Cybersecurity & Tech Surveillance & Privacy

Thoughts on the Opinion in Spokeo v. Robins

Adam Klein
Monday, May 16, 2016, 3:08 PM

The Court’s opinion in Spokeo v. Robins is here. I wrote about Spokeo when it was argued last November. My concern was that a ruling in Spokeo’s favor might limit Congress’s ability to provide private remedies for online harms that are intangible but nonetheless deeply injurious:

Published by The Lawfare Institute
in Cooperation With

The Court’s opinion in Spokeo v. Robins is here. I wrote about Spokeo when it was argued last November. My concern was that a ruling in Spokeo’s favor might limit Congress’s ability to provide private remedies for online harms that are intangible but nonetheless deeply injurious:

It’s easy to imagine many types of online conduct that a forward-thinking legislature might deem injurious—even reprehensible—but that, like publishing false information about a consumer, may inflict only intangible dignitary or emotional harm. Temporarily hijacking or defacing a person or organization’s website. Publishing or sharing intimate photos or videos without the consent of the person depicted—a particularly odious but increasingly widespread form of harassment. Posting publicly someone’s private emails or other confidential communications. Using a drone to spy on a neighbor. Hijacking a person’s social media account and using it as “a platform to broadcast racist and homophobic messages.” None of these examples necessarily inflicts what Spokeo’s brief calls “concrete harm”—yet each, to varying degrees, harms the victim’s dignity, reputation, or sense of well-being, often in a deep and personal way.

As a reminder, the question in Spokeo was (and I’m simplifying this to some degree) whether having false information posted about one online, in violation of a federal statute, is a sufficient “injury in fact” to confer Article III standing to sue in federal court.

Today’s opinion holds, by a 6-2 vote, that the Ninth Circuit failed to sufficiently consider the independent requirement that a plaintiff’s injury in fact be “concrete,” and remands for such consideration. This disposition has all the hallmarks of a make-this-case-go-away compromise: an inconclusive remand for a Court of Appeals do-over, coupled with a broad, pragmatic majority coalition (Alito, joined by Roberts, Kennedy, Thomas, Breyer, and Kagan).

That said, the Court has threaded the needle well here. Today’s opinion should not impede Congress from providing a private remedy for serious digital-age harms. (More on that below.) And the three brisk opinions (by today’s standards, 24 pages for three opinions is practically Holmesian) are worth reading for their divergent takes on the foundations of standing doctrine.

For our purposes, the key passage of Justice Alito’s majority opinion is Part II.B.2, which discusses the requirement that the plaintiff’s injury be “concrete.” The opinion, to its credit, emphasizes that concrete does not mean tangible:

Although tangible injuries are perhaps easier to recognize, we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete.

But which intangible injuries are sufficiently “concrete” to give rise to standing? The Court lists two factors that will help courts determine “whether an intangible harm constitutes injury in fact.” These are:

  • History: whether an intangible harm resembles traditional common-law grounds for suit.
  • Congressional action: whether Congress has elevated the intangible harm to the level of a statutory right.

The Court then explains what type of statutory right that would not provide a basis to sue. Fortunately, the example it offers here suggests that Spokeo was not intended to, and will not, prevent Congress from elevating serious digital-era harms to statutory rights:

For that reason, Robins could not, for example, allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III. …

A violation of one of the FCRA’s procedural requirements may result in no harm. For example, even if a consumer reporting agency fails to provide the required notice to a user of the agency’s consumer information, that information regardless may be entirely accurate. In addition, not all inaccuracies cause harm or present any material risk of harm. An example that comes readily to mind is an incorrect zip code. It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.

There’s not much new here: It is already settled law that the deprivation of “a procedural right in vacuo”—that is, without “some concrete interest that is affected by the deprivation”—cannot support Article III standing. And we’re not particularly concerned with foot-fault procedural violations—our fear was that Spokeo might affect Congress’s ability to provide a private remedy for deeply injurious, but intangible, digital injuries.

At most, the Court’s zip-code example implies a minor substantive limitation: some truly de minimis inaccuracies will not suffice. But if the standard is whether it is “difficult to imagine” an inaccuracy working “any concrete harm,” this should not significantly constrain Congress from addressing serious digital-age invasions of personal dignity and privacy like those described above.

What’s more, the opinion tempers even this modest constraint by noting several ways in which the law permits quite intangible injuries to support a private action.

First, it notes that “the law has long permitted recovery by certain tort victims even if their harms may be difficult to prove or measure.” The example given is slander per se, a doctrine that permits some slandered plaintiffs to recover without showing that specific damages resulted from the falsehood. This is a potentially important analogue for digital-age dignitary harms like online harassment.

Second, it acknowledges previous cases holding that the violation of statutory rights to obtain information that is useful for other purposes, such as campaign-finance information, can be a sufficiently concrete harm. This line of cases is a potential analogue for private suits (assuming these are authorized by statute) seeking to check the veracity, or even investigate the existence, of data held by third parties. Such third-party data is a fundamental, but potentially problematic, element of life in the digital age—an area where one could imagine a role for private-suits.

The bottom line on Spokeo: If the Court’s aim was to filter out truly frivolous lawsuits while preserving Congress’s flexibility to address serious digital-age intangible harms, it has done well.

Adam I. Klein is director of the Robert Strauss Center for International Security and Law at the University of Texas at Austin. He previously chaired the federal government’s Privacy and Civil Liberties Oversight Board, which oversees the FBI and other intelligence agencies.

Subscribe to Lawfare