Seventh Circuit Affirms Dismissal of Data Privacy Class Action on Article III Standing Grounds
Since the United States Supreme Court decided Spokeo, Inc. v. Robins in May 2016, lower courts have struggled to consistently determine whether a plaintiff has standing to sue in federal court, which, as the Spokeo court explained, “requires a concrete injury even in the context of a statutory violation.” That is, even when Congress has made something unlawful and authorized an award of statutory damages for the unlawful act, the mere violation of that law is not itself sufficient to confer standing to sue under Article III of the U.S. Constitution. But precisely what is required to demonstrate sufficient “injury” under Article III remains unclear after Spokeo, especially in the data-breach and data-privacy contexts.
In Gubala v. Time Warner Cable, Inc., however, a unanimous Seventh Circuit decision, authored by Judge Posner, held that the defendant’s possible failure to comply with a requirement contained in the Cable Communications Policy Act (requiring the destruction of personally identifiable information (“PII”) if the information is no longer necessary for the purpose for which it was collected) did not afford the plaintiff Article III standing to sue for violation of the statute where his personal information was not released or disseminated in any way. The plaintiff in Gubala had subscribed to Time Warner cable services in 2004, which required him to provide the company with various pieces of PII, including social security and credit card numbers. He cancelled his subscription two years later, but eight years thereafter, the plaintiff discovered that his PII had not, in fact, been destroyed. He then filed a putative class action against the cable provider.
The district court dismissed the case on standing grounds and, in a fairly biting opinion, the Seventh Circuit agreed:
[A] lawsuit . . . is not justiciable under federal law unless the plaintiff has a “concrete” interest in prevailing in the case, for such an interest is the sine qua non of “standing to sue.” [Plaintiff]’s problem is that while he might well be able to prove a violation of [the statute], he has not alleged any plausible (even if attenuated) risk of harm to himself from such a violation—any risk substantial enough to be deemed “concrete.”
As Judge Posner explained, plaintiff’s “only allegation is that the retention of the information, on its own, has somehow violated a privacy right” or caused economic harm. “All he’s left with is the claim that the violation of [the statute] made him feel aggrieved” — he proffered no allegation or evidence that he was, in fact, “aggrieved” by the purported statutory violation, i.e., that PII he supplied had been leaked and caused financial or other injury to him or had even been at risk of being leaked. The Court derided Plaintiff’s economic loss argument as “gibberish” — that is, the notion that he was harmed as a result of overpaying Time Warner for long-cancelled cable services because Time Warner did not provide the level of data protection that it was required to provide.
Ultimately, in Gubala, it did not matter whether or not Time Warner violated the Cable Communications Policy Act. “[T]he absence of allegation let alone evidence of concrete injury inflicted or likely to be inflicted” required the Seventh Circuit to affirm the dismissal of the lawsuit for lack of standing.
In the post-Spokeo legal landscape, questions of Article III standing (especially in the data privacy context) are likely to continue vexing litigants and courts, especially as various federal courts of appeal fall on different sides of these issues.