In a boost for consumer-facing businesses in the digital age, the Eighth Circuit Court of Appeals recently affirmed dismissal of class claims alleging violations of a federal data protection statute, finding that plaintiff failed to allege facts demonstrating he suffered a real injury.
In Braitberg v. Charter Communications, Inc., plaintiff was a customer of defendant cable service provider. When plaintiff opened his account, he provided defendant with his personally identifiable information (PII) – including address, telephone number, and social security number. Plaintiff subsequently cancelled his service, yet defendant retained his PII for a number of years thereafter. Plaintiff filed a putative class action claiming that the retention of his data after he closed his account violated the federal Cable Communications Policy Act.
The district court dismissed plaintiff's claims, and the Eighth Circuit affirmed. Applying the U.S. Supreme Court's Spokeo, Inc. v. Robins decision from earlier this year, the appellate court held that plaintiff lacked standing because the complaint merely pleaded a violation of the statute, without alleging facts demonstrating that the violation caused him any injury-in-fact. In finding no allegations of concrete injury, the court noted that the complaint did not allege that defendant had disclosed plaintiff's PII to a third party, or that the PII was accessed by an outside party, or that defendant had used the PII after plaintiff cancelled his service. The court also found no plausible allegation that defendant's retention of the PII had diminished the value of the PII or of the services that plaintiff had purchased from defendant.
Braitberg is the first published federal appellate decision to apply Spokeo which held that Article III of the U.S. Constitution "requires a concrete injury even in the context of a statutory violation," and such requirement is not automatically satisfied where a statute grants a statutory right and authorizes private lawsuits to enforce it. As the Supreme Court explained, a plaintiff cannot "allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III."
When Spokeo was issued, it was hailed by the defense bar as welcome protection against the potential draconian penalty of class-wide damage recoveries for ticky-tack statutory violations. Since then, a number of district courts have applied Spokeo in different contexts, with inconsistent outcomes. As the first federal appellate decision on record, Braitberg clarifies what a plaintiff needs to do to allege injury, particularly in the context of a data privacy claim. We expect greater clarification as additional appellate courts apply Spokeo in other contexts.