On Monday, the Supreme Court of the United States, in a 6-2 decision, found that people who have been hurt by others' breaking the law, but who suffered no concrete and actual or imminent financial damage as a result, do not have the right to sue. The nature of the case, however, and some details in the ruling, shed light on some important factors relevant to personal information on the internet. Ultimately, this decision could impact every American.
The case in question is Spokeo Inc. v. Robins , in which Thomas Robins sued Spokeo--a website that aggregates information about many people--for publishing incorrect information about him. As attorneys Fernando Pinguelo and Kurt Watkins explained to me, Robins sued Spokeo claiming that Spokeo had violated the Fair Credit and Reporting Act (FCRA), which is a federal law intended to protect consumers. The Act, which first went into effect in 1970, governs the dissemination of credit reports, consumer data, and similar information. Companies specializing in organizing such data, such as data brokers and background-search and credit-reporting companies, are regulated by the FCRA. Today, in the internet age, information protected by the FCRA is, of course, so much more easily searched, accessed, stored, and disseminated than at any time in the past.
Fashioning itself as a "people search engine," Spokeo is a data broker--an entity that collects consumers' personal information and resells or shares that information with others as part of the so-called "big data" economy. Specifically, Spokeo provides information by crawling numerous public records and other sources and aggregating the data. The information that it presents for public consumption is not necessarily subjected to rigorous verification, and not guaranteed to be up to date or even accurate. In fact, due to the number of companies providing synthesized personal data as well as the ability for people to create profiles for others on social media and other Internet platforms, information errors can compound. For example, a human resources department using Spokeo to assess a job candidate's qualifications can, at times, be presented with highly inaccurate information about the candidate.
It was the dissemination of highly inaccurate information about him that prompted Robins to sue Spokeo in the first place; he claimed that the site provided incorrect details regarding his age, education, employment status, and details of his personal life, and, in doing so, created an unflattering portrait of him. The lawsuit eventually landed in the lap of the Supreme Court because it touched on significant, never-before-addressed legal issues that required resolution. Although the Court agreed that Spokeo likely violated the FCRA by presenting such misinformation, the Court found that Robins did not allege that he had a concrete, actual, or imminent injury that would qualify him to bring a lawsuit. He did not, for example, allege that he was denied credit or employment as a direct consequence of Spokeo's actions. Rather, the Court found Robins merely alleged concerns about potential damage that might ultimately rise from Spokeo's making misinformation about him available on the internet, where potential employers might view it.
The Court did acknowledge, per the arguments raised in Justice Ruth Bader Ginsberg's dissent (which sided with Robins's position that he had met the harm threshold necessary to allow his lawsuit to continue), that the potential damage caused by Spokeo posting inaccurate information about Robins was significantly more than the damage that might occur from someone posting other types of inaccurate information on the internet-- for example, incorrectly listing someone's ZIP code. That said, the majority of the Justices found that without concrete and actual damage--now or in the future--Robins could not sue.
It is important to note that the Court did not conclude that Robins had no standing to sue Spokeo for publishing inaccurate information about him, but rather that he could not sue over a statutory violation without demonstrating actual damage or the likelihood that real damage would occur, and that the lower court failed to engage in a complete analysis of this particular issue. Hence, the Court sent the case back to the lower court to perform such an analysis and determine whether Robins met the threshold standard that would allow for his lawsuit against Spokeo to move forward.
The Court's ruling seems to advance the cause of individual privacy and the right of people to have only accurate information about themselves published online; the Court made it a point to say that 1) not all injuries had to be immediately tangible in order to give someone the right (i.e., standing) to sue over internet-based misinformation, and 2) that future harms can be considered, provided that someone suing can demonstrate that there is material risk of harm in the future.
The Court did not, however, set down a clear standard to define how much risk must exist to meet the criteria or what would constitute sufficient harm under the circumstances, perhaps setting the stage for future similar cases to end up in front of the Court.
It also did not address other issues, such as whether Robins could sue Spokeo in state court for slander.
Furthermore, internet-accessible inaccurate or outdated information about people has also given rise to other laws. Recently, the EU Court of Justice demanded that Google give members of the EU the "right to be forgotten" and accommodate EU members' requests that the search giant remove from search results information that is no longer relevant or accurate. The EU and Google are both still grappling with the effects of that ruling and the practicalities of "deleting" information from internet searches. If Spokeo were to present inaccurate or outdated information about an EU member, for example, it might be forced to remove that information by EU law.
One thing is clear: for the next few years, courts and regulators around the world are going to continue to grapple with the matter of an individual's right to have data providers supply only accurate and current information about him or her. If you are in the business of supplying such data, or using such data, you should pay attention to developments in this regard. And, of course, any rulings on these matters will likely impact pretty much everyone at some point in his or her life.