Class Action Litigation Report

Transcription

1 Class Action Litigation Report Reproduced with permission from Class Action Litigation Report, 18 CLASS 51, 1/13/17. Copyright 2017 by The Bureau of National Affairs, Inc. ( ) DATA PRIVACY SUPREME COURT The U.S. Supreme Court s decision in Spokeo v. Robins impels plaintiffs to pay more attention when drafting their complaints to ensure that they allege concrete injuries from defendants statutory violations, attorneys Lee S. Brenner and Cathy D. Lee say. The authors examine the impact of the ruling on data privacy litigation an area where many post- Spokeo courts have issued defendant-friendly decisions, holding that absent allegations of specific incidents of the use of stolen data for identity fraud, the increased risk of identity theft alone does not confer standing. Has the Supreme Court s Resolution of Spokeo Played Out as Expected? where the putative class action alleged hyper-technical violations of a federal statute without alleging facts showing actual harm. The predictions turned out to be correct, but only in certain circumstances. Data Privacy BY LEE S. BRENNER AND CATHY D. LEE P rior to the Supreme Court s resolution of Spokeo, there was a concern that the Ninth Circuit Court of Appeal s Article III standing rule would allow plaintiffs to bring class actions based on nothing more than a bare statutory violation without any requirement of actual harm, rendering companies vulnerable to abusive litigation. On May 16, 2016, however, the United States Supreme Court resolved Spokeo Inc. v. Robins by holding that a consumer cannot satisfy the injury-infact demands of Article III by alleging only a bare procedural violation of a statute, divorced from any concrete harm. Many anticipated that this decision would lead to favorable outcomes for defendants, particularly Data privacy litigation is one area where many post- Spokeo courts have issued defendant-friendly decisions, holding that absent allegations of specific incidents of the use of stolen data for identity fraud, the increased risk of identity theft alone does not confer standing. For example, in Khan v. Children s National Health System, a patient whose personal information may have been contained in s to which hackers gained access, brought a putative class action against the hospital operator alleging, inter alia, violations of consumer protection laws (Khan v. Children s Nat l Health Sys.., No. TDC , 5/19/16). The United States District Court for the District of Maryland found that the patient s purported increased risk of identity theft was insufficient to allege injury-in-fact required for standing, absent facts that the hackers had attempted to engage in any misuse of patients personal information or that their purpose was to use patients personal data to engage in identity theft. Plaintiff s gen- COPYRIGHT 2017 BY THE BUREAU OF NATIONAL AFFAIRS, INC. ISSN

2 2 eral allegations that data breach victims are 9.5 times more likely to suffer identity theft was not sufficient to confer standing. Similarly, in Gubala v. Time Warner Cable, Inc., plaintiff brought a putative class action alleging that the Time Warner violated the Cable Communications Policy Act (CPPA) by failing to destroy his personal identifiable information upon termination of his services with Time Warner (Gubala v. Time Warner Cable, Inc., No. 15-cv-1078, 6/17/16). The United States District Court for the Eastern District of Wisconsin found that plaintiff s allegations regarding consumers highly valuing the privacy of their personally identifiable information did not demonstrate that the plaintiff had suffered a concrete injury, especially given that he did not allege that Time Warner had disclosed his information to a third party. Because of the absence of any alleged harm to plaintiff, the Court found that the plaintiff did not have Article III standing to bring the lawsuit. Truth In Lending Act (TILA) The effect of Spokeo has been clear in TILA cases, where the question of a plaintiff s standing depends on whether the bank s shortcomings on disclosure affected the plaintiff s ability to pursue certain courses of action. For example, in McLaughlin v. Wells Fargo Bank, N.A., a plaintiff who faced foreclosure had investigated refinancing her mortgage or conducting a short sale and her inaccurate payoff statement directly affected her ability to pursue these options for avoiding foreclosure. (McLaughlin v. Wells Fargo Bank, NA, No. C WHA, 6/22/16). The United States District Court for the Northern District of California found that the bank s downplaying of the harm done by the inaccurate payoff statements was unconvincing. As such, the Court found Article III standing. Yet, where a plaintiff failed to allege any harm from a bank s failure to disclose, courts have held that the plaintiff failed to satisfy the injury-in-fact requirements for standing. For example, in Jamison v. Bank of America, N.A., plaintiff alleged that the bank failed to disclose insurance claim proceeds in its mortgage payoff and periodic statements (Jamison v. Bank of America, N.A., No. 2:16-cv KJM-AC, 7/7/16). The United States District Court for the Eastern District of California found that although the bank s inaccurate statements would not provide an accurate view of the outstanding balance if the plaintiff had applied for refinancing, had wished to fully satisfy her loan obligation, or if the bank had attempted foreclosure, the plaintiff did not allege those circumstances actually arose or that she suffered any harm. Thus, the Court held that the plaintiff s allegations were insufficient to satisfy the injury-in-fact requirement for establishing Article III standing. Fair and Accurate Credit Reporting Act (FACTA) In contrast to the clear holdings in the TILA context, the post-spokeo decisions regarding the FACTA have not been clear. In Kamal v. J. Crew Group, Inc., the plaintiff brought a putative class action alleging that a J. Crew receipt showing 10 digits of his credit card number violated FACTA because FACTA only allows the disclosure of the last 5 digits (Kamal v. J. Crew Group, Inc., No. 2: (WJM), 10/20/16). Plaintiff alleged that he was more susceptible to fraud by dumpster divers who could coble together credit card numbers. The United States District Court for District of New Jersey found that plaintiff had failed to allege facts demonstrating a risk sufficiently actual or imminent to constitute a concrete injury, as there was no evidence that anyone had attempted to access plaintiff s credit card information. Yet, the United States District Court of the Southern District of Florida came out differently. In Wood v. J Choo USA, Inc., plaintiff brought a putative class action alleging that Jimmy Choo s sales receipt displayed the expiration date of her credit card violating FACTA, which purportedly exposed her to an elevated risk of identity theft (Wood v. J Choo USA, Inc., No. 15-cv , 8/11/16). The Court held that the plaintiff had alleged the requisite injury-in-fact sufficient to have standing for a FACTA claim. The Court reasoned that through FACTA, Congress had created a substantive legal right for card-holding consumers to receive receipts truncating their personal credit card numbers and expiration dates, and that plaintiff suffered a concrete harm when Jimmy Choo allegedly printed the offending receipt. Telephone Consumer Protection Act (TCPA) The TCPA is another area of law where there appears to be no consensus regarding standing post-spokeo. Some courts have found that a TCPA violation itself does not constitute an actual injury for the purpose of standing. For example, in Romero v. Department Stores National Bank, a consumer brought a putative class action against a debt collector alleging that it made automated calls to her cell phone over 290 times over six months in violation of the TCPA (Romero v. Dept. Stores Nat l Bank, No. 15-CV-193-CAB-MDD, 8/5/16). The United States District Court for the Southern District of California held that the credit card holder did not have Article III standing to assert a TCPA claim based on calls: s (1) of which she was not aware at the time it occurred, s (2) that she heard ring but did not answer because no reasonable juror could find that an unanswered call could cause lost time or aggravation sufficient to establish standing, and s (3) that she answered because plaintiff did not show that defendants use of an automatic telephone dialing system (ATDS) caused her greater lost time or aggravation than she would have had the calls been dialed manually (which does not violate the TCPA). Therefore, the Court granted the debt collector s motion to dismiss the TCPA claim for lack of subjectmatter jurisdiction. Nonetheless, courts across the nation have disagreed regarding the injury sufficient to create standing under the TCPA. Conclusion While the Supreme Court s decision in Spokeo did not uniformly lead to defendant-friendly decisions, it re COPYRIGHT 2017 BY THE BUREAU OF NATIONAL AFFAIRS, INC. CLASS ISSN

3 3 quired plaintiffs to pay more attention to drafting their complaints to ensure that they allege concrete injuries from defendants statutory violations. There certainly are many decisions in putative class actions that are favorable to defendants post-spokeo. Nevertheless, depending on the context, various splits of authority concerning standing remain. CLASS ACTION LITIGATION REPORT ISSN BNA

4 COPYRIGHT 2017 BY THE BUREAU OF NATIONAL AFFAIRS, INC. CLASS ISSN

5 CLASS ACTION LITIGATION REPORT ISSN BNA