purposes of Article III standing.

On January 22, 2018, the Supreme Court denied Spokeo’s petition without comment or discussion.

Conclusion – The Circuit Splits Left Behind

The Supreme Court’s denial of Spokeo’s petition ends the Spokeo I-IV saga and closes the loop on whether Robins’ FCRA claim based on publication of inaccurate credit reporting constitutes a concrete harm for purposes of Article III standing. After Spokeo, we know that intangible injuries can be deemed concrete if the harm was traditionally regarded as providing the basis for a lawsuit at common law. However, federal district and circuit courts remain split as to how Spokeo II’s concreteness standard should be applied. As of February 14, 2018, 1,303 court opinions have cited Spokeo II in the 631 days since the decision was entered and amended by the Supreme Court. That amounts to more than two court opinions per day over that period.

The circuit splits range from the manner in which the federal courts apply the “degree of risk” standard for impending injuries, to the way that the concreteness standard is applied to intangible injuries arising from alleged violations of consumer statutes.

  • For instance, the Fourth, Fifth, Seventh, Eighth, and Eleventh Circuits have interpreted Spokeo II’s concreteness standard to require a showing of actual harm or risk of impending harm to the named plaintiff, whereas the Second and Third Circuits require only a risk of harm to someone, not necessarily the named plaintiff.
  • In the context of data breach claims, the Third, Sixth, Seventh, Ninth, Eleventh, D.C., and Federal Circuits have held that victims of personal data theft have suffered a concrete harm if their personal data is stolen, whereas the Second, Fourth, and Eighth Circuits require more than just stolen data to establish a concrete harm, particularly when there has been a lengthy passage of time from the breach to the filing of the complaint.
  • Differences have also arisen in how courts apply the Spokeo standard to claims under various federal consumer statutes. The Second, Fourth, Seventh, Eighth, and D.C. Circuits have found that statutory violations of the FCRA, without more, do not meet the concreteness requirement of standing, while the Third and Ninth Circuits have reached the opposite conclusion. A similar circuit split has arisen under the FDCPA, with the Sixth Circuit holding that a violation of the FDCPA, without more, does not constitute a concrete injury sufficient for purposes of Article III standing, while the Second, Eighth, and Eleventh Circuits hold that it does. Likewise, the Third, Ninth, and Eleventh Circuits have held that a violation of the TCPA, without more, satisfies the concreteness requirement of standing, whereas a number of federal district courts, including the United States District Courts for the Eastern District of Missouri, Eastern District of Louisiana, and Western District of Louisiana, have reached the opposite conclusion. In the context of the Fair and Accurate Credit Transactions Act, the Second and Seventh Circuits have held that bare statutory violations do not satisfy Spokeo’s standard for a concrete harm, whereas a number of federal district courts, including the United States District Courts for the Southern District of Florida and the Northern District of Georgia, have found that a statutory violation alone is enough. Similar splits have emerged under the Video Privacy Protection Act and Consumer Credit Protection Act, though the majority of courts have found that a violation of those statutes, without any further injury, is sufficient to confer standing.

These district and circuit splits raise concerns regarding forum shopping, and confirm that Article III standing is an issue that should be analyzed by all parties in federal court – both at the beginning of litigation and throughout the pendency of the case. The Supreme Court will have an opportunity resolve certain of these circuit splits and revisit the issue of what constitutes a concrete harm in the context of data breach cases if it grants a pending petition for writ of certiorari to review the D.C. Circuit’s decision in Attias v. CareFirst Inc., 865 F.3d 620 (D.C. Cir. 2017).

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Bryan Cave | Attorney Advertising

Written by:

Bryan Cave

Bryan Cave on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at info@jdsupra.com. In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at: info@jdsupra.com.

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.