Last week, the Eighth Circuit became the first Circuit Court to address the reach of Spokeo v. Robbins in a privacy case, holding that a plaintiff’s allegation that a cable company’s retention of his personal information in violation of the Cable Communications Policy Act (CCPA) was, on its own, insufficient to establish Article III standing. Plaintiff’s allegation of a technical violation of the statute, without alleging how that violation injured him, failed to allege a concrete injury recognized by Congress or at common law.
The CCPA governs the collection, dissemination and destruction of the personal information of the customers of cable service subscribers. See 47 U.S.C. § 551. The CCPA provides that: “[a] cable operator shall destroy personally identifiable information if the information is no longer necessary for the purpose for which it was collected and there are no pending requests or orders for such information[.]” 47 U.S.C. § 551(e). It also provides a private right of action for parties “aggrieved by any act of a cable operator in violation of its provisions.” See id. at § 551(f)(1). Prevailing plaintiffs may recover statutory damages in the amount of $100 per day of violation or $1,000, whichever is greater, as well as punitive damages and attorneys’ fees.
Alex Braitberg was a subscriber of cable services from Charter Communications, Inc. (“Charter”) from July 2007 through June 2010. When he signed up for service, Charter required Braitberg to provide his personally identifiable information, including his address, telephone number, and social security number, to activate his service. In March 2013, Braitberg confirmed that Charter had retained all of the personally identifiable information that he had submitted in 2007 despite his not being a subscriber for almost three years.
Braitberg brought a class action lawsuit alleging that Charter had violated the CCPA by retaining the personally identifiable information of its customers after they had cancelled their subscriptions and after retention of that information was no longer necessary for Charter to provide services, collect payments, or satisfy any tax, accounting, or legal obligations. In bringing his complaint, Braitberg alleged that he and the other proposed class members had suffered two injuries. First, he alleged Charter’s retention of subscribers’ personal information directly invaded their federally protected privacy rights. Second, he alleged the class had not received the full value of the services that they had purchased from Charter. Specifically, Braitberg alleged that he had placed a monetary value on controlling and protecting his personal information and that when he subscribed for cable service, he paid for Charter to destroy their information when Charter no longer needed it. Under this theory, Charter’s failure to destroy his personal information as required by the CCPA and Charter’s privacy policy, therefore deprived him of the service for which he had paid.
The district court dismissed the complaint upon Charter’s motion challenging plaintiff’s Article III standing.
The Eighth Circuit affirmed the district court’s dismissal in in Braitberg v. Charter Communications, Inc., No. 14-1737 (8th Cir. Sept. 8, 2016), finding that Braitberg’s allegation of a technical violation of the CCPA without more failed to allege a concrete and particularized injury sufficient to confer standing. The court began its analysis by observing that the Supreme Court’s holding earlier this year in Spokeo v. Robbins, 136 S.Ct. 1540, 1549 (2016) that “Article III standing requires a concrete injury even in the context of a statutory violation” controlled and overruled prior Eighth Circuit precedent.
Turning to the factual allegations of the case before it, the Eighth Circuit found that Braitberg had fallen short of the Spokeo standard and failed to allege a concrete injury arising from Charter Communications’ alleged retention of his personal information. See Charter, No. 14-1737, at 8. Instead, Braitberg had only alleged “a bare procedural violation, divorced from any concrete harm.” See id. (quoting Spokeo at 136 S.Ct. at 1549). The Court noted that Braitberg had failed to allege that the personal information that Charter had retained allegedly in violation of the CCPA had been disclosed to or accessed by a third party or that Charter had even used the information itself during the disputed period. See id. Braitberg had not identified “a material risk of harm from the retention,” and that the “speculative or hypothetical risk” he identified was “insufficient.” See id. The court observed that while there was an established common law tradition recognizing injury based on the invasion of privacy rights, there was no such tradition for the retention of personal information that was lawfully obtained. See id. The Court similarly rejected Braitberg’s economic injury argument, holding that “[w]ithout a plausible allegation that Charter’s mere retention of the information caused any concrete and particularized harm to the value of that information, Braitberg has not adequately alleged that there was any effect on the value of the service that he purchased from Charter.” Id., at 9.
Although Charter represents only one Circuit Court’s application of Spokeo, it gives defendants in privacy lawsuits ammunition to challenge standing where the complaint is premised on a violation of a statutory right. Unless they can show that a statutory violation concerns a right that has been traditionally recognized at common law or can demonstrate that Congress has explicated the harm caused to individuals from violation of the right, plaintiffs in the Eight Circuit will find Charter to be a roadblock at the pleading stage.