In Spokeo, Inc. v. Robins, the US Supreme Court held that an action based on an alleged statutory violation, without a showing of concrete harm, does not satisfy the injury-in-fact requirement to establish standing (136 S. Ct. 1540, 1549 (2016)). In a pair of recent cases, the US Courts of Appeals for the Third and Seventh Circuits relied on Spokeo in reaching different conclusions on whether and when an alleged statutory violation gives rise to an injury for Article III standing purposes.

On January 20, 2017, in In Re Horizon Healthcare Services, Inc. Data Breach Litigation, the Third Circuit vacated the district court's dismissal of the plaintiffs' putative class action, holding that the improper disclosure of personal data in violation of the Fair Credit Reporting Act (FCRA) is a cognizable injury for purposes of Article III standing ( (3d Cir. Jan. 20, 2017)).

On the same day, in Gubala v. Time Warner Cable, Inc., the Seventh Circuit held that the plaintiff lacked standing because he failed to allege any harm or risk of harm from the defendant's alleged violation of the Cable Communications Policy Act (CCPA), because he did not allege that the defendant disclosed or lost his personal data ( (7th Cir. Jan. 20, 2017)).

Horizon Healthcare Services, Inc., a New Jersey-based health insurance provider, collects and maintains personal identifying information on its customers as part of its business.

In November 2013, two laptop computers containing unencrypted personal information of over 800,000 Horizon customers were stolen from Horizon's headquarters.

Plaintiffs sued Horizon in 2014 on behalf of themselves and a class of Horizon customers, alleging that Horizon violated the FCRA and several state laws by failing to protect their personal information. Although the plaintiffs did not allege that their identities were entirely stolen, some alleged various consequences to their credit score and tax refunds as a result of the release of their personal information.

Horizon sought to dismiss the complaint for lack of subject matter jurisdiction under FRCP 12(b)(1). The district court granted the motion, concluding that the plaintiffs lacked Article III standing because they did not suffer a cognizable injury.

The Third Circuit vacated the dismissal, accepting the plaintiffs' argument that Horizon's alleged violation of their statutory right in the security of their personal information was itself an injury for purposes of Article III standing, because:

In rejecting the defendant's reading of Spokeo, the Third Circuit held that Spokeo merely reiterated traditional tests for standing, but did not alter them in any way. Instead, Spokeo merely clarified that Congress has broad power to define injuries for standing purposes, including those not recognized under common law. And because the plaintiffs alleged a de facto injury that satisfied the concreteness requirement for Article III standing, the Third Circuit saw no need to consider whether there could be some circumstances where the mere technical violation of a procedural requirement cannot constitute an injury in fact.

Derek Gubala was a Time Warner Cable subscriber from 2004 through 2006, when he cancelled his subscription. In 2014, he learned that Time Warner retained the personal information he provided to the company when he first subscribed. Gubala commenced a putative class action suit in federal court, seeking injunctive relief for alleged violations of the Cable Communications Policy Act (47 U.S.C. § 551(e)), which requires cable operators to destroy subscribers' personal information when the information becomes no longer necessary for the purpose for which it was collected. Although Gubala claimed that Time Warner's retention of his information violated a privacy right, he failed to allege that Time Warner leaked, lost, gave away, or intended to give away any of the information.

The district court dismissed Gubala's suit for lack of standing, holding that he alleged only a bare statutory violation without any allegations of injury or risk of harm.

The Seventh Circuit affirmed the dismissal, citing Spokeo for the proposition that alleging a bare statutory violation without any plausible risk of harm is not substantial enough to be deemed "concrete" for Article III standing purposes. The court emphasized that although violations of privacy rights are actionable, Gubala failed to allege that Time Warner released or intended to release any of his personal information.

Although the Third and Seventh Circuits ultimately reached different conclusions as to whether the named plaintiffs satisfied Article III's injury-in-fact requirement, both cases underscore that would-be class action plaintiffs must actually suffer concrete and particularized harm. A harm that is theoretical or based on conjecture is not enough to pass muster under the Supreme Court’s standing jurisprudence. In these cases:

Both cases therefore stand as a reminder that any analysis of a putative class action complaint must include a careful reading of the pleadings to ensure the plaintiff actually pleaded a legally cognizable harm.