BOSTON (Legal Newsline) — Months after a U.S. Supreme Court ruling said those who bring lawsuits must show a "concrete and particularized" harm, the plaintiffs attorneys involved have defeated a defense attempting to use that ruling in another case.
A judge ruled this month that providing personally identifiable information to a third party obtained from app users' viewing data can cause the users harm.
According to court documents, Alexander Yershov used the USA Today mobile app to watch video content. Each time Yershov watched a video, Gannett Co. — the USA Today parent company — sent the title of the video, the device’s GPS coordinates and a unique ID associated with the device to Adobe Systems Inc., a data analytics and online marketing company.
Yershov sued Gannett, accusing the media giant of violating the Video Privacy Protection Act (VPPA) when it transmitted his phone’s GPS coordinates along with video identification information to a third party.
The two sides argued over a recent U.S. Supreme Court decision regarding harm. In Spokeo v. Robins, the court ruled that "to establish injury in fact, a plaintiff must show that he or she suffered 'an invasion of a legally protected interest' that is 'concrete and particularized' and 'actual or imminent, not conjectural or hypothetical.'"
The plaintiff’s attorneys knew Spokeo would be referenced in the case, said one of them, Aaron Lawson of Edelson in Chicago. The same firm also represented Thomas Robins in Spokeo v. Robins.
“In its initial motion to dismiss, Gannett argued that we lacked standing to sue," Lawson told Legal Newsline.
"The issue didn't come up on appeal, though our opening brief includes a footnote discussing the issue. And Gannett announced that it would be raising Spokeo specifically in the first status conference following remand. More generally, because Spokeo implicates a threshold issue, it has a role to play in every case.”
In court, Gannett argued that the Spokeo decision indicates Yershov has to do more than show the company violated the statute. But Yershov countered that the Supreme Court’s decision showed that statutory violations could lead to cognizable injuries, even if there isn’t additional harm.
U.S. District Judge F. Dennis Saylor IV, of the District of Massachusetts, agreed with Yershov, saying the law states that someone whose personally identifiable information is disclosed has a right to relief.
“We think Judge Saylor got things exactly right when he recognized that the VPPA guards against a concrete, intangible harm: the invasion of Mr. Yershov's legally protected interest in the privacy of his video-viewing history,” Lawson said.
Even before Spokeo, courts had started to recognize that people whose private information was compromised in a data breach had the grounds to sue.
“We think courts are beginning to recognize that privacy interests are important enough to be cognizable in federal court,” Lawson said.
“After Spokeo, a number of courts have recognized that invasions of privacy constitute concrete harm. That's the position we've always taken, and it’s encouraging to see courts agree with us.”
Yershov already took his case to the U.S. Court of Appeals for the First Circuit over whether he counts as a “consumer” under the VPPA, even though he wasn’t a renter, subscriber or purchaser of the provider’s goods or services. The court decided the point in his favor and sent it back to the lower court.