Is a Privacy Violation an "Injury"?

The Supreme Court's call for supplemental briefing in Frank v. Gaos will lead it to a difficult question.


Last week, the Supreme Court heard oral argument in an interesting and important class action case, Frank v. Gaos, about when lawyers can agree to settle a case on behalf of a class action by giving all of the money to a charity instead of the class. Today, however, the Supreme Court called for supplemental briefing on a different question—whether the named plaintiffs have suffered an "injury" sufficient to create standing under the Court's doctrine. That question may prove to be even trickier.

The plaintiffs in Gaos complain that Google has unlawfully turned over information about their search histories. Before the Supreme Court's decision in Spokeo v. Robins, some circuits, including the Ninth Circuit, had concluded that any violation of an individual statutory right was enough for standing. As the cases said, "Congress may enact statutes creating legal rights, the invasion of which creates standing, even though no injury would exist without the statute." In Spokeo, the Court concluded that that formulation was incomplete, and that the right must also be "concrete" though it could nonetheless be "intangible."

During the Frank oral argument, some justices became concerned that the plaintiffs in Gaos might not have standing, because they may have alleged little more than the illegal disclosure of their private search histories. While the justices batted around the possibility of a remand, the request for supplemental briefing suggests that the Court will decide the standing issue on its own.

Doing so, however, will require the Court to decide a somewhat tricky question about the nature of standing in privacy cases. Is the disclosure of previously private information itself a concrete injury? Or must the plaintiff allege that somebody else used that information against them in a particular way? Indeed, this is one of the tricky things about the Spokeo decision itself. Margot Kaminski and Matthew DeLuca have articles about standing for privacy claims after Spokeo. And as I wrote in an article last year about Spokeo:

For instance, last summer the D.C. Circuit confronted a lawsuit by two D.C. shoppers who complained that local clothing stores had demanded their zip codes in violation of local law. Without disputing that the information was illegally demanded, D.C. Circuit dismissed the case for lack of standing. The forced disclosure of one's zip code, it held, was not a concrete injury after Spokeo. In Spokeo the Court had offered a coincidentally similar example, writing: "not all inaccuracies cause harm or present any material risk of harm. An example that comes readily to mind is an incorrect zip code. It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm."

The D.C. Circuit found the dictum apt, writing, "If, as the Supreme Court advised, disclosure of an incorrect zip code is not a concrete Article III injury, then even less so is [the plaintiffs'] naked assertion that a zip code was requested and recorded without any concrete consequence. [The plaintiffs] do not allege, for example, any invasion of privacy, increased risk of fraud or identity theft, or pecuniary or emotional injury."

This is probably the correct conclusion to draw from Spokeo's somewhat gratuitous discussion of zip codes, but at a more fundamental level it again suggests that something is wrong with Spokeo. Why must the plaintiffs show something like a risk of identity theft or emotional injury to demonstrate a concrete injury? Why can't an illegal disclosure itself be a concrete injury? As to a zip code, this may seem strange. But imagine that the illegal disclosure was something else–an unflattering photograph or email, perhaps. Surely this ought to be actionable without showing a subsequent consequence, like the loss of one's job or social standing. Or, more modestly, imagine somebody who is embarrassed by their middle name and does not wish to see it disclosed. If that person has a legal right against disclosure, why should they need anything more?

There are two possible ways to resolve the scope of privacy laws in light of the courts' position on zip codes. One possibility, the more aggressive one, is to conclude that illegal disclosure of facts about oneself is never itself a concrete injury. To sue over the disclosure of one's address, photos, name, or anything else, one would have to demonstrate some sort of downstream consequences from these disclosures. In other words, privacy itself would not be a protectable interest under Article HI. This position has a certain logical purity, but one hopes that it is too implausible even for today's courts to adopt. It would mean that even injuries recognized under long-standing common law principles would not be enough to satisfy the "injury in fact" requirement.

The alternative possibility, a more modest one, is that some illegal disclosures are injurious in themselves, and others are not. For instance, perhaps the disclosure of photographs is different in kind from the disclosure of zip codes, even if both are protected by legal right. (The D.C. Circuit's attempt to distinguish "invasion of privacy" as an actionable "concrete consequence" might point to this possibility.) There is some common sense intuition behind this approach, but it is not entirely principled. If the legislature has made the judgment to protect both kinds of information, it is not at all clear why judges may decide that one is "concrete," that is, "real," and the other is not. This saves some of privacy law from Spokeo only by creating a constitutional common law of privacy interests.

What is more, the question of when the illegal disclosure of information is a concrete injury is one that appears to have divided lower courts in the short time since Spokeo. So, in order to deny standing (and perhaps in order to grant it) the Court may have to resolve another circuit split beyond the one that it originally granted the case to resolve.

This makes me a little nervous, since I do not think the Court does its best work on tricky federal courts questions when they are noticed at the last minute in the middle of another merits case. The posture also means that the issue may not get as much public attention (and I am not even sure whether amicus briefs are permitted on this issue—though surely there would have been many if the issue were granted in another case).

Still, having concluded that there was a real jurisdictional question, the justices do have an obligation to do their best to resolve it. And asking for supplemental briefing may be the most responsible thing they can do at this point.

NEXT: "The [11-Year-Old] Child 'Has to Get Herself Ready for School and on the Bus with No Supervision by Mother'"

Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Report abuses.

  1. Comparative law tip of the day: this issue came up in the High Court of England and Wales recently in Lloyd v Google [2018] EWHC 2599 (QB), where someone tried to sue Google for a GDPR violation on behalf of several million other claimants similarly situated without even claiming that he or any other member of the putative class suffered any injury in fact whatsoever. The Court thought about it very carefully and then told him to go away.

  2. De minimis not curat lex seems like a useful legal guide post in this case. In the modern age, firms and agencies handle huge amounts of data from customers and others, which they ought to keep private. But realistically, they’re going to slip up from time to time. Class actions on behalf of millions (or hundreds of millions) of people could impose huge costs. Is the nature of the fault and its likely consequences such as would justify the imposition of such costs? A credit card number, yes; an erroneous zipcode, probably not.

    1. “firms and agencies handle huge amounts of data from customers and others, which they ought to keep private. But realistically, they’re going to slip up from time to time.”

      If they can’t be sued, they’re going to slip up way more often.

      Yes, it might take a couple of big awards and resulting higher insurance costs to get them to try to avoid “oops, we released private information belonging to thousands of people that was entrusted to us! Darn! Buy Equifax credit monitoring services at a slight discount!”

  3. I am curious to how far this approach will spread. Will we apply it to trespass cases that didn’t affect the owner’s use of the property? To assaults that were not followed by a completed battery? To attempts of all sorts?

    1. Those are common law intentional torts under state law, so it’s not going to come up in Federal court. Even a diversity suit wouldn’t satisfy the amount in controversy if it’s a de minimis harm.

      1. What if the assaulter was a federal agent?

  4. So long as the issue is the entire class and not just whether the objectors have some interest that was not served by the settlement having SCOTUS take a look at it strikes me as a good thing. But any determination that class faithfully discharged their job would be very ugly.

  5. ===and that the right must also be “concrete” though it could nonetheless be “intangible.”===


  6. I have difficulty with case. It seems obvious to me that a person’s search results could be potentially embarrassing, just like their video rental records in another era. So if a legislature says they have a right to keep them private, it seems obvious to me there’s a live case or controversy

    I fear standing requirements could be converted into a way for conservative judges to veto privacy and personal protection statutes. If judges disagree with a law, they simply say no real harm has been done and therefore there is no standing to sue. That’s just judicial activism by another name.

    Legislatures have to be free to decide whether something causes harm or not, and reasonable people have to be free to disagree. One can agree or disagree with things like lawsuits for emotional harm, one can think having one’s feelings hurt or being embarrassed isn’t real harm. But it’s legislatures’ and not judges’ job to make these calls.

    1. And even if it didn’t seem obvious to me, different people and cultures have different emotional makeup find different things embarrassing. But everyone thinks their own personal emotions universal and reflective of objective reality. So judges aren’t free to use their own emotions as the touchstone for what is “objectively” hurtful and shut everyone else out from having a say. Just as emotions and emotional hurt are realities of human existence, whether or not a rationalist thinks them rational, so is diversity in people’s emotional makeup, and the role of culture in shaping it.

      Judges in the United States, especially on the Supreme Court, come from a remarkably narrow segment of American society, and simply aren’t necessarily able to see things the way everyone else does or understand others. They need a dose of humility about their omniscience, and allow other people their right to speak for themselves about what hurts them.

      This is a basic, fundamental right, and critical to a participatory constitutional democracy. The Court should not ignore it so haughtily. If people aren’t even allowed to say what hurts them and be listened to and believed, if what they say their hurts are is dismissed so lightly they aren’t even allowed to enter the courthouse door, they have no hope of being able to have their grievances redressed, or to have their and social peace distressed by their hurts restored.

  7. So I have to wonder, is Ted Frank going to ask for outside help on this?

    It’s his case both as plaintiff and as counsel, and the initial questions presented were squarely in his expertise as a result of his halfway-test case. So aside from having a few other people check his briefing for blind spots and such, given this is probably not a situation he couldn’t dissociate himself from while working on it, he didn’t really need to hand it to someone else.

    But this separate issue…well, I’m not aware it’s something he’s spent lots of time in. (Could be I’m just not aware, tho, and he spent significant time in the Spokeo weeds at the time — someone tell me if so.) Seems like a reasonable time — particularly on the sort of deadline relevant here if there (probably? too lazy to check) was one — to bring in some outside expertise for at least very significant help on the matter.

  8. Isn’t there a bigger problem with standing here, in that the search histories were anonymous? Google tracks searches and clicks so it can tell advertisers what kind of searches lead to clickthroughs, but it doesn’t tell the advertisers “Billy Jones searched for this and clicked on that.”

Please to post comments