The Need for Clarification of the Requirements for Establishing Article III Standing in Privacy Lawsuits Where There Is No Injury
By Derek Care, Peter C. Neger, and James G. Snell, Bingham McCutchen LLP
On June 28, 2012, the U.S. Supreme Court dismissed as “improvidently granted” certiorari in a case that had significant implications for companies whose businesses involve the collection or use of consumers’ personal information.1 Specifically, the Supreme Court dismissed an appeal from the U.S. Court of Appeals for the Ninth Circuit’s decision in Edwards v. First Am. Corp.,2 in which the court of appeals held that the plaintiff had standing under Article III of the U.S. Constitution to challenge a purported violation of the anti-kickback provision of the Real Estate Settlement Procedures Act of 1974 (RESPA),3 even though the plaintiff could not establish any actual injury resulting from the violation. The Supreme Court had granted certiorari,4 and even heard oral arguments as to whether Congress has the ability to create Article III standing where actual, concrete injury cannot be shown, but ultimately dismissed the Edwards appeal finding that certiorari had been improvidently granted.
The Edwards case attracted widespread attention from amici curiae, including privacy advocates (who sought affirmation of Edwards) and internet and technology companies whose business involves the collection or use of consumers’ personal information (who sought the opposite).5 This attention was not surprising. Since Edwards was issued in 2010, it has become a central weapon in the plaintiffs’ bar’s arsenal for arguing that Article III standing exists whenever a plaintiff alleges a statutory violation, even if the alleged violation causes no actual, concrete harm or injury to any consumer.
Indeed, several courts have interpreted Edwards as broadly standing for the proposition that any allegations of a violation of a statute that provides a private right of action are sufficient to establish injury-in-fact for purposes of Article III standing—even where those same claims were dismissed due to the absence of allegations of actual injury sufficient to state a claim under the statute.6
The Supreme Court’s dismissal of certiorari preserved Edwards as good law, at least in the Ninth Circuit, and left open questions as to the requirements for establishing Article III standing where a plaintiff’s claims lack any suggestion of actual, concrete injury. Nonetheless, since the dismissal of that appeal, at least one court has held that injury-in-fact is not established merely by claims of violations of a privacy-related statute involving alleged misconduct that causes no cognizable harm to consumers. Specifically, the U.S. District Court for the Northern District of Illinois recently held, in Sterk v. Best Buy Stores LP (“Best Buy”), that retention of customers’ personal information for longer than necessary for the purpose it was collected in violation of the Video Privacy Protection Act (VPPA)7 does not constitute the injury-in-fact necessary to establish Article III standing.8 The Best Buy decision relied heavily upon, and followed closely on the heels of, a decision by Judge Richard Posner of the U.S. Court of Appeals for the Seventh Circuit in a substantially similar case, Sterk v. Redbox Automated Retail Inc. (“Redbox”). In Redbox, the court held that retention of consumers’ personal information in violation of the VPPA, without disclosure of the same, neither causes any actual damages nor justifies an award of statutory damages under the VPPA.9
Best Buy, if upheld, would potentially create a split of authority between the Ninth and Seventh Circuits as to the requirements for establishing Article III standing––one that may justify the Supreme Court taking the opportunity it declined in Edwards to clarify whether injury-in-fact may be established absent well-plead allegations of actual, concrete injury. Indeed, because the conduct alleged in Best Buy has been determined to neither cause actual damages nor justify statutory damages, whereas the payment of kickbacks in violation of RESPA alleged in Edwards has been recognized by Congress and courts as potentially harming consumers even if no overcharge results, Best Buy presents if anything a better test case for clarifying the requirements for establishing Article III standing than did Edwards. As discussed in further detail below, clarification is needed to ensure that Article III standing is properly limited, consistent with prior Supreme Court precedent, to plaintiffs who have alleged actual, concrete injury-in-fact, and to discourage lawsuits seeking significant statutory damage awards where no actual harm can be shown.
Edwards and Article III Standing in Connection With No-Injury Claims
In Edwards, the plaintiff home purchaser alleged that the defendant title insurance company paid millions of dollars to individual title companies to secure exclusive referrals from those companies in violation of the anti-kickback provision of RESPA, and that she had been referred to the defendant as a result of this scheme. The title insurance company and its parent moved to dismiss on grounds, inter alia, that the plaintiff could not establish that she had suffered any actual injury in connection with her claims because the price of title insurance was set by state law, and thus she could not have suffered an overcharge as a result of the defendants’ alleged misconduct. The district court denied the defendants’ motion to dismiss for lack of Article III standing, finding that the plaintiff had alleged sufficient injury by claiming a violation of her rights under RESPA. The Ninth Circuit, reviewing de novo, affirmed. 10
In so holding, the Edwards court outlined the familiar requirements for establishing Article III standing—i.e., injury, causation, and redressability—and stated that the Supreme Court has held with respect to the first of these that “[t]he injury required by Article III can exist by virtue of ‘statutes creating legal rights, the invasion of which creates standing.’”11 Because RESPA creates such rights and authorizes private actions for enforcement of those rights, the court held, a plaintiff has Article III standing to bring claims based on violations of the anti-kickback provision of RESPA even if the plaintiff cannot establish a resulting overcharge.12 The Edwards court noted that its decision was in accord with similar decisions from the Third and Sixth Circuits concerning Article III standing in connection with alleged violations of the anti-kickback provision of RESPA.13
The defendants thereafter petitioned the U.S. Supreme Court for, and were granted, certiorari—an arguably surprising decision given the apparent absence of a circuit split on the specific issue of interpretation of RESPA presented in the Ninth Circuit’s Edwards decision. The Supreme Court heard oral argument on the Article III standing issue Nov. 29, 2011.14 Nevertheless, despite having heard oral argument and despite the numerous amicus filings described above, the Court issued a per curiam opinion June 28, 2012, dismissing the petition for certiorari as improvidently granted without further explanation.15 Edwards thus remains good law, at least in the Ninth Circuit.
While Edwards addressed the narrow issue of whether allegations of a RESPA violation are sufficient to confer Article III standing even if such violations cause no actual injury or harm, some courts have broadly interpreted Edwards as standing for the proposition that any allegations of a violation of a statute that provides a private right of action are sufficient to confer Article III standing, regardless of whether the plaintiff(s) suffered an actual, concrete injury as a result. Notably, courts have relied on Edwards to find that allegations of violations of privacy-related statutes governing the collection and use of consumers’ personal information established Article III standing—even where those plaintiffs’ claims were ultimately dismissed pursuant to Federal Rule of Civil Procedure 12(b)(6) due to the absence of well-plead allegations of injury or loss required to state a claim, or where the plaintiffs’ allegations were found insufficient to establish injury-in-fact for purposes of substantively similar nonstatutory claims.
For example, in a recent decision by the U.S. District Court for the Northern District of California concerning claims for violations of the Computer Fraud and Abuse Act (CFAA)16 in connection with the collection of consumers’ personal information by mobile applications operating on Apple Inc.’s iPhones, iPads, and iPods, the court relied on Edwards in finding that the plaintiffs had adequately alleged injury-in-fact, even though the court also dismissed the plaintiffs’ claims based on the absence of well-plead allegations of actual economic injury as required to state a claim under the CFAA.17 Similarly, in a decision by that same court in a lawsuit involving Google Inc.’s practice of incorporating consumers’ search terms in the URLs generated by such searches, the court, relying on Edwards, held that the plaintiff adequately alleged injury-in-fact for purposes of its Stored Communications Act (SCA)18 claim by alleging that Google’s practices violated the statute, while also holding that the plaintiff’s allegations that she was harmed by Google’s conduct failed to establish injury-in-fact for purposes of the plaintiff’s related claims under California common law.19 Recent decisions by district courts within the Ninth Circuit involving Facebook Inc., Amazon.com Inc., and LinkedIn Corp. have reached similar results.20
At the same time Edwards was working its way to and through the Supreme Court, a number of consumer class actions were filed against movie rental and/or cable television providers throughout the country based on allegations that those defendants had violated statutes such as the VPPA by retaining consumers’ lawfully collected personal information longer than necessary for the purpose it was collected. The Redbox action was one of the first of these. The plaintiff in Redbox brought a complaint in the U.S. District Court for the Northern District of Illinois alleging that he had rented a DVD from Redbox Automated Retail LLC, a DVD rental company, and that Redbox thereafter retained personal information concerning that plaintiff and similarly situated plaintiffs in violation of Section 2710(e) of the VPPA, which prohibits retention of customers’ personal information longer than necessary for the purpose it was collected. The defendant moved to dismiss on the grounds that the VPPA did not provide for private rights of action for violations of Section 2710(e). The district court denied the motion. On an interlocutory appeal, the Seventh Circuit, in a decision by Judge Posner, reversed, finding that the VPPA does not authorize private rights of action based on mere retention of personal information without disclosure of the same.21
In so holding, the Seventh Circuit emphasized, among other things,22 that mere retention of personal information causes no actual injury or harm to consumers: “How could there be injury, unless the information, not having been destroyed, were disclosed? If, though not timely destroyed, it remained secreted in [Redbox's] files until it was destroyed, there would be no injury.”23 Further, while the VPPA provides for statutory damages for violations of its provisions, the court found that mere retention of personal information does not justify an award of such damages absent a showing of actual injury because “liquidated damages are intended to be an estimate of actual damages, and if failure of timely destruction results in no injury at all because there is never any disclosure, the only possible estimate of actual damages for [unlawful retention] would be zero.”24
Following Redbox, courts in the Seventh and Ninth Circuits have rejected similar claims for unlawful retention of personal information under the VPPA,25 the SCA,26 and under breach of contract theories.27 Those claims were dismissed on grounds that the relevant statutes do not provide a private right of action for unlawful retention of personal information, or because unlawful retention without disclosure of personal information causes no actual injury as required to state a claim.
The Best Buy court, however, went a step further and dismissed the plaintiff’s unlawful retention claims for the additional reason that he had failed to establish injury-in-fact in connection with those claims. In Best Buy, the plaintiff—incidentally, the same nominal plaintiff as in the Redbox action—alleged that the defendants had retained personal information relating to customers’ purchases of DVDs longer than was necessary for the purpose it was collected in violation of Section 2710(e) of the VPPA. The defendants moved to dismiss that claim pursuant to Federal Rule of Civil Procedure 12(b)(1) for failure to allege injury-in-fact, arguing that the “[p]laintiff cannot allege an injury-in-fact merely by asserting statutory violations.” The plaintiff countered that a “claim of violation of a statutory right under the VPPA alone is sufficient injury-in-fact to confer Article III standing.”The court sided with the defendants and found that the plaintiff failed to establish injury-in-fact.28
In so holding, the court acknowledged that injury-in-fact may be established based on a statutory violation; nonetheless, the court noted that “the Supreme Court has held that ‘Congress cannot erase Article III’s standing requirement by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.”29 Thus, the “injury required by Article III may exist when created by statute” only where Congress “elevates ‘to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate at law.”30 Unlawful retention of personal information, which presents no concrete injury absent disclosure, cannot be so elevated.31 Moreover, the Court held that the language of the VPPA itself precluded any argument that an allegation of a statutory violation, absent any attendant injury, was sufficient to confer standing—specifically because the VPPA limits standing to those who have been “aggrieved”by a violation of the statute, i.e., those who have suffered an “injury-in-fact.”32
The court dismissed the plaintiff’s theory that he and the purported class suffered any actual harm as a result of the defendants’ purportedly unlawful retention of their personal information. First, the court rejected the plaintiff’s argument that the defendants had in any way deprived him of the value of his personal information because he had not alleged that the defendants in any way prevented him from selling his own personal information. Second, the court rejected the plaintiff’s argument that he had overpaid for his DVD purchases insofar as he was not provided the privacy protections he claimed to have bargained for, i.e., destruction of his personal information when no longer necessary for the purpose it was collected. This argument failed, the court held, because the plaintiff had not alleged that there was any price difference for credit card purchases that required that he disclose his personal information to the defendants, and cash purchases that did not.33 Accordingly, because the plaintiff had failed to allege any actual injury, and because mere allegations of a violation of the retention provision of the VPPA do not themselves establish injury-in-fact, the plaintiff had failed to establish that he had Article III standing, thus requiring dismissal of his claim.34
A Conflict Between Edwards and Best Buy
Read narrowly, there may be no conflict between the decisions in Edwards and Best Buy. Whereas Best Buy concerned a category of activity—unlawful retention of personal information without disclosure—that courts have determined does not cause any actual injury to the consumers whose personal information was retained, Edwards concerned conduct—payment of kickbacks in connection with title insurance referral—that Congress recognized may cause injury to consumers even if they are not overcharged for title insurance, i.e., a consumer may be harmed as a result of receiving advice from a title agent that is tainted by his or her receipt of a kickback.35 Thus, the decision of the Ninth Circuit (and those of its sister circuits) finding that a plaintiff establishes injury-in-fact by alleging a RESPA violation even if he or she cannot demonstrate a resulting overcharge is arguably not inconsistent with the Best Buy court’s finding that the plaintiff’s allegations of a violation of the VPPA failed to establish injury-in-fact.
However, Best Buy is in direct conflict with the broader interpretation of Edwards—seized upon by the plaintiffs’ bar—that any allegations of a statutory violation are sufficient to confer Article III standing. While the Supreme Court’s dismissal of Edwards unfortunately left the Article III issue uncertain, the Best Buy holding is more consistent than Edwards with the Supreme Court’s earlier precedent regarding the requirements for Article III standing, and stands to better serve the interests of consumers whom statutes such as the VPPA are intended to protect.
First, the Best Buy decision is consistent with the Supreme Court’s recognition that the “irreducible constitutional minimum of standing” requires a showing, “[f]irst and foremost … of ‘injury in fact’—a harm suffered by the plaintiff that is ‘concrete’ and ‘actual or imminent, not ‘conjectural’ or ‘hypothetical.’”36 As Judge Posner observed, unlawful retention of personal information, without disclosure of same, neither causes actual harm to the consumer whose personal information has been retained nor justifies an award of statutory damages for such retention.37 Accordingly, the harm presented in Best Buy was both wholly conjectural and hypothetical. Nonetheless, under the broad interpretation of Edwards advocated by the Best Buy plaintiff, allegations of a violation of Section 2707(e) of the VPPA would have themselves established injury-in-fact, regardless of the nature of the injury suffered (or not) by the plaintiff.38 Such a holding would conflict with the Supreme Court’s admonition that “‘Congress cannot erase Article III’s standing requirement by statutorily granting the right to sue to a plaintiff who would not otherwise have standing.’”39 That admonition alone illuminates the error of broadly interpreting Edwards as eliminating the need to allege and show actual, concrete injury to establish Article III standing in connection with claims based on statutory violations.
Second, from a policy standpoint, the Best Buy court’s approach discourages lawsuits where there is no actual injury, but where a statutory claim could lead to crippling statutory damages—a result which actually protects the interests of the very consumers in whose names such actions are brought. This is particularly true with respect to companies whose businesses involve the collection and use of consumers’ personal information. Because such companies may interact with a significant number of consumers, and because statutes such as the VPPA provide for statutory damages for each individual violation, no-injury lawsuits such as Best Buy threaten companies with millions, if not billions, in damages even where the plaintiff(s) cannot demonstrate any actual loss or harm resulting from the challenged conduct.40 Such litigation both impose substantial litigation costs on companies, and place significant pressure on defendants to settle such actions—even where defenses are strong—to avoid the remote possibility of staggering statutory damages.41 Because such costs are likely passed onto their consumers, either in the form of increased costs or diminished services, no-injury lawsuits ostensibly launched in the name of protecting consumers’ interests will ultimately have the direct opposite result. Thus, companies whose business involves the collection or use of personal information and their customers both benefit from having no-injury lawsuits weeded out from federal courts at the earliest possible point in a litigation, including pursuant to motions to dismiss under Federal Rule of Civil Procedure 12(b)(1). Accordingly, denying Article III standing in connection with no-injury claims such as those in Best Buy is not only consistent with the Supreme Court precedent, but also in the interests of the consumers for whom statutes such as the VPPA were enacted to protect.
Best Buy has yet to reach the Seventh Circuit on appeal and, indeed, is currently subject to a motion for reconsideration by the plaintiff.42 Thus, the Best Buy decision may never be in a position to create a circuit-level split of opinion as to whether mere allegations of a statutory violation satisfy the injury-in-fact requirement for establishing Article III standing. Nonetheless, whether as a result of Best Buy or some other case not yet decided, the increasing number of no-injury lawsuits—particularly those concerning alleged mismanagement of consumers’ personal information in violation of statutes such as the VPPA—and the threat of costs and statutory damages that they presentprovide ample justification for the Supreme Court to revisit the issue it declined to address in Edwards to clarify the requirements for establishing Article III standing in connection with no-injury claims. If and when it does so, however, applicable precedent and the interests of both businesses and consumers dictate that it should reach the same result as did the court in Best Buy.
Peter C. Neger is a partner in Bingham McCutchen LLP’s New York City office. He has more than 30 years of litigation experience in both federal and state courts, and in arbitrations and mediations. James G. Snell is a partner in the firm’s Silicon Valley office. He is co-chair of Bingham’s Intellectual Property Group and co-chair of the firm’s Privacy and Security Group. Derek Care is an associate in Bingham’s New York City office. He represents clients in a wide range of complex commercial matters, including intellectual property, privacy, and internet-related litigation.
© 2013 Bloomberg Finance L.P. All rights reserved. Bloomberg Law Reports ® is a registered trademark and service mark of Bloomberg Finance L.P.
This document and any discussions set forth herein are for informational purposes only, and should not be construed as legal advice, which has to be addressed to particular facts and circumstances involved in any given situation. Review or use of the document and any discussions does not create an attorney-client relationship with the author or publisher. To the extent that this document may contain suggested provisions, they will require modification to suit a particular transaction, jurisdiction or situation. Please consult with an attorney with the appropriate level of experience if you have any questions. Any tax information contained in the document or discussions is not intended to be used, and cannot be used, for purposes of avoiding penalties imposed under the United States Internal Revenue Code. Any opinions expressed are those of the author. Bloomberg Finance L.P. and its affiliated entities do not take responsibility for the content in this document or discussions and do not make any representation or warranty as to their completeness or accuracy.