Third and Seventh Circuits Weigh In On Article III Standing After Spokeo
In a pair of cases, the US Courts of Appeals for the Third and Seventh Circuits reached different conclusions in light of the US Supreme Court's decision in Spokeo, Inc. v. Robins as to whether a defendant's violation of a statute mandating protection and destruction of consumers' personal information is enough to grant a plaintiff Article III standing.
In Spokeo, Inc. v. Robins, the US Supreme Court held that an action based on an alleged statutory violation, without a showing of concrete harm, does not satisfy the injury-in-fact requirement to establish standing (136 S. Ct. 1540, 1549 (2016)). In a pair of recent cases, the US Courts of Appeals for the Third and Seventh Circuits relied on Spokeo in reaching different conclusions on whether and when an alleged statutory violation gives rise to an injury for Article III standing purposes.
On January 20, 2017, in In Re Horizon Healthcare Services, Inc. Data Breach Litigation, the Third Circuit vacated the district court's dismissal of the plaintiffs' putative class action, holding that the improper disclosure of personal data in violation of the Fair Credit Reporting Act ( www.practicallaw.com/4-502-8855) (FCRA) is a cognizable injury for purposes of Article III standing (2017 WL 242554 (3d Cir. Jan. 20, 2017)).
On the same day, in Gubala v. Time Warner Cable, Inc., the Seventh Circuit held that the plaintiff lacked standing because he failed to allege any harm or risk of harm from the defendant's alleged violation of the Cable Communications Policy Act (CCPA), because he did not allege that the defendant disclosed or lost his personal data (2017 WL 243343 (7th Cir. Jan. 20, 2017)).
The Horizon Decision
Horizon Healthcare Services, Inc., a New Jersey-based health insurance provider, collects and maintains personal identifying information on its customers as part of its business.
In November 2013, two laptop computers containing unencrypted personal information of over 800,000 Horizon customers were stolen from Horizon's headquarters.
Plaintiffs sued Horizon in 2014 on behalf of themselves and a class of Horizon customers, alleging that Horizon violated the FCRA and several state laws by failing to protect their personal information. Although the plaintiffs did not allege that their identities were entirely stolen, some alleged various consequences to their credit score and tax refunds as a result of the release of their personal information.
Horizon sought to dismiss the complaint for lack of subject matter jurisdiction ( www.practicallaw.com/3-501-7659) under FRCP 12(b)(1). The district court granted the motion, concluding that the plaintiffs lacked Article III standing because they did not suffer a cognizable injury.
The Third Circuit vacated the dismissal, accepting the plaintiffs' argument that Horizon's alleged violation of their statutory right in the security of their personal information was itself an injury for purposes of Article III standing, because:
Supreme Court precedent held that the breach of a statute can cause an injury, and thus grant Article III standing, even without additional harm if Congress permits it.
By enacting the FCRA, Congress established that the unauthorized disclosure of personal information by a credit reporting agency is an injury in and of itself.
The plaintiffs' allegations describe the very injury the FCRA was intended to prevent.
In rejecting the defendant's reading of Spokeo, the Third Circuit held that Spokeo merely reiterated traditional tests for standing, but did not alter them in any way. Instead, Spokeo merely clarified that Congress has broad power to define injuries for standing purposes, including those not recognized under common law. And because the plaintiffs alleged a de facto injury that satisfied the concreteness requirement for Article III standing, the Third Circuit saw no need to consider whether there could be some circumstances where the mere technical violation of a procedural requirement cannot constitute an injury in fact.
The Time Warner Cable Decision
Derek Gubala was a Time Warner Cable subscriber from 2004 through 2006, when he cancelled his subscription. In 2014, he learned that Time Warner retained the personal information he provided to the company when he first subscribed. Gubala commenced a putative class action suit in federal court, seeking injunctive relief for alleged violations of the Cable Communications Policy Act (47 U.S.C. § 551(e)), which requires cable operators to destroy subscribers' personal information when the information becomes no longer necessary for the purpose for which it was collected. Although Gubala claimed that Time Warner's retention of his information violated a privacy right, he failed to allege that Time Warner leaked, lost, gave away, or intended to give away any of the information.
The district court dismissed Gubala's suit for lack of standing, holding that he alleged only a bare statutory violation without any allegations of injury or risk of harm.
The Seventh Circuit affirmed the dismissal, citing Spokeo for the proposition that alleging a bare statutory violation without any plausible risk of harm is not substantial enough to be deemed "concrete" for Article III standing purposes. The court emphasized that although violations of privacy rights are actionable, Gubala failed to allege that Time Warner released or intended to release any of his personal information.
Although the Third and Seventh Circuits ultimately reached different conclusions as to whether the named plaintiffs satisfied Article III's injury-in-fact requirement, both cases underscore that would-be class action plaintiffs must actually suffer concrete and particularized harm. A harm that is theoretical or based on conjecture is not enough to pass muster under the Supreme Court’s standing jurisprudence. In these cases:
The Time Warner plaintiff presented no evidence or allegations of a security breach or the potential for future harm from Time Warner's retention of his personal information. The sum of the alleged injury was the bare violation of a statute, without any concrete harm or risk of harm.
The Horizon plaintiffs, by contrast, presented more robust allegations regarding the consequences of the defendant's statutory violation. They alleged both an injury in fact (that their personal information was in fact stolen and disseminated), as well as immediate and continuing risk of future injury from identity fraud, identity theft, tax fraud, and insurance fraud.
Both cases therefore stand as a reminder that any analysis of a putative class action complaint must include a careful reading of the pleadings to ensure the plaintiff actually pleaded a legally cognizable harm.