Update On Data Breach And Data Privacy Class Actions Post-Spokeo

In May, the U.S. Supreme Court issued its opinion in Spokeo v. Robins, providing guidance on the "injury-in-fact" aspect of the constitutional standing requirement for putative class action plaintiffs. 136 S. Ct. 1540 (2016), as revised (May 24, 2016). Spokeo was quickly hailed by both plaintiff- and defense-side lawyers as a major victory, but in truth provided something for everyone. It requires, for example, that a plaintiff allege "a concrete injury even in the context of a statutory violation . . ." and not merely a "bare procedural violation, divorced from any concrete harm." Id. at 1543, 1549. Further, a "concrete" injury must "actually exist" and be "real, and not abstract." Id. at 1548. On the other hand, a "concrete" injury is not "necessarily synonymous with 'tangible.'" Id. at 1549. Ways to determine whether "intangible" harm qualifies as "concrete" include: (1) evaluating whether the alleged harm "has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit" and (2) looking to the judgment of Congress which "has the power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before." Id.

How has Spokeo affected decisions on data breach and data privacy class actions? Like Spokeo itself, subsequent decisions, including several from just the past few weeks, have been somewhat mixed.

Most recently, in Yershov v. Gannet Satellite Information Network, Inc., dba USA Today, a federal court in Massachusetts denied a motion to dismiss, allowing a putative privacy class action to continue. No. CV 14-13112-FDS, 2016 WL 4607868 (D. Mass. Sept. 2, 2016). Plaintiff Yershov alleged that each time he watched a USA Today video his location information and information about the video watched was sent to a third-party data analytics company, in violation of the Video Privacy Protection Act ("VPPA"). Id. at *1. Defendant Gannett, the app manufacturer, moved to dismiss for lack of standing, arguing under Spokeo that Plaintiff had alleged only a bare statutory violation and no concrete harm. Id. Judge Saylor of the District of Massachusetts denied the motion, finding that Plaintiff had alleged a concrete, though intangible harm - an invasion of his right to privacy in his video review history. Id. at *8. The decision, in part, relied on Spokeo's guidance to look to "both history and the judgment of Congress" to determine whether an...