Standing in Privacy Lawsuits: Is the Tide Turning in Favor of Consumers?

Abstract

Standing has emerged as one of the most significant procedural obstacles to data privacy plaintiffs, who are faced with unique problems created by the rapid advancements in information systems that are able to collect and share personal data of Internet users. A particularly concerning scenario is the largely unregulated aggregation and sale of consumer data by third parties, commonly known as data brokers, who are the modern equivalent of the Yellow Book, except at the scale of the Internet. Consumers are at the risk of significant privacy harm caused by any misuse or disclosure of their personal information by data brokers, and there is very limited, if any, historical precedent for their ability to challenge and get relief for the resulting injuries. The standing to sue, therefore, is part of an important framework to enable individuals allegedly harmed by data brokers to protect their own right of privacy.Courts are split regarding what injury plaintiffs must have incurred to have standing to assert online privacy related claims. A related circuit split has developed regarding whether a plaintiff must show injury sufficient to meet Article III requirements even where Congress by statute has expressly provided a private cause of action. The Supreme Court is considering this issue in Spokeo, Inc. v. Robins in its current term, which is the case this comment focuses on.The comment first analyzes both these circuit splits and then discusses the standing claim in Spokeo, Inc. In reviewing the legal precedent and the policy concerns related to this issue, it argues that the Court should construe statutory violation as an alternate measure rather than a substitute for injury-in-fact, so that a statutory violation, without more, should not be enough for standing. It then concludes that the Court should grant standing where a plaintiff, as a result of being deprived of a legally-protected right, suffers an injury that is sufficiently individualized and concrete to accord him a personal stake in the outcome of the controversy. This approach allows the Court to strike the right balance between frivolous claims and valid consumer protection policy concerns in the contemporary context of online privacy suits.