“[I]f inaccurate information falls into a government database, does it make a sound?” Partly affirming summary judgment for the defendant in Owner-Operator Indep. Drivers Ass’n, v. DOT, No. 16-5355 (D.C. Cir. Jan. 12, 2018), the U.S. Court of Appeals for the D.C. Circuit answered its own question in the negative and held that a handful of truck drivers lacked standing to sue over the existence of allegedly inaccurate driver information in a government database. However, the court also ruled that two truck drivers about whom information was disseminated could overcome the Spokeo bar that sunk the claims of their peers and permitted their claims to go forward. In doing so, the appeals court helped clarify what actions in the digital realm rise to the level of concrete harm.

Plaintiffs in Owner-Operator were five commercial truck drivers and their industry association. Pursuant to federal regulations, the drivers’ safety records were contained in the Motor Carrier Management Information System, which employers may access through the Department of Transportation’s (DOT) Pre-Employment Screening Program. Each of the plaintiff drivers successfully challenged safety citations they had received in court, and then asked to have the citation reports removed from the safety record database.Continue Reading D.C. Circuit finds dissemination, but not mere existence, of inaccurate information in government database satisfies Article III standing requirement post-Spokeo

The Ninth Circuit added another chapter to the storied tale of Article III standing jurisprudence on August 15 when, on remand from the Supreme Court, the appellate court unanimously revived a plaintiff’s Fair Credit Reporting Act (“FCRA”) suit in Robins v. Spokeo, Inc., __ F.3d __, 2017 WL 3480695 (9th Cir. Aug. 15, 2017).

The single FCRA claim asserted by Thomas Robins is premised upon the Spokeo website, which collects data to build consumer-information profiles.  Profiles may allegedly include such details, as the court noted, as a “person’s age, contact information, marital status, occupation, hobbies, economic health, and wealth.”  Robins’ website profile allegedly included his inaccurate age, marital status, reported wealth and profession, and even his photo (of a different person).

He sued Spokeo for willful violation of section 1681e(b) of the FCRA, alleging that it had “failed to ‘follow reasonable procedures to assure maximum possible accuracy’ of the information in his credit report.”  A willful violation allows for a statutory award, even in the absence of actual damages.  See id. 15 U.S.C. § 1681n.  Robins alleged that the publication of the inaccurate information hurt his job prospects and caused him to suffer emotional distress.   Whether such alleged injuries satisfied the Article III test for standing has been the focus of the litigation, which is now in its seventh year.

On the first appeal, the Ninth Circuit reversed the district court’s dismissal of the suit, finding that Robins had pleaded a “concrete and particularized” injury, i.e., an injury-in-fact, because he had alleged Spokeo violated his individual statutory rights (Spokeo I).  The Supreme Court in May 2016 vacated the Ninth Circuit’s decision (Spokeo II).  While the Court agreed Robins’ alleged injury was particularized to him, it held that a mere alleged statutory violation was not enough to establish a concrete injury necessary for Article III standing.
Continue Reading Ninth Circuit Holds Alleged FCRA Violation Satisfies Article III Standing

In yet another appellate court decision signaling the strength of the United States Supreme Court’s 2016 Spokeo decision, the U.S. Court of Appeals for the Seventh Circuit affirmed the dismissal of a pair of putative class actions against Time Warner Cable, Inc. (“TWC”) and Great Lakes Higher Education Corporation (“Great Lakes”) alleging Fair Credit Reporting Act (“FCRA”) violations because plaintiff job applicant failed to plead an injury sufficient to establish Article III federal standing post-Spokeo.

Plaintiff Cory Groshek (“Plaintiff”) filed the pair of suits alleging that TWC and Great Lakes violated the FCRA by requesting consumer credit reports on him as part of the job application process without complying with 15 U.S.C. section 1681b(b)(2)(A).  That provision bars prospective employers such as TWC and Great Lakes from obtaining consumer reports for employment purposes unless (a) a clear and conspicuous disclosure has been made in writing to the job applicant at any time before the report is procured, in a document that consists solely of the disclosure that a consumer report may be obtained for employment purposes (commonly known as the “stand-alone disclosure requirement”); and (b) the job applicant has authorized in writing the procurement of the report.  According to Plaintiff, TWC and Great Lakes did not provide clear and conspicuous disclosures, and as a result, the authorization he provided permitting the companies to obtain consumer reports was invalid.

The trial court agreed with TWC and Great Lakes’ arguments that Plaintiff had not suffered a concrete injury over Plaintiff’s claims that he suffered concrete informational and privacy harms. In light of Spokeo, the Seventh Circuit analyzed whether “the common law permitted suit in analogous circumstances,” and whether the alleged statutory violation presented an “appreciable risk of harm” to the concrete interest Congress sought to protect via statute.  In a concise opinion, the Seventh Circuit found that Plaintiff’s claims did not confer Constitutional standing to bring suit in federal court based on either analysis.Continue Reading Seventh Circuit Affirms Dismissal of FCRA Class Claims Based on Job Application Credit Reports Due to Lack of Standing

As courts continue to grapple with close calls on standing following the U.S. Supreme Court’s seminal decision in Spokeo v. Robins, another court has given defendants a win for intangible injuries and risk of future harm.  On June 6, the District of New Jersey dismissed – for the second time – a putative class action lodged against J. Crew for a technical violation of the Fair and Accurate Credit Transactions Act (“FACTA”) because the alleged damages were too speculative to establish Article III standing.  In Kamal v. J. Crew, et al., 2017 WL 2443062 (D.N.J. June 6, 2017), U.S. District Judge William Martini granted J. Crew’s motion to dismiss plaintiff Ahmed Kamal’s Second Amended Complaint alleging the retailer printed too many credit card digits on receipts because – pursuant to Spokeo and a 2017 Third Circuit decision applying Spokeo – plaintiff failed to allege a sufficiently concrete injury.

Plaintiff alleged that J. Crew wilfully violated FACTA by printing the first six and last four digits of plaintiff’s credit card number on receipts, as FACTA directs that businesses shall not “print more than the last 5 digits of the card number.” As described by Judge Martini, the Complaint’s allegations boiled down to two distinct injuries: (1) disclosure of information considered “intrinsically private” by law; and (2) increased risk of future credit card fraud or identity theft.  Ultimately, though, neither injury was a “concrete” harm, and thus plaintiff failed to establish constitutional standing, leading to the dismissal.
Continue Reading J. Crew Credit Card Digit Class Action Dismissed Again Because of Overly Speculative Identity Theft, Fraud Risks

In an instructive opinion on how intangible harms can cause injuries sufficient to confer standing on plaintiffs—and a rare example of the U.S. Supreme Court’s latest ruling on standing aiding plaintiffs—a West Virginia federal court ruled June 30 that computer-dialed telemarketing calls caused concrete, particularized privacy invasions such that plaintiff’s Telephone Consumer Protection Act (“TCPA”) putative class action claim could move forward.

The ruling in Mey v. Got Warranty, Inc., et al., No. 5:15-cv-00101 (N.D. W.Va. June 30, 2016) provides a contrast to the growing number of dismissals issued by courts across the country finding that, after the U.S. Supreme Court’s opinion in Spokeo v. Robins, 136 S. Ct. 1540 (2016), plaintiffs in various cases failed to allege concrete, particularized injuries sufficient for Article III standing.1   Because of this, it may provide guidance for plaintiffs—particularly in the area of technology-related statutes and data breaches, where standing is often an issue—on how to avoid summary dismissal of their claims.  Given the court’s detailed opinion, the import of the holding may extend well beyond the context of the case, in which plaintiff alleged she received numerous robocalls in violation of TCPA provisions barring autodialed, prerecorded messages and calls to those on the National Do Not Call Registry.Continue Reading Federal Court Finds Intangible Harm Caused by Robocalls Sufficient for Post-Spokeo Standing in TCPA Claim Alleging Privacy Invasion

A recent argument and non-decision at the Supreme Court could have significant effects on plaintiffs’ lawsuits under consumer data protection and privacy laws. Last week, the Court heard arguments on the standard of harm for establishing standing under the Fair Credit Reporting Act, and declined to review a Driver’s Privacy Protection Act case in which the harm to the potential class was uncertain.

The cases, Spokeo Inc. v. Robins, et al. and Senne v. Palatine, Illinois, interpret actual or potential harm as a requirement for standing in actions brought under laws that protect consumers’ personal information. While the justices appeared divided on whether Spokeo’s publication of false consumer information online constituted injury sufficient to allow a plaintiff to sue under FCRA, the Court’s denial of the plaintiff’s appeal in Palatine let stand the Seventh Circuit’s decision that the benefits of including personal information on parking tickets should be balanced against the “negligible harm” of disclosing the information. The law that results in Spokeo and the new Seventh Circuit interpretation of the DPPA have the potential to make it more difficult for plaintiffs to get their privacy law cases into court.
Continue Reading Spokeo, Palatine Cases Discuss Negligible Harm from Privacy Breaches, Could Put Damper on Suits

A panel of the Seventh Circuit Court of Appeals (Wood, C.J., Kanne, J. and Tinder, J.) has reversed the dismissal of a data security breach class action lawsuit against luxury department store Neiman Marcus.

This lawsuit stemmed from a hacking incident in which “350,000 cards were potentially exposed; and 9,200 of those 350,000 cards were known to have been used fraudulently.” The company provided notices to consumers and a year of free credit monitoring. A number of class action lawsuits were brought by consumers, consolidated into the lawsuit Hilary Remijas v. Neiman Marcus Group, LLC. “The plaintiffs point to several kinds of injury they have suffered: 1) lost time and money resolving the fraudulent charges, 2) lost time and money protecting themselves against future identity theft, 3) the financial loss of buying items at Neiman Marcus that they would not have purchased had they known of the store’s careless approach to cybersecurity, and 4) lost control over the value of their personal information.”

The trial court dismissed the case for lack of Article III standing under Rule 12(b)(1) and declined to rule on defendant’s Rule 12(b)(6) argument. The Seventh Circuit found that at least some of plaintiffs’ alleged injuries passed Constitutional muster, even under the standards set forth in cases like Clapper v. Amnesty International USA.
Continue Reading Seventh Circuit Revives Data Security Breach Class Action Against Neiman Marcus: Finds Article III Standing In Class Expenses “Resolving Fraudulent Charges and Protecting…Against Future Identity Theft.”

In Clapper vs. Amnesty International, a group including journalists, human right activists, and labor leaders challenged the 2008 amendments made to the Foreign Intelligence Surveillance Act. The amendments included broadening the surveillance powers of the federal government with respect to communications outside the U.S.

Plaintiffs claimed that their work required open communication with persons