The Supreme Court's Spokeo Decision And Its Potential Impact On Privacy And Data Security Class Actions

On May 16, 2016, the Supreme Court decided Spokeo, Inc. v. Robins, ruling that a plaintiff must sufficiently allege an injury that is both concrete and particularized in order to have Article III standing, and further that a "bare procedural violation" of a plaintiff's statutory right may not be sufficiently "concrete" under this analysis. This ruling has the potential to affect class actions generally, but may prove especially influential in privacy and data security class actions.

Plaintiff Thomas Robins brought a putative class action against Spokeo, which operates a "people search engine" that gives users access to individuals' personal information culled from a number of databases, after Robins discovered that his Spokeo-generated profile contained inaccurate information. Specifically, the profile suggested that Robins was an affluent, employed, fifty-something husband and father with a graduate degree, yet Robins claimed that all this information was