The U.S. Court of Appeals for the Third Circuit recently entered its position on the post-Spokeo debate, regarding what is sufficient to establish Article III standing under the Fair Credit Reporting Act (FCRA). In In re Horizon Healthcare Services Inc. Data Breach litigation, No. 15-2309, four people sued their health insurer, Horizon Healthcare Services, Inc. (Horizon), on behalf of a putative class alleging that Horizon had willfully and negligently violated the FCRA by inadequately protecting their personal information. Specifically, the plaintiffs alleged that Horizon violated the FCRA when two laptops containing unencrypted and sensitive personal information for the named plaintiffs, as well as more than 839,000 other Horizon members, were stolen from Horizon’s headquarters in Newark, New Jersey. The complaint did not include any allegation that three of the four named plaintiffs’ identities were stolen as a result of the data breach. However, one named plaintiff alleged that his 2013 tax refund was stolen and that someone had attempted to use his credit card number in an online transaction. The plaintiffs’ complaint further alleged that Horizon had violated the FCRA by furnishing their information in an unauthorized fashion, by allowing it to fall into the hands of thieves and by falling short of its FCRA responsibility to adopt reasonable procedures to keep sensitive information confidential.
In the district court, Horizon moved to have the case dismissed for lack of Article III standing. To establish Article III standing, a plaintiff must present (1) an injury in fact or an invasion of a legally protected interest that is concrete and particularized; (2) a causal connection between the injury and the conduct complained of; and (3) a likelihood that the injury will be redressed by a favorable decision. Horizon argued that the plaintiffs failed to establish that they suffered a concrete injury in fact. Plaintiffs argued that the violation of their statutory right under the FCRA, to have their personal information secured against unauthorized disclosure, gave rise to a cognizable and concrete injury that satisfies the first element of Article III standing. The district court rejected the plaintiffs’ argument and found that standing required some form of additional, specific harm beyond mere violations of statutory and common law rights. Thus, the district court granted Horizon’s motion to dismiss holding that none of the plaintiffs had claimed an injury in fact, i.e., a cognizable injury, because, although their personal information had been stolen, none of them had adequately alleged that the information was actually used to their detriment.
The plaintiffs’ appealed the dismissal to the Third Circuit, who focused in on one issue: the concreteness requirement of the injury-in-fact element of standing. The Third Circuit reversed the district court’s ruling finding that the plaintiffs had standing due to Horizon’s alleged violation of FCRA. The Third Circuit recognized that it had not been entirely consistent in its pronouncements regarding whether a violation of a statute, by itself, can cause an injury sufficient for purposes of Article III standing. However, it explained that recently it had made clear that “when it comes to laws that protect privacy, a focus on economic loss [was] misplaced,” in the analysis of injury-in-fact, because “the unlawful disclosure of legally protected information constituted a clear de facto injury.” Moreover, the Third Circuit reasoned that the Supreme Court’s decision in Spokeo, Inc. v. Robins did not compel a different outcome. Indeed, the Third Circuit explained that “Spokeo itself does not state that it is redefining the injury-in-fact requirement . . . [but] reemphasizes that Congress has the power to define injures that were previously inadequate in law.” With that said, the Third Circuit did reason that in Spokeo there was a recognition that some circumstances exist where the mere technical violation of a procedural requirement of a statute cannot, in and of itself, constitute an injury in fact, but the appellate court went on to state that “[t]hose limiting circumstances are not defined in Spokeo and [it had] no occasion to consider them” at that time.
Based on its analysis, the Third Circuit found that the plaintiffs had standing based on the mere violation of the FCRA because “with the passage of FCRA, Congress established that the unauthorized dissemination of personal information by a credit reporting agency causes an injury in and of itself – whether or not the disclosure of that information increased the risk of identity theft or some other future harm.” Thus, the plaintiffs had not alleged a mere technical or procedural violation of FCRA, but they had alleged the unauthorized dissemination of their own private information, which was the very injury that FCRA had intended to prevent. The Third Circuit held that such a de facto injury satisfies the concreteness requirement for Article III standing.
While the Sixth Circuit and Eleventh Circuits have issued similar rulings regarding Article III standing under FCRA and the Fair Debt Collections Practices Act post-Spokeo, this ruling by the Third Circuit is the first published circuit court opinion finding standing for a de facto injury that results from a violation of the FCRA itself and no additional specific harm. The Third Circuit's reasoning is a marked departure from prior cases in which the Third Circuit and other federal and state courts have said that fear of future identity theft alone does not establish Article III standing. Of course, the Third Circuit’s ruling is only one judicial interpretation of post-Spokeo standing for FCRA lawsuits. Nonetheless, this opinion demonstrates how courts continue to wrestle with how to apply Spokeo and that the circuit courts continue to be split, signaling that the entire issue could return to the Supreme Court for clarification.