When big technology companies engage in misconduct, the primary legal redress available to their consumers is class action litigation.1×1. See, e.g., Ashley Carman, Former Lyft Driver Files Class Action Lawsuit Against Uber over Its “Hell” Tracking Program, The Verge (Apr. 24, 2017, 5:50 PM), https://www.theverge.com/2017/4/24/15414006/uber-hell-tracking-software-lyft-drivers-class-action-lawsuit [https://perma.cc/V7ZJ-LSRS]; see also Gene Maddaus, Snap Inc. Hit with Securities Class Action Alleging Inflated Growth, Variety (May 16, 2017, 7:03 PM), http://variety.com/2017/biz/news/snap-inc-securities-class-action-growth-pomerantz-1202429910/ [https://perma.cc/L3DN-DS7J]. But in order to file such lawsuits, consumers must have standing, a legal requirement that protects the constitutional separation of powers imperative. Rooted in the Article III limitation that courts adjudicate only actual “[c]ases” and “[c]ontroversies,”2×2. U.S. Const. art. III, § 2, cl. 1. standing requires plaintiffs to show that they have suffered an “injury in fact” in order to access the courts.3×3. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992). Standing also requires an injury that is “fairly . . . trace[able] to the [defendant’s] challenged action,” id. at 560 (first alteration in original) (quoting Simon v. E. Ky. Welfare Rights Org., 426 U.S. 26, 41 (1976)), and redressable by a favorable judicial decision, id. at 561. In order to meet that “irreducible constitutional minimum,” injuries must be “concrete and particularized,” and “actual or imminent.”4×4. Id. at 560 (quoting Whitmore v. Arkansas, 495 U.S. 149, 155 (1990)). “[C]onjectural or hypothetical” disputes should be left to the other branches.5×5. Id. (quoting Whitmore, 495 U.S. at 155); see also id. at 577. Recently, in Robins v. Spokeo, Inc.,6×6. 867 F.3d 1108 (9th Cir. 2017). the Ninth Circuit held that a plaintiff who alleged he had been harmed by the defendant’s violation of the Fair Credit Reporting Act7×7. 15 U.S.C. §§ 1681–1681x (2012). (FCRA) had suffered an injury sufficiently concrete to confer standing.8×8. Robins, 867 F.3d at 1118. In doing so, the Ninth Circuit affirmed standing’s separation of powers roots, honored congressional intent, and preserved class actions as a primary enforcement mechanism against technology companies.
Congress passed the FCRA in 1970 with the stated intent of “prevent[ing] consumers from being unjustly damaged because of inaccurate or arbitrary information in a credit report.”9×9. S. Rep. No. 91-517, at 1 (1969). To achieve that aim, the FCRA imposes on consumer reporting agencies a number of requirements concerning the creation and use of consumer reports, including that agencies “follow reasonable procedures to assure maximum possible accuracy of” their reports.10×10. 15 U.S.C. § 1681e(b) (emphasis added). The FCRA also provides that “[a]ny person who willfully fails to comply with any requirement [of the FCRA] with respect to any [person] is liable to that [person]” for, among other things, actual damages, statutory damages of $100 to $1000 per violation, costs of the action, and attorney’s fees.11×11. 15 U.S.C. § 1681n(a).
Spokeo, Inc. operates a “people search engine,” which aggregates personal information about individuals to share with its users, including employers evaluating prospective employees.12×12. Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1543 (2016). When Thomas Robins learned that his Spokeo profile stated he was a relatively affluent fifty-something, with children, a job, and a graduate degree — none of which was true — he filed a class action complaint in the Central District of California, alleging that Spokeo had willfully violated the FCRA by failing to follow reasonable procedures to ensure the accuracy of the information it disseminated about him.13×13. Id. at 1546. He alleged that Spokeo’s violation had harmed his employment prospects when he had been unemployed, causing him ongoing anxiety and stress.14×14. See First Amended Complaint at 8, Robins v. Spokeo, Inc., No. 2:10-cv-5306, 2011 WL 7782796 (C.D. Cal. Feb. 17, 2011).
The district court dismissed Robins’s complaint for lack of Article III standing, holding that the procedural violation of the FCRA, without any actualized injury, was not a sufficient injury.15×15. See Robins v. Spokeo, Inc., No. CV10–05306, 2011 WL 597867 at *1–2 (C.D. Cal. Jan. 27, 2011). The Ninth Circuit reversed.16×16. Robins v. Spokeo, Inc., 742 F.3d 409, 414 (9th Cir. 2014). It stated that “the violation of a statutory right is usually a sufficient injury” within Article III’s limits,17×17. Id. at 412 (emphasis added). and that those limits were respected in this case because “Spokeo violated [Robins’s] statutory rights, not just the statutory rights of other people,” and because Robins’s interests were “individualized rather than collective.”18×18. Id. at 413. Spokeo also challenged whether it qualified as a consumer reporting agency under the FCRA definition, see 15 U.S.C. § 1681a(f) (2012), but the Ninth Circuit did not decide the issue for the purposes of its ruling on standing, see Robins, 742 F.3d at 414 n.4. Thus, the court said, Robins had suffered a standing-sufficient injury by the violation of his FCRA-conferred rights.19×19. Robins, 742 F.3d at 413–14.
The Supreme Court vacated and remanded.20×20. Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1545 (2016). Writing for the Court, Justice Alito21×21. Justice Alito was joined by Chief Justice Roberts and Justices Kennedy, Thomas, Breyer, and Kagan. explained that standing is a logical conjunction, not a disjunction, and that though the Ninth Circuit properly established that Robins’s injury was particularized, it did not sufficiently consider whether his injury was also concrete.22×22. Spokeo, 136 S. Ct. at 1548. In remanding the case with instructions to conduct the concreteness inquiry,23×23. Id. at 1550. Justice Alito offered some guidance: a concrete injury is “real, and not abstract” and “must be de facto; that is, it must actually exist.”24×24. Id. at 1548 (internal quotation marks omitted). Concrete injuries are more than “bare procedural” harms, but need not be tangible.25×25. Id. at 1549. And whether an intangible harm qualifies as an injury turns on both history and congressional decisions.26×26. Id.
Justice Alito declined to take a position on the correct result of the prescribed concreteness inquiry in Robins’s case.27×27. Id. at 1550. However, he did set the goalposts. “On the one hand,” he wrote, “Congress plainly sought to curb the dissemination of false information by adopting procedures [in the FCRA] designed to decrease that risk. On the other hand, Robins cannot satisfy the demands of Article III by alleging a bare procedural violation.”28×28. Id. Not all procedural violations create harm or a material risk of harm; for example, “[i]t is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.”29×29. Id.
Justice Thomas concurred in the judgment. He preferred to reach the majority’s result by tracing the development of private versus public rights through common law courts.30×30. Id. (Thomas, J., concurring). He explained that courts were historically more generous toward plaintiffs seeking to vindicate their own private rights than toward those suing to protect the public at large; only the former could access the courts by showing a bare violation of a right. Id. at 1550–51. Thus, Justice Thomas encouraged the court of appeals to consider whether the right Congress sought to protect through the FCRA was private or public. Id. at 1554.
Justice Ginsburg, joined by Justice Sotomayor, dissented. She felt no need to remand the case, because she believed Robins’s complaint to have sufficiently alleged that Spokeo had harmed his job prospects.31×31. Id. at 1556 (Ginsburg, J., dissenting).
Given these goalposts, the Ninth Circuit determined on remand that Spokeo’s alleged FCRA violation established a concrete harm sufficient to confer standing.32×32. Robins, 867 F.3d at 1118. Because the Ninth Circuit made the particularization determination in its first opinion, see Robins v. Spokeo, Inc., 742 F.3d 409, 413–14 (9th Cir. 2014), it devoted the second purely to concreteness, see Robins, 867 F.3d at 1112. Writing for the panel, Senior Judge O’Scannlain33×33. Senior Judge O’Scannlain was joined by Judges Graber and Bea. adopted the two-pronged test for concreteness put forth by the Second Circuit in Strubel v. Comenity Bank34×34. 842 F.3d 181 (2d Cir. 2016); see id. at 190. : “(1) whether the statutory provisions at issue were established to protect [Robins’s] concrete interests (as opposed to purely procedural rights), and if so, (2) whether the specific procedural violations alleged in this case actually harm, or present a material risk of harm to, such interests.”35×35. Robins, 867 F.3d at 1113. Given the congressional record tracking the increasing “ubiquity and importance of consumer reports,” Judge O’Scannlain had “little difficulty” concluding that the FCRA was established to protect a concrete interest in preventing dissemination of false information to future employers.36×36. Id. at 1114. He analogized that interest to others protected by common law — for example, tort law has long provided remedies for defamatory statements that cause harm.37×37. Id. at 1114–15. Guided by congressional judgment and historical practice, Judge O’Scannlain concluded that the first prong was easily satisfied.38×38. Id. at 1115.
On the second prong, Judge O’Scannlain acknowledged that the failure to follow reasonable procedures as prescribed by the FCRA does not always cause real-world harm.39×39. Id. at 1115–16. For example, even if a credit reporting agency collects false information, it does not always publish it.40×40. Id. at 1116. But he declined to draw a precise line between violations that do and do not confer standing.41×41. Id. at 1117. Instead, he weighed Robins’s harm against the Supreme Court’s counterexample — an incorrect zip code — and concluded that a misrepresented age, marital status, educational background, employment history, and the like were much more likely to harm employment prospects or create emotional distress.42×42. Id. Relying on an amicus brief by the Consumer Financial Protection Bureau, Judge O’Scannlain reasoned that “even seemingly flattering inaccuracies can hurt an individual’s employment prospects as they may cause a prospective employer to question the applicant’s truthfulness or to determine that he is overqualified.”43×43. Id. (citing Brief of Amicus Curiae Consumer Financial Protection Bureau in Support of Plaintiff-Appellant at 20–21, 20 n.3, Robins, 867 F.3d 1108 (No. 11-56843), https://www.consumerfinance.gov/documents/611/77-2_-_CFPB_Amicus_Brief.pdf [https://perma.cc/5J27-3DUZ]). Thus, Judge O’Scannlain concluded that the alleged FCRA violation was an injury sufficient to confer standing and remanded the case.44×44. Id. at 1118. The Ninth Circuit also briefly considered and dismissed Spokeo’s argument that “Robins’s allegations of harm are too speculative to establish a concrete injury.” Id. at 1117; see also id. at 1117–18. Contrasting the case at hand with Clapper v. Amnesty International USA, 568 U.S. 398 (2013), it concluded that both the “challenged conduct” — an FCRA violation — and the “attendant injury” — Robins’s harmed employment prospects — had already occurred; thus, Robins’s allegations were not speculative. Id.
With that conclusion, the Ninth Circuit respected congressional intent and preserved a key safeguard for consumers in the digital era. By adopting the Strubel standard, and applying it liberally, the court respected standing’s separation of powers roots and exercised a healthy deference to Congress. Moreover, the court’s decision will have the important consequence of preserving the vitality of class action litigation as the best — and sometimes only — mechanism for protecting against online abuses. Thus, Robins made Spokeo practical in the best way possible.
The Supreme Court’s guidance on what constitutes a concrete injury was itself anything but concrete. On the one hand, the Court rejected the notion that the mere violation of a statute conferring a procedural right is a sufficient injury to confer standing; on the other, it affirmed Congress’s power to “define injuries . . . that will give rise to a case or controversy where none existed before.”45×45. Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1549 (2016) (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 580 (1992) (Kennedy, J., concurring in part and concurring in the judgment)). It was not, therefore, a foregone conclusion that the Ninth Circuit would hold that Robins had standing.46×46. Some had predicted that Spokeo would make it more difficult for courts to find standing in cases where plaintiffs alleged violation of procedural rights. See, e.g., Sarah E. Pugh, Comment, Cloudy with a Chance of Abused Privacy Rights: Modifying Third-Party Fourth Amendment Standing Doctrine Post-Spokeo, 66 Am. U. L. Rev. 971, 992 (2017) (“As a result of the Court’s decision in Spokeo, it is more difficult for plaintiffs alleging procedural rights violations to establish standing.”). In fact, during oral arguments, Justice Alito called Robins’s alleged injury a “quintessential speculative harm.”47×47. See Transcript of Oral Argument at 38, Spokeo, 136 S. Ct. 1540 (No. 13-1339). He seemed troubled by the lack of proof that anyone other than Robins had ever searched for Robins on the Spokeo website, let alone used the information they found against him.48×48. See id. Similarly, Justice Ginsburg expressed concerns about the difficulty of quantifying intangible harms for the purpose of assessing statutory damages.49×49. See id. at 48–49. The FCRA provides for $100 to $1000 per violation50×50. 15 U.S.C. § 1681n(a)(1)(A) (2012). — but what is a violation? A false fact published? A page view of that fact?
That the Ninth Circuit’s ultimate decision was not compelled by the Supreme Court is further illustrated by the fact that other circuits have taken the Court’s guidance in different directions. Perhaps the most crystallized realization of this split is between the Eighth and the Sixth Circuits. In decisions just days apart, both citing Spokeo, the former ruled that a violation of a consumer protection statute was insufficient to confer standing because the plaintiff had not identified any actual harm that resulted from the defendant’s violation of the statute, while the latter held in a class action about a data breach that plaintiffs did not have to show their data had actually been misused to clear Spokeo’s standing bar — a statutory violation was enough.51×51. Compare Braitberg v. Charter Commc’ns, Inc., 836 F.3d 925, 931 (8th Cir. 2016), with Galaria v. Nationwide Mut. Ins. Co., 663 F. App’x 384, 388–89 (6th Cir. 2016). For another example of Spokeo being interpreted in contradictory manners, consider courts’ disparate treatment of the FCRA’s “separate document” provision. See Michael G. McLellan, Finding a Leg to Stand On: Spokeo, Inc. v. Robins and Statutory Standing in Consumer Litigation, Antitrust, Summer 2017, at 49, 51–52. In another recent FCRA case, the Third Circuit spelled out the “material risk of harm” concreteness test used by numerous other circuits before adopting its own, new test, supplying no explanation for the departure.52×52. See In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 637 (3d Cir. 2017).
The Ninth Circuit thus chose one plausible interpretation — the Strubel test — out of many. That choice was normatively desirable on at least three dimensions: the nature of the test itself, the manner in which it was applied, and the implications for future class action litigation in the online sphere. First, the Strubel test reflects an appropriate deference to Congress in that it is supported by an examination of congressional intent.53×53. Robins, 867 F.3d at 1113 (noting that a concrete injury may be one “where Congress conferred the procedural right to protect a plaintiff’s concrete interests” (quoting Strubel v. Comenity Bank, 842 F.3d 181, 190 (2d Cir. 2016)). The choice of a deferential test was no accident; the Ninth Circuit cited affirmatively to opinions that have weighed congressional intent in determining what is a concrete injury.54×54. Id. (citing deference to Congress in Second, Fourth, and Sixth Circuit opinions, as well as previous deference in a Ninth Circuit opinion). The decision also makes sense in light of Judge O’Scannlain’s previous advocacy for judicial restraint. See Diarmuid F. O’Scannlain, Lecture, Politicians in Robes: The Separation of Powers and the Problem of Judicial Legislation, 101 Va. L. Rev. Online 31, 33 (2015). The court seemed to respect that “legal rights reflect social judgments about where harm has and has not occurred,” and those social judgments are best left to a democratically accountable branch.55×55. Daniel Townsend, Essay, Who Should Define Injuries for Article III Standing?, 68 Stan. L. Rev. Online 76, 80 (2015) (arguing that “where Congress has defined an injury, the Court should not apply a separate test to see if the injury is ‘real’ enough for the Court’s purposes,” id. at 77). Here, the Supreme Court overstepped in its declaration that a mistaken zip code would not have adverse offline consequences.56×56. Lauren E. Willis, Spokeo Misspeaks, 50 Loy. L.A. L. Rev. (forthcoming 2017) (manuscript at 109), https://ssrn.com/abstract=3015784 [https://perma.cc/M2HJ-XYVP] (explaining how the Supreme Court’s example of a piece of misinformation that would not cause any harm — an incorrect zip code — was misplaced because, for example, such information is used in “credit granting and pricing decisions”). This mismatch underscores the genius of separation of powers in the standing context and explains the importance of the Ninth Circuit’s deference to Congress on what Congress sees as important rights to protect.
Second, the court was generous in its application of the test. It briefly examined the FCRA and its legislative history before concluding with “little difficulty” that the “interests protected by [the] FCRA’s procedural requirements are ‘real,’ rather than purely legal creations.”57×57. Robins, 867 F.3d at 1114. This language is perhaps a reflection of the discussion at the Spokeo oral argument, during which the justices attempted to parse out the difference between an “injury in fact” versus an “injury in law.” See Transcript of Oral Argument, supra note 47. Those interests were similar enough to certain torts — libel and slander — for which “[c]ourts have long entertained causes of action” that the court felt no need to conduct a more fact-intensive inquiry.58×58. Robins, 867 F.3d at 1115. Given that the analogized common law torts are difficult to prove,59×59. Id. at 1114–15. the court could easily have been more stringent in its application of the Strubel test. For example, in applying the “material risk of harm” prong, it could have followed Justice Alito’s line of questioning at oral argument60×60. See Transcript of Oral Argument, supra note 47, at 37–38. and asked for proof — or at least proof of a material risk — that a prospective employer had seen the misinformation about Robins on Spokeo. To do so would have required remanding to the trial court to allow Robins to subpoena data from Spokeo, track down each individual or company who had viewed his Spokeo profile, and ascertain whether the access of that profile had in any way influenced their decisions about whether to hire him; that is, it would have effectively precluded the lawsuit. Instead, the court gave Robins the benefit of the doubt in its willingness to simply imagine how Spokeo’s misinformation could have harmed Robins.
Finally, if deference to Congress was the Ninth Circuit’s rationale, the preservation of class actions to protect individuals in the online sphere was the practically significant consequence. When the Supreme Court granted certiorari, courts around the country stayed statutory damages cases.61×61. Tyler Kasperek Somes, Assessing Spokeo, Inc. v. Robins: The Future of Statutory Damage Class Actions in the Consumer Protection Arena, 20 J. Consumer & Com. L. 122, 124 (2017). When its decision came down, the implications for class actions to vindicate online harm were seemingly bleak. The Court appeared to set a high, fact-intensive bar for finding the violation of a statutorily conferred intangible harm — that is, the exact type of harm that tends to occur online — which would significantly narrow the class of named plaintiffs who could bring enforcement actions.62×62. The Supreme Court, 2015 Term — Leading Cases, 130 Harv. L. Rev. 307, 446 (2016) (“Spokeo jeopardizes the breadth of many laws whose enforcement is likewise premised on suits by classes of persons whom the proscribed conduct has a tendency to injure, regardless of proof of consequential harms[,] . . . includ[ing], among others, the Copyright Act of 1976, the Credit Repair Organizations Act, the Electronic Fund Transfer Act, and the Telephone Consumer Protection Act . . . .” (citations omitted)). Class actions require a named plaintiff, who has been concretely injured and whose injuries are “typical” of those of the class members, to bring the case. See Fed. R. Civ. P. 23(a)(3). Justice Ginsburg in fact brought up the issue of class certification during oral arguments, noting that the Court’s decision on standing would likely have implications at the class certification step of the litigation. See Transcript of Oral Argument, supra note 47, at 28. Instead, the Ninth Circuit’s willingness to extrapolate, as discussed above, will ensure that class actions remain available as a regulatory mechanism.
This consequence is especially important in the online sphere, where class actions are often the only available regulatory mechanism. Online, a few search engines wield enormous power,63×63. This imbalance is hard to overstate. Studies suggest, for example, that how Google ranks its search results could influence the outcome of presidential elections. Robert Epstein, How Google Could Rig the 2016 Election, Politico Mag. (Aug. 19, 2015), http://www.politico.com/magazine/story/2015/08/how-google-could-rig-the-2016-election-121548 [https://perma.cc/T6UA-Z9NK]. and the information they make (or do not make) available is deployed in “make or break” contexts — employment decisions, loan applications, and the like.64×64. This effect is especially true in the credit reporting context. Press Release, Consumer Fin. Prot. Bureau, CFPB to Supervise Credit Reporting (July 16, 2012), https://www.consumerfinance.gov/about-us/newsroom/consumer-financial-protection-bureau-to-superivse-credit-reporting [https://perma.cc/Q5X7-CKRD] (quoting then–Consumer Financial Protection Bureau Director Richard Cordray as stating that “[c]redit reporting is at the heart of our lending systems and enables many of us to get credit, afford a home, or get an education”). The sheer magnitude of information available online, and thus the sheer amount of misinformation that will inevitably be published, means executive agencies simply do not have the resources to prosecute every violation. And it would be financially untenable for every wronged individual to pursue litigation to recover $100 to $1000. Thus, the FCRA deputizes the private bar, incentivizing it with statutory damages to file class actions and effectively act as a regulator.65×65. See Somes, supra note 61, at 126–28 (explaining why the class action regime is a necessary and perhaps the only effective enforcement mechanism for injuries under the FCRA). Denying access to that regulatory mechanism would have the practical effect of allowing powerful companies to operate unchecked. Had the Ninth Circuit denied standing, it would have allowed Spokeo to “get away” with disseminating inaccuracies regarding important personal data. Thus, the court shifted the contours of the doctrine to avoid a pattern of undesirable outcomes.66×66. Richard H. Fallon, Jr., The Linkage Between Justiciability and Remedies — And Their Connections to Substantive Rights, 92 Va. L. Rev. 633, 637 (2006) (“[Courts] decide cases by seeking what they regard as an acceptable overall alignment of doctrines involving justiciability, substantive rights, and available remedies.”).
Robins made Spokeo practical in the best possible way. It moved away from the Supreme Court’s failure to recognize the potential real-world importance of a correct zip code, toward a legal rule that recognizes the incentives that individuals have to litigate and the significance of disseminating false information. In deferring to Congress’s judgment, imagining the significance of an online, intangible harm, and allowing the litigation to proceed, the Ninth Circuit preserved a critical tool for consumers who wish to hold companies accountable.