In the 9th Circuit's August 15, 2017 decision in Robins v. Spokeo, the latest in the long-running legal debate about when a consumer cause of action exists for a data breach, the 9th Circuit has declared that inaccuracies in a published credit report may sometimes constitute a "concrete injury" sufficient to confer Article III standing. This is a significant win for consumer protection advocates, as plaintiffs may now avoid the difficult task of proving actual, tangible harm flowing from a credit reporting company's error. Under Spokeo, some errors are simply bad enough to constitute injury-in-fact.

Background and Procedural History

The Defendant, Spokeo, compiles consumer data and builds individual consumer-information profiles. The Plaintiff, Thomas Robins, had alleged willful violations of the Fair Credit Reporting Act, specifically § 1681e(b), which requires consumer reporting agencies to "follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates." Specifically, Robins alleged that Spokeo falsely reported a variety of information about him (e.g., that Robins was in his 50s, married with children, employed in a professional or technical field, has a graduate degree and that his wealth level is higher than it actually is). Robins alleged that these errors (even ones that arguably portrayed him in a more favorable light), violated the FCRA and caused actual harm to his employment prospects by misrepresenting facts that would be relevant to employers.

The District Court initially dismissed Robins' complaint, declining to find standing concluding that he had alleged only a bare violation of the statute and did not suffer injury-in-fact. In 2014, the 9th Circuit reversed, finding that Robins did suffer a "concrete and particularized injury" sufficient to confer standing. On certiorari, the Supreme Court vacated the 9th Circuit's opinion and remanded the case for the court to more robustly discuss and analyze the "concreteness" requirement imposed by Article III. Thus, the 9th Circuit's task on remand was to answer the following question:

When is a violation of a statutory right, an "intangible harm," a sufficiently concrete injury for the purposes of Article III standing?

The 9th Circuit expressly adopted the 2nd Circuit's "material risk" framework elucidated in Strubel v. Comenity Bank. Strubel instructs that a procedural violation of a statute can constitute a concrete injury where Congress has conferred a procedural right to protect a plaintiff's concrete interests and the procedural violation presents a "risk of real harm to that concrete interest." Using this framework, the 9th Circuit court then engaged in a two-pronged analysis to determine: 1) whether the FCRA provisions were established to protect Robins' concrete interests; and 2) whether the procedural violations actually harmed or presented a material risk to those interests. The 9th Circuit concluded FCRA was designed to protected Robins and there was a material risk to Robins' interests.

  • First, the 9th Circuit had little difficulty concluding that the interests protected by the FCRA were in fact "real" and not "purely legal creations." Noting the ubiquity and importance of consumer reports in modern life – in particular, in employment decisions, loan applications and employment decisions – the 9th Circuit reasoned that the very existence of inaccurate information in a credit report was a threat to a consumer's livelihood. And, indeed, the interests protected by the FCRA resemble other "reputational and privacy interests" that have long been protected by the law. The 9th Circuit analogized inaccurate consumer information reporting to the common law action of libel, which is actionable per se.

    • In short, consumers like Robins enjoy a concrete interest in accurate consumer reports, and the FCRA was designed to protect that interest.
  • Second, the 9th Circuit concluded that Spokeo's FCRA violations constituted a material risk to Robins' concrete interest in an accurate consumer report. However, not all reporting inaccuracies would create such a risk: an incorrectly reported zip code would not work any concrete harm. Further, publication of inaccurate information is an important, if not dispositive, factor in this concreteness analysis.

    • This analysis will require a fact-specific evaluation of the alleged reporting inaccuracies in each and every case.

Here, Robins' allegations related to facts that were substantially more likely to harm his concrete interests than, for example, an incorrect zip code. Accordingly, Robins' allegations of harm were not too speculative to establish a concrete injury and it was of no consequence whether he did, or would, suffer additional concrete harm such as a lost job opportunity.

Where does the latest Spokeo decision leave us?

Going case-by-case, in search of bright lines. Until we have them, some reporting inaccuracies maybe deemed to create a material risk to a consumer's interest in accurate reporting, but others may not.

To view Foley Hoag's Security, Privacy and The Law Blog please click here

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.