Not long ago, Internet data broker Spokeo was fined $800,000 by the Federal Trade Commission for allegedly published fake reviews online to hawk its service, advertised as “not your grandma’s phone book.” It also advertised to corporations that its reports were a way to “explore beyond the resume.” That was a pretty straightforward violation of federal law, the FTC said. Reports used for employment decisions are credit reports that fall under the Fair Credit Reporting Act, which requires a whole host of things Spokeo didn’t do, such as offering consumers a reasonable way to fix mistakes. Spokeo changed its business practices, but obviously still embraces its status as a spooky company.
So it would seem odd that a company like Spokeo is today holding the flag for some of the biggest digital firms in the world. But here we are. The U.S. Supreme Court is hearing arguments Monday about whether or not to allow a lawsuit by a consumer who says Spokeo published inaccurate information about him. Yahoo, eBay, Facebook, and Google have all filed amicus briefs arguing on Spokeo’s behalf. So have Trans Union and Experian.
As always, this dirty details of this case hinge on finer points of law, not the top-line issues we’d all like to see the Supreme Court rule on. This isn’t about privacy vs. large corporations. Or about fairness in credit reports. Or whether a company can get away with telling mistruths about you. Or even about the future of advertising.
Legally, the cases hinges on laws that offer what’s called a private right of action. To take the conversation away from the Spokeo case for a moment: The Telephone Consumer Protection Act created the ever-popular Do Not Call list. If a company violates the Do Not Call list, you have two main forms of redress. You can complain to a federal regulator. And you can sue the company, privately, and get up to $500 for each violation. Which part of the TCPA do telemarketers fear most, do you think: the complaints, or the $500-per-call lawsuits?
Right. So, private rights of action play an important part in any consumer law. The Fair Debt Collection Practices Act creates a similar right for consumers who are unfairly harassed by debt collectors.
Now, back to Spokeo. The plaintiff in the case is appealing to the private right of action provision in the Fair Credit Reporting Act. He says Spokeo was acting as a credit reporting agency and published inaccurate information about him. Spokeo and its supporters counter that the consumer in question suffered no actual harm as the result of the mistakes, therefore he is not entitled to any relief. Fundamentally, lawsuits are designed to make a victim whole after a harm. No harm, no foul, no lawsuit.
The forces of data collection have all aligned on Spokeo’s side, and for obvious reasons. They want to be able to collect, process and share data about you without fear of a lawsuit. In fact, they want to be able to spread mistruths about you without fear of a lawsuit. Of course they do. Taking the time to make sure their information is actually accurate would be really expensive. So in addition to trotting out amicus briefs, there’s also plenty of opinion pieces circulating with talk about stifling innovation and making class action lawyers rich, like this one posted in the Christian Science Monitor.
“If the Supreme Court upholds the Spokeo decision, it would cement plaintiffs’ ability to magically transform innocuous conduct into a lucrative class action,” wrote James Cooper of George Mason University, which harbors industry talking-points generator think-tank, the Mercatus Center. “In recent years, enterprising plaintiffs’ attorneys have made a cottage industry of recasting the data flows that are the lifeblood of the modern information economy as violations of Cold War-era statutory schemes, such as the Video Privacy Protection Act (VPPA) or the Electronic Communications Privacy Act (ECPA)….These suits could serve a purpose if they were addressing privacy concerns that were otherwise being ignored, but that just isn’t the case. There’s simply nothing to suggest that the millions of consumers who engage in the digital economy on a daily basis are silently suffering.”
I must confess, the plaintiff in Spokeo has a hard time proving actual harm. He says the incorrect data might have cost him job prospects. A lower court found that harm too speculative, so he had no “standing” to sue. An appeals court reversed, saying that the FCRA provided such standing. The harm was breaking the law which set out the penalty.
When Congress passed laws like the TCPA or the FCRA, it clearly intended for consumers to have this extra arrow in their quiver when fighting against misbehaving corporations. Spokeo and others argue that enforcement should be left to agencies like the Federal Trade Commission. We all know better than that. Do you think a federal agency will act on your behalf if a company spreads a mistruth about you, or would you rather be able to do something yourself?
This question matters, because one of the big issues of the 21st Century will be the central question of this case: What’s the harm? I wrote about this topic for a recent issue of Super Lawyers. (If an algorithm sees you naked, should you care?)
What’s the harm if a company collects your data and loses it? What’s the harm if they describe you as an “urban scrambler” when you really live in the suburbs? What’s the harm if you end up in a “diabetes focused” data bucket when you are completely healthy? I don’t know. We might not find out for years, or even decades. Alessandro Acquisti at Carnegie Mellon often talks about the privacy “blank check” problem. When you give your data to someone, you give them a blank check. You never know what might come of the transaction. Maybe nothing. Maybe some annoying marketing. Maybe your health insurance rates will go up in a few years. No one knows.
By the time we wait for actual harm, it will be too late.
I don’t disagree that suing under the Fair Credit Reporting Act can feel a bit outdated. After all, its unclear which data brokers are credit reporting agencies subject to private rights of action, and which aren’t. (By the way, Spokeo says it’s not a credit reporting agency, and shouldn’t be subject to the FCRA private right of action anyway, but that’s a separate legal issue to be settled on another day if Spokeo loses this round.) America needs an updated, comprehensive privacy laws that clears up a lot of these things.
But Heaven help us if a consumer’s private right of action is killed off by the Supreme Court in order to defend a company like Spokeo and its “right” to trade in inaccurate information. The Supreme Court, if it buys what industry groups are selling, could kill off private rights of action across the board.
“Speaking hypothetically, a broad ruling in favor of Spokeo wouldn’t entirely end the private right of action but it would come pretty close,” said consumer law expert Joel Winston. “It would be a huge blow because it would require a plaintiff to go beyond mere ‘statutory violations’ and show ‘injury in fact.’ Thus, it would be close to impossible to bring a TCPA case in all but the most egregious situations.”
Telemarketers would dearly love that. So would data brokers. But I promise, you would not.
You can read a lot more about the case on ScotusBlog.com
1 Trackback / Pingback