By: Douglas F. Brent, CIPP/US
We’ve written before about aggressive, hyper technical lawsuits alleging violations of the Fair Credit Reporting Act (FCRA), a 1970 law designed to ensure “fair and accurate credit reporting.” A relevant example for Kentucky businesses is Bickley v. Dish Network, a 2014 Sixth Circuit decision rejecting a privacy-based claim that a “consumer report” was used impermissibly by a company to verify (and reject) a fraudulent service order from an imposter. In that case, the appeals court hinted the suit was likely frivolous, bordering on extortion. It’s a strong warning.
Nevertheless, when Congress opens a door to lawsuits by creating private rights of action with statutory damages, plaintiffs will walk through that door. Some claims will be meritorious, others purely opportunistic. This week, in Spokeo v. Robins, the U.S. Supreme Court provided guidance to lower courts on when the doors to federal courts are to be opened to plaintiffs seeking to vindicate statutory claims under the FCRA and similar statutes, and when they shall remain closed.
Spokeo is a search engine. It provides both free and paid searches, including ones that employers and creditors might use to evaluate individuals. Given the nature of its work, it is a “consumer reporting agency” subject to the FCRA.
What happened to get Spokeo sued?
Robins claimed Spokeo generated an inaccurate profile about him. The inaccuracies? His marital status, age, employment status, and education, and whether he had kids. For a search engine claiming reliability, those are pretty big misses. But did those errors give Robins a legal right to sue in federal court? Access to federal courts requires “standing.” Standing requires injury in fact traceable to the defendant’s conduct that is likely to be redressed if the plaintiff wins. The Ninth Circuit Court of Appeals had said the violation of the statutory right to a “fair and accurate” report was an injury sufficient to confer standing to sue.
The Supreme Court disagreed, suggesting that Robins had alleged only “procedural” failings by Spokeo. The Court said “injury” not only must be particularized, but “concrete,” which is more than abstract legal harm:
“[a] violation of one of the FCRA’s procedural requirements may result in no harm. . . In addition, not all inaccuracies cause harm or present any material risk of harm. An example that comes readily to mind is an incorrect zip code.”
Under Spokeo, a consumer aiming to sue under the FCPA must show that a legally protected interest has been “invaded” in a concrete and particularized way. The claimed injury cannot be “conjectural or hypothetical.”
This is not especially groundbreaking, and may not spell the end of privacy-based FCRA claims. Most notably, the Court in Spokeo took no position as to whether Robins adequately alleged an injury in fact. Instead, it remanded the case to the lower appeals court to consider that question after applying the requirements of the Court’s “standing” analysis.