Article III Standing
Background
By artificially tightening Article III standing requirements and refusing to exercise jurisdiction over a growing number of cases, federal courts have made it increasingly difficult for individuals to vindicate their privacy rights.
Documents
Article III of the U.S. Constitution provides that federal courts have jurisdiction over “Cases” and “Controversies” arising under federal law. In construing these terms, the U.S. Supreme Court has held that a plaintiff must establish “standing” to bring a lawsuit in federal court—that is, the suit must be based on an actual or imminent alleged injury that is concrete and particularized.
Traditionally, cases brought by plaintiffs to vindicate their statutory private rights have almost always met this standard: Congress has the power to enact laws that create new legal rights and empower individuals to sue when those rights are violated by another party. But two recent decisions by the Supreme Court—Spokeo, Inc. v. Robins (2016) and TransUnion LLC v. Ramirez (2021)—have cast significant doubt on Congress’s power to create rights that are actionable in federal court. Breaking from decades of Article III standing precedent, the Court has announced a new rule: proof of concrete harm, not just legal injury, is a universal requirement of Article III standing—though what exactly constitutes a “concrete harm” is still disputed.
As a result, federal courts are increasingly second-guessing the judgment of Congress by dismissing privacy lawsuits and other civil cases even when companies have unambiguously violated the law.
The Evolution of Article III Standing
Federal courts are courts of limited jurisdiction, meaning that they may only consider a case if the subject matter and parties meet certain requirements. One of the requirements that courts have read into Article III, the portion of the U.S. Constitution establishing the judicial branch, is that a plaintiff must have “standing” to bring a case in federal court. Article III standing doctrine traces back to a pair of Supreme Court cases in the 1920s—Fairchild v. Hughes (1920) and Massachusetts v. Mellon (1921)—which together established that plaintiffs cannot sue the government in federal court if they fail to allege that they were specifically injured by (or face imminent injury from) unlawful government conduct. This rule, as the Court explained in Fairchild, was necessary to preserve the separation of powers between the judiciary and the political branches of government:
Article III standing doctrine gradually evolved over a series of Supreme Court cases in the 1970s and 1980s. By the time the Court decided Valley Forge Christian College v. Americans United for Separation of Church and State (1982), the principal elements standing doctrine were in place:
In 1992, the Court crystallized the Article III standing test into its modern formulation, imposing significant new requirements for what constitutes a judicially cognizable “injury in fact.” As the Court wrote in Lujan v. Defenders of Wildlife:
Even as the Supreme Court began to raise the bar for Article III standing, the Court continued to emphasize that standing doctrine was animated by separation of powers concerns—in particular, avoiding judicial encroachment on the role of the executive by ruling on matters in which a plaintiff has no direct stake. “To permit Congress to convert the undifferentiated public interest in executive officers’ compliance with the law into an ‘individual right.’ vindicable in the courts is to permit Congress to transfer from the President to the courts the Chief Executive’s most important constitutional duty, to ‘take Care that the Laws be faithfully executed,’” the Court explained in Lujan.
A Radical Shift in Standing Doctrine
Beginning in 2016, the Supreme Court introduced dramatic changes to Article III standing doctrine, threatening the ability of individuals to enforce privacy rights even in suits between non-government litigants. In Spokeo, Inc. v. Robins (2016), the Supreme Court considered a claim under the Fair Credit Reporting Act’s accuracy requirement. The Court held that while Congress has the power to pass laws that create new legal rights, plaintiffs cannot always establish standing based on a violation of those rights (a “legal injury”). The Court concluded that certain “bare procedural violations” are not sufficiently “concrete” to satisfy the case and controversy requirement of Article III. The Court explained that lower courts must decide whether a plaintiff’s alleged injury is sufficiently “concrete” to establish standing and advised courts to look to traditional harms historically recognized by courts. Even though exercising jurisdiction in cases like Spokeo carries no risk of encroaching on the power of the executive branch—the core concern that gave rise to Article III standing doctrine in the first place—the Supreme Court concluded that federal courts were powerless to adjudicate certain types of private-party suits authorized by Congress.
In 2021, the Court went a step further. In TransUnion LLC v. Ramirez, the Court ruled 5-4 that proof of “concrete harm”—not merely legal injury—is an irreducible requirement of Article III standing. The jury in the case had found that TransUnion willfully violated the Fair Credit Reporting Act when it falsely flagged the credit reports of thousands of individuals for being “Specially Designated Nationals” on the Office of Foreign Asset Controls list, which includes alleged terrorists, drug traffickers, and other sanctioned individuals. The Supreme Court held that individuals who could prove that these false credit reports had been disclosed to third parties had standing to sue, but individuals who could not provide evidence of disclosure did not meet the burden under Article III. According to the Court:
As EPIC wrote after the Court’s decision, TransUnion has major implications for individuals seeking redress in federal court for privacy violations that do not involve the improper disclosure of personal information. EPIC filed an amicus brief in TransUnion urging the Court to hold that people can sue when their privacy rights are violated, regardless of whether they allege that the violation led to other harms. Justice Thomas, joined by three other members of the Court, agreed and would have ruled that standing exists in any case brought by an individual to vindicate a violation of their private rights.
EPIC’s Work on Article III Standing
EPIC is the leading organization in the country advocating for the standing of individuals to sue for invasions of their privacy rights. Since 2012, EPIC has filed numerous amicus briefs in the Supreme Court and U.S. Courts of Appeals arguing against artificially restrictive interpretations of Article III that deny members of the public access to federal courts and intrude on the power of Congress and state legislatures to establish vindicable privacy rights. These cases include TransUnion LLC v. Ramirez (2021), Patel v. Facebook (2019), Eichenberger v. ESPN (2017), Attias v. Carefirst (2017), Gubala v. Time Warner Cable (2017), Cahen v. Toyota Motor Corp. (2017), In re SuperValu Customer Data Security Breach Litigation (2017), Storm v. Paytime, Inc. (filed 2016), Spokeo, Inc. v. Robins (2016), Clapper v. Amnesty Int’l (2013), First American v. Edwards (2012). In 2013, EPIC’s Alan Butler published an article in the New England Law Review concerning the implications of the Supreme Court’s Article III standing analysis in Clapper v. Amnesty International.
Recent Documents on Article III Standing
-
Amicus Briefs
Limon v. Circle K Stores Inc.
California Supreme Court
Whether state courts should use the more restrictive federal court standing analysis when deciding whether plaintiffs have standing to sue.
-
Amicus Briefs
Peter Maldini v. Marriott International, Inc.
US Court of Appeals for the Fourth Circuit
-
Amicus Briefs
TransUnion LLC v. Ramirez
US Supreme Court
Whether plaintiffs in FCRA and other privacy suits can establish standing based on a violation of their statutory rights.
-
Amicus Briefs
Patel v. Facebook
US Court of Appeals for the Ninth Circuit
Whether collection of an individual's biometric data in violation of the Illinois Biometric Information Privacy Act is sufficient to establish Article III standing
-
Amicus Briefs
Eichenberger v. ESPN
US Court of Appeals for the Ninth Circuit
Whether ESPN's tracking of video viewing habits of streaming users violates the Video Privacy Protection Act and whether consumers whose VPPA rights have been violated can establish Article III standing to sue in federal court
-
Amicus Briefs
Attias v. CareFirst, Inc
US Court of Appeals for the DC Circuit
Whether victims of a data breach have adequately alleged damages
-
Amicus Briefs
Gubala v. Time Warner Cable
US Court of Appeals for the Seventh Circuit
Whether consumers can sue for violations of the Cable Communications Policy Act
Top Updates
Resources
-
Standing Requirement: Overview
Legal Information Institute | 2021
-
Privacy Harms
Danielle Keats Citron & Daniel J. Solove | 2021
-
Standing and Privacy Harms: A Critique of TransUnion v. Ramirez
Danielle Keats Citron & Daniel J. Solove | 2021
-
Standing Up to Clapper: How to Increase Transparency and Oversight of FISA Surveillance
Alan Butler | 2013
-
Standing, Injury in Fact, and Private Rights
F. Andrew Hessick | 2008
Support Our Work
EPIC's work is funded by the support of individuals like you, who help us to continue to protect privacy, open government, and democratic values in the information age.
Donate