You are on page 1of 2

June 2, 2016

Authors:

Travis Brennan
Shareholder
(949) 725-4271
Tbrennan@sycr.com

Katie Beaudin
(949) 725-4074
Kbeaudin@sycr.com

sycr.com

Supreme Court Offers Limited Guidance, And No


Conclusion, On Standing in Consumer Suits
Involving Data Mishandling
On May 16, 2016 the U.S. Supreme Court issued a muchanticipated ruling in which it passed on an opportunity to impose
stricter standing requirements on plaintiffs in actions alleging
mishandling of consumer information. The ruling in Spokeo, Inc. v.
Robins made clear that a federal statutes grant of individual rights
alone does not necessarily confer standing to sue for a violation of
those rights. However, the ruling is unlikely to alter the trend of
increased consumer lawsuits arising from data mishandling or breach
in the near future because the Supreme Court did not itself apply the
injury-in-fact standing analysis required under the U.S. Constitution.
Thomas Robins alleged that Spokeo violated the Fair Credit
Reporting Act (FCRA) because it failed to follow reasonable
procedures to assure maximum possible accuracy of consumer
reports. The District Court dismissed his complaint for failure to
properly plead an injury-in-fact, but the Ninth Circuit Court of
Appeals reversed that decision. Rather than applying the injury-in-fact
standard itself, the Supreme Court ultimately remanded the case back
to the Ninth Circuit, ordering that court to do its analysis over again and
making clear that it was taking no position on the ultimate conclusion
the Ninth Circuit had reached. It held that the Ninth Circuits
application of the standard was incomplete because it had not
addressed whether the plaintiffs injuries were sufficiently concrete,
i.e., whether the injuries were real rather than abstract. There is a good
chance the Ninth Circuit will reach the same conclusion it did the first
time given the composition of that court. Even if the Supreme Court
agrees to hear the case again after the Ninth Circuit revisits the issue, it
is no longer apparent, following the death of Justice Antonin Scalia
earlier this year, that there is a majority of justices willing to limit
plaintiffs standing to sue in these types of consumer actions.

While Spokeo did not involve a breach of consumers personal


information, the Supreme Courts refusal to apply the standing
analysis in that case is likely to embolden plaintiffs in data breach
litigation. Class action plaintiffs in particular have been advancing
several theories of liability in data breach litigation that do not involve
FCRA or other federal statutes concerning informational rights,
including claims for common law negligence, violation of state
information security laws, and violation of state unfair competition
laws. While the Constitutions injury-in-fact requirement, or similar
standing requirements under state law, may apply to those claims as
well, the Supreme Courts refusal to apply that standard itself in
Spokeo means the overall trend toward more relaxed standing
requirements will continue for the foreseeable future. For companies
that collect or process personal consumer data, or have obligations in
how they report consumer data, the risks of data breach or
mishandling remain high, and ongoing compliance with the
patchwork of laws governing data security and reporting remains as
vital as ever in order to minimize exposure.

Travis Brennan
(949) 725-4271
tbrennan@sycr.com

Katie Beaudin
(949) 725-4074
kbeaudin@sycr.com

This publication is provided for your convenience and does not constitute legal advice. It
is prepared for the general information of our clients and other interested persons. This
publication should not be acted upon in any specific situation without appropriate legal
advice.

COPYRIGHT 2016 STRADLING YOCCA CARLSON & RAUTH, P.C.

PAGE 2

You might also like