Supreme Court's Spokeo Decision Erects Barriers For Privacy And Data Security Plaintiffs

On May 16, 2016, the United States Supreme Court in Spokeo, Inc. v. Robins confirmed that a "concrete" injury is required of all private parties seeking to assert claims in federal court, even those alleging violations of a federal statute for which Congress has provided a statutory damages remedy. Where no concrete injury has yet been suffered, a claimant must allege a sufficiently imminent "risk of real harm" in order to satisfy the concreteness requirement. Although the Spokeo case addressed a claim for willful violation of the Fair Credit Reporting Act ("FCRA"), the decision is likely to have broad implications in other contexts as well – particularly in the privacy and data security space, where plaintiffs frequently seek to recover statutory damages for purported violations of statutes such as the Telephone Consumer Protection Act, Video Privacy Protection Act, and Electronic Communications Privacy Act, as well as FCRA, often without alleging any actual or