Last May, when the U.S. Supreme Court issued its ruling on constitutional standing and statutory violations in Spokeo v. Robins, I predicted both sides of the class action bar would seize upon language in the confusing and arguably self-contradictory opinion. That quickly turned out to be true. What I didn’t expect, however, was a fast-emerging consensus from the federal circuits on Spokeo’s impact.
On Friday, the 3rd U.S. Circuit became the latest appellate court to find that Spokeo does not preclude class actions in which plaintiffs allege their only injury is intangible. A three-judge 3rd Circuit panel ruled that customers of Horizon Healthcare have constitutional standing to proceed with a class action claiming the insurer left their personal information exposed in the theft of two laptops containing customer data. The panel – Judges Kent Jordan, Thomas Vanaskie and Patty Shwartz – reinstated the class action, which had been dismissed on standing grounds by U.S. District Judge Claire Cecchi of Newark, New Jersey.
As Judge Jordan wrote in the court’s opinion, the 3rd Circuit’s Spokeo analysis aligns with the 6th Circuit’s post-Spokeo decision in Galaria v. Nationwide, which, in turn, cited pre-Spokeo decisions in which the 7th Circuit found the mere threat of identity threat to be sufficient to establish standing in a data breach class action. The 3rd Circuit also noted its agreement with the 11th Circuit’s post-Spokeo ruling in Church v. Accretive Health, which involved debt collection rather than privacy claims, but similarly held a concrete injury need not be tangible.
The outlier among the federal circuits, at least for the moment, is the 8th Circuit, which ruled last September in Braitberg v. Charter Communications that a cable customer alleging the unlawful retention of his personal data did not meet Spokeo’s test for constitutional standing. Braitberg, according to the 8th Circuit, failed to identify a “material risk of harm” from the cable company’s alleged violation of the requirement that it destroy its records on him.
In Friday’s opinion, the 3rd Circuit explicitly rejected the 8th Circuit’s reasoning. “Although it is possible to read the Supreme Court’s decision in Spokeo as creating a requirement that a plaintiff show a statutory violation has caused a ‘material risk of harm’ before he can bring suit,” the opinion said, “we do not believe that the court so intended to change the traditional standard for the establishment of standing.” (In a footnote, the 3rd Circuit cited the Braitberg opinion as the most notable example of what it considers over-reading of Spokeo’s holding.)
The Horizon decision isn’t the 3rd Circuit’s first utterance on Spokeo. Last June, soon after the Supreme Court’s decision, a different 3rd Circuit panel partly revived a class action accusing Google and Viacom of illegally collecting children’s Internet data. That panel, quoting from the justices’ Spokeo opinion, said the plaintiffs met the Supreme Court’s test because they had suffered “a clear de facto injury, i.e., the unlawful disclosure of legally protected information.” In Friday’s Horizon ruling, which delves more deeply into Spokeo analysis, the 3rd Circuit said the data breach plaintiffs had “at least as strong” a basis as those in the previous case.
Horizon’s lawyers at Arnold & Porter Kaye Scholer had argued that the risk of identity theft from the inadvertent disclosure of personal data is exactly the sort of intangible injury the Supreme Court frowned upon in Spokeo. But it’s looking more and more like appellate courts disagree.
Plaintiffs in the Horizon class action are represented by Barnow & Associates, Lite DePalma Greenberg, Kaplan Fox & Kilsheimer and Wilentz Goldman & Spitzer. Erich Schork of Barnow argued the plaintiffs’ case at the 3rd Circuit.