Cybersecurity Implications of Supreme Court's Spokeo Decision Begin to Emerge

On May 16, 2016, the Supreme Court issued its opinion in Spokeo, Inc. v. Robins, 578 U.S. (2016), holding that Article III standing requires plaintiffs to demonstrate concrete injury in the context of a statutory violation. In the week since the Court's opinion, Spokeo has already been cited in high-profile cybersecurity cases.

1. Khan v. Children's National Health System

In Khan v. Children's National Health System, Children's National was attacked by hackers in a phishing scam that compromised the personal information of approximately 18,000 patients. See Memorandum Opinion, No. 8:15-cv-02125, at 2 (D. Md. May 19, 2016) (ECF 33). The plaintiff filed a proposed class action, alleging violations of consumer protection acts and common law claims. Id. at 2-3. Children's National filed a motion to dismiss, arguing that the plaintiff lacked standing because she had not suffered an injury in fact. Id. at 3. In response, the plaintiff claimed, among other things, that she faced an imminent threat of identity theft, that she had expended time and money to obtain credit monitoring and protect herself against identity theft, and that she had statutory standing under the consumer protection acts.

The court found that the plaintiff lacked standing. He noted that, while the plaintiff was concerned that her personal information might be misused, she had not alleged that she or anyone else affected by the data breach had learned of any misuse. With respect to the plaintiff's assertion that she nevertheless had statutory standing, the court cited Spokeo for the proposition that "Article III standing requires a concrete injury even in the context of a statutory violation." The court found that the plaintiff had not connected the alleged violations of the consumer protection acts with an injury and had advanced no authority that "a state legislature or court, through a state statute or cause of action, can manufacture Article III standing for a litigant who has not suffered a concrete injury." Id. at 15. As the plaintiff's lack of standing deprived the court of jurisdiction, the court remanded the case to state court.

2. In re Nickelodeon Consumer Privacy Litigation

In In re Nickelodeon Consumer Privacy Litigation, Viacom Inc. was accused of collecting website information about children's genders and birthdays so that it could target them for advertising. See Opinion, No. 2:12-cv-07829-SRC-CLW, at 2 (D.N.J. Jan. 20, 2015) (ECF 84). The plaintiffs sued, alleging violations of the Video Privacy Protection Act and New Jersey's Computer Related Offenses Act. Id. at 1. Although the district court found that the plaintiffs had standing, it dismissed the complaint for failure to state a claim, and the plaintiffs appealed to the Third Circuit.

On appeal to the Third Circuit, Viacom argued that the plaintiffs lacked standing based on the alleged statutory violations and had not independently pled an injury. Viacom Br., In re Nickelodeon Consumer Priv. Litig., No. 15-1441, at 11, 13 (3d Cir. June 15, 2015). Viacom's brief, filed before the Spokeo decision, observed that the Supreme Court had granted certiorari in Spokeo to resolve the issue of whether standing could be conferred through a statutory violation. Id. at n.1. Following the Spokeo decision, Viacom filed a letter supplementing its brief and arguing that the Spokeo holding required dismissal for lack of standing because the plaintiffs had alleged only statutory violations and had not plausibly pled economic harm. Viacom Ltr., In re Nickelodeon Consumer Priv. Litig., No. 15-1441 (3d Cir. May 20, 2016).

3. Boelter v. Advance Magazine Publishers, Inc.

In Boelter v. Advance Magazine Publishers, Inc., the plaintiff brought a class action against Advance Magazine Publishers, Inc. (d/b/a Condé Nast), alleging that Condé Nast had sold their personal information (including names, titles of magazines subscribed to, and home addresses) to third parties in violation of Michigan's Video Rental Privacy Act. See Mem. of Law in Support of Mot. to Dismiss, No. 15-cv-05671, at 6 (S.D.N.Y. Oct. 2, 2015) (ECF 19). In its motion to dismiss, filed prior to the Spokeo decision, Condé Nast argued that plaintiff impermissibly based her standing on the alleged violation of the Michigan statute and had not pled actual harm. See id. at 7-8. Condé Nast observed that Spokeo was pending before the Supreme Court and that Michigan's attorney general had joined a group of eight attorneys general in an amicus brief urging the Court to hold that a technical violation of a statute cannot confer Article III standing. Id. at 8.

After Spokeo was decided, both the plaintiff and Condé Nast filed letters with the court claiming that the decision supported their side. The plaintiff filed a letter, arguing that Spokeo held that "a plaintiff . . . need not allege any additional harm beyond the one Congress has identified." Ltr. in Support of Opp. to Mot. to Dismiss, Boelter v. Advance Magazine Publishers, Inc., No. 15-cv- 05671, at 1 (S.D.N.Y. May 16, 2016) (ECF 45). Citing to authority holding that a violation of the Michigan statute was sufficient to confer standing, the plaintiff argued that Spokeo supported standing. Id.

Condé Nast filed a letter in reply, arguing that Spokeo supported dismissal for lack of standing. Condé Nast asserted that the plaintiff's letter had avoided "what the Supreme Court actually had to say about" injury-in-fact. Ltr. in Resp. to Pl. May 16, 2016 Ltr., Boelter v. Advance Magazine Publishers, Inc., No. 15-cv-05671, at 1 (S.D.N.Y. May 18, 2016) (ECF 46). Condé Nast pointed out that the Supreme Court had emphasized that a plaintiff does not "automatically satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right. Article III standing requires a concrete injury even in the context of a statutory violation." Id. Accordingly, Condé Nast maintained that the plaintiff lacked standing.

Conclusion

Spokeo has mostly been cited in support of the principle that standing cannot be based solely on the violation of a statutory right. There must also be concrete injury. While Spokeo's effect on cybersecurity cases is yet to be seen, it is already being used in support of arguments that plaintiffs lack standing. As these cases and others are litigated in the coming months, the full impact of Spokeo should become apparent.