Privacy Injuries and Article III Concreteness

Abstract

The Supreme Court’s 2016 decision in Spokeo, Inc. v. Robins requires federal courts to investigate the “concreteness” of a plaintiff’s injury, even after Congress has recognized the injury by statute. Spokeo’s concreteness discussion is a confusing mixture of several distinct considerations, and there is little rhyme or reason to how the lower courts have interpreted and applied Spokeo to other statutorily authorized injuries.

This Article offers a descriptive framework that situates Spokeo among the Court’s past cases, which recognize four distinct informational injuries—those arising from the withholding, acquiring, using, and disseminating of information. This four-injury taxonomy is instrumental to developing an alternative approach that avoids Spokeo’s mistakes: Federal courts should give binding deference to Congress’s decision to make an injury privately enforceable when three conditions are met—when the plaintiff alleges an informational injury; when the defendant is a non-governmental actor; and when Congress has effectively personalized the injury and the plaintiff is among the injured.

The Court’s approach—an unmoored judicial investigation into an informational injury’s amorphous “concreteness”—erodes Congress’s ability to provide avenues of redress for new and novel harms, and this erosion is already undermining privacy protections. Since Spokeo, lower courts have refused to enforce provisions of the Fair Credit Reporting Act, the Fair and Accurate Credit Transactions Act, and the Cable Communications Policy Act, among other statutes. The informational-injury lens shows that courts lack a principled way to stop Spokeo from also undermining provisions of the Wiretap Act, the Stored Communications Act, Illinois’s Biometric Information Privacy Act, and nascent privacy reform proposals that have private rights of action—including European- and California-style data processing restrictions and an information fiduciary regime.

The Court’s Spokeo decision is in tension with historical practice, is having deleterious effects on privacy interests in the lower courts, and threatens to gut putative privacy law reform. This Article provides a mechanism for understanding how the Court’s standing jurisprudence goes awry, and it posits a simpler and superior alternative approach.

Keywords: Article III standing, injury in fact, Spokeo v. Robins, privacy, jurisdiction, Wiretap Act, Stored Communications Act, Fair Credit Reporting Act, Biometric Information Privacy Act, California Consumer Privacy Act, Video Privacy Protection Act, Lujan v. Defenders of Wildlife, class-action litigation