On Monday, May 16, 2016, the Supreme Court of the United States issued its highly anticipated opinion in Spokeo, Inc. v. Robins, a case that examined the question of whether a plaintiff who ...25 May 2016
Supreme Court Standing Case Has Implications for Privacy Litigation
Outside of the FISA context, the Court’s decision likely will make it more difficult for private plaintiffs in privacy and data breach litigation cases to establish standing based merely on a dignity interest or potential future harm. The “certainly impending” standard used in Clapper may provide further support for courts to find a lack of standing in privacy and data breach cases lacking evidence of misuse of information and actual financial harm.
In 2008, Congress passed the FISA Amendments Act which, inter alia, contained a provision that expanded the U.S. Government’s ability to engage in surveillance targeting the electronic communications of non-U.S. persons located abroad. This provision, codified at 50 U.S.C. § 1881a, differs from the FISA surveillance provisions in place prior to the 2008 amendment in that it does not require the Government to demonstrate probable cause that the target of the surveillance is a foreign power (or the agent of a foreign power) or to specify the nature and location of each facility or place at which the surveillance will occur. However, surveillance conducted pursuant to § 1881a is subject to certain safeguards, such as judicial authorization (more specifically, the authorization of the Foreign Intelligence Surveillance Court (FISC) is generally required), congressional oversight, and a requirement that any such surveillance comply with the Fourth Amendment.
On the day the FISA Amendments Act was enacted, the respondents, a group of attorneys and human rights, labor, legal, and media organizations, filed suit seeking both a declaration that § 1881a is facially unconstitutional—in violation of both the First Amendment and Fourth Amendment—and a permanent injunction preventing the U.S. Government from conducting surveillance pursuant to § 1881a. The district court dismissed the suit for lack of Article III standing, but, on appeal, a panel of the U.S. Circuit Court for the Second Circuit reversed the lower court’s decision, ruling that the respondents did have standing. The Supreme Court accepted the case citing the “importance of the issue and the novel view of standing adopted by the Court of Appeals” (emphasis added).
To establish Article III standing, the aggrieved must demonstrate that it has suffered an injury in fact that is “particularized, and actual or imminent” and that is “fairly traceable to the challenged action.” In Clapper, the respondents set forth two alternate theories of standing. Underlying both theories was the respondents’ assertion that their work requires them to engage in sensitive telephone and e-mail communications with non-U.S. persons located in foreign countries, who they believe are likely targets of U.S. Government surveillance under § 1881a.
Under the first theory of standing, the respondents claimed they suffered an injury in fact based on the “objectively reasonable likelihood that their communications with their foreign contacts will be intercepted under § 1881a at some point in the future.” The Court rejected this claim, stating that the respondents’ theory of future harm is too speculative and does not satisfy the requirement that threatened injury be “certainly impending” to constitute injury in fact. Notably, the respondents—as U.S. persons—cannot be targets of surveillance under § 1881a, therefore their theory of harm rested on the assumption that their foreign contacts would be targeted and their own communications would be incidentally intercepted by the U.S. Government. Justice Alito, writing for the majority, stated that the respondents’ assumption is highly speculative. Justice Alito reasoned that in order for such a potential harm to be realized, the U.S. Government would need to decide to target the non-U.S. persons with whom the respondents communicate, the U.S. Government would need to use § 1881a to authorize such surveillance (as opposed to other available methods of surveillance), the FISC would need to authorize the surveillance, the U.S. Government would need to be successful in its surveillance efforts, and the U.S. Government would need to incidentally acquire the respondents’ own communications in its surveillance efforts. In short, the Court stated that this “highly attenuated chain of possibilities” does not amount to a threatened injury that is certainly impending.
Under the second theory of standing, the respondents argued that they suffered present injury because the risk posed by § 1881a surveillance caused them to take “costly and burdensome measures” to protect the confidentiality of their communications with their foreign contacts (e.g., the respondents claimed they must travel to have in-person conversations). The Court also rejected this argument, stating that “respondents cannot manufacture standing by choosing to make expenditures based on hypothetical future harm that is certainly not impending.” Thus, the Court held that the respondents' present injuries are not fairly traceable to § 1881a.
Finally, the Court rejected the respondents’ argument that they should have standing because otherwise the constitutionality of § 1881a could never be challenged. The Court stated that even if such a statement were true, the proposition that if a respondent does not have standing, then no one would have standing, is not a reason to find standing. Furthermore, the Court stated that its holding in the present case does not insulate § 1881a from judicial review. To support this point, the Court pointed to the FISC’s role in reviewing surveillance requests, an electronic communications service provider’s ability to challenge Government demands that it assist in carrying out surveillance activities under § 1881a, and the ability of affected persons to challenge the Government’s use of any information derived from such surveillance.
This case had been widely anticipated by the privacy community because of the potential impact on civil litigation following data breaches or alleged improper access to and use of private information. With the Supreme Court's ruling, as noted, plaintiffs' burden of proceeding in litigation where there is no demonstrable harm remains very high.
The French Data Protection Authority (CNIL) has announced its inspections program topics for 2016, with health data, flight passengers’ data, and data used for marketing and Internet...20 May 2016