A More Stringent Article III Standard As A Useful Class-Action Tool (Even Beyond Data-Breach Cases)

Introduction

In February 2013, the U.S. Supreme Court held in Clapper v. Amnesty Int’l USA, et al.,[1] that attorneys and human rights, labor, legal, and media organizations whose work required them to correspond with likely targets of federal surveillance lacked Article III standing to challenge the statute authorizing that surveillance. The case involved Section 702 of the Foreign Intelligence Surveillance Act, added by the Amendments Act of 2008 (“FAA”), which authorizes the attorney general and the director of National Intelligence to surveil non-U.S. persons reasonably believed to be outside of the United States. The plaintiffs claimed they were injured because there was an objectively reasonable likelihood their communications would be intercepted under the FAA and, as a result, they incurred additional expenses associated with taking steps to avoid that risk. The defendants countered that plaintiffs lacked Article III standing because they had failed to show they had suffered an injury that is “concrete, particularized, and actual or imminent; fairly traceable to the challenged action; and redressable by a favorable ruling.”[2] In a 5-4 decision by Justice Alito, the Supreme Court agreed with the defendants, finding that the alleged injury was too speculative and therefore insufficient to confer Article III standing to sue.

The decision, which has already been successfully (and widely) used in data-breach class-action cases to secure dismissals at the pleadings stage, may be the first salvo in a more general shift by the Supreme Court towards a more stringent Article III standard. Clapper, together with Spokeo, Inc. v. Robins, another Article III case in which a petition for a writ of certiorari has been filed and remains pending, may also become important in the context of class-action suits brought under statutes allowing for recovery without a showing of actual injury. If the Supreme Court accepts certiorari in Spokeo, it will decide whether plaintiffs alleging Fair Credit Reporting Act (“FCRA”) violations without any showing of actual harm have Article III standing – an issue on which the circuits are split. If the Supreme Court sides with Spokeo, then plaintiffs seeking to bring class-action lawsuits based on various state and federal statutes providing for statutory penalties even without a showing of injury would still need to meet Article III’s – and Clapper’s – threshold showing of actual harm or “certainly impending” injury to have standing. This would make Article III standing a potentially powerful defendants’ tool in putative class-action cases.

Article III Standing and the Supreme Court’s Clapper Decision

Article III of the United States Constitution limits federal courts’ jurisdiction to “cases” and “controversies.” A key element of the case-or-controversy requirement is that a plaintiff must establish that he or she has standing to sue.[3] To establish Article III standing to sue in federal court, the plaintiff must show an injury that is “concrete, particularized, and actual or imminent; fairly traceable to the challenged action; and redressable by a favorable ruling.” A threatened injury (as opposed to an injury that has already been inflicted) “must be certainly impending to constitute injury in fact;” “[a]llegations of possible future injury,” as the Supreme Court has held, are not sufficient to confer standing.[4]

The Supreme Court in Clapper interpreted Article III jurisprudence to hold that attorneys and human rights, labor, legal, and media organizations whose work required them to correspond with likely targets of federal surveillance lacked standing because their claims of injury were too speculative. In writing for the majority, Justice Alito noted that because the government’s practices are secret and the FAA authorizes, but does not direct, the government to surveil certain targets, “respondents can only speculate as to how the Attorney General and the Director of National Intelligence will exercise their discretion in determining which communications to target.”[5] Because the government had other statutory bases to conduct the surveillance, plaintiffs could only “speculate” as to whether the government would authorize surveillance under the FAA and not pursuant to another authorizing statute. Justice Alito further noted that it was unclear whether the government would actually surveil the plaintiffs’ foreign contacts and thereby intercept the plaintiffs’ communications. In the end, the Court found the numerous speculative possibilities precluded a finding that the harm was “certainly impending,” and, importantly, also held that protective measures the plaintiffs allegedly undertook to avoid their communications being intercepted – such as buying plane tickets to meet with their contacts in person – were self-inflicted and “manufactured,” and did not transform their speculative fears of surveillance into Article III standing to sue.

Post-Clapper Holdings in Data-Breach Cases and Spokeo, the Next Big Test for Article III Standing

In the roughly year and a half since Clapper was decided, the ruling has most often been successfully cited in defendants’ briefing in data-breach class-action cases. Federal courts in Illinois, New Jersey, Ohio, and the District of Columbia have all interpreted Clapper to require dismissal of data breach lawsuits where the plaintiffs did not allege identity theft or other actual misuse of personally identifiable or other sensitive information.[6]

The Clapper decision, however, did not address the applicable Article III standard when a statute allows an action to be brought without a showing of actual injury – something numerous commonly litigated statutes allow.[7] That issue may soon be decided by the Supreme Court in another Article III case, Spokeo, in which a petition for a writ of certiorari has been filed. There, the respondent, Thomas Robins, filed a putative class-action complaint alleging that Spokeo, a “people search” website that aggregates data about individuals from other websites, is a “consumer reporting agency” that generates “consumer reports.” Robins further alleged that Spokeo had published, in violation of FCRA, inaccurate information about him on its website. The district court initially dismissed the complaint with leave to amend, holding that Robins’s allegations of possible future injury did not satisfy Article III. After Robins amended, the district court initially found the pleading deficiency had been cured, but later reversed itself and dismissed with prejudice based on its earlier analysis under Article III. Robins appealed.

The Ninth Circuit reversed the district court, holding that Robins had Article III standing because “creation of a private right of action to enforce a statutory provision implies that Congress intended the enforceable provision to create a statutory right,” and that the “violation of a statutory right is usually a sufficient injury in fact to confer standing.”[8] In other words, the Ninth Circuit held that if the applicable statute itself does not require a showing of actual harm, a mere showing that the statute was violated suffices to confer Article III standing. Spokeo appealed the Ninth Circuit’s decision to the Supreme Court in May 2014. The key issue presented in its petition for certiorari is: “Whether Congress may confer Article III standing upon a plaintiff who suffers no concrete harm, and who therefore could not otherwise invoke the jurisdiction of a federal court, by authorizing a private right of action based on a bare violation of a federal statute.”[9]

The Ninth Circuit’s decision in Spokeo is at odds with (at least) two other circuits – the Second and Fourth Circuits have both held in ERISA cases that breaches of the statute’s provisions “in and of themselves [do not] constitute an injury-in-fact sufficient for constitutional standing.” Kendall v. Employees Ret. Plan of Avon Prods., 561 F.3d 112, 121 (2d Cir. 2009); David v. Alphin, 704 F.3d 327, 338 (4th Cir. 2013). It is therefore possible the Supreme Court will accept certiorari to resolve the split.

Article III Standing as a Class-Action Tool

If the Supreme Court accepts certiorari in Spokeo, and ultimately holds that Article III requires an actual injury even where the applicable state or federal statutes do not require the same showing, the combination of Clapper and Spokeo could render Article III a powerful class-action defense tool. As the data-breach cases aptly demonstrate, class-action claims brought under common-law theories (and removed to federal court under the Class Action Fairness Act if originally brought in state court) will survive dismissal only if the harm that the plaintiffs allege is truly concrete and, if it has not yet occurred, certainly is impending. If the class-action claims are brought under state or federal statutes that provide statutory damages without requiring a showing of actual harm, the claims would likewise be subject to dismissal if the plaintiffs could not satisfy Clapper and demonstrate Article III standing apart from a violation of the statute itself.

A required and more stringent standard of actual harm also has significant implications for class certification. A particularized showing of actual harm complicates the typicality, commonality, and predominance requirements of Rule 23. Even if the class representative could meet the showing required for Article III standing, the individualized inquiry needed to determine whether the same was true for members of the putative class might preclude certification.[10]

The issues presented by Clapper and Spokeo are potentially far-ranging, particularly in defending class actions. Businesses with a history of being targets of class-action claims should carefully monitor how the Supreme Court responds to the Spokeo petition and any decision issued by the Court in this evolving area of Article III law.