Supreme Court Issues Important Ruling on Standing in Class Action and Data Breach Cases

May 20, 2016

Plaintiffs frequently bring class action claims for alleged statutory violations for which Congress has provided private rights of action and statutory damages. In many of these instances, plaintiffs do not allege any specific, tangible harm (such as monetary loss), but claim that the violation of these so-called “statutory rights” by itself constitutes injury-in-fact sufficient to satisfy standing requirements. This week, the Supreme Court held in Spokeo v. Robins that plaintiffs must allege concrete harm, apart from a mere statutory violation, in order to satisfy standing requirements.


In Spokeo v. Robins, the plaintiff brought class action claims against Spokeo for alleged violations of the Fair Credit Reporting Act (“FCRA”). The FCRA provides that “[a]ny person who willfully fails to comply with any requirement [of the Act] with respect to any [individual] is liable” for “actual damages” or statutory damages of $100 to $1,000 per violation.

Spokeo operates a website that aggregates personal background information from various sources and makes that information available to the public. The plaintiff in Spokeo alleged that Spokeo misrepresented his personal information on its website and thereby violated various provisions of the FCRA. Spokeo moved to dismiss the plaintiff’s complaint, arguing that the plaintiff had not alleged actual harm sufficient to meet the injury-in-fact requirement for standing, and the district court agreed, dismissing the case. On appeal, the Ninth Circuit reversed, holding that the plaintiff had standing because he had sufficiently alleged that Spokeo violated his statutory rights under the FCRA.

The Opinion

The Supreme Court vacated the Ninth Circuit’s decision and remanded for further proceedings. In doing so, the Supreme Court held that although the Ninth Circuit had evaluated whether the plaintiff’s injury was particularized, it had failed to consider whether the plaintiff had alleged a concrete harm that satisfied the injury-in-fact requirement.

The Court went on to provide a framework for the Ninth Circuit’s analysis on remand. While concrete harm must be “real” and cannot be “abstract,” the Court stated that concrete harm is not necessarily “tangible.” A plaintiff may in some circumstances be able to satisfy the injury-in-fact requirement of Article III standing by alleging certain intangible harms.

The Court also recognized that congressional judgment may be relevant in evaluating whether an intangible harm is concrete and satisfies the injury-in-fact requirement for standing purposes. However, “Congress’ role in identifying and evaluating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Instead, Article III standing requires concrete harm “even in the context of a statutory violation.” In other words, plaintiffs cannot simply allege a violation of a statutory right and maintain standing to bring suit, but must plead concrete harm apart from a “bare procedural violation.”


After Spokeo, plaintiffs cannot merely allege that statutory violations constitute injury-in-fact sufficient to maintain standing. Plaintiffs must allege some type of concrete harm. Going forward, plaintiffs will likely point to intangible harm associated with violation of a statute and argue that the intangible harm is sufficiently concrete for standing purposes. This may be particularly relevant for standing analysis in the data breach context, where those impacted by a breach may not be able to articulate tangible, monetary loss. Plaintiffs in those cases may claim that statutory rights created by Congress protect against certain intangible harms (such as rights to privacy), thereby elevating those same intangible harms to concrete harms that satisfy standing requirements.

Spokeo may also impact class certification. In order to obtain class certification, plaintiffs must show that classwide issues predominate over any issues affecting individual class members. Whether class members have suffered concrete harm may require an individualized inquiry as to each class member. For instance, in a class action for statutory claims premised on a data breach, class members that are able to allege that a third party actually misused their personal information may have standing while class members only able to allege that a third party may have accessed their personal information may not. After Spokeo, the standing question may present a serious challenge to plaintiffs seeking to certify a class for claims based on violations of statutory rights.

For additional information please contact one of the Haynes and Boone lawyers listed below.

Media Contacts