The Spokeo Decision
In Spokeo, the Supreme Court considered whether a plaintiff claiming violations of the Fair Credit Reporting Act caused by the dissemination of inaccurate information had established Article III standing even though he could not show the violation had resulted in a real-world injury. The Court explained that plaintiffs must show an injury that is both “particularized,” meaning that it “affect[s] the plaintiff in a personal and individual way,” and “concrete,” meaning that it is “real, and not abstract.” Importantly, the Court clarified that “concrete” does not necessarily mean “tangible,” and that “we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete.”
The Court went on to explain when such intangible injuries could establish standing. One consideration is “whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Another is whether Congress has recognized a substantive harm by legislating a cause of action against it. The Court clarified, however, that the existence of a statutory right to sue was not always sufficient; rather, “Article III standing requires a concrete injury even in the context of a statutory violation.” As a result, a plaintiff could not show injury-in-fact merely by “alleg[ing] a bare procedural violation, divorced from any concrete harm.”
However, a “risk of real harm” nonetheless can be sufficiently concrete to bestow standing. This means that “the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. In other words, a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified.” The analysis, then, becomes a fact-specific one, and the Court provided the example under the FCRA that listing an incorrect zip code would not be anticipated to result in any concrete harm. Beyond that, however, the Court expressly declined to list other examples of inadequate procedural violations, leaving that question for the Ninth Circuit to decide on remand.
Differing Interpretations of Spokeo
Since Spokeo, defendants have generally argued that it created a requirement of an additional showing of harm, and plaintiffs have responded that it added nothing new to the standing analysis, but clarified that intangible injuries could be sufficient to establish standing.
One disagreement among courts is whether Spokeo imposed a requirement that a statutory violation must result in a material risk of harm. The Third Circuit observed that Spokeo did not “creat[e] a requirement that a plaintiff show a statutory violation has caused a ‘material risk of harm’ before he can bring suit.” While most courts have aligned with that interpretation, the Third Circuit recognized that its holding was contrary to findings of some other courts, like the Eighth Circuit, which had interpreted Spokeo to require plaintiffs to show that improperly retaining information in violation of the Cable Communications Policy Act resulted in “material risk of harm from the retention” in order to establish injury in fact.
But while larger interpretive differences exist in some courts, many differences in outcomes are simply the result of individual application of Spokeo to specific circumstances. For example, a court may dismiss a complaint where a plaintiff alleges that a defendant violated the Fair Debt Collection Practices Act (FDCPA) “by failing to list her account as ‘disputed by consumer,’” but made no showing of how she had been harmed, including by failing to show any effect on her credit score. Similarly, a plaintiff who alleged a statutory violation of the FCRA, without making any allegations about the potential results of that violation, had her complaint dismissed because “merely asserting a violation of the FCRA is insufficient without connecting it to a concrete injury.” The Ninth Circuit, on the other hand, ruled that a violation of the FCRA resulted in a concrete risk of harm when the plaintiff could list the potential harms that likely resulted from the breach.
Decisions have also varied based on the statute at issue. This is a natural result of the Spokeo ruling, as statutes will vary both in terms of whether they address an analogue of “a harm that has traditionally been regarded as providing a basis for a lawsuit,” and whether they could be characterized as providing procedural or substantive protections. One observer surveyed cases applying Spokeo, and concluded that plaintiffs alleging violations of the Telephone Consumer Protection Act and Fair Debt Collection Practices Act have largely been determined to have standing, while plaintiffs in cases alleging Fair and Accurate Credit Transactions Act violations have generally been unsuccessful. In cases concerning the FCRA, plaintiffs have established standing in approximately half of the cases.
The dispute over the proper interpretation of Spokeo has also been at issue in the recent spate of high profile data breach cases. Defendants have argued that Spokeo imposes a requirement that plaintiffs show not only that their information was stolen, but that they suffered some additional harm as a result of the data theft. Courts have come out on both sides of this dispute.
The Ninth Circuit’s Spokeo Remand Decision
When Spokeo reached the Ninth Circuit on remand, Spokeo argued that the plaintiff there must show that an injury from the inaccurate information was “certainly impending.” The Ninth Circuit rejected that argument, and focused on the potential harm that could result from the statutory violation. The court recognized that under the Supreme Court’s Spokeo decision, “a plaintiff will not be able to show a concrete injury simply by alleging that a consumer-reporting agency failed to comply with one of FCRA’s procedures.” Because the provision at issue was procedural, the court needed to determine whether the violation would “raise a real risk of harm to the concrete interests that FCRA protects.”The Ninth Circuit concluded that the plaintiff had satisfied that test by alleging much more than an incorrect zip code—that Spokeo had incorrectly listed his marital status, age, education, employment history, and wealth level, and that it “does not take much imagination to understand how inaccurate reports on such a broad range of material facts about Robins’s life could be deemed a real harm.”
Not long after that, the Ninth Circuit issued another decision that further illuminated how it would apply Spokeo. In Eichenberger v. ESPN, Inc., the Ninth Circuit analyzed the sufficiency of allegations under the Video Privacy Protection Act (VPPA). The court ruled that, unlike the FCRA at issue in Spokeo, the VPPA did concern a historical common law right—the right to privacy—and that every violation of that statute could be anticipated to violate that right. As a result, the plaintiff was not required to plead any additional harm beyond the violation of the statute.
Spokeo’s Second Petition
Spokeo sought to bring the dispute over intangible injuries back to the Supreme Court. In its certiorari petition, Spokeo again adopted the position that injury-in-fact must stem from impending harm. The question Spokeo sought to certify was “[w]hether the injury in fact requirement is satisfied by claimed intangible harm to an interest protected by the underlying statute, even if the plaintiff cannot allege that she suffered either real-world harm or an imminent risk of such harm.” Spokeo argued that there was “widespread confusion” in the lower courts surrounding the question of when statutory violations resulted in the sorts of intangible harms that bestowed standing on a plaintiff, and cited the cases referenced in Section III above in support of its position. Spokeo urged the Court to clarify that an injury must be imminent to be considered concrete.
The respondents pointed out that this is the question the Supreme Court had decided in Spokeo by holding that an injury need not be tangible to be concrete. They argued that Spokeo was attempting to relitigate the Supreme Court’s 2016 decision with its petition, not address an open question or circuit split.
On January 22, 2018, the Supreme Court denied Spokeo’s petition for certiorari, leaving it to the lower courts to continue determining how to apply Spokeo’s holding in particular contexts and under various statutes.
Reading the Tea Leaves
While the varying rulings make litigating in this area difficult, recognizing the trends in court decisions allows plaintiffs to focus their allegations in certain ways that may assist them in establishing standing under Spokeo. First, plaintiffs should find some analogue to a common law harm “that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” This provides plaintiffs with a strong basis for arguing that the defendant’s actions resulted in injury-in-fact without delving into the statutory procedural versus substantive distinction.
Second, even if there is such an analogue, plaintiffs should show that the statute is providing a substantive protection, meaning that Congress found the harm at issue to be sufficiently important that courts should imply a risk of harm as a result of the statutory violation.
Lastly, if it is unavoidable that the right at issue is procedural (as it was in Spokeo), plaintiffs must show that the violation at issue was not merely “technical,” like the listing of an incorrect zip code. The court’s analysis is likely to be a fact-specific one, so they key is to demonstrate, to the extent possible, how a violation of a procedural statute can be reasonably inferred to result in harm (amounting to a “material risk of harm,” if possible), as the Ninth Circuit concluded was the case on remand.
While defendants will continue to argue that plaintiffs must always specifically allege a risk of “imminent harm” as a result of a statutory violation, if plaintiffs can focus on the above three showings, they likely should be able to establish standing under Spokeo and the ensuing case law.
 Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), as revised (May 24, 2016).
 Spokeo, Inc. v. Robins, No. 17-806, 2018 WL 491554 (U.S. Jan. 22, 2018).
 Spokeo, 136 S. Ct. at 1548. It was the independent concreteness analysis that the Supreme Court held the Ninth Circuit had not conducted, necessitating remand.
 Id. at 1549.
 Id. at 1550.
 Id. at 1550 n.8.
 In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 637 (3d Cir. 2017).
 Braitberg v. Charter Commc’ns, Inc., 836 F.3d 925, 930 (8th Cir. 2016); see also Gubala v. Time Warner Cable, Inc., No. 15–CV–1078–PP, 2016 WL 3390415, at *4 (E.D. Wis. June 17, 2016).
 Piper v. Meade & Assocs., Inc., No. RWT 17-CV-863, 2017 WL 4516698, at *4 (D. Md. Oct. 10, 2017).
 Saltzberg v. Home Depot, U.S.A., Inc., No. CV1705798RGKAKX, 2017 WL 4776969, at *2 (C.D. Cal. Oct. 18, 2017).
 Robins v. Spokeo Inc., 867 F.3d 1108 (9th Cir. 2017), discussed in Section III, below.
 Neal Marder et al., The Most Noteworthy Class Action Developments Of 2017, Law360 (Dec. 8, 2017), https://www.law360.com/articles/992695/the-most-noteworthy-class-action-developments-of-2017.
 Compare Attias v. Carefirst, Inc., 865 F.3d 620, 628 (D.C. Cir. 2017) (finding standing based on “substantial risk of future injury” where plaintiffs’ social security and credit card numbers were accessed in data breach resulting in risk of identity theft), and Horizon Data Breach Litig., 846 F.3d at 640 (3d Cir. 2017) (holding that violation of FCRA by dissemination of private information results in “a de facto injury that satisfies the concreteness requirement for Article III standing”), with Whalen v. Michaels Stores, Inc., 689 F. App’x 89, 90-91 (2d Cir. 2017) (affirming that standing was lacking where plaintiff could not show that there was future threat of harm resulting from data breach involving credit card numbers because plaintiff’s credit card had been canceled after the breach).
 Spokeo, 867 F.3d at 1117-18.
 Id. at 1115-16.
 Id. at 1116.
 Id. at 1117.
 876 F.3d 979 (9th Cir. 2017).
 Id. at 983.
 Id. at 984.
 Petition at i, Spokeo v. Robins, 17-806 (Dec. 4, 2017).
 Id. at 14.
 Opposition at 15, Spokeo v. Robins, 17-806 (Dec. 20, 2017).
 Spokeo, Inc. v. Robins, No. 17-806, 2018 WL 491554 (U.S. Jan. 22, 2018).
*Braden Beard is an associate in the Washington, DC office.