Data breaches abound, but not every breach results in a cognizable claim. Which violations should constitute actionable injuries? What injury allegations satisfy standing requirements in federal courts? How should courts articulate sufficient cognizable injuries to warrant relief? Professor Ignacio Cofone, in a forthcoming article titled Privacy Standing, offers a framework for answering these questions and guiding courts to more consistent opinions for similarly situated victims.
Standing challenges confound courts resulting in inconsistent rulings. As Cofone notes, “No standing means unenforced rights.” Identifying privacy harms, however, is difficult. The primary obstacle lies in assessing privacy harms, for which Cofone proposes a conceptual solution. Cofone first notes the doctrinal woes of the courts. Courts tend to conflate the issue of privacy loss with Article III standing analysis. The Supreme Court, in Spokeo v. Robins, clarified that plaintiffs seeking relief for privacy injury must pose a cognizable real-world harm. The Court emphasized that the harm must be concrete, but did not further guide lower courts in rendering this assessment. Some circuits find standing doctrines satisfied based on a violation of a statutory privacy right, while other courts find standing not met unless plaintiff shows an additional kind. Examples of additional harm are financial harm or reputational harm. Cofone asserts that both approaches have flaws and should be replaced by a three-step framework that considers the fact-dependent nature of privacy injuries.
With useful illustrations from Urban Outfitters to real-world controversies like Grindr, Cofone guides readers through the proposed framework. First, a judge must identify the loss of privacy. Next, the judge should identify the privacy harm, and last, the judge should determine when the harm rises to an actionable privacy injury. Cofone suggests that the second step of whether a privacy loss constitutes a privacy harm is to examine any intrusion on normative values. For example, the jurist must ask whether the privacy loss violated normative privacy values such as the right to be let alone, autonomy, secrecy, control over personal information, protection of one’s dignity, and intimacy. For the final step, the judge must determine whether the privacy harm is actionable based on judicial precedent and the existence or nonexistence of statutes granting standing. Cofone asserts that the synthesis of both equates to applying a reasonable person standard.
The core problem, and Cofone’s solution, matter because of increased collection of personal information and data breaches. The increased risk and occurrence of privacy loss necessitate clearly defined standards by which parties may seek remedies for violations of common law and statutory privacy rights. Still courts must engage in proper line-drawing to determine which claims are actionable. Implementing Cofone’s solution will enable courts to hear and redress meritorious claims of privacy violations without opening the door to unfounded or incognizable claims.
Cofone’s framework is purposefully narrow to alleviate the concern that finding standing for every privacy injury case would open the floodgates to all kinds of privacy complaints. By judiciously excluding cases in which no privacy loss occurred, or the loss of privacy was not a privacy harm, or the harms are reasonable under the circumstances, courts will be free to recognize some injuries as constituting standing while avoiding the slippery slope of recognizing any privacy loss as an actionable claim. The shift to a nuanced conception of privacy loss and privacy injury—rather than a binary notion—is a central theme of Cofone’s project.
To conceptualize the harms inherent to mass data collection, aggregation, and potential data breaches, Cofone introduces the idea of a probabilistic privacy injury. To illustrate the point, the Article uses a graph to show two normal distribution curves: one relatively flat and wide representing an individual in low danger of suffering a privacy injury, another steep and narrow in grave danger of suffering a privacy injury. This illustration includes Bayesian statistical analysis, and Cofone helpfully explains the graph and its underlying bases.
Cofone likens privacy harms to environmental torts, which Cofone argues, suffer from similar problems of temporal and evidentiary separation of cause and effect. The comparison provides a lens through which Cofone advocates for establishing enhanced legal protections of statutory privacy rights. Cofone explores the common law recognition of probabilistic standing as a useful model. According to Cofone’s contention, recognizing probabilistic privacy injuries the same way the law recognizes diffuse environmental harms would overcome challenges that probabilistic privacy injuries are too general to meet standing doctrine’s particularized harm requirement.
This article demonstrates that privacy injuries should be independently assessed. Courts should not require an additional showing of another kind of harm (like financial or reputational harm) because doing so misses the point of privacy rights. The normative values of privacy, Cofone explains, are what Congress sought to protect when it created statutory rights of privacy. Citing Justice Thomas’s dissent in TransUnion v. Ramirez, Cofone argues that Courts should defer to Congress’s power to create and define rights.
With Privacy Standing, Cofone renders valuable contributions to collective legal knowledge. Namely, Cofone creates opportunity for scholarly and judicial advancement from the article’s conceptualization of privacy harm as a probabilistic injury, its three-step framework for identifying actionable privacy injuries, and its synthesis of the misguided rationale underlying the circuit split on standing doctrine pertaining to privacy injuries. Overall, Cofone’s work will inure to the benefit of federal court standing doctrines. It also will ensure that those with proven violations of privacy rights do not go without a remedy. With luck, Cofone’s work will foster further scholarship developing privacy law and refining judicial treatment of similar difficult-to-prove injuries.
