In the past week, panels from the Third and Seventh Circuits have issued rulings that interpret the Supreme Court’s Spokeo decision on Article III standing. The decisions reflect a possible circuit split concerning the test for determining when the violation of a federal statute gives rise to a “concrete” harm under Spokeo.
In the Supreme Court’s decision, there are several references to “risk of harm” in the discussion of when a statutory violation causes concrete harm. For example, toward the end of the opinion, the Court wrote:
A violation of one of the FCRA’s procedural requirements may result in no harm. For example, even if a consumer reporting agency fails to provide the required notice to a user of the agency’s consumer information, that information regardless may be entirely accurate. In addition, not all inaccuracies cause harm or present any material risk of harm. An example that comes readily to mind is an incorrect zip code. It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.
In its recent Horizon decision, the Third Circuit held that the “material risk of harm” language in Spokeo should not be read to raise the bar for pleading concrete injury:
Although it is possible to read the Supreme Court’s decision in Spokeo as creating a requirement that a plaintiff show a statutory violation has caused a “material risk of harm” before he can bring suit, 17 id. at 1550, we do not believe that the Court so intended to change the traditional standard for the establishment of standing.
Can the Seventh Circuit’s decision in Gubala be read as disagreeing? For example:
[Plaintiff] Gubala’s problem is that while he might well be able to prove a violation of section 551, he has not alleged any plausible (even if attenuated) risk of harm to himself from such a violation—any risk substantial enough to be deemed “concrete.”
Perhaps a greater point of contrast between the two opinions surrounds the distinction between procedural and substantive statutory violations. In Spokeo, the Court discussed the concept of a procedural violation at some length, including:
On the other hand, Robins cannot satisfy the demands of Article III by alleging a bare procedural violation. A violation of one of the FCRA’s procedural requirements may result in no harm.
The Third Circuit appears to read Spokeo as making an important distinction between procedural violations and substantive violations:
It is nevertheless clear from Spokeo that there are some circumstances where the mere technical violation of a procedural requirement of a statute cannot, in and of itself, constitute an injury in fact.
the Plaintiffs here do not allege a mere technical or procedural violation of FCRA. They allege instead the unauthorized dissemination of their own private information – the very injury that FCRA is intended to prevent. There is thus a de facto injury that satisfies the concreteness requirement for Article III standing.
But Judge Posner, in the Seventh Circuit’s Gubala, finds the distinction unhelpful:
Gubala argues in his briefs that the Supreme Court’s recent admonishment in Spokeo that “Article III standing requires a concrete injury even in the context of a statutory violation,” applies only to violations of statutory rights that can be categorized as “procedural” rather than “substantive.” But a failure to comply with a statutory requirement to destroy information is substantive, yet need not (in this case, so far as appears, did not) cause a concrete injury. Anyway at oral argument Gubala’s counsel conceded the irrelevance of his attempted distinction between substantive and procedural statutory violations, acknowledging that it was foreclosed by Meyers v. Nicolet Restaurant of De Pere, LLC, 843 F.3d 724 (7th Cir. 2016), decided after he filed his briefs.
It may be possible, in the end, to chalk up the differences between the Third and Seventh Circuit decisions to their underlying facts — in the Third Circuit case, personal information was stolen, whereas in the Seventh Circuit case, plaintiff’s claim focused on mere retention of personal information. But there also appear to be diverging interpretations of Spokeo that may well require another Supreme Court decision.