On October 5, 2016, in Nokchan v. Lyft, Inc, United States District Court for the Northern District of California dismissed Nokchan’s putative class action, finding his claim of privacy violations under the Fair Credit Reporting Act (“FCRA”) failed to meet the requirements of Article III standing established by Spokeo, Inc. v. Robins. This was because Nokchan failed to show a concrete injury. In Spokeo, the Supreme Court held that plaintiffs must show they have a “concrete injury” to establish standing under Article III, and, in certain circumstances, the breach of a “procedural right” amounts to a concrete injury. In a matter of days after Spokeo, several cases invoking the decision arose, with plaintiffs alleging privacy violations due to data breaches.
Nokchan is no exception to the long line of cases post-Spokeo, as it follows hot on the heels of the Sixth Circuit’s decision in Galaria et al. v. Nationwide Mutual Ins. In this case, the court held in favor of the plaintiff’s FCRA claim. The plaintiff’s claim was based on a data breach and the court found that the theft of data placed the plaintiff at a higher risk of fraud and identity theft, and that this constituted a concrete injury. Although Nokchan and Galaria each deal with different injuries, the application of Spokeo is similar in both cases and continues to diverge from the 11th Circuit’s recent interpretation of the case. The Circuit split and lack of consistency in applying the Article III standing requirements post-Spokeo suggest this issue will likely be analyzed again by the Supreme Court.
In particular, the Nokchan decision diverges from case law post-Spokeo because it puts the burden on the plaintiff to prove cognizable harms in addition to alleging a statutory violation. This interpretation of Spokeo conflicts with some courts’ interpretation, such as the 11th Circuit, that interpreted Spokeo more broadly to confer standing to plaintiffs with just “informational injuries” without additional articulated harms.
In Nokchan, the plaintiff’s claim arose as a result of an employment application with Lyft which required Nokchan to complete a credit and background check. Nokchan alleged that Lyft violated his privacy and statutory rights by failing to comply with the disclosure requirements under the FCRA and state laws. Nokchan also alleged that Lyft failed to provide a “clear and unambiguous” disclosure of his rights under the FCRA and state laws at the time of the disclosures. Lyft, relying on Spokeo, moved to dismiss the complaint based on a lack of standing because Nokchan had failed to prove a concrete injury. The court agreed.
Nokchan attempted to distinguish his claim from the position under Spokeo. First, without citing any support, Nokchan argued that the invasion of privacy is a traditionally recognized injury and that his authorization to Lyft was not proper. Second, Nokchan also argued that he suffered an “informational injury,” which was sufficiently concrete to meet the requirements of Spokeo. The court disagreed, recognizing the case law post-Spokeo has not been consistent with respect to “how broadly to read the language in Spokeo with respect to informational injury.” The court noted it disagreed with the Eleventh Circuit’s “broad reading” in Church v. Accretive Health, Inc. (where it was found that a hospital’s failure to provide certain disclosures to a patient under the Fair Debt Collection Practices Act resulted in a concrete injury under Spokeo because the patient’s “right to receive the disclosures is not hypothetical or uncertain”) but agreed with the reasoning of the federal district court in New York in Dolan v. Select Portfolio Servicing, (in which it was held that a loan servicer’s failure to provide disclosures required under Section 2605 of the Real Estate Settlement Procedures Act did not constitute an intangible harm sufficient to confer standing).
In coming to its decision, the court noted that pre-Spokeo case law would have helped Nokchan establish his claim, because these cases established that “violation of a disclosure requirement under the FCRA, by itself, is sufficient to confer Article III standing on a plaintiff.” However, that is not the case post-Spokeo. Time will tell how other courts interpret Spokeo with regard to informational injuries, but it is likely that further U.S. Supreme Court clarification on what exactly constitutes a “concrete injury” to confer Article III standing will be necessary. For now, U.S. companies should continue to argue and push for courts to interpret Spokeo as requiring an articulated concrete harm in addition to “informational injuries” to confer Article III standing.
