Yottabytes: Storage and Disaster Recovery

Nov 12 2015   11:00AM GMT

Does Inaccurate Data Hurt You? Supreme Court Will Decide

Sharon Fisher Sharon Fisher Profile: Sharon Fisher

Tags:
privacy
Security

Companies that collect data – and organizations that like to help people concerned about the data the companies are collecting – are on opposing sides of a case that the Supreme Court is hearing.

Like the recent decision on whether you had to give up your phone password, this is one of those incredibly arcane legal things that has very little to do with the actual case, but could have major ramifications to the computer industry either way it’s decided.

The actual case revolves around the data aggregation site Spokeo. This site has been around for a while. It uses publically available data to collect information about a person, some of which it provides for free and some of which you pay for. Because of how it collects and aggregates the data, it can sometimes be laughably inaccurate.

“It listed me as married to someone ten years older than his actual age whom I divorced in 2002, that my house was worth $1 million (let me tell you, my *town* is hardly worth that much), that I played hockey and football, and that my 60+ year-old house was built in 2003,” I wrote in 2010 when this site first started making the rounds. It’s not much more accurate today; it lists my former husband as taking my name and has his age wrong, it lists an email address I never used and a phone number I haven’t used in two years, and has me living in two houses a thousand miles apart at the same time (one of them is off by almost twenty years).

That said, it still has a list of all the places I’ve lived since college with significant information about them, and enough contact information that if someone wanted to be a pest, they could do so, especially if they were willing to pay to get additional information about me. Could someone have gotten this information on their own? Sure, but it would have been harder and more time-consuming. (Interestingly, some of the briefs in this case encourage the Justices to look themselves up.)

Anyway, there’s this guy, Thomas Robins, who didn’t find the inaccuracies laughable. In fact, he said they had caused him harm. Did they say he was an embezzler or a child molester? No, they said he had a graduate degree and was married with children. He was concerned that this inaccurate information would make it harder for him to find a job, though he didn’t have any evidence that had happened or that anyone had even looked at his file in the first place. And so he was suing Spokeo, not because their collection of data was creepy and an invasion of his privacy, but because it was inaccurate. Now the case has made its way to the Supreme Court, which heard oral arguments on it this month.

And so that’s what the legal decision hinges on. It’s not about Spokeo’s collection of the data. It’s not about whether Robins was damaged by the inaccurate data. (Indeed, a number of the arguments on either side make it clear that they aren’t commenting on the merits of his case, which implies they think it’s a crock.)

Instead, it’s all about whether Robins has “standing” to file a case, because he can’t point to any specific damages that were done – simply the fact that he believes that Spokeo is violating the Fair Credit Reporting Act by having this inaccurate information about him in its database.

How many millions does he stand to get if he wins? None. At most, if the court decides he has standing, and if he wins, he gets $1,000. So why is he going to all this effort to file the case? And why are companies like Google, Facebook, eBay, and Yahoo! lining up to fight him on it? (To give some indication of the significance of this case, there’s 17 friend of the court briefs on it. That’s a lot.)

Because if it’s decided Robins has standing, even though he doesn’t have any specific damages he can prove, anybody can file a case any time they find a company making some sort of mistake or violating some aspect of a federal law, even if it didn’t hurt them – such as failing to follow the law by including an 800 number in its listing. “Plaintiffs can seek damages for unwanted phone calls or text messages, [Spokeo’s attorneys] noted, as well as improper disclosure of videos, mislabeled food, a failure to provide full notices involving loans or debts and retaining or disclosing personal information from credit cards and other electronic transactions,” writes David Savage in the Los Angeles Times.

Moreover, they can do it as a class action. Let’s say they discovered Facebook was making some sort of error in its data collection that applied to every member of Facebook. So that $1,000 per person suddenly becomes $1.23 trillion, plus the cost of fighting the case. And Facebook, Google and Yahoo have already all faced similar lawsuits over violations of different federal laws, writes Lawrence Hurley for Reuters.

“This closely-watched case has major potential implications for consumer-facing companies of all types, as it may result either in a ‘green light’ for no-damage class actions based on technical liability theories, or could result in a requirement that plaintiffs plead and prove some concrete harm, which would create a major new roadblock for consumer claims, particularly class actions,” summarizes the Consumer Financial Services Law Monitor. The case could also limit Congress’ ability to pass laws in the future to help protect people from inaccurate information.

Of course, who really stands to make money with this kind of case? The lawyers. Chances are you’ve gotten one of these class-action notifications before – pages and pages of tiny print telling you that if you jump through a whole lot of hoops, eventually you’ll get $5.34, while the legal firms that fought the case collect millions. People arguing against this case say that a finding in favor of Robins will result in many, many more class-action lawsuits.

On the other hand, it’s important to retain the right to have class-action lawsuits in the first place, because that’s how change gets made and wrongs get righted. And people arguing in favor of this case point out that there’s other times when people have been allowed to sue without having to prove specific damages in their case, such as housing discrimination cases. “If Spokeo wins the broad holding its lawyers at Mayer Brown are advocating, class actions under all sorts of consumer and civil rights statutes, including the Telephone Consumer Protection Act, the Wiretap Act, and the Americans with Disabilities Act, will be endangered,” writes Alison Frankel for Reuters. On the other hand, requiring plaintiffs to show that they’ve suffered “real-world harm” could make it harder to fight patent trolls, she adds.

So organizations such as the Center for Democracy and Technology and the Electronic Frontier Foundation are also stepping in, because they want to ensure that people have the right to protect themselves from inaccurate data collection. “A host of privacy laws, including the Stored Communications Act, the Video Privacy Protection Act, and the Cable Communications Policy Act, create a private right of action similar to FCRA, and could be limited by a broad ruling in this case,” writes G.S. Hans of the CDT. “As with FCRA, each of these laws remains vital to protecting individual privacy today, given how much data exists about us online and the potential for privacy violations involving that data.”

What might be the most Solomonic ruling, these organizations and analysts say, is for the Court to rule that Robins does or doesn’t have standing, but to limit it to this case in particular rather than establishing a broad legal precedent. “A broad ruling that an alleged statutory violation alone is insufficient injury in fact to establish Article III standing would impinge on congressional authority and invalidate private actions in a wide range of federal statutes,” the CDT and EFF write. “The question before the Court asks whether Congress can confer Article III standing by authorizing a private right of action based on a ‘bare violation’ of any federal statute. As framed, the question presented has implications far beyond Mr. Robins’ particular case and the FCRA itself. The Court’s ruling could affect the ability of individuals to file claims under private rights of action authorized by a vast number of other federal statutes, as well.”

The Court is expected to rule by June.

 Comment on this Post

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

Share this item with your network: