Ninth Circuit Issues Ruling on Spokeo: Inaccuracies Create Concrete Harms
Over seven years ago, CDT filed a complaint with the Federal Trade Commission against the people-search company Spokeo, alleging that the company and other data brokers were not protecting consumers as required by the Fair Credit Reporting Act (FCRA). A class action lawsuit filed against Spokeo in 2011, led by lead plaintiff Thomas Robins, raised a host of new issues about the nature of privacy harms, the actual protections provided by federal privacy laws, and the use of litigation as a vehicle for protecting consumers’ privacy. As the case made its way through the court system, the question of whether Robins had legal standing to bring the lawsuit came to the forefront.
When Spokeo v. Robins came before the Supreme Court in 2015, CDT argued in an amicus brief that limiting private claims under the FCRA could lead to a further increase in inaccurate information about consumers. In the age of big data, where information proliferates rapidly, small inaccuracies can snowball into opaque and biased inferences. A private right of action to ensure companies are living up to their responsibilities under the FCRA is an important check against this problem.
In a 6-2 decision last May, the Supreme Court took a narrower view. It held that standing requires “injury in fact,” which is a harm that is both particular and concrete. While the Ninth Circuit had previously found Robins’ allegations to be sufficiently particular to him, the Supreme Court determined that the lower court had failed to devote appropriate attention to whether Robins’ injuries were sufficiently concrete. The Ninth Circuit was directed to try harder next time.
This week, one year and twenty-one pages later, the Ninth Circuit has reevaluated Robins’ claim and found a concrete harm to establish standing. The Ninth Circuit panel rejected Spokeo’s suggestion that an inaccurate credit report, by itself, is too speculative to establish a concrete injury, concluding that the FCRA “exists specifically to protect consumers’ concrete interest in credit-reporting accuracy.” The Ninth Circuit highlighted the “ubiquity and importance of consumers reports in modern life” and the significant “real-world implications” that result if they are inaccurate.
Much of the debate around this case has revolved around whether a bare procedural violation should be enough to show concrete injury. In its most recent ruling, the Ninth Circuit asserted that Spokeo’s failures went beyond a simple violation of FCRA’s procedures: Robins alleges that Spokeo prepared an inaccurate consumer report and published it online, creating further damage. The Ninth Circuit acknowledged that determining whether any given bit of wrong information might harm (or help) an individual is not easily done, but it found Robins’ case to be an easy on its face.
The Supreme Court’s Spokeo decision, on the other hand, provided limited guidance on what constitutes “harmless” misinformation. It offered up only the dubious example that disseminating an erroneous zip code would have little capacity to create concrete harm to anyone, ignoring the fact that zip codes have, by themselves, been pernicious tools for racism.
Spokeo allegedly bungled Robins’ age, marital status, educational background, and employment history. As CDT’s amicus brief in this case explained, these sorts of inaccuracies could remove Robins from consideration at the earliest phases of a job search, subject him to higher insurance payments or credit interest rates, or simply mark him as untrustworthy. According to this week’s ruling by the Ninth Circuit, the accuracy of this type of information is “directly and substantially related” to the goals of the FCRA.
Indeed, if data brokers like Spokeo are going to facilitate the collection and sharing of personal data, using significantly inaccurate information, they will have to face the fact that this practice is not just a violation of the FCRA, but it is also a harm and a legally concrete one at that.
