Cybersecurity Implications Of Supreme Court's Spokeo Decision Begin To Emerge

On May 16, 2016, the Supreme Court issued its opinion in Spokeo , Inc. v. Robins, 578 U.S. ____ (2016), holding that Article III standing requires plaintiffs to demonstrate concrete injury in the context of a statutory violation. In the week since the Court's opinion, Spokeo has already been cited in high-profile cybersecurity cases.

1. Khan v. Children's National Health System

   In Khan v. Children's National Health System, Children's National was attacked by hackers in a phishing scam that compromised the personal information of approximately 18,000 patients. See Memorandum Opinion, No. 8:15-cv-02125, at 2 (D. Md. May 19, 2016) (ECF 33). The plaintiff filed a proposed class action, alleging violations of consumer protection acts and common law claims. Id. at 2-3. Children's National filed a motion to dismiss, arguing that the plaintiff lacked standing because she had not suffered an injury in fact. Id. at 3. In response, the plaintiff claimed, among other things, that she faced an imminent threat of identity theft, that she had expended time and money to obtain credit monitoring and protect herself against identity theft, and that she had statutory standing under the consumer protection acts.

   The court found that the plaintiff lacked standing. He noted that, while the plaintiff was concerned that her personal information might be misused, she had not alleged that she or anyone else affected by the data breach had learned of any misuse. With respect to the plaintiff's assertion that she nevertheless had statutory standing, the court cited Spokeo for the proposition that "Article III standing requires a concrete injury even in the context of a statutory violation." The court found that the plaintiff had not connected the alleged violations of the consumer protection acts with an injury and had advanced no authority that "a state legislature or court, through a state statute or cause of action, can manufacture Article III standing for a litigant who has not suffered a concrete injury." Id. at 15. As the plaintiff's lack of standing deprived the court of jurisdiction, the court remanded the case to state court.

2. In re Nickelodeon Consumer Privacy Litigation

   In In re Nickelodeon Consumer Privacy Litigation, Viacom Inc. was accused of collecting website information about children's genders and birthdays so that it could target them for advertising. See Opinion, No. 2:12-cv-07829-SRC-CLW, at 2 (D.N.J. Jan. 20, 2015) (ECF 84). The plaintiffs sued...