Is a Privacy Violation an "Injury"?

The Supreme Court's call for supplemental briefing in Frank v. Gaos will lead it to a difficult question.

Last week, the Supreme Court heard oral argument in an interesting and important class action case, Frank v. Gaos, about when lawyers can agree to settle a case on behalf of a class action by giving all of the money to a charity instead of the class. Today, however, the Supreme Court called for supplemental briefing on a different question—whether the named plaintiffs have suffered an "injury" sufficient to create standing under the Court's doctrine. That question may prove to be even trickier.

The plaintiffs in Gaos complain that Google has unlawfully turned over information about their search histories. Before the Supreme Court's decision in Spokeo v. Robins, some circuits, including the Ninth Circuit, had concluded that any violation of an individual statutory right was enough for standing. As the cases said, "Congress may enact statutes creating legal rights, the invasion of which creates standing, even though no injury would exist without the statute." In Spokeo, the Court concluded that that formulation was incomplete, and that the right must also be "concrete" though it could nonetheless be "intangible."

During the Frank oral argument, some justices became concerned that the plaintiffs in Gaos might not have standing, because they may have alleged little more than the illegal disclosure of their private search histories. While the justices batted around the possibility of a remand, the request for supplemental briefing suggests that the Court will decide the standing issue on its own.

Doing so, however, will require the Court to decide a somewhat tricky question about the nature of standing in privacy cases. Is the disclosure of previously private information itself a concrete injury? Or must the plaintiff allege that somebody else used that information against them in a particular way? Indeed, this is one of the tricky things about the Spokeo decision itself. Margot Kaminski and Matthew DeLuca have articles about standing for privacy claims after Spokeo. And as I wrote in an article last year about Spokeo:

For instance, last summer the D.C. Circuit confronted a lawsuit by two D.C. shoppers who complained that local clothing stores had demanded their zip codes in violation of local law. Without disputing that the information was illegally demanded, D.C. Circuit dismissed the case for lack of standing. The forced disclosure of one's zip code, it held, was not a concrete injury after Spokeo. In Spokeo the Court had offered a coincidentally similar example, writing: "not all inaccuracies cause harm or present any material risk of harm. An example that comes readily to mind is an incorrect zip code. It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm."

The D.C. Circuit found the dictum apt, writing, "If, as the Supreme Court advised, disclosure of an incorrect zip code is not a concrete Article III injury, then even less so is [the plaintiffs'] naked assertion that a zip code was requested and recorded without any concrete consequence. [The plaintiffs] do not allege, for example, any invasion of privacy, increased risk of fraud or identity theft, or pecuniary or emotional injury."

This is probably the correct conclusion to draw from Spokeo's somewhat gratuitous discussion of zip codes, but at a more fundamental level it again suggests that something is wrong with Spokeo. Why must the plaintiffs show something like a risk of identity theft or emotional injury to demonstrate a concrete injury? Why can't an illegal disclosure itself be a concrete injury? As to a zip code, this may seem strange. But imagine that the illegal disclosure was something else–an unflattering photograph or email, perhaps. Surely this ought to be actionable without showing a subsequent consequence, like the loss of one's job or social standing. Or, more modestly, imagine somebody who is embarrassed by their middle name and does not wish to see it disclosed. If that person has a legal right against disclosure, why should they need anything more?

There are two possible ways to resolve the scope of privacy laws in light of the courts' position on zip codes. One possibility, the more aggressive one, is to conclude that illegal disclosure of facts about oneself is never itself a concrete injury. To sue over the disclosure of one's address, photos, name, or anything else, one would have to demonstrate some sort of downstream consequences from these disclosures. In other words, privacy itself would not be a protectable interest under Article HI. This position has a certain logical purity, but one hopes that it is too implausible even for today's courts to adopt. It would mean that even injuries recognized under long-standing common law principles would not be enough to satisfy the "injury in fact" requirement.

The alternative possibility, a more modest one, is that some illegal disclosures are injurious in themselves, and others are not. For instance, perhaps the disclosure of photographs is different in kind from the disclosure of zip codes, even if both are protected by legal right. (The D.C. Circuit's attempt to distinguish "invasion of privacy" as an actionable "concrete consequence" might point to this possibility.) There is some common sense intuition behind this approach, but it is not entirely principled. If the legislature has made the judgment to protect both kinds of information, it is not at all clear why judges may decide that one is "concrete," that is, "real," and the other is not. This saves some of privacy law from Spokeo only by creating a constitutional common law of privacy interests.

What is more, the question of when the illegal disclosure of information is a concrete injury is one that appears to have divided lower courts in the short time since Spokeo. So, in order to deny standing (and perhaps in order to grant it) the Court may have to resolve another circuit split beyond the one that it originally granted the case to resolve.

This makes me a little nervous, since I do not think the Court does its best work on tricky federal courts questions when they are noticed at the last minute in the middle of another merits case. The posture also means that the issue may not get as much public attention (and I am not even sure whether amicus briefs are permitted on this issue—though surely there would have been many if the issue were granted in another case).

Still, having concluded that there was a real jurisdictional question, the justices do have an obligation to do their best to resolve it. And asking for supplemental briefing may be the most responsible thing they can do at this point.