On May 16, 2016, the Supreme Court decided Spokeo, Inc. v. Robins, ruling that a plaintiff must sufficiently allege an injury that is both concrete and particularized in order to have Article III standing, and further that a “bare procedural violation” of a plaintiff’s statutory right may not be sufficiently “concrete” under this analysis. This ruling has the potential to affect class actions generally, but may prove especially influential in privacy and data security class actions.

Plaintiff Thomas Robins brought a putative class action against Spokeo, which operates a “people search engine” that gives users access to individuals’ personal information culled from a number of databases, after Robins discovered that his Spokeo-generated profile contained inaccurate information. Specifically, the profile suggested that Robins was an affluent, employed, fifty-something husband and father with a graduate degree, yet Robins claimed that all this information was incorrect. Robins alleged that Spokeo willfully violated the Fair Credit Reporting Act (FCRA), which requires consumer reporting agencies to “follow reasonable procedures to assure maximum possible accuracy of” consumer reports. See 15 U. S. C. §1681e(b). Under the FCRA, “[a]ny person who willfully fails to comply with any requirement [of the Act] with respect to any” individual may be held liable for actual or statutory damages. See 15 U.S.C. §1681n(a). The District Court for the Central District of California dismissed the complaint, holding that Robins had not sufficiently pled an injury in fact as required for Article III standing. The Ninth Circuit reversed, essentially holding that Robins had alleged an injury in fact because his injury was sufficiently particularized, as Spokeo allegedly had violated his statutory rights and because he had a personal interest in how his credit information was handled.

The Supreme Court reversed the Ninth Circuit, ruling that the Court of Appeals had engaged in an incomplete Article III standing analysis; specifically, the Ninth Circuit had failed to consider whether Robins’ alleged injury was sufficiently “concrete,” in addition to being particularized. The Court began its analysis by noting that under the standard set out in Lujan v. Defenders of Wildlife, a party has Article III standing where the party alleges that it has suffered an “injury in fact” that is “fairly traceable” to the defendant’s conduct and that may be redressed by a judicial decision. In order to allege an injury in fact, the party must allege that it has experienced “an invasion of a legally protected interest” that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.”

The Court noted that the Ninth Circuit’s reasoning as to its injury in fact inquiry focused solely on the particularity of Robins’ injury, when the court’s analysis should have focused both on particularity and concreteness. The Court pointed out that while a concrete injury does not necessarily have to be “tangible,” it does have to be “real” as opposed to “abstract.” Moreover, a defendant’s interference with a plaintiff’s statutory right does not automatically qualify as an injury that is sufficiently concrete for Article III purposes; the plaintiff still must suffer some sort of concrete harm. The Court reasoned that although the risk of real harm could satisfy the concreteness requirement in some cases, a “bare procedural violation” – such as a consumer agency’s dissemination of an individual’s incorrect zip code, which technically would violate FCRA – would not qualify as a concrete harm. However, the Court refrained from determining whether Robins had alleged a concrete injury under FCRA, and instead remanded the case for the Ninth Circuit to decide that issue.

The Spokeo decision is likely to affect pleading in class actions generally, as plaintiffs now must be more diligent than ever in drafting their pleadings to ensure that their alleged injuries are both concrete and particularized. However, Spokeo’s more lasting legacy may be its potential limitation of class actions based on claims relating to technical or “bare procedural” violations of plaintiffs’ statutory rights. Though the Court refrained from determining whether Robins’ alleged injuries were sufficiently concrete and particularized to allow him to proceed with his FCRA claim, the Court made clear that plaintiffs whose statutory rights have been violated, but have not suffered any real harm as a result, do not have Article III standing. This takeaway resonates strongly in the privacy and data security realm, as the technical violation of plaintiffs’ statutory rights granted by laws like the Telephone Consumer Protection Act and Video Privacy Protection Act frequently serves as the basis for many class actions, even when the true “injury” stemming from such a violation often is questionable at best. The legacy of the Spokeo decision, therefore, may be fewer successful privacy and data security class actions. In the meantime, however, the decision likely means that plaintiffs’ class action attorneys will be making every effort to portray their clients’ injuries – however technical – as very real.