In the 9th Circuit's August 15, 2017 decision in Robins v. Spokeo, the latest in the long-running legal debate about when a consumer cause of action exists for a data breach, the 9th Circuit has declared that inaccuracies in a published credit report may sometimes constitute a "concrete injury" sufficient to confer Article III standing. This is a significant win for consumer protection advocates, as plaintiffs may now avoid the difficult task of proving actual, tangible harm flowing from a credit reporting company's error. Under Spokeo, some errors are simply bad enough to constitute injury-in-fact.
Background and Procedural History
The Defendant, Spokeo, compiles consumer data and builds individual consumer-information profiles. The Plaintiff, Thomas Robins, had alleged willful violations of the Fair Credit Reporting Act, specifically § 1681e(b), which requires consumer reporting agencies to "follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates." Specifically, Robins alleged that Spokeo falsely reported a variety of information about him (e.g., that Robins was in his 50s, married with children, employed in a professional or technical field, has a graduate degree and that his wealth level is higher than it actually is). Robins alleged that these errors (even ones that arguably portrayed him in a more favorable light), violated the FCRA and caused actual harm to his employment prospects by misrepresenting facts that would be relevant to employers.
The District Court initially dismissed Robins' complaint, declining to find standing concluding that he had alleged only a bare violation of the statute and did not suffer injury-in-fact. In 2014, the 9th Circuit reversed, finding that Robins did suffer a "concrete and particularized injury" sufficient to confer standing. On certiorari, the Supreme Court vacated the 9th Circuit's opinion and remanded the case for the court to more robustly discuss and analyze the "concreteness" requirement imposed by Article III. Thus, the 9th Circuit's task on remand was to answer the following question:
When is a violation of a statutory right, an "intangible harm," a sufficiently concrete injury for the purposes of Article III standing?
The 9th Circuit expressly adopted the 2nd Circuit's "material risk" framework elucidated in Strubel v. Comenity Bank. Strubel instructs that a procedural violation of a statute can constitute a concrete injury where Congress has conferred a procedural right to protect a plaintiff's concrete interests and the procedural violation presents a "risk of real harm to that concrete interest." Using this framework, the 9th Circuit court then engaged in a two-pronged analysis to determine: 1) whether the FCRA provisions were established to protect Robins' concrete interests; and 2) whether the procedural violations actually harmed or presented a material risk to those interests. The 9th Circuit concluded FCRA was designed to protected Robins and there was a material risk to Robins' interests.
- First, the 9th
Circuit had little difficulty concluding that the interests
protected by the FCRA were in fact "real" and not
"purely legal creations." Noting the ubiquity and
importance of consumer reports in modern life – in
particular, in employment decisions, loan applications and
employment decisions – the 9th Circuit reasoned that the very
existence of inaccurate information in a credit report was a threat
to a consumer's livelihood. And, indeed, the interests
protected by the FCRA resemble other "reputational and privacy
interests" that have long been protected by the law. The
9th Circuit analogized inaccurate consumer information
reporting to the common law action of libel, which is actionable
per se.
- In short, consumers like Robins enjoy a concrete interest in accurate consumer reports, and the FCRA was designed to protect that interest.
- Second, the 9th
Circuit concluded that Spokeo's FCRA violations constituted a
material risk to Robins' concrete interest in an
accurate consumer report. However, not all reporting inaccuracies
would create such a risk: an incorrectly reported zip code would
not work any concrete harm. Further, publication of inaccurate
information is an important, if not dispositive, factor in this
concreteness analysis.
- This analysis will require a fact-specific evaluation of the alleged reporting inaccuracies in each and every case.
Here, Robins' allegations related to facts that were substantially more likely to harm his concrete interests than, for example, an incorrect zip code. Accordingly, Robins' allegations of harm were not too speculative to establish a concrete injury and it was of no consequence whether he did, or would, suffer additional concrete harm such as a lost job opportunity.
Where does the latest Spokeo decision leave us?
Going case-by-case, in search of bright lines. Until we have them, some reporting inaccuracies maybe deemed to create a material risk to a consumer's interest in accurate reporting, but others may not.
To view Foley Hoag's Security, Privacy and The Law Blog please click here
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.