MAKING THE INTANGIBLE CONCRETE: LITIGATING INTANGIBLE PRIVACY HARMS IN A POST-SPOKEO WORLD

By Elizabeth C. Pritzker¹

I. INTRODUCTION

Twenty-five years ago, the Supreme Court in Lujan v. Defenders of Wildlife² declared that for a federal court to have subject matter jurisdiction in a case, the plaintiff must have Article III standing in the form of an "injury in fact" to bring the claim. Subsequently, "injury in fact" became a "bedrock" Article III prerequisite for a party invoking the jurisdictional power of the federal courts.³

Since Lujan, defendants have regularly sought to invoke the Article III "injury in fact" requirement as a shield against plaintiffs lacking tangible physical harm or monetized damages—especially against plaintiffs seeking statutory damages on behalf of a class. Such cases typically involve federal statutes designed to protect individuals from unauthorized data gathering, improper or negligent disclosure of their private information, unwanted solicitations and calls, or personal intrusions of their privacy. These statutes endow private litigants with causes of action that empower them to enforce the laws as "private attorneys general" and include statutory damages.⁴ This broad sweep of statutory power has put the question of Article III standing in the balance, raising concerns about whether Congress may grant standing to individuals who have not suffered tangible injury, in the form of a physical or economic harm, from the malfeasance at issue.

Last term, in Spokeo Inc. v. Robins,⁵ an eight-member Supreme Court⁶ aimed to clarify the Article III standing requirement for privacy-related class action lawsuits. Justice Alito’s majority opinion focused on two key points: (1) that "particularized" injury and "concrete" injury are distinct, but necessary, requirements of standing; and (2) that the plaintiff’s alleged "concrete" harm may be either tangible or intangible to meet Article III standing.⁷

[Page 1]

Particularization and concreteness have long been a feature in class action jurisprudence, but the notion of an intangible concrete harm raises new questions about how plaintiffs can successfully demonstrate such harm in federal court. Defendants also face new considerations when deciding whether to seek dismissal of consumer and privacy class actions based on lack of Article III standing. For example, defendants now need to carefully consider whether to remove a case to federal court. In the year since Spokeo was decided, many courts have remanded class actions to state courts based on a defense challenge to standing—with one court even awarding attorneys’ fees for improvident removal.⁸

This Article examines privacy law cases that address the intangible harm question in the months following Spokeo, to show what has and hasn’t worked for purposes of establishing Article III standing. The Article also discusses the risks defendants face in challenging plaintiffs’ asserted bases for Article III standing in cases removed to federal court.

II. SPOKEO’S ARTICULATION OF ARTICLE III STANDING

Spokeo addressed issues of Article III standing for statutory violations—in this instance, a class claim alleging violations of the Fair Credit Reporting Act (FCRA). Plaintiff Thomas Robins sued Spokeo, Inc., an online "people search engine," alleging that Spokeo had published untrue facts about him, including that he was married with children, in his fifties, employed, relatively affluent, and had a graduate degree. Robins alleged all of this information was false, and that dissemination of this information had damaged his employment prospects.⁹

Robins brought suit on behalf of himself and a class of similarly situated individuals under the FCRA, which provides for statutory damages of "not less than $100 and not more than $1,000" for each willful violation "with respect to any consumer."¹⁰ The FCRA seeks to ensure "fair and accurate credit reporting."¹¹ To achieve this end, the Act regulates the creation and use of "consumer report[s]" by "consumer reporting agenc[ies]" for certain specified purposes, such as credit transactions, insurance, licensing, consumer-initiated business transactions, and employment.¹² Specifically, the FCRA requires that credit reporting agencies "follow reasonable procedures to assure maximum possible accuracy of consumer reports" and information.¹³ Robbins alleged that Spokeo had violated these and other procedural requirements of the Act.¹⁴

[Page 2]

The district court dismissed the proposed class action on the ground that the "alleged harm to Plaintiff’s employment prospects [was] speculative, attenuated and implausible." Further, since the alleged inaccuracies, in the court’s view, had actually upgraded Robins’ personal and professional credentials, the court ruled that Robins had not alleged the "injury in fact" necessary for Article III standing.¹⁵ The Ninth Circuit reversed, finding that Robins had demonstrated "violations of statutory rights created by the FCRA [that] are ‘concrete, de facto injuries.’"¹⁶

Justice Alito, joined by five justices,¹⁷ delivered the Supreme Court’s Spokeo opinion. The opinion begins with a nod to Lujan, which "established that the ‘irreducible constitutional minimum’ of standing consists of three elements."¹⁸ These elements are that "[t]he plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by favorable judicial decision."¹⁹ To satisfy these requirements at the pleading stage, "the plaintiff must ‘clearly . . . allege facts demonstrating’ each [standing] element."²⁰

Justice Alito extensively explained the "injury in fact" element of Article III standing. To establish an "injury in fact" plaintiffs must allege "an invasion of a legally protected interest"—that is both "concrete and particularized."²¹ These inquiries, while related, are not one and the same. A particularized injury "must affect the plaintiff in a personal and individual way."²² The plaintiff must "’personally [have] suffered some actual or threatened injury.’"²³

Courts must then independently assess whether the alleged injury is concrete. "Particularization is necessary to establish injury in fact," Justice Alito wrote, "but it is not sufficient. An injury in fact must also be ‘concrete.’"²⁴ "A ‘concrete’ injury must be ‘de facto’; that is, it must actually exist . . . . [It must be] ‘real,’ and not ‘abstract.’"²⁵ But, he explained, "'[c]oncrete’ is not . . . necessarily synonymous with ‘tangible.’"²⁶ "Although tangible injuries²⁷ are perhaps easier to recognize," Justice Alito acknowledged that the Supreme Court has "confirmed in many of [its] previous cases that intangible injuries can nevertheless be concrete."²⁸

[Page 3]

In determining whether intangible injuries, such as those involving privacy or information injuries, constitute "injury in fact" for Article III purposes, Justice Alito’s Spokeo opinion identifies two factors to consider: (1) does the alleged intangible harm have "a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts";²⁹ and (2) has Congress identified the intangible harm "as one that meets minimum Article III requirements"?³⁰ This Article will refer to these factors as the (1) historical precedent factor and (2) congressional identification factor.

The historical precedent factor asks whether there is historical precedent that says the intangible harm is a cognizable and redressable injury. Notably, this factor is not rooted in statute. If, for example, the plaintiff can allege an intangible harm from a defendant practice that amounts or is analogous to an intrusion upon seclusion—a specific privacy tort listed in the Restatement Second of Torts, 652(b)—she may be found to have satisfied the first Spokeo factor of "injury in fact" identified in Justice Alito’s majority opinion because historical legal precedent supports the intangible harm caused by the intrusion upon seclusion tort.

The congressional intent factor has two components, both of which focus on statutory language and intent. First, has the Legislature identified in the statute a violation that amounts to a specific harm or a risk of such harm? In such circumstances, the violation of a "right granted by statute" will be sufficient to constitute injury and "a plaintiff in such circumstances need not allege any additional harm beyond the harm Congress has identified."³¹ Second, does the statute’s wording offer guidance on how Congress views the nature or severity of the harm in question? Stated another way, courts should ask whether one can discern, from the statute’s language or its history, a legislative attempt to "define injuries and articulate chains of causation" in such a way as to establish concreteness?³²

[Page 4]

The Supreme Court did not dismiss the case, as Spokeo had urged. Nor, indeed, did the Supreme Court majority apply the Spokeo principles articulated in Justice Alito’s opinion to the facts in the case. Instead, the court remanded the case to the Ninth Circuit, finding that their previous analysis was "incomplete" because the panel had "overlooked" concreteness.³³ In remanding the case, the Spokeo majority took "no position" as to whether Robins had alleged a "degree of risk" of harm "sufficient to meet the concreteness requirement" for standing.³⁴

The Ninth Circuit heard arguments on the remanded case on December 13, 2016. Although the panel has not issued its opinion following remand, other Ninth Circuit panels have interpreted Spokeo and its Article III standing requirements in cases involving intangible privacy or information-related concerns. Circuit and district courts throughout the country have tackled these issues as well, but with divergent results.

III. THE AFTERMATH OF SPOKEO

Spokeo‘s multi-factor inquiry introduces a fair amount of ambiguity into the Article III analysis. This has led to divergent trends in the federal courts of appeal. The Ninth Circuit as well as the Second, Third, Sixth, and Eleventh Circuits have adopted broad interpretations of Spokeo and its Article III standing requirements, while the Fourth, Seventh, Eighth, and District of Columbia Circuits have interpreted Spokeo more narrowly.

A. Circuits Construing Spokeo More Broadly

1. Ninth Circuit

The Ninth Circuit recently issued two key post-Spokeo cases. In the first of these cases, Van Patten v. Vertical Fitness Group,³⁵ plaintiff alleged on behalf of himself and similarly-situated class members that defendant’s Gold’s Gym franchises had sent unsolicited text messages for gym memberships to plaintiff’s and class members’ cell phones³⁶ in violation of the Telephone Consumer Protection Act (TCPA). Citing Spokeo, the court noted that Congress has the authority to establish concrete harms for Article III purposes, and that Congress did so in enacting the TCPA.³⁷ These harms, according to the Ninth Circuit, take the form of "[u]nsolicited telemarketing phone calls or text messages [that], by their nature, invade the privacy and disturb the solitude of their recipients."³⁸ Accordingly, the court held that "[a] plaintiff alleging a violation under the TCPA "’need not allege any additional harm beyond the one Congress has identified.’"³⁹

[Page 5]

The second notable Ninth Circuit case is Syed v. M-I, LCC.⁴⁰ The case involved whether a prospective employer could "satisfy the Fair Credit Reporting Act’s (FCRA) disclosure requirements by providing a job applicant with a disclosure that ‘a consumer report may be obtained for employment purposes’ which simultaneously serves as a liability waiver for the prospective employer and others."⁴¹ Plaintiff Syed applied for a job at M-I and signed a pre-employment form that both authorized M-I to secure Syed’s credit report as part of a pre-employment background check, and stipulated that, by signing the document, Syed was waiving his rights to sue M-I for violations of the FCRA. Although the FCRA permits employers to request credit reports of potential employees, the Ninth Circuit held that M-I’s practice of including a liability waiver in the disclosure authorization form violated a statutory provision of the Act that requires that the authorization document "consist solely of the disclosure."⁴² Importantly, the court viewed this practice as "more than a ‘bare procedural violation’" of the law.⁴³ "The disclosure requirement at issue," the court observed, "creates a right to information by requiring prospective employers to inform job applicants that they intend to procure their consumer reports as part of the employment application process . . . and [itself] creates a right to privacy by enabling applicants to withhold permission to obtain the report . . . and a concrete injury [occurs] when applicants are deprived of their ability to meaningfully authorize the credit check."⁴⁴ Thus, because "Congress has recognized the harm such violations cause, thereby articulating a ‘chain[] of causation that will give rise to a case or controversy,’"⁴⁵ the Ninth Circuit held—as in Van Patten—that Syed was not required to plead anything beyond a statutory violation for Article III standing purposes.

2. Second Circuit

The Second Circuit, in Strubel v. Comenity Bank,⁴⁶ similarly interpreted Spokeo as instructing "that an alleged procedural violation can by itself manifest concrete injury where Congress conferred the procedural right to protect a plaintiff’s concrete interests and where the procedural violation presents a ‘risk of real harm’ to that concrete interest."⁴⁷ In Strubel, the court considered whether four alleged violations of the Truth in Lending Act ("TILA") were sufficient to convey Article III standing absent a separate injury allegation under Spokeo.⁴⁸

[Page 6]

The case involved TILA-required consumer disclosures in a Victoria Secrets branded credit card agreement. Comenity Bank’s allegedly violated two of TILA’s statutory requirements in its agreements, namely (1) the requirement of notice to the consumer of consumer rights pertaining to disputed credit card purchases and (2) the requirement that a dissatisfied consumer must notify the creditor in writing, give rise to Article III standing absent a separately articulated injury.⁴⁹ "These disclosures do not operate in a vacuum," the court observed.⁵⁰ "Rather each serves to protect a consumer’s concrete interest in ‘avoid[ing] the uninformed use of credit,’ a core object of the TILA . . . These procedures afford such protection by requiring a creditor to notify a consumer, at the time he opens a credit account, of how the consumer’s own actions can affect his rights with respect to credit transactions."⁵¹ As the court explained, "[a] consumer who is not given notice of his obligations is likely not to satisfy them and, thereby, unwittingly lose the very credit rights that the law affords him." The court concluded, "a creditor’s alleged violation of each notice requirement, by itself, gives rise to a risk of real harm to the consumer’s concrete interest in the informed use of credit."⁵² Having alleged such procedural violations, Strubel was not required to allege "any additional harm" to demonstrate the concrete injury necessary for Article III standing.⁵³

Strubel was careful to distinguish other violations of statutory procedure that "present[] no material risk of harm" to plaintiffs, stating that in such instances, allegations of procedural violations, alone, would not confer standing under Spokeo. To that point, the court found that plaintiff’s "alleged defect in [TILA’s] 30-day notice of correction[ ] [for billing errors] does not, by itself, present any material risk of harm," and therefore was insufficient for Article III standing without a separate alleged injury.⁵⁴

[Page 7]

3. Third Circuit

The Third Circuit has issued two post-Spokeo cases that squarely address Article III standing in class action cases alleging data collection and data breach claims.

The first of these cases is In re Nickelodeon Consumer Privacy Litigation,⁵⁵ a multidistrict consolidated class action brought on behalf of children younger than 13 who alleged that defendants, Viacom and Google, unlawfully collected personal information about them on the Internet, including what webpages the children visited and what videos they watched.⁵⁶ Plaintiffs raised six claims, including violations of (i) the Wiretap Act (18 U.S.C. §§ 2510, et seq), (ii) the Stored Communications Act (18 U.S.C. § 2701, et seq), (iii) the California Invasion of Privacy Act (Cal. Penal Code §§ 630, et seq.), (iv) the Video Privacy Protection Act (VPPA) (18 U.S.C. § 2710), (v) the New Jersey Computer Related Offenses Act (N.J. Stat. Ann. § 2A:38A—3), and (vi) a claim under New Jersey common law for intrusion upon seclusion.⁵⁷ The district court dismissed plaintiffs’ complaints in their entirety, for lack of any sufficiently alleged concrete injury, and, on appeal, the Third Circuit first took up the question of Article III standing under Spokeo.

The Third Circuit in Nickelodeon had little difficultly deciding that plaintiffs had satisfied Spokeo‘s requirements. The court stated, "in some cases an injury in fact may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing."⁵⁸ "While perhaps ‘intangible,’" the court reasoned, the harm alleged by the plaintiffs "also is concrete in the sense that it involves a clear de facto injury, i.e., the unlawful disclosure of . . . information," which was clearly protected by statute and by common law.⁵⁹

In the second case, In re Horizon Healthcare Services, Inc. Data Breach Litigation,⁶⁰ the Third Circuit again revived a class complaint that had been dismissed by the district court for lack of Article III standing. Horizon involved the theft of two laptops containing sensitive personal information from health insurer Horizon Healthcare Services, Inc. Plaintiffs filed a class complaint on behalf of themselves and other Horizon customers whose information was stored on those laptops, alleging willful and negligent violations of the FCRA, 15 U.S.C. section 1681 et seq., as well as numerous violations of state law, stemming from plaintiffs’ claims that Horizon had failed to adequately protect their personal information.⁶¹ The district court dismissed for lack of standing, stating that none of the plaintiffs had adequately plead cognizable injury because none had alleged that the stolen personal information was actually used to their detriment.⁶²

[Page 8]

In reversing, the Third Circuit in Horizon stated that it "understood] that the Spokeo court meant to reiterate traditional notions of standing, rather than erect any new barriers that might prevent Congress from identifying new causes of action though they may be based on intangible harms."⁶³ Drawing on Nickelodeon as precedent, the court observed that "’unauthorized disclosures of information’ have long been seen as injurious."⁶⁴ The court then looked to the statutory protections afforded plaintiffs under the FCRA, holding that "with the passage of FCRA, Congress established that the unauthorized dissemination of personal information by a credit reporting agency causes an injury in and of itself—whether or not the disclosure of that information increased the risk of identity theft or some other future harm."⁶⁵ Further, the court reasoned that the intangible harm the FCRA sought to remedy had a "close relationship to a harm [i.e. invasion of privacy] that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Thus, the court had "no trouble concluding that Congress properly defined [in the FCRA] an injury that ‘give[s] rise to a case or controversy where none existed before.’"⁶⁶

In Horizon, the Third Circuit found that plaintiffs did not allege a "mere technical or procedural violation of FCRA,"⁶⁷ but rather alleged the unauthorized dissemination of their own private information—the very injury that FCRA is intended to prevent." Thus, the Court found a "de facto injury that satisfied the concreteness requirement for Article III standing."⁶⁸

4. Sixth Circuit

In Galaria v. Nationwide Mutual Insurance Company,⁶⁹ the Sixth Circuit held that a putative class of consumers whose personally private information was stolen after hackers breached the computer network of Nationwide Mutual Insurance had Article III standing under Spokeo to assert claims for invasion of privacy, negligence, bailment, and violations of the Fair Credit Reporting Act (FCRA).⁷⁰ The district court had dismissed plaintiffs’ complaint, reasoning that the plaintiffs—who had not yet suffered identity theft—lacked Article III standing to bring the negligence and bailment claims, and lacked statutory standing to bring the FCRA claims.⁷¹ The Sixth Circuit reversed, finding that plaintiffs had satisfied each of Spokeo‘s injury in fact requirements.

The court found that plaintiffs’ allegations "that the theft of their personal data places them at a continuing, increased risk of fraud and identity theft," coupled with facts to show that class members had to spend time and money to monitor their credit, were "sufficient to establish cognizable Article III injury at the pleading stage of the litigation."⁷² "[A]lthough it might not be ‘literally certain’ that plaintiffs’ data will be misused," the Sixth Circuit concluded, "there is a sufficiently substantial risk of harm that incurring mitigation costs is reasonable."⁷³ Plaintiffs’ additional allegation that they incurred costs to obtain credit protection separately qualified as a "concrete injury suffered to mitigate an imminent harm," necessary to satisfy the injury requirement.⁷⁴

[Page 9]

5. Eleventh Circuit

The Eleventh Circuit’s post-Spokeo rulings in the privacy arena provide mixed guidance.

In an early post-Spokeo case, Church v. Accretive Health, Inc.,⁷⁵ the court broadly interpreted Spokeo to find that Article III standing existed in a putative class action against a hospital (Accretive Health) that alleged violations of the Fair Debt Collections Practices Act (FDCPA). Plaintiff alleged that the hospital violated the FDCPA when it sent her a letter advising her that she owed a debt to the hospital that did not contain certain disclosures required by the Act.⁷⁶ Although Church did not allege that she had suffered any actual monetary damages from this failure—only that she was "very angry" and "cried a lot," the Eleventh Circuit nonetheless held that plaintiff’s alleged statutory violation amounted to an injury in fact for standing purposes.⁷⁷ The court observed that "[a]n injury-in-fact, as required by Article III, ‘may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing’"⁷⁸ Here, the court found, "Church alleges she had a right to receive the FDCPA-required disclosures" and the hospital did not dispute that the debt collection letter it sent did not contain all of the FDCPA’s required disclosures.⁷⁹ The Eleventh Circuit held that Church sufficiently alleged that she "sustained a concrete—i.e., ‘real’—injury because she did not receive the allegedly required disclosures."⁸⁰ "While this injury may not have resulted in tangible economic or physical harm that courts often expect," the Eleventh Circuit concluded, "the Supreme Court [in Spokeo] has made clear an injury need not be tangible to be concrete."⁸¹

The Eleventh Circuit interpreted Spokeo more narrowly in Nicklaw v. Citimortgage, Inc.⁸² In that case, the plaintiff sold real property that he owned in New York, using the proceeds of the sale to pay off a mortgage owned by CitiMortgage. New York state law required that CitiMortgage record a certificate of discharge with the county clerk that the mortgage had been discharged, within 30 days of payoff. Failure to file the certificate within 30 days rendered CitiMortgage liable to Nicklaw for a statutory payment of $500, an amount that increased to $1,000 after 60 days, and $1,500 after 90 days.⁸³ CitiMortgage failed to record the loan satisfaction certificate for 115 days.⁸⁴ Nicklaw filed a class action suit against CitiMortgage in the Southern District of Florida, alleging statutory violations of the New York law. The Eleventh Circuit rejected Nicklaw’s two asserted bases of Article III standing: (1) that CitiMortgage’s untimely recording of the mortgage discharge gave rise to substantive legal rights under New York law, and (2) that timely recordation of a satisfaction of mortgage has deep roots in American common law (here, the statutory law of New York).⁸⁵ The court looked to Spokeo‘s statement that "Article III standing requires a concrete injury even in the context of a statutory violation,"⁸⁶ and found Nicklaw’s claims wanting because "Nicklaw allege[d] neither a harm nor a material risk of harm that the district court could remedy" through the litigation.⁸⁷ The Court observed that "[Nicklaw’s] complaint does not allege that he lost money because CitiMortgage failed to file the certificate. It does not allege that his credit suffered. It does not even allege that he or anyone else was aware that the certificate of discharge had not been recorded during the relevant time period."⁸⁸

[Page 10]

The Eleventh Circuit in Nicklaw also underscored the heightened requirements for standing in federal court under Spokeo. The court noted that Nicklaw could have alleged a right sufficient to form a cause of action in a court of New York.⁸⁹ Instead the court held that "Nicklaw chose to sue CitiMortgage in federal court, and the requirement of concreteness under Article III is not satisfied every time a statute creates a legal obligation and grants a private right of action for its violation."⁹⁰ As such, "A plaintiff must suffer some harm or risk of harm from the statutory violation to invoke the jurisdiction of a federal court."⁹¹

[Page 11]

B. CIRCUITS CONSTRUING SPOKEO MORE NARROWLY

1. Fourth Circuit

The Fourth Circuit, in Beck v. McDonald⁹² interpreted the majority Spokeo opinion much more narrowly than some of its sister circuits. As in the Sixth Circuit Galaria case, Beck involved the theft of a hospital clinic laptop containing unencrypted information about individual patients— in this instance, veterans who received medical care at a Veterans Affairs Medical Center in Columbia, South Carolina. Plaintiffs filed suit on behalf of a class of patients whose information was stored on the missing laptop, alleging violations of the Privacy Act (5 U.S.C. § 552a et seq.), and the Administrative Procedures Act (5 U.S.C. § 701 et seq.).⁹³ The Fourth Circuit affirmed an order dismissing the action at summary judgment, concluding that plaintiffs lacked Article III standing.

The court held that plaintiffs’ claims that they were at risk of future identity theft from misappropriation of their personal information were "too speculative" based on the facts of the case to constitute an injury in fact.⁹⁴ In reaching this conclusion, the Fourth Circuit found Galaria and other decisions favoring Article III standing for similar data breach-related claims distinguishable because the data theft in those cases "intentionally targeted the personal information compromised in the data breaches," whereas in Beck, "plaintiffs ma[de] no such claims."⁹⁵ Further, having had the benefit of discovery, which had failed to uncover "evidence that the information contained on the stolen laptop has been accessed or misused," the court found that plaintiffs had not met their burden to demonstrate that the risk of future identity theft from the theft of their personal information was reasonably likely or sufficiently concrete a harm to satisfy Spokeo’s Article III standing requirements.⁹⁶ Plaintiffs’ efforts to assert standing based on the costs they incurred for credit protection and monitoring were held to be insufficient to establish a concrete, intangible harm since plaintiffs had demonstrated only a "speculative threat" that their personal information would be misused in the future.⁹⁷

2. Seventh Circuit

In Meyers v. Nicolet Restaurant of DePere, LLC,⁹⁸ the Seventh Circuit held that a class plaintiff lacked Article III standing to sue a restaurant for failing to truncate the expiration date of his credit card on a receipt, in violation of the Fair and Accurate Credit Transactions Act (FACTA) (15 U.S.C. § 1681 et seq.). FACTA was enacted by Congress "in response to what it considered to be the increasing threat of identity theft."⁹⁹ At issue in Meyers was Section 1681c(g)(1), which requirespiration date or m merchants that accept credit or debit cards not include on purchase receipts the card exore than the last 5 digits of the credit card number.¹⁰⁰ A merchant that "willful[ly] violat[es]" this provision may be liable for "any actual damages sustained" or "statutory damages of between $100 and $1,000."¹⁰¹

[Page 12]

"Spokeo compels the conclusion that Meyers’ allegations [i.e., the claimed statutory violations of FACTA] are insufficient to satisfy the injury-in-fact requirement for Article III standing," the court held.¹⁰² Noting that district courts considering FACTA’s requirement that credit card information be appropriately truncated were split on the federal standing question,¹⁰³ the Seventh Circuit in Meyers determined that some "showing of injury apart from the statutory violation" itself was necessary to confer Article III standing under Spokeo.¹⁰⁴

In so holding, the court found persuasive two post-Spokeo decisions from two other Circuit courts: the Eighth Circuit decision in Braitberg v. Charter Comm’ns, Inc.,¹⁰⁵ and the D.C. Circuit decision in Hancock v. Urban Outfitters, Inc.^106,107 These cases are discussed below.

3. Eighth Circuit

Braitberg involved alleged statutory violations of the Cable Communications Policy Act (CCPA), 47 U.S.C. § 551(e). Braitberg gave Charter Communications personal information, such as his address, telephone number, and social security number when he signed up for cable services. Braitberg canceled these cable services after three years.¹⁰⁸Some three years after this cancellation, Braitberg learned that Charter had retained all of his personally identifiable information, in violation of the CCPA, which provides that: "'[a] cable operator shall destroy personally identifiable information if the information is no longer necessary for the purpose for which it was collected and there are no pending requests or orders for access to such information [by the subscriber] or pursuant to a court order."¹⁰⁹

[Page 13]

Braitberg filed a class action lawsuit alleging that Charter’s retention of personal information—after it was no longer required to provide services, collect payments or satisfy other legal obligations—violated class members’ rights under the CCPA.¹¹⁰ He claimed that Charter’s alleged violation caused injury in two ways: (1) as an alleged "direct invasion of their federally protected privacy rights" and (2) by "depriv[ing] Braitberg and the class of the full value of the services they purchased from Charter" since Braitberg and other class members ascribed monetary value to controlling their personal information.¹¹¹

The Eighth Circuit affirmed the district court’s order of dismissal finding that Braitberg had not alleged an injury in fact under Spokeo.¹¹² The Eighth Circuit quoted the district court which found that Braitberg’s assertion that Charter had directly invaded class members’ federally protected rights amounted merely to "’a bare procedural violation, divorced from any concrete harm.’"¹¹³ This was insufficient for Article III standing under Spokeo, according to the court:

Braitberg alleges only that Charter violated a duty to destroy personally identifiable information by retaining certain information longer than the company should have kept it. He does not allege that Charter has disclosed the information to a third party, that any outside party has accessed the data, or that Charter has used the information in any way during the disputed period. He identifies no material risk of harm from the retention; a speculative or hypothetical risk is insufficient. Although there is a common law tradition of lawsuits for invasion of privacy, the retention of information lawfully obtained, without further disclosure, traditionally has not provided the basis for a lawsuit in American courts.¹¹⁴

Braitberg’s alleged economic injury—an alleged diminution of the value of the cable services that he purchased from Charter—also was held to be insufficient for standing purposes. Braitberg argued that consumers who signed up with Charter’s cable services placed a value on the assumption that Charter would "protect their personal data against improper access and unauthorized secondary use," and that Charter’s wrongful retention of personal information deprived consumers of the "full monetary value" of their transactions.¹¹⁵ The Eleventh Circuit found these allegations of harm too speculative for Article III standing purposes, holding that Braitberg had failed to allege "any plausible connection" between Charter’s wrongful retention of consumers’ private information in violation of the CCPA, and any alleged loss in value of the cable services they had purchased from the company.¹¹⁶

[Page 14]

4. D.C. Circuit

The D.C. Circuit decision in Hancock involved class claims against two clothing retailers, Urban Outfitters and Anthropologie, for allegedly requesting customers’ zip codes in connection with consumer credit card purchases, in violation of two D.C. consumer financial protection statutes, the District of Columbia Consumer Identification Information Act (CII) (D.C. Code § 47-3151 et seq.) and the District of Columbia Consumer Protection Procedures Act (DCCPPA) (D.C. Code § 28-3901 et seq.).¹¹⁷ These statutory violations, however, failed to "get out of the starting gate," as plaintiffs did not properly allege an injury in fact.¹¹⁸ In reaching its decision that Article III’s standing requirement had not been met, the D.C. Circuit analogized the statutory wrong of collecting zip code information alleged in Hancock to the act of disseminating incorrect zip code information in violation of the Fair Credit Reporting Act—an example of a statutory violation the majority in Spokeo viewed, without more, as "difficult to imagine" working "any concrete harm" for standing purposes.¹¹⁹

The court in Hancock did search for some allegation of harm beyond the statutory violations asserted in plaintiffs’ class complaint. But, at oral argument, "Hancock’s . . . counsel candidly admitted that ‘the only injury that the named plaintiffs suffered was that they were asked for a zip code when . . . [under] the law they should not have been.’"¹²⁰ Plaintiffs did not establish an Article III injury as they did "not allege, for example, any invasion of privacy, increased risk of fraud or identity theft, or pecuniary or emotional injury."¹²¹

IV. DETERMINING CONCRETE INTANGIBLE HARMS IN PRACTICE

As shown, federal Circuit Courts have not taken a uniform, bright-line approach in applying Spokeo in privacy law cases. Instead, the Circuit decisions analyzing standing reflect two approaches, with each approach focusing on one of the two key considerations described by Justice Alito in the majority Spokeo opinion. This Article will refer to these approaches as (1) the statutory approach and (2) the factual approach.

Under the statutory approach, evidenced by Circuits construing Spokeo more broadly, courts focus on the portion ofJustice Alito’s opinion that asks whether Congress has identified the harm alleged as one that meets "minimum Article III requirements."¹²²

[Page 15]

These courts analyze the statute at issue and decide whether it creates a right that, if violated, effectively constitutes a per se Article III injury. The Ninth Circuit decisions in Van Patten and Syed are examples of this judicial approach.

Under the factual approach, illustrated by those Circuits adopting a narrower view of Spokeo, courts look more searchingly to the particular facts alleged by the plaintiff, including the manner in which a particular statute is alleged to have been violated, to determine whether the alleged facts demonstrate a concrete intangible harm that is "actual or imminent," "fairly traceable to the challenged action," and "redress[able] by a favorable judicial decision."¹²³ The Eleventh Circuit decision in Nicklaw, the Fourth Circuit decision in Beck, and the Eighth Circuit decision in Braitberg are examples of this approach.

Irrespective of these emerging approaches, successful federal court briefing after Spokeo likely will rely on context-specific or historically-based arguments for concrete injury. Plaintiffs seeking to establish Article III standing in privacy law cases and class actions will need to consider ways of pleading injury-in-fact with an enhanced focus on these issues.

This Article (1) describes potential strategies for pleading intangible harms after Spokeo and (2) provides a chart describing post-Spokeo privacy law decisions that have found Spokeo‘s Article III standing to have been satisfied.

1. Pleading Intangible Harms After Spokeo

As a preliminary matter, plaintiffs should be cognizant of statutory violations that amount to bare procedural violations divorced from the concrete harm that Congress sought to guard against in passing the statute. Braitberg is an example of this, where the claim related to the alleged unlawful retention of personal information, but the harm that Congress sought to address in passing the CCPA was the unauthorized disclosure of personal information. Putting the two claims in context, the provision of the statute regarding retention of personal information was intended to act as a procedural safeguard to limit the instances of inadvertent—and therefore unauthorized—disclosures of personal information. But the fact that Congress put the procedural safeguard in place demonstrates that the harm it sought to address had to do with unauthorized disclosures. Thus, in terms of pleading concrete injuries in the statutory privacy context, plaintiffs must make an effort to understand the harms Congress intended to protect against in enacting a particular statute, and should be selective in the claims they bring, including with respect to different provisions of the same statute.

Additionally, certain types of intangible injuries—informational, reputational, invasion of privacy, and even the risk of future harm—can be pleaded to reflect a concrete injury that can be redressed in federal court under Spokeo. These types of injuries have long been redressed in English and American courts, and thus, fall within Justice Alito’s framework of claims that give rise to Article III standing.

[Page 16]

Informational injuries fall roughly into three categories. The first category is failure to receive accurate information (misrepresentation claims), and several federal statutes, such as the Fair Debt Collection Practices Act (FDCPA), the Truth in Lending Act (TILA), and the Fair Credit Reporting Act (FCRA), contain provisions aimed at preventing the transmission of inaccurate information that may be pleaded to allege a concrete, intangible harm under Spokeo.¹²⁴ A second informational injury category is failure to receive informational content—a recognized form of Article III injury for which statutes like the FDCPA, the TILA and the FCRA may provide a basis to articulate concrete injury as required by Spokeo. Third, the failure to receive information in the specific manner prescribed by Congress may also provide a basis for Article III standing in privacy law cases.¹²⁵

Like informational injury, the invasion of one’s privacy is a quintessential "harm that has been traditionally regarded as providing a basis for a lawsuit in English or American courts."¹²⁶ Invasion of privacy thus qualifies as a sufficiently concrete injury for standing purposes under Spokeo. Plaintiffs may therefore allege Article III standing under a number of federal statutes—such as the FCRA, FDCPA, and Telephone Consumer Protection Act (TCPA)—which were specifically enacted to protect against harmful violations of privacy, often by regulating companies that intend to access or use consumers’ personal information.

A classic example of a statutory violation that evokes an invasion of privacy-type harm is unwanted robocalling or telemarketing, in violation of the provisions of the TCPA. As the Ninth Circuit observed in Van Patten, "[u]nsolicited telemarketing phone calls or text messages, by their nature, take the form of and disturb the solitude of recipients,"¹²⁷ and can thereby provide a basis for Article III standing on an invasion of privacy injury theory.

Reputational injuries also may give rise to federal standing. The U.S. Supreme Court has long held that "a risk of injury to [one’s] reputation," without more, is sufficient injury for Article III standing.¹²⁸ Where violations of statutory protections involve statements or disclosures to third parties, and where disclosure of that information may work harm to the consumer, plaintiffs may be able to plead a reputational injury sufficient to satisfy Spokeo‘s standing requirements.¹²⁹

[Page 17]

Finally, Spokeo explicitly recognizes that "the real risk of harm"—such as the increased risk of identity theft that may arise in the data breach context—can be enough, on its own, to satisfy the concreteness requirement.¹³⁰ The key to success in such cases will depend on the extent to which a plaintiff’s allegations about potential future injuries are substantially likely to occur, or are sufficiently imminent, to constitute a real risk of injury for Article III purposes.

2. Post-Spokeo Intangible Harms Satisfying Article III Standing

A number of courts have considered complaints alleging privacy-related claims and found the intangible harm requirements of Spokeo satisfied. The following table lists certain post-Spokeo privacy law decisions in which plaintiffs alleging intangible harms have succeeded in establishing Article III standing. It also describes the "alleged harms" that were pleaded, by identifying the category of harm the plaintiffs sought to link to the intangible injury asserted in the case.

This table is not intended to be a comprehensive compendium of post-Spokeo case law. More than 550 federal courts have grappled with Spokeo’s teachings since the Supreme Court issued its majority opinion in May 2016. It is not possible to analyze each decision in this Article. This table serves only as guide to representative privacy law cases in which plaintiffs successfully pleaded intangible "particularized and concrete" injuries for Article III standing purposes.

[Page 18]

Statue	Alleged Violation	Alleged Harms	Spokeo’s Standing Requirements Met
FCRA	Failure to disclose proper information Disclosure of private information without permission	Invasion of Privacy	In re Horizon Healthcare Servs., Inc. Data Breach Litig., 846 F.3d 625 (3d Cir. 2017)
		Emotional Distress	Larson v. Trans Union, LLC, 201 F. Supp. 3d 1103 (N.D. Cal. 2016)
		Informational Injury	Larson v. Trans Union, LLC, 201 F. Supp. 3d 1103 (N.D. Cal. 2016) Stokes v. Realpage, Inc., No. CV 151520, 2016 WL 6095810 (E.D. Pa. Oct. 19, 2016) Syed v. M-I, LLC, 853 F.3d 492, (9th Cir. 2017)
		Increased risk of identity theft or misuse of private information	Galaria v. Nationwide Mut. Ins. Co., 663 F. App’x. 384 (6th Cir. 2016) In re Horizon Healthcare Servs., Inc. Data Breach Litig, 846 F.3d 625 (3d Cir. 2017)
FDCPA	Failure to protect private customer information Failure to make required disclosures	Improper disclosure of personal information	Daubert v. Nra Grp., LLC, No. 3:15-CV-00718, 2016 WL 4245560 (M.D. Pa. Aug. 11, 2016)
		Informational Injury (Failure to Receive Required Content)	Church v. Accretive Health, Inc., 654 F. App’x. 990 (11th Cir. 2016) Lane v. Bayview Loan Servicing, LLC, 2016 WL 3671467 (N.D. Ill. July 11, 2016) Taymuree v. Nat’l Collegiate Student Loan Tr. 2007-2, No. 16-CV-06138, 2017 WL 952962 (N.D. Cal. Mar. 13, 2017)
		Wasting Consumer Time/ Annoyance	Horowitz v. GC Servs. Ltd. P’ship, No. 14CV2512, 2016 WL 7188238 (S.D. Cal. Dec. 12, 2016) Reed v. IC Sys., Inc., No. 3:15-279, 2017 WL 89047 (W.D. Pa. Jan. 10, 2017)
		Emotional Distress	Church v. Accretive Health, Inc., 654 F. App’x. 990 (11th Cir. 2016)
TCPA		Invasion of Privacy	A.D. v. Credit One Bank, N.A., No. 14 C 10106, 2016 WL 4417077 (N.D. Ill. Aug. 19, 2016) Aranda v. Caribbean Cruise Line, Inc., 202 F. Supp. 3d 850 (N.D. Ill. 2016) Cabiness v. Educ. Fin. Sols., LLC, No. 16-CV-01109, 2017 WL 167678 (N.D. Cal. Jan. 17, 2017) Nghiem v. Dick’s Sporting Goods, Inc., No. SACV1600097, 2016 WL 8203204 (C.D. Cal. Dec. 1, 2016) Van Patten v. Vertical Fitness Grp., 847 F.3d 1037 (9th Cir. 2017) Horowitz v. GC Servs. Ltd. P’ship, No. 14CV2512, 2016 WL 7188238 (S.D. Cal. Dec. 12, 2016) Mey v. Got Warranty, Inc., 193 F. Supp. 3d 641 (N.D. W. Va. 2016)
		Intrusion on cell phone capacity	Horowitz v. GC Servs. Ltd. P’ship, No. 14CV2512, 2016 WL 7188238 (S.D. Cal. Dec. 12, 2016) Rogers v. Capital One Bank (USA), N.A., 190 F. Supp. 3d 1144 (N.D. Ga. 2016)
		Wasting customer time/nuisance	Booth v. Appstack, Inc., No. C13-1533, 2016 WL 3030256 (W.D. Wash. May 25, 2016)131 Cabiness v. Educ. Fin. Sols., LLC, No. 16-CV-01109, 2017 WL 167678 (N.D. Cal. Jan. 17, 2017) Etzel v. Hooters of Am., LLC, No. 1:15-CV-01055, 2016 WL 8604317 (N.D. Ga. Nov. 15, 2016) Caudill v. Wells Fargo Home Mortg., Inc., No. CV 5: 16-066, 2016 WL 3820195 (E.D. KY. July 11, 2016)
			Holderread v. Ford Motor Credit Co., LLC, No. 4:16-CV-00222, 2016 WL 6248707 (E.D. Tex. Oct. 26, 2016) Horowitz v. GC Servs. Ltd. P’ship, No. 14CV2512, 2016 WL 7188238 (S.D. Cal. Dec. 12, 2016) JWD Auto., Inc. v. DJM Advisory Grp. LLC, No. 215CV793, 2016 WL 6835986 (M.D. Fla. Nov. 21, 2016) LaVigne v. First Cmty. Bancshares, Inc., No. 1:15-CV-00934, 2016 WL 6305992 (D.N.M. Oct. 19, 2016) Mey v. Got Warranty, Inc., 193 F. Supp. 3d 641 (N.D. W.Va. 2016) Van Patten v. Vertical Fitness Grp., 847 F.3d 1037 (9th Cir. 2017)
TILA		Informational Injury (Failure to Receive Required Content)	Strubel v. Comenity Bank, 842 F.3d 181 (2d Cir. 2016)
VPPA		Invasion of Privacy	Yershov v. Gannet Satellite Info. Network, Inc., 204 F. Supp. 3d 353 (D. Mass. 2016)
		Intrusion Upon Seclusion	In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262 (3d Cir. 2016)
State Statutes		Failure to deliver information or file in a timely fashion	Bellino v. JPMorgan Chase Bank, N.A., 209 F. Supp. 3d 601 (S.D.N.Y. 2016) (NY Real Property Laws)132 Jaffe v. Bank of Am., N.A., 197 F. Supp. 3d 523 (S.D.N.Y. 2016) (NY Real Property Laws)
		Unlawful disclosure of legally protected information	Boelter v. Hearst Commc’ns, Inc., 192 F. Supp. 3d 427 (S.D.N.Y. 2016) (MI Video Rental Privacy Act) In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262 (3d Cir. 2016) (NJ Computer Related Offenses Act)
		Unlawful collection of legally protected information	Fraser v. Wal-Mart Stores, Inc., No. 2:13-CV-00520, 2016 WL 6094512 (E.D. Cal. Oct. 18, 2016) (Song-Beverly Credit Card Act)
		Invasion of Privacy	In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262 (3d Cir. 2016) (NJ common law for intrusion upon seclusion) Matera v. Google Inc., No. 15-CV-04062, 2016 WL 5339806 (N.D. Cal. Sept. 23, 2016) (Wiretap Act and California Invasion of Privacy Act)

[Page 19]

V. "IT AIN’T OVER ‘TIL ITS OVER":¹³³ THE RISKS OF SEEKING TO DISMISS FOR LACK OF STANDING

A common defense to consumer and privacy class actions is to seek dismissal based on lack of Article III standing. But, defendants also need to consider carefully the basis for such a dismissal, and its implications for the course of the case.

Importantly, Spokeo’s standing analysis speaks only to a plaintiff’s standing to bring a claim in federal court. Accordingly, claims that may not survive a Spokeo analysis in federal court may nonetheless be brought in state court. Indeed, since Spokeo, several courts have remanded to state courts class actions asserting federal claims based on lack of Article III standing.¹³⁴ Courts also have remanded cases removed to federal court under the Class Action Fairness Act (CAFA), based on lack of standing.¹³⁵

Defendants should exercise caution when removing cases where the plaintiff’s federal court standing may be in question. The decision in Mocek v. Allsaints USA Ltd.,¹³⁶ highlights the risk of challenging plaintiff’s standing under Spokeo in removed class actions. Mocek involved a federal claim under the Fair and Accurate Credit Transaction Act (FACTA) (15 U.S.C. § 1681c).¹³⁷ The case originally was filed in state court. Allsaints removed the action to federal court based on federal question jurisdiction, and immediately sought dismissal under Spokeo.¹³⁸ The district court remanded the case based on 28 U.S.C. section 1447(c), concluding that the parties were "aligned in the view" that the court lacked subject-matter jurisdiction. The court stated: "plaintiff chose to litigate her FACTA claim in state court, and regardless of whether federal jurisdiction was colorable at the time of removal, the parties now agree that there is none."¹³⁹

The Mocek court did not look favorably on Allsaint’s strategy of invoking the federal court’s jurisdiction for removal purposes, only to challenge that jurisdiction under Spokeo. According to the court, "defendant tried to have it both ways by asserting, then immediately disavowing, federal jurisdiction, apparently in hopes of achieving outright dismissal, with prejudice, rather than the remand required by § 1447(c)."¹⁴⁰ The court held "it should have been obvious to defendant, based on well-settled law, that with no party asking for the merits of plaintiff’s claim to be decided in federal court, and both sides arguing against federal jurisdiction, the only possible outcome was for the case to end up right back where it started: in state court."¹⁴¹ "Under these circumstances," the court concluded, Allsaints "lacked an ‘objectively reasonable basis for seeking removal,’" and plaintiff was awarded $58,000 in attorneys’ fee incurred as a result of removal.¹⁴²

[Page 26]

VI. CONCLUSION

Federal courts have not taken a uniform, bright-line approach in applying Spokeo. Some Circuit Courts interpret Spokeo broadly, while other Circuit Courts read the decision narrowly. These trends reflect two judicial approaches, one approach that focuses on the statutory basis for asserted claims, and another which focuses on the particular claims of redressable harm alleged in the complaint. To the extent plaintiffs are able to articulate a context-specific or historic basis for "particularized and concrete" injury stemming from statutory violations raising privacy concerns, many courts will find that federal court standing under Spokeo is satisfied.

Litigants on both sides of the case need to carefully consider when and whether to bring their actions in federal court. Plaintiffs concerned about satisfying Spokeo’s standing requirements may wish to consider bringing their statutory privacy law claims in state court. Alternatively, but less preferably, plaintiffs may succeed in transferring cases out of federal court and into state court based on Spokeo¹⁴³ Defendants considering removal also need to think twice before seeking dismissal of removed actions for lack of Article III standing.

[Page 27]

——–

Notes:

^1. Elizabeth C. Pritzker is a founding member of Pritzker Levine LLP, an Oakland, California-based law firm that represents plaintiffs in antitrust, consumer protection and privacy matters, including class actions. She is a member of the Executive Committee for the Antitrust, Unfair Competition and Privacy Law Section of the State Bar of California.

^2. 504 U.S. 555, 560-61 (1992).

^3. See, e.g., McConnell v. FEC, 540 U.S. 93, 225 (2003) ("One element of the ‘bedrock’ case-or-controversy requirement is that plaintiffs must establish that they have standing to sue . . . . [W]e have reiterated . . . that . . . a plaintiff must demonstrate an ‘injury in fact.’" (citations omitted)), overruled by Citizens United v. FEC, 558 U.S. 310 (2010).

^4. Examples of such statutes include, among others: the Consumer Protection Credit Act (CPCA) (15 U.S.C. § 1601 et seq.); the Drivers’ Privacy Protection Act (DPPA) (18 U.S.C. § 2721 et seq.); the Electronic Communications Privacy Act (ECPA) (18 U.S.C. § 2510 et seq); the Electronic Funds Transfer Act (EFTA) (15 USC § 1693 et seq.); the Fair and Accurate Credit Transactions Act (FACTA) (15 U.S.C. § 1681a et seq.); the Fair Credit Reporting Act (FCRA) (15 U.S.C. § 1681 et seq.); the Fair Debt Collections Practices Act (FDCPA) (15 U.S.C. § 1692 et seq.); the Telephone Consumer Protection Act (TCPA) (47 U.S.C. § 227 et seq.); the Truth in Lending Act (TILA) (15 U.S.C. § 1601 et seq.); and the Video Privacy Protection Act (VPPA) (18 U.S.C. § 2710 et seq.).

^5. 578 U.S. ___, 136 S. Ct. 1540 (2016).

^6. Justice Antonin Scalia died February 13, 2016, after the Supreme Court heard arguments in Spokeo on November 2, 2015, but before the case was decided on May 16, 2016.

^7. Id. at 1548-50.

^8. Mocek v. Allsaints USA Ltd., ___ F. Supp. 3d ___, 2016 WL 7116590 (N.D. Ill. Dec. 7, 2016).

^9. Spokeo, 136 S. Ct. at 1544, 1546.

^10. 15 U.S.C. §§ 1681n(a)-(a)(1)(A).

^11. Id. § 1681(a)(1).

^12. See id §§ 1681a(d)(1)(A)-(C); id. § 1681b.

^13. Id. § 1681e(b).

^14. Spokeo, 136 S. Ct. at 1545-46.

^15. Robins v. Spokeo, Inc., No. CV10-05306, 2011 WL 11562151, at *1 (C.D. Cal. Sept. 19, 2011).

^16. Robins v. Spokeo, Inc., 742 F.3d 409, 410, 413-14 (9th Cir. 2014).

^17. Justice Alito’s majority Spokeo opinion was joined by Justices Kennedy, Thomas, Breyer, Kagan and Chief Justice Roberts. Justice Thomas also filed a concurring opinion. Justices Ginsberg and Sotomayor dissented. Spokeo, 136 S. Ct. at 1550, 1554.

^18. Id. at 1547 (citing Lujan, 504 U.S. at 560).

^19. Id. (citations omitted).

^20. Id. (ellipse in original, citations omitted).

^21. Id. at 1548.

^22. Id. (citations omitted).

^23. Id. (citations omitted).

^24. Id.

^25. Id. (internal citations omitted).

^26. Id. at 1549. The court expressed unanimity on this issue. See id. at 1550 (Thomas, J., concurring) ("[T]he court explains that ‘concrete’ means ‘real’ and ‘not abstract,’ but not ‘necessarily synonymous with tangible’ . . . . I join the court’s opinion.") (internal quotation marks omitted); id. at 1555—56 (Ginsburg, J., dissenting) ("Concreteness as a discrete requirement for standing, the court’s decisions indicate, refers to the reality of an injury, harm that is real, not abstract, but not necessarily tangible.")

^27. "Tangible" injuries include, for example, physical injuries accompanying mass torts (see id. at 1548 n.7); emotional distress, or other forms of psychic harm (see, e.g., Carey v. Piphus, 435 U.S. 247, 263, 263 n.2 (1978) ["Distress is a personal injury familiar to the law," and "[w]e use the term ‘distress’ to include mental suffering or emotional anguish."]); loss of time, money or property (see, e.g., Palm Beach Golf Center-Boca, Inc. v. John G. Sarris, D.D.S., P.A., 781 F.3d 1245, 1251 (11th Cir. 2015) ["We find that Palm Beach Golf has Article III standing sufficient to satisfy the injury" requirement . . . under the federal Telephone Consumer Protection Act’s prohibition on junk faxes, 47 U.S.C. § 227(b)(1)(C), "because it has suffered a concrete and personalized injury in the form of the occupation of its fax machine for the period of time required for the electronic transmission of the (unwanted) data."]); and injuries to financial, economic or property interests. See, e.g., Ass’n of Data Processing Serv. Orgs. v. Camp, 397 U.S. 150, 152—53 (1970) (plaintiffs had standing to allege that unfair competition caused them economic injury).

^28. Spokeo, 136 S. Ct. at 1549.

^29. Id.

^30. Id.

^31. Id. (emphasis in original).

^32. Id.

^33. Id. at 1545.

^34. Id. at 1550.

^35. 847 F.3d 1037 (9th Cir. 2017).

^36. Van Patten alleged he had received two such unsolicited text messages on his phone. Id. at 1041.

^37. Id. at 1043 ("[I]n enacting the TCPA, Congress made specific findings that ‘unrestricted telemarketing can be an intrusive invasion of privacy’ and are a ‘nuisance.’ Congress sought to protect consumers from the unwanted intrusion and nuisance of unsolicited telemarketing phone calls and fax advertisements." (internal citations omitted)).

^38. Id.

^39. Id. (quoting Spokeo, 136 S. Ct. at 1549) (emphasis in original). Despite holding that Van Patten met Spokeo‘s standing requirements, the court ultimately affirmed the district court’s dismissal of plaintiff’s TCPA claim, holding that he both consented to the text messages and failed to expressly revoke his consent. Id at 1046—48.

^40. 853 F.3d 492, (9th Cir. 2017).

^41. Id. at 495-96 (citing 15 U.S.C. §1681b(b)(2)(A)).

^42. Id. at 496 (citing 15 U.S.C. § 1681b(b)(2)(A)).

^43. Id.

^44. Id. at 505. Finding that 15 U.S.C. §§ 1681b(b)(2)(a) "unambiguously forecloses the inclusion of a liability waiver in a disclosure document," the Ninth Circuit determined that M-I’s actions were in "’reckless disregard of statutory duty.’ Its violation of the FCRA was therefore willful under 15 U.S.C. § 1681n," subjecting the company to liability for statutory damages, punitive damages, and attorney’s fees and costs. Id. at 497, 503-06

^45. Id. at 499 (citing Spokeo, 136 S. Ct. at 1549).

^46. 842 F.3d 181 (2d Cir. 2016).

^47. Id. at 190 (citing Spokeo, 136 S. Ct. at 1549).

^48. Id. at 185—86, 190—94.

^49. Id. at 190 (referencing 15 U.S.C. § 1637(a)(7)).

^50. Id.

^51. Id. (citations omitted).

^52. Id. at 190—91 (italics added, italics in original omitted) (internal quotation marks and citation omitted).

^53. Id. (italics in original) (citing Spokeo, 136 S. Ct. 1549).

^54. Id. at 193 (internal quotation marks and citation omitted). For a similar analysis, see Ross v. AXA Equitable Life Ins. Co., ___ F. App’x. ___ , 2017 WL 730266 (2d Cir. Feb. 23, 2017) (finding that alleged violation of a New York Insurance Law requirement prohibiting insurers from making "any misleading representation, or any misrepresentation of the financial condition of any such insurer or of the legal reserve system upon which it operates," did not inherently present any material risk of harm; plaintiff required to separately allege materiality and likelihood of harm to support Article III standing requirements of Spokeo).

^55. 827 F.3d 262 (3d Cir. 2016).

^56. Id. at 267.

^57. Id. at 271.

^58. Id. at 273 (citing In re Google Inc. Cookie Placement Consumer Privacy Litig., 806 F.3d 125, 134 (3d Cir. 2015)).

^59. Id. at 274.

^60. 846 F.3d 625 (3d Cir. 2017).

^61. Id. at 627.

^62. Id.

^63. Id. at 638.

^64. Id.

^65. Id. at 639.

^66. Id. at 639-40 (citing Spokeo, 136 S. Ct. at 1549).

^67. Id. at 640.

^68. Id.

^69. 663 F. App’x. 384 (6th Cir. 2016).

^70. Id. at 386, 390-91.

^71. Id. at 385.

^72. Id. at 388.

^73. Id.

^74. Id. at 389.

^75. 654 F. App’x. 990 (11th Cir. 2016).

^76. Id. at 991.

^77. Id.

^78. Id at 993 (citation omitted).

^79. Id. at 995

^80. Id.

^81. Id. (citing Spokeo, 136 S. Ct. at 1549).

^82. 839 F.3d 998 (11th Cir. 2016).

^83. Id. at 1000 (citing N.Y. Real Prop. Law § 275; N.Y. Real Prop. Acts. Law § 1921).

^84. Id. at 1000-01.

^85. Id. at 1003.

^86. Id. at 1002 (internal quotations and citations omitted).

^87. Id. at 1003.

^88. Id. Other procedural deficiencies in Nicklaw’s complaint also likely contributed to the court’s decision to dismiss it for lack of Article III standing. Significantly, a separate federal district court had previously dismissed Nicklaw’s claims on mootness grounds, in light of an offer by Citibank to pay Nicklaw all statutory penalties that were owed. See id. at 1001. Nicklaw did not appeal that dismissal; instead, he filed a new complaint a year later in a different federal court.

^89. Id. at 1003.

^90. Id. The Eleventh Circuit reached a similar conclusion in Meeks v. Ocwen Loan Servicing, LLC, ___ F. App’x. ___ , 2017 WL 782285, *1 (11th Cir. Mar. 1, 2017), holding that a plaintiff alleging statutory violations against a mortgage lender for its failure to timely comply with the Real Estate Settlement Procedures Act’s (RESPA) requirement that it acknowledge receipt of a borrower’s request for information within five days, without more, was insufficient to confer Article III standing for statutory damages under Spokeo.

^91. Nicklaw, 839 F.3d at 1003.

^92. 848 F.3d 262 (4th Cir. 2017).

^93. Id. at 267.

^94. Id. at 271, 274.

^95. See id. at 273—74 ("The Sixth, Seventh and Ninth Circuits have all recognized, at the pleading stage, that plaintiffs can establish an injury-in-fact based on [threatened risk of future identity theft]."), and at 274 ("Underlying the cases are common allegations that sufficed to push the threatened injury of future identity theft beyond the speculative to the sufficiently imminent. In Galaria . . . . , for example, the data thief intentionally targeted the personal information compromised in the data breaches . . . . Here, the Plaintiffs make no such claims.")

^96. Id. at 274—75.

^97. Id. at 276—77.

^98. 843 F.3d 724 (7th Cir. 2016).

^99. Id. at 725.

^100. Id.

^101. Id. (citing 15 U.S.C. § 1681(a)(1)(A)).

^102. Id. at 727.

^103. See id. at 728 n.3 (comparing Kamal v. J. Crew Grp., Inn., No. 2:15-0190, 2016 WL 6133827, at *3—4 (D.N.J. Oct. 20, 2016) [printing of first six numbers of credit card without more was not sufficient injury-in-fact, as there was "no evidence that anyone has accessed or attempted to access or will access Plaintiff’s credit card information"] with Woods v. J. Choo USA, Inc. ___ F. Supp. 3d ___, 2016 WL 4249953, at *3—5 (S.D. Fla. Aug. 11, 2016) [failure to truncate an expiration date was sufficient for standing purposes because Congress has created a substantial personal right to receive a truncated receipt]).

^104. Id. at 729 (emphasis added).

^105. 836 F.3d 925 (8th Cir. 2016).

106 830 F.3d 511 (D.C. 2016).

107 Meyers, 843 F.3d at 728.

^108. Braitberg, 836 F.3d at 926.

^109. Id. at 927 (citing 47 U.S.C. § 551(e)).

^110. Id.

^111. Id.

^112. Id. at 930.

^113. Id. (citing Spokeo, 136 S. Ct. at 1549).

^114. Id. (citing Restatement (Second) of Torts § 652A (Am. Law Inst. 1977); see also Spokeo, 136 S. Ct. at 1549).

^115. Id at 931.

^116. Id.

^117. 830 F.3d at 512.

^118. Id. at 514.

^119. Id. (citing Spokeo, 136 S. Ct. at 1550).

^120. Id. (internal citation omitted).

^121. Id.

^122. Spokeo, 136 S. Ct. at 1548—49.

^123. See id. at 1547-48 (citing Lujan, 504 U.S. at 560-61).

^124. The FDCPA, for example, specifically prohibits the false representation of "the character, amount or legal status of any debt." (15 U.S.C. § 1692e(2)(A)). Similarly, the FCRA requires that credit-reporting agencies, upon request by a consumer, "clearly and accurately disclose to the consumer… [a]ll information in the consumer’s file at the time of the request," as well as "[t]he sources of the information." (15 U.S.C. § 1681g(a)(1) & (2)). Claims that allege a violation of these or similar statutes can be thought of as inflicting an emotional injury by denying the consumer access to truthful information.

^125. Examples of these latter two categories of informational injuries include the Ninth Circuit decision in Syed, 2017 WL 1050586 at *1, 4 (consumers had Article III standing to assert violations of FCRA’s disclosure requirements), and Second Circuit decision in Strubel, 842 F.3d at 190 (consumers had standing to assert violations of TILA’s dispute notification requirements).

^126. Spokeo, 136 S. Ct. at 1549.

^127. Van Patten, 847 F.3d at 1043.

^128. Meese v. Keene, 481 U.S. 465, 475 (1987).

^129. The primary claim at issue in Spokeo is a violation of the FCRA’s requirement that consumer reporting agencies "follow reasonable procedures to assure maximum possible accuracy of" consumers’ reports. Spokeo, 136 S. Ct. at 1545 (citation omitted). This is a typical claim brought when a consumer’s report contains an inaccuracy, and in many cases it will not be difficult for the plaintiff to identify reputational harm that would flow from such inaccuracies. The key question for the Ninth Circuit on remand is whether Robins will be able to articulate a theory of reputational harm even when the inaccuracy is "non-negative," i.e., the consumer looks better as a result of Spokeo’s inaccuracy. Arguably, an inaccuracy of this type that results in, for example, an employer believing that an applicant with inflated credentials is too expensive to hire, prone to bombast or factually dishonest, may be a sufficiently "particularized and concrete" reputational injury for Article III standing purposes.

^130. Id. at 1549.

^131. Order clarified with no change in result, No. C13-1533, 2016 WL 3620798 (W.D. Wash. June 28, 2016).

^132. Motion to certify appeal granted, No. 14-CV-3139, 2017 WL 129021 (S.D.N.Y. Jan. 13, 2017)

^133. Yogi Berra, American baseball legend, discussing the 1973 National League pennant race. See How people started saying ‘It ain’t over till it’s over’, BBC News Magazine (Sep. 23, 2015), http://www.bbc. com/news/magazine-34324865.

^134. See, e.g., Hopkins v. Staffing Network Holdings, LLC, No. 16 C 7907, 2016 WL 6462095, at *4 (N.D. Ill. Oct. 18, 2016) (remanding FCRA claim after finding plaintiff lacked Article III standing); Davis Neurology v. DoctorDirectory.com LLC, No. 4:16 CV 00682, 2016 U.S. Dist. Lexis 84391, at *1 (E.D. Ark. June 29, 2016) (sua sponte remand of TCPA claim for lack of Article III standing).

^135. See, e.g., Polo v. Innoventions Int’l, LLC, 833 F.3d 1193, 1196 (9th Cir. 2016) ("a removed case in which the plaintiff lacks Article III standing must be remanded to state court"; remanding state consumer protection claim removed under CAFA); Wallace v. ConAgra Foods, Inc., 747 F.3d 1025, 1033 (8th Cir. 2014) (remanding state law consumer protection claims based on lack of standing); Khan v. Children’s Nat’l Health Sys., ___ F. Supp. 3d ___ , 2016 WL 2946165, at *7 (D. Md. May 19, 2016 (remanding state law claims in data breach class action based on lack of Article III standing).

^136. ___ F. Supp. 3d ___ , 2016 WL 7116590 (N.D. Ill. Dec. 7, 2016).

^137. Id. at *1.

^138. Id. at *2.

^139. Id.

^140. Id. at *3.

^141. Id.

^142. Id. (citation omitted).

^143. See, e.g., Medellin v. IKEA U.S.A. W., Inc., 672 F. App’x 782 (9th Cir. 2017). In Medellin, the defendant removed a class action brought under the California Song-Beverly Credit Card Act to federal court. After the district court decertified the class, the plaintiff appealed and, creatively, conceded that there had been no allegation of cognizable harm under Spokeo. The Ninth Circuit vacated the decertification ruling, holding the district court should instead have dismissed the case for lack of Article III standing, paving the way for plaintiff to attempt to seek transfer back to state court. Id.