RSS Feed LinkedIn Instagram Twitter Facebook
FMG Law Blog Line

Posts Tagged ‘#Article III’

The Standing Requirement Remains an Open Question But Still a Valid Defense to Cyber Claims

Posted on: June 26th, 2019

By: Jeff Alitz

In litigation proceeding in the Federal Courts, it has always been necessary for a successful plaintiff to in some manner establish that the harm sought to be remedied by a federal lawsuit falls within the authority of the courts to hear and decide such cases. Put another way, Article III of the Constitution limits the authority of Federal Courts to decide only those cases where the claimant has “standing” –  a cognizable interest in the dispute. That interest must be demonstrated by a showing of  1. A concrete injury, 2. The injury is attributable to the defendant’s actions and 3. The injury can in some way be addressed by a favorable decision in the case. Given the fact that in many cases claimants have demonstrated that a cyber breach has occurred for which a target defendant is responsible, only to be denied standing -and hence denied recovery- where no actual “harm” or loss has been established, just what constitutes that harm is an often-litigated issue that has been in many lawsuits a powerful defense to those parties alleged to have committed some type of cyber misstep. Several recent Supreme Court actions have both done little to clarify that issue – what type of “harm’ must be demonstrated for standing to be proven – but the actions have simultaneously served to preserve standing as a significant hurdle for cyber claim plaintiffs to clear in most states.

Specifically, on March 20, 2019, in reviewing the Frank v. Gaos decision decided by the Ninth Circuit which had approved the class action settlement between Google and a group (class) of Google users, the Supreme Court ordered the Ninth Circuit court to determine if the plaintiffs in that case had suffered a concrete injury before any settlement could be approved. But, in reaching that result, the Court did not give any guidance on how a court need decide if an injury- in- fact had occurred. Less than a week later, in denying certiorari to the parties in Zappos v. Stevens, the Court similarly declined to give any clarity to the injury in fact standard. In effect by refusing to resolve the split among the circuit courts where some have determined that simply identifying theft of information or cyber fraud and the THREAT of future misuse is sufficient to confer standing ( as the Sixth, Seventh, Ninth and D.C. Circuits have done) while others (the First, Second, Third, Fourth and Eighth Circuits) have held that simply alleging the threat of future harm is not enough to establish an actual harm sufficient for standing purposes, the Court has left that issue to the lower courts to continue to resolve on a piecemeal basis.

The Supreme Court’s inaction comes at a time when state legislatures are focusing on the injury -in- fact issue by enacting statutes that attempt to eliminate any requirement that a claimant must establish actual harm to succeed on cyber liability based lawsuit. California’s Privacy Act of 2018, Massachusetts Senate Bill 120 and the Illinois Biometric Privacy Act each either clearly state or simply suggest (in the case of the Illinois act)  that no injury apart from being subject to a theft or disclosure is needed to establish standing. Nevertheless, in those states that have NOT passed such legislation and in those states that are not within the jurisdictions of the Circuit Courts that have watered down the Article III requirement that a concrete injury be established to confer standing, defendants in cyber lawsuits – and their insurers and attorneys – can continue to focus on the lack of provable harm to defeat such claims.

If you have questions or would like more information, please contact Jeff Alitz at [email protected].

SCOTUS Clarifies Standing Requirements in Long-Awaited Spokeo Opinion

Posted on: May 18th, 2016

By:  Matthew Foree

On Monday, the Supreme Court of the United States issued its anticipated opinion in the Spokeo, Inc. v. Robins case.  Robins alleged that Spokeo, which operates a “people search engine,” violated the Fair Credit Reporting Act by publishing incorrect information about him.  Among other things, Robins alleged that this publication affected his ability to obtain employment.  The Supreme Court addressed the issue of “[w]hether Congress may confer Article III standing upon a Plaintiff who suffered no concrete harm, and who therefore could not otherwise invoke the jurisdiction of a Federal Court, by authorizing a private right of action based on a bare violation of the Federal Statue.”  The Court vacated and remanded the case back to the Ninth Circuit, which had previously held that Robins sufficiently alleged standing.  Justice Alito delivered the Court’s Opinion and was joined by Chief Justice Roberts and Justices Kennedy, Thomas, Breyer and Kagan.  Justice Thomas filed a Concurring Opinion and Justices Ginsburg and Sotomayor filed a Dissenting Opinion.

The majority reviewed its Article III standing jurisprudence in making its decision.  It reiterated that the “irreducible constitutional minimum” of standing consists of three elements.  The plaintiff must have “(1) suffered an injury in fact (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.”   Additionally the court noted that the injury in fact element requires a plaintiff to show that he or she suffered “an invasion of a legally protected interest” that is both “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.”

The majority determined that the Ninth Circuit’s injury in fact analysis did not consider the independent “concreteness” requirement, but that it only considered the “particularization” requirement that an injury “affect the plaintiff in a personal and individual way.”  The Court clarified that the injury in fact must be both concrete and particularized.  It noted that concreteness is different from particularization and requires an injury to “actually exist.”  The Court used the term “concrete” to mean “real” and not “abstract.”  The Court did recognize, however, that “concrete” is not necessarily synonymous with “tangible” such that intangible injuries can be concrete.  The Court tempered this statement by recognizing that this “does not mean that a Plaintiff automatically satisfies the injury in fact requirement whenever a statue grants a person a statutory right and purports to authorize that person to sue to vindicate that right.”  It clarified that Article III standing requires a concrete injury even in the context of a statutory violation.  For that reason, the Court held that Robins could not allege a bare procedural violation divorced from any concrete harm, and satisfy the injury in fact require of Article III.

The court distilled its analysis in the context of this case to two components:  “On the one hand, Congress plainly sought to curb the dissemination of false information by adopting procedures designed to decrease that risk.  On the other hand, Robins cannot satisfy the demands of Article III by alleging a bare procedural violation.”  The Court recognized that a violation of one of the FCRA’s procedural requirements could result in no harm.  It gave an example of a consumer reporter agency failing to provide the required notice to the user of the agencies consumer information when that information may be entirely accurate.  It also recognized that not all inaccuracies cause harm or present any material risk of harm, and gave an example of publishing an incorrect zip code.  It stated, “It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.”

In sum, the Court found that the Ninth Circuit did not appreciate the distinction between concreteness and particularization, such that its standing analysis was incomplete.  Therefore, the Court vacated the judgement below and remanded the case for proceedings consistent with its opinion.

Finally, the Court stated that it took no position as to whether the Ninth Circuit’s ultimate conclusion that Robins adequately alleged an injury in fact was correct.  Accordingly, the Court passed on the ultimate issue for another day such that the decision is much narrower and provides less guidance than anticipated.  It remains unclear how the Ninth Circuit will handle Mr. Robins’s case on remand with the Court’s clarification, but it is possible that even that decision will find its way back to the Supreme Court.  Although the Court’s opinion includes certain language that may be helpful for defendants, the specific line-drawing as to what a plaintiff must allege to establish standing ultimately will be determined by the lower courts.  In the near term, the Court’s opinion will likely result in plaintiffs using inventive pleading to allege sufficient injury for statutory violations in an attempt to avoid dismissal for lack of standing.  This could create interesting issues in cases based on statutory violations for which it is difficult to allege concrete injury, such as Telephone Consumer Protection Act class actions, particularly in the context of cellular telephone calls made to wrong numbers.  In the meantime, we will continue to monitor any developments in this area.