Consumer Privacy

Article III Standing

Background

By artificially tightening Article III standing requirements and refusing to exercise jurisdiction over a growing number of cases, federal courts have made it increasingly difficult for individuals to vindicate their privacy rights.

Documents

Article III of the U.S. Constitution provides that federal courts have jurisdiction over “Cases” and “Controversies” arising under federal law. In construing these terms, the U.S. Supreme Court has held that a plaintiff must establish “standing” to bring a lawsuit in federal court—that is, the suit must be based on an actual or imminent alleged injury that is concrete and particularized. Traditionally, cases brought by plaintiffs to vindicate their private rights would necessarily meet this standard: Congress has the power to enact laws that create new legal rights and that allow individuals to sue when those rights are violated by another private party. But two recent decisions by the Supreme Court—Spokeo, Inc. v. Robins (2016) and TransUnion LLC v. Ramirez (2021)—have cast significant doubt on Congress’s power to create rights that are actionable in federal court. Breaking from decades of Article III standing precedent, the Court announced a new rule: proof of “concrete harm,” not merely legal injury, is a universal requirement of Article III standing. As a result, federal courts are increasingly second-guessing the judgment of Congress and dismissing lawsuits—in particular, privacy lawsuits—even when defendant companies have unambiguously violated the law.

The Evolution of Article III Standing

Federal courts are courts of limited jurisdiction, meaning that they may only consider a case if the subject matter and parties meet certain requirements. One of the requirements that courts have read into Article III, the portion of the U.S. Constitution establishing the judicial branch, is that a plaintiff must have “standing” to bring a case in federal court. Article III standing doctrine traces back to a pair of Supreme Court cases in the 1920s—Fairchild v. Hughes (1920) and Massachusetts v. Mellon (1921)—which together established that plaintiffs cannot sue the government in federal court if they fail to allege that they were specifically injured by (or face imminent injury from) unlawful government conduct. This rule, as the Court explained in Fairchild, was necessary to preserve the separation of powers between the judiciary and the political branches of government:

We have no power per se to review and annul acts of Congress on the ground that they are unconstitutional. That question may be considered only when the justification for some direct injury suffered or threatened, presenting a justiciable issue, is made to rest upon such an act. Then the power exercised is that of ascertaining and declaring the law applicable to the controversy.

Article III standing doctrine gradually evolved over a series of Supreme Court cases in the 1970s and 1980s. By the time the Court decided Valley Forge Christian College v. Americans United for Separation of Church and State (1982), the principal elements standing doctrine were in place:

[A]t an irreducible minimum, Art. III requires the party who invokes the court’s authority to “show that he personally has suffered some actual or threatened injury as a result of the putatively illegal conduct of the defendant,” and that the injury “fairly can be traced to the challenged action” and “is likely to be redressed by a favorable decision,” In this manner does Art. III limit the federal judicial power “to those disputes which confine federal courts to a role consistent with a system of separated powers and which are traditionally thought to be capable of resolution through the judicial process.”  

In 1992, the Court crystallized the Article III standing test into its modern formulation, imposing significant new requirements for what constitutes a judicially cognizable “injury in fact.” As the Court wrote in Lujan v. Defenders of Wildlife:

First, the plaintiff must have suffered an “injury in fact”—an invasion of a legally protected interest which is (a) concrete and particularized and (b) “actual or imminent, not ‘conjectural’ or ‘hypothetical[.]’” Second, there must be a causal connection between the injury and the conduct complained of—the injury has to be “fairly … trace[able] to the challenged action of the defendant, and not … th[e] result [of] the independent action of some third party not before the court. Third, it must be “likely,” as opposed to merely “speculative,” that the injury will be “redressed by a favorable decision.”

Even as the Supreme Court began to raise the bar for Article III standing, the Court continued to emphasize that standing doctrine was animated by separation of powers concerns—in particular, avoiding judicial encroachment on the role of the executive by ruling on matters in which a plaintiff has no direct stake. “To permit Congress to convert the undifferentiated public interest in executive officers’ compliance with the law into an ‘individual right.’ vindicable in the courts is to permit Congress to transfer from the President to the courts the Chief Executive’s most important constitutional duty, to “take Care that the Laws be faithfully executed,’” the Court explained in Lujan.

A Radical Shift in Standing Doctrine

Beginning in 2016, the Supreme Court introduced dramatic changes to Article III standing doctrine, threatening the ability of individuals to enforce privacy rights even in suits between non-government litigants. In Spokeo, Inc. v. Robins (2016), the Supreme Court considered a claim under the Fair Credit Reporting Act’s accuracy requirement. The Court held that while Congress has the power to pass laws that create new legal rights, plaintiffs cannot always establish standing based on a violation of those rights (a “legal injury”). The Court concluded that certain “bare procedural violations” are not sufficiently “concrete” to satisfy the case and controversy requirement of Article III. The Court explained that lower courts must decide whether a plaintiff’s alleged injury is sufficiently “concrete” to establish standing and advised courts to look to traditional harms historically recognized by courts. Even though exercising jurisdiction in cases like Spokeo carries no risk of encroaching on the power of the executive branch—the core concern that gave rise to Article III standing doctrine in the first place—the Supreme Court concluded that federal courts were powerless to adjudicate certain types of private-party suits authorized by Congress. 

In 2021, the Court went a step further. In TransUnion LLC v. Ramirez, the Court ruled 5-4 that proof of “concrete harm”—not merely legal injury—is an irreducible requirement of Article III standing. The jury in the case had found that TransUnion willfully violated the Fair Credit Reporting Act when it falsely flagged the credit reports of thousands of individuals for being “Specially Designated Nationals” on the Office of Foreign Asset Controls list, which includes alleged terrorists, drug traffickers, and other sanctioned individuals. The Supreme Court held that individuals who could prove that these false credit reports had been disclosed to third parties had standing to sue, but individuals who could not provide evidence of disclosure did not meet the burden under Article III. According to the Court:

For standing purposes, therefore, an important difference exists between (i) a plaintiff ’s statutory cause of action to sue a defendant over the defendant’s violation of federal law, and (ii) a plaintiff ’s suffering concrete harm because of the defendant’s violation of federal law. Congress may enact legal prohibitions and obligations. And Congress may create causes of action for plaintiffs to sue defendants who violate those legal prohibitions or obligations. But under Article III, an injury in law is not an injury in fact. Only those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court.

As EPIC wrote after the Court’s decision, TransUnion has major implications for individuals seeking redress in federal court for privacy violations that do not involve the improper disclosure of personal information. EPIC filed an amicus brief in TransUnion urging the Court to hold that people can sue when their privacy rights are violated, regardless of whether they allege that the violation led to other harms. Justice Thomas, joined by three other members of the Court, agreed and would have ruled that standing exists in any case brought by an individual to vindicate a violation of their private rights.

EPIC’s Work on Article III Standing

EPIC is the leading organization in the country advocating for the standing of individuals to sue for invasions of their privacy rights. Since 2012, EPIC has filed numerous amicus briefs in the Supreme Court and U.S. Courts of Appeals arguing against artificially restrictive interpretations of Article III that deny members of the public access to federal courts and intrude on the power of Congress and state legislatures to establish vindicable privacy rights. These cases include TransUnion LLC v. Ramirez(2021), Patel v. Facebook (2019), Eichenberger v. ESPN (2017), Attias v. Carefirst (2017), Gubala v. Time Warner Cable (2017), Cahen v. Toyota Motor Corp. (2017), In re SuperValu Customer Data Security Breach Litigation (2017), Storm v. Paytime, Inc. (filed 2016), Spokeo, Inc. v. Robins (2016), Clapper v. Amnesty Int’l (2013), First American v. Edwards (2012). In 2013, EPIC’s Alan Butler published an articlein the New England Law Review concerning the implications of the Supreme Court’s Article III standing analysis in Clapper v. Amnesty International.

Recent Documents on Article III Standing

  • Amicus Briefs

    TransUnion LLC v. Ramirez

    US Supreme Court

    Whether plaintiffs in FCRA and other privacy suits can establish standing based on a violation of their statutory rights.

  • Amicus Briefs

    Patel v. Facebook

    US Court of Appeals for the Ninth Circuit

    Whether collection of an individual's biometric data in violation of the Illinois Biometric Information Privacy Act is sufficient to establish Article III standing

  • Amicus Briefs

    Eichenberger v. ESPN

    US Court of Appeals for the Ninth Circuit

    Whether ESPN's tracking of video viewing habits of streaming users violates the Video Privacy Protection Act and whether consumers whose VPPA rights have been violated can establish Article III standing to sue in federal court

  • Amicus Briefs

    Gubala v. Time Warner Cable

    US Court of Appeals for the Seventh Circuit

    Whether consumers can sue for violations of the Cable Communications Policy Act

  • Amicus Briefs

    Cahen v. Toyota Motor Corporation

    US Court of Appeals for the Ninth Circuit

    Whether drivers can sue for privacy and security vulnerabilities in connected cars

  • Amicus Briefs

    In re SuperValu Customer Data Security Breach Litigation

    US Court of Appeals for the Eighth Circuit

    Concerning Whether Victims of Data Breaches Must Suffer Certainly Impending or Actual Concrete Harms (i.e., Damages) In Order to Sue

  • Amicus Briefs

    Storm v. Paytime, Inc.

    US Court of Appeals for the Third Circuit

    Concerning Whether Victims of Data Breaches Must Suffer Identity Theft or Financial Fraud In Order to Sue

  • Amicus Briefs

    Spokeo, Inc. v. Robins

    US Supreme Court

    Whether courts have jurisdiction to review cases brought by individuals based on violations of their federal privacy rights

  • Amicus Briefs

    First American Financial Corp. v. Edwards

    US Supreme Court

    Concerning Standing and Liquidated Damages for Federal Statutory Rights

Support Our Work

EPIC's work is funded by the support of individuals like you, who help us to continue to protect privacy, open government, and democratic values in the information age.

Donate