Standing in Data Breach Cases Likely Heading Back to the Supreme CourtData breach plaintiffs often have a very difficult time stating a concrete injury, and courts have wrestled with whether these plaintiffs can file suit in federal court. We have been watching this issue and writing about it frequently. The issue is whether plaintiffs have suffered an “injury in fact” that gives them Article III standing. The Supreme Court’s 2016 decision in Spokeo v. Robins took a narrow view of Article III standing where the plaintiffs alleged that their federal statutory rights were violated, but did not allege that they suffered any factual injury beyond the statutory violation. Spokeo gave defendants strong arguments to dismiss data-breach cases for lack of standing, but results have been mixed—perhaps because Spokeo addressed federal claims and not state-law negligence claims that are most commonly asserted after data breaches. Spokeo has proven to be a mixed blessing.

Now the issue looks to be heading back to the Supreme Court in Zappos.com, Inc. v. Stevens. That case highlights how the various circuits have taken divergent views on standing in data breach cases. The Supreme Court has not granted certiorari yet, but court watchers have singled this case out as a likely grant. We are monitoring the case closely, as any ruling from the Supreme Court in the data-breach context would have far-reaching effects on this rapidly developing area of the law.

Stay tuned.

Spokeo v. Robins – which confirmed that a plaintiff’s allegation of a defendant’s statutory violation without accompanying concrete harm fails to satisfy Article III’s “case or controversy” requirement – has brought the issue of standing to the forefront in a variety of class action cases. Standing has become a frequent weapon in the defense’s arsenal, both as an initial hurdle for a class plaintiff to overcome, and as a basis for resisting class certification by demanding that each putative class member demonstrate actual, concrete injury. A recent decision by the Seventh Circuit, however, reminds us that there can be a downside to a successful standing challenge: the permanent loss of a federal forum for adjudication of the claim.

The Standing Trap: Will a Spokeo Challenge Lock a Class Action Defendant into a State Court Forum?Collier v. SP Plus Corporation involved a class action brought against the operator of public parking facilities, claiming that the receipts generated by the defendant contained the expiration dates of consumers’ credit and debit cards, in violation of the Fair and Accurate Credit Transaction Act (FACTA). Plaintiffs alleged willful violation of FACTA and sought statutory and actual damages. Their complaint, however, did not describe any concrete harm resulting from the alleged statutory violation. SP Plus removed the case to federal court, invoking the court’s federal question jurisdiction under FACTA, and then moved to dismiss under Fed. R. Civ. P. 12(b)(1), contending that plaintiffs lacked Article III standing because they alleged no injury in fact.  Plaintiffs responded by moving to remand the case to state court, contending that SP Plus had failed to establish subject matter jurisdiction. The district court denied the motion to remand, and granted plaintiffs leave to amend to make factual allegations in support of their request for actual damages. When plaintiffs did not amend their complaint, the trial court dismissed the case with prejudice. Plaintiffs appealed to the Seventh Circuit.

The appeals court reversed. The court agreed that plaintiffs’ complaint did not allege an actual injury sufficient to establish Article III standing under Spokeo. Nonetheless, relying on the mandatory language of 28 U.S.C. § 1447(c), the court held that remand to state court was the only permissible option upon a finding of lack of subject matter jurisdiction. The court also noted that even if a dismissal had been proper, it should have been one without prejudice, as a jurisdictional dismissal is not an adjudication on the merits. In a parting shot, the court expressed displeasure that the defendant had removed the case to federal court and then promptly attacked federal jurisdiction; SP Plus’s “dubious strategy has resulted in a significant waste of federal judicial resources, much of which was avoidable.”

There are several takeaways from this decision:

  • From the defense perspective, seeking a Rule 12(b)(1) jurisdictional dismissal in a case removed from state court is strategically risky. The weight of authority (which Collier reflects) and the language of 28 U.S.C. § 1447(c) instruct that a successful challenge to plaintiff’s standing will result in a remand to state court. And the benefit of a federal court’s ruling of “no Article III standing” is far from clear, unless the state court’s standing jurisprudence mirrors Article III. Even then, as a non-final (and, at best, appealable by permission only) ruling, it is difficult to imagine that a state court would consider the remand order to be preclusive. There is authority in some circuits that a district court can dismiss rather than remand to state court if remand would be futile, i.e., if it is clear that the state court would likewise dismiss for lack of standing. But making that showing is likely to be difficult, as many states’ standing rules differ from federal standards. And – as Collier also teaches – a jurisdictional dismissal by the federal court should be one without prejudice, leaving the plaintiff free to refile the case in state court anyway.
  • Of course, ignoring standing altogether does not eliminates the trap. The plaintiff himself can raise the issue in an effort to have the case remanded. And as the late, great Dan Meador taught many of us in his Federal Courts class, “even the janitor can raise subject matter jurisdiction.” But beyond those scenarios, the defendant is better served by saving its standing arguments for class certification, in particular the argument that each class member must show actual injury, thus defeating commonality, typicality and predominance. Not all courts have bought into the concept that every member of the class must have standing, but arguing these issues under the Rule 23 factors can create traction for the defense while minimizing the risk of remand.
  • Collier also serves as a reminder that federal jurisdictional statutes (including the Class Action Fairness Act) may be of limited utility to the defendant facing a class action involving statutory violations without actual injury. Federal district courts have a duty independent of any Congressional enactment to determine whether an action involves an actual “case or controversy” under Article III.
  • Defense counsel’s natural instinct in “touch foul” class actions is to argue early and often that “plaintiff hasn’t been hurt at all.” In class cases removed from state court, however, it may be wise to curb that instinct. Attacking standing can result in the defendant being left to the tender mercies of the state court where plaintiff’s counsel initially chose to bring the suit.

FACTA Cases Continue to Present Ideal Targets for <i>Spokeo</i> Challenges—Eleventh Circuit Defendants Take Particular NoticeWe’ve already written about Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), in which the Supreme Court reaffirmed that all federal plaintiffs, even those alleging a statutory violation, must have suffered a real, concrete injury in order to have Article III standing. As we’ve noted in a past blog post, despite Spokeo’s clear guidance that a mere technical statutory violation, divorced from any concrete harm, is not enough to confer Article III standing, lower courts have divided on how to apply Spokeo to federal statutory class actions. Notwithstanding Spokeo’s inconsistent application in other contexts, many have been willing to use Spokeo as a basis to dismiss claims under the Fair and Accurate Credit Transaction Act or FACTA. One recent example is Kirchein v. Pet Supermarket, Inc.

A quick primer: FACTA prohibits the willful printing of more than the last five digits of a consumer’s credit card number on an electronically generated receipt provided at the point of sale. Even though there is basically no evidence suggesting that consumers’ identities are at any material risk if a FACTA violation occurs, FACTA is a severely punitive statute. Damages for each FACTA violation are between $100 and $1,000, either per customer or per receipt—courts are divided on that question—with no classwide statutory damage cap. The combination of high damages, relative ease of proving violations, and availability of class certification creates strong incentives for plaintiffs to bring FACTA claims as class actions. Plaintiffs asserting FACTA claims usually define the class to exclude consumers who have suffered any actual damages.  Those consumers can recover even more individually under the statute, but proving individual damages often precludes class certification. As a result, FACTA cases commonly feature a large number of unharmed class members.

Enter Spokeo. In that case, the Supreme Court held that Congress cannot declare non-injuries to be injuries for purposes of Article III:

Congress’ role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right. Article III standing requires a concrete injury even in the context of a statutory violation. For that reason, [the plaintiff] could not, for example, allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III.

Spokeo’s requirement of harm beyond a mere statutory violation has been very difficult for FACTA plaintiffs to overcome. As Judge Moreno of the Southern District of Florida put it, “the Seventh and Second Circuits, as well as multiple district courts, have held that under Spokeo, a plaintiff who has not suffered any actual harm or material risk of harm lacks standing to sue for violations of the Act” (see Tarr v. Burger King Corp.).  A similar case, Gesten v. Burger King Corp., suffered the same fate at the hands of Judge Scola in the Southern District of Florida.

The latest case to join this line is Kirchein, a FACTA case before Judge Scola that the parties had previously preliminarily settled. The defendant discovered through the course of the settlement process that there were more class members than expected, so it moved to vacate preliminary approval of the settlement. While the court did not directly vacate approval of the settlement, it went much further and dismissed the entire case for lack of subject matter jurisdiction. It noted that, even if it was possible that a FACTA violation could give rise to standing, the injury alleged by the plaintiff did not give rise to standing because the plaintiff did not even allege that his personal information had been involuntarily exposed to anyone.

These cases demonstrate that many garden-variety FACTA complaints are exactly what Spokeo forbids. Federal jurisdiction requires more than a pure procedural issue.

We’ll conclude with four takeaways:

  • First, Spokeo’s injury-in-fact requirement is an issue the defendants should continue to press in every class action seeking only statutory damages, notwithstanding the existence of a few less-than-favorable decisions. The Southern District of Florida’s recent FACTA decisions should give defendants renewed hope in their ability to challenge standing because these cases reflect a growing reversal of a trend of finding standing in similar cases.Many of the early post-Spokeo FACTA cases that found jurisdiction did so by relying on pre-Spokeo cases, particularly Hammer Sam’s East, Inc. While the Eleventh Circuit, in an unpublished opinion about the FDCPA, seemed to give Spokeo a narrow reading in Church v. Accretive Health, Inc., the court later upheld dismissals on Spokeo grounds in other statutory damage cases shortly thereafter (see Meeks v. Ocwen Loan Servicing, LLC,  and Nicklaw v. CitiMortgage, Inc.). Courts with FACTA claims had initially found shelter under Church to keep their cases, but time has proven that shelter far from leak proof. For its part, the Southern District of Florida has now recognized that Spokeo has often dispositive implications for FACTA class actions, and that the pre-Spokeo Hammer case is obsolete.
  • Second, on a related point, defendants may benefit from pressing a Spokeo challenge even if outright dismissal is unlikely. Plaintiffs can be forced into making individualized allegations about how they were personally harmed. Those allegations can then be used as a lever to upend class certification on commonality, typicality, and predominance grounds.
  • Third, while FACTA is particularly egregious in penalizing what looks to be harmless conduct, claims seeking statutory damages under other federal and state statutes are also vulnerable to Spokeo Alleged technical violations of notice provisions under the FDCPA can, in some instances, be pure touch fouls with no harm. Other kinds of data breach claims, such as state-law negligence or privacy claims arising from payment card hacking, are another context in which Spokeo may apply when plaintiffs allege nothing more than an increased risk of identity theft.
  • Fourth, watch out for removal issues. While FACTA raises a federal question and an automatic chance to remove a case, a motion under Spokeo can easily result in a remand. Burger King found this out the hard way: After Judge Scola dismissed the Gesten case, the plaintiff re-filed in state court. Burger King removed, but the district court remanded, noting that Burger King had previously successfully argued that federal jurisdiction does not exist.