Law of the Land: Spokeo, Inc. v. Robins
By: Ryan Cash
The recent Supreme Court case involving Spokeo, Inc. and Thomas Robins has implications for data providers and companies handling consumer information. Next Caller takes a deeper dive into the case, decision, and importantly, the dissent, to evaluate what this means for the industry moving forward.
One can search Spokeo for personal information (address, marital status, age, economic health, occupation) about an individual via his or her name, phone number or email address. The case invokes the Fair Credit Reporting Act of 1970, (FCRA), which applies to companies that provide information bearing on someone’s credit standing, character, reputation, etc. Given the nature of the information Spokeo provides, it is alleged to be subject to FCRA. Companies subject to FCRA must follow “reasonable procedures to assure maximum possible accuracy of” consumer reports. To make sure reporting agencies follow FCRA, Congress grants consumers the right to sue noncomplying agencies.
Thomas Robins’ Spokeo profile contained inaccurate information. He was unemployed and claims the misinformation affected his ability to get a job. By presenting wrong information, Robins says Spokeo willfully violated FCRA’s requirements. The key is establishing whether Robins has standing to sue. To have standing, he must show that Spokeo’s conduct caused him “injury in fact” which requires “particular and concrete harm.” In English, Spokeo’s conduct injured Robins himself, as an individual, not the greater public, and the injury is real, not hypothetical. The District Court ruled Robins’ did not meet the requirements. The Ninth Circuit reversed saying Spokeo violated his rights under FCRA, and the mishandling of his information harmed him as an individual, so he has standing to sue. The Supreme Court evaluates the Ninth Circuit’s decision.
Decision and Reasoning:
The Supreme Court rules the Ninth Circuit’s analysis was incomplete. This rests on a distinction between the terms “particular and concrete.” According to the Supreme Court, the Ninth Circuit wrongly combined the two independent requirements, and their analysis only satisfied one of them: “particular.” They successfully showed that the handling of Robins’ personal information affected him as an individual, rather than the greater public (ie. the wrong information in Robins’ profile did not harm you or I). However, their analysis did not take up the question of concreteness. They did not adequately address whether the FCRA violation resulted in real harm. Justice Alito provides examples of where FCRA violations may cause no harm, such as if Spokeo gives an incorrect zip code, it would be a rather innocuous violation. It’s important to understand the Supreme Court is ruling on the Ninth Circuit’s analysis, not the case itself. The Court takes no position on whether the Ninth Circuit’s conclusion was correct or not. They simply rule that the analysis is incomplete, and send the case back to the Ninth Circuit.
Justice Ginsberg leads the dissent, and her reasoning rests on two arguments. One is historical precedent. She provides multiple cases where the terms “concrete and particular” were combined in the ruling. In other words, historically the court has not needed to discuss “concrete” and “particular” independently, as this ruling claimed it did. The second, and in my opinion, more interesting argument, is that Justice Ginsberg believes the violation of FCRA’s requirements in this case did in fact cause concrete harm, and that Thomas Robins has standing to sue. She essentially finds the court’s observation to be a red herring. The opinion stated there are cases where an FCRA violation would cause no harm, such as providing an incorrect zip code. However, in Ginsberg’s eyes, this case is fundamentally different. Spokeo misrepresented Robins’ education, economic status and family situation, which could create an impression that he is overqualified for the positions that he is seeking and materially affect his job prospects. FCRA’s requirements were designed to prevent situations exactly like this. Therefore, she sees merit in Robins’ complaint and would affirm the Ninth Circuit’s decision.
Discussion and Implications:
Okay, enough legal jargon. So what does this mean? There are important considerations embedded in this ruling. First, the Supreme Court did not officially rule in favor of Spokeo or decide on the merits of Robins’ allegation. They gave the legal equivalent of a “maybe, but I’m not convinced yet; go back to the drawing board.” In other words, this case is very much alive and not settled. Second, Justice Ginsberg’s dissent gives an indication of the type of reasoning that will be used moving forward. She says there is concrete harm here. The misinformation from Robins’ Spokeo profile constitutes real and concrete harm to his employment prospects. The Ninth Circuit’s judgment simply did not address it in full, but if they do, they can reaffirm their decision. Hopefully they do not just copy and paste, but you never know.
For data companies, it’s important to be aware that protection of consumer information is top of mind for litigators and the courts. Companies need to take extra precaution to ensure that they are carefully, responsibly and accurately handling consumer information, and they are compliant with relevant statutes, like FCRA. If you do not wish to fall under FCRA, know that a disclaimer alone is not enough to exempt you. Know who is using the information you are providing and how they are using it. Ensure that those using the information are aware of the requirements of legislation like FCRA, because if they use it in a way that violates said requirements; the hammer comes down on the agency. If you provide information that could relate to credit, character, personal characteristics, etc. make sure it is not being used for discriminatory practice or creditworthiness evaluation (ability to pay bills, employment, etc.). For further reading on best practices consult the FTC Big Data Report here.