Simple Question/Big Implications

The thing about appellate cases is that they always start with a question.  If you are dissatisfied with a lower court’s decision, you can’t approach the court of appeals with a declarative statement along the lines of “that court got it wrong!”  No, you have to frame the case around a question or set of questions.  The United States Supreme Court recently decided to hear a case that provides a good illustration of this principle.

The case is Spokeo, Inc. v. Robbins. The petitioner, Spokeo, filed its petition for certiorari on May 1, 2014.  The “cert petition” is the request that the Supreme Court hear the case.  Almost everything that comes before the Supreme Court is a “discretionary appeal” – the Court doesn’t have to hear every case, and in fact, it grants “cert” in a small minority of cases.    But getting back to my original point.  Spokeo’s cert petition poses a simple question:

                                          QUESTION PRESENTED
                         Whether Congress may confer Article III standing
                         upon a plaintiff who suffers no concrete harm,
                         and who therefore could not otherwise invoke 
                         the jurisdiction of a federal court, by authorizing
                         a private right of action based on a bare violation
                         of a federal statute.

But it is truly loaded.  And of great concern to a host of “Amicus Curiae” who have filed briefs in the case.  In appellate proceedings, “friends of the court” (the English translation of “amicus curiae”) may file briefs in support of one side or the other.  One of the more high profile amicus briefs in the Spokeo case has been filed on behalf of eBay, Facebook,  Google and Yahoo!.  This is like the Marvel Avengers of the online world.

But I digress. The question here is why do these online behemoths care about this case? It arises, after all under the Fair Credit Reporting Act.  Thomas Robbins alleged that Spokeo violated the act in the process of gathering data as part of its “people search engine” function.  But the issue, like the question presented has implications far beyond the limited set of facts presented.  

The concern for the amicus parties is that absent some evidence that a plaintiff has suffered some real, concrete injury, any party that collects gazillions of data bytes from millions of users is constantly at risk of some sort of technical statutory violation.  And if that’s all it takes to confer standing, the courthouse gates will be flung wide open.   

This issue applies to the world of data privacy in a very real way.    Frequently, victims of data breaches are hard pressed to identify any harm.  And several courts have found that the “fear” of identity theft is an insufficient injury to confer standing.  In response, some data breach plaintiffs have sued under state consumer protection statutes – arguing that the data collector violated its promise to protect such data – and sought statutory damages provided by the consumer protection statute in whatever state.   

That is essentially the issue in Spokeo. The question is simple.  But the answer will have enormous consequences – it will either shut the courthouse to millions of potential plaintiffs or expose any number of defendants to liability.  We will see.