Supreme Court challenges privacy litigants to demonstrate Article III standing

In Frank v Gaos, the United States Supreme Court wrestled with the continuing challenges of “standing” in internet privacy litigation.

The case stems from an appeal regarding the settlement of the plaintiff class’ claims against Google for violation of the Stored Communications Act (the “SCA”). The SCA provides a private right of action to a person “aggrieved by any violation” of its provisions. In this case, the plaintiff alleged that Google’s practice of transmitting users’ search terms in referrer headers violated the SCA’s prohibition against an electronic communication service provider divulging the contents of a communication while in electronic storage by that service.

In the settlement at issue, Google was required to provide some additional disclosure about referrer headers and to pay $8.5 million. However, none of the settlement payment would go to absent class members. Instead, other than funds used for administrative costs, incentive payments to the named plaintiffs, and a fee award to class counsel, the remainder would be paid to nonprofit organizations providing public awareness and education regarding internet privacy that provided no direct benefit to the plaintiff class. Unsurprisingly, objectors challenged the settlement.

Before evaluating the proprietary of the settlement, the Court stated that the plaintiffs’ standing under Article III had to be resolved. The Court observed that no lower court in Frank had considered whether any of the named plaintiffs had alleged SCA violations that were sufficiently “concrete and particularized to support standing.” In spite of Justice Thomas’ dissent, arguing that the plaintiff need only allege an invasion of a right conferred by the SCA, the Court remanded the case to the District Court to address the standing issue.

We have discussed Article III standing previously, after the 2nd Circuit heard arguments in Whalen v. Michael Stores, Inc. It is noteworthy that state courts have not necessarily aligned with the Federal courts’ position on standing. For example, we recently discussed the Illinois Supreme Court’s holding that a person “need not have sustained actual damage beyond violation of his or her rights under the [Illinois Biometric Information Privacy] Act in order to bring an action under it.”

We expect standing to be a central issue as the law evolves in litigation involving a private right of action under data security legislation.

Matt Hafter is a member of Thompson Coburn’s cybersecurity pract