Facebook seeks standing ruling in data privacy dispute

Technology companies have long argued users cannot sue them for privacy violations when they are supposedly unharmed as a result of the misconduct.

Courts have interpreted the defense with varying results. Alphabet Inc.-owned Google got a San Jose federal judge to toss a case by advancing the same argument in 2013 as did Apple Inc. two years earlier.

Facebook has not been as successful in more recent cases concerning its practices of selling data to third parties and using facial recognition technology.

Now, the social media giant wants to finally settle the issue. Earlier this month, Facebook asked the judge overseeing the lawsuit about the Cambridge Analytica scandal to grant a rare appeal that may pause the case while higher courts weigh in.

"The question whether alleged data privacy violations give rise to [standing] is an evolving issue of increasing importance that already has drawn considerable attention from the nation's appellate courts, including the U.S. Supreme Court," longtime Facebook attorney and Gibson, Dunn & Crutcher LLP partner Orin Snyder wrote in the appeal. .

Hostile to Facebook's position that it cannot be sued for selling users' personal information, U.S. District Judge Vince Chhabria found the company "cannot be more wrong." He ruled in September that hundreds of thousands of users whose data was improperly sold to third parties have standing to sue.

Chhabria wrote, "Courts have often held that this particular type of intangible injury -- disclosure of sensitive private information, even without further consequence -- gives rise" to sue. In re: Facebook, Inc. Consumer Privacy User Profile Litigation, 18-MD02843 (N.D. Cal., filed June 6, 2018).

Facebook's claim that the judge's decision is in opposition to prior court precedent may get the case tossed entirely if higher courts agree.

Both sides cited rulings in favor of their positions, but Facebook's argument primarily relies on antiquated opinions courts have since moved on from, according to some legal experts.

Privacy attorney Anita Taff-Rice of iCommLaw said the cases Facebook references are primarily from the early 2010s, before it and other technology companies pivoted to being "data brokers."

"The standard for standing in privacy cases has evolved," she said.

Timothy Blood of Blood Hurst & O'Reardon LLP, representing users in the lawsuit, agreed, saying, "That's now the minority view."

"They're arguing against the trend," he said, adding courts, while not all the way there, are inching toward recognizing data as "personal property."

Still, both attorneys said the issue is unsettled and will eventually need to be decided by the U.S. Supreme Court. While the judge may have had stern words for Facebook's argument that it cannot be sued when there is no concrete injury, Chhabria still had to address existing precedent favoring the defense's position in his ruling.

In a 2012 lawsuit over Google's privacy policy integration, U.S. Magistrate Judge Paul Grewal in San Francisco found in favor of Google. He rejected the argument that the "loss of personal information, even in the absence of any cognizable economic harm, was sufficient to confer" standing, according to his order. In re: Google, Inc. Privacy Policy Litigation, 12-CV01382 (N.D. Cal., filed March 20, 2012).

"A plaintiff must allege how the defendant's use of the information deprived the plaintiff of the information's economic value," he wrote. "Put another way, a plaintiff must do more than point to the dollars in a defendant's pocket; he must sufficiently allege that in the process he lost dollars of his own."

Chhabria dismissed Grewal's opinion by explaining later cases "provide ample support for the conclusion that this type of privacy invasion alone creates standing" regardless of "whether or not he was right about precedent at the time."

Chhabria, who has never been reversed on appeal, said his reasoning is "equally true of earlier district court cases" on which Grewal relied. He was primarily referring to a 2011 case in which U.S. District Judge Lucy Koh dismissed a class action against Apple for allowing third parties to collect users' personal information. In re: iPhone Application Litigation, 11-MD02250 (N.D. Cal., filed Aug. 25, 2011).

If plaintiffs' attorneys had to address Grewal's finding later in the case, Taff-Rice said they could easily claim there's already a market for users to sell their personal information.

"I may be hard-pressed to find someone that would need my data," she said. "But there are certainly vendors that would trade data for goodies."

Grewal is now vice president and deputy general counsel for Facebook.

Facebook also argued a 2016 case concerning "people search engine" Spokeo Inc., which gives users in-depth reports on individuals, should compel Chhabria to grant an appeal. The case bounced around various courts before ending up at the U.S. Supreme Court, which ruled in favor of Spokeo by remanding the matter back to the 9th U.S. Circuit Court of Appeals because the panel did not properly examine whether the plaintiff suffered a "concrete injury."

In reaching its decision, the U.S. high court took no position about whether the 9th Circuit's ultimate conclusion that the plaintiff adequately alleged an injury was correct. Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).

The appellate court panel noted that determining whether "intangible injuries" give rise to standing to sue is a "somewhat murky area" when it reheard the case.

"In the wake of Spokeo, the question of whether the alleged sharing of private information gives rise to [standing] has been the subject of much debate in the appellate courts, including the U.S. Supreme Court and the 9th Circuit," Snyder wrote in Facebook's recent appeal.

Chhabria will have to balance resolving the case in a reasonable time frame with settling what may be an unsettled area of law that is potentially worth billions of dollars, according to Blood, who said determining damages "is a live issue that hasn't been litigated yet."

Facebook pointed to another Google lawsuit in which plaintiffs alleged the company improperly shared their private online search terms with third parties in favor of its argument that Chhabria would actually be saving time by granting the appeal. In that case, which lasted nine years, the United States took the position that it was unclear whether plaintiffs sufficiently alleged standing because they did not "identify any particular injury that resulted in Google's conduct," according to a friend-of-the-court brief.

"This court can avoid similar inefficiencies and delay by allowing Facebook to take up the standing question now," Snyder wrote. Frank v. Gaos, 2019 DJDAR 2243 (March 20, 2019).

Chhabria will consider whether to grant the appeal at a Nov. 4 hearing.