No Harm, No Foul: Undisclosed Sale of Personally Identifying Information Does Not Give Rise to Standing to Sue

At a time when cybersecurity issues, privacy issues, and the protection of confidential personally identifying information (“PII”) from unauthorized use or identity theft are at the forefront of the minds of businesses and individuals alike, the Seventh Circuit Court of Appeals recently issued an opinion that restricts a consumer’s ability to bring a lawsuit concerning the undisclosed sale of PII for profit.  While the facts of the case are unique, the Seventh Circuit has now held that consumers — including class action representatives — lack standing to file a lawsuit in federal court with respect to allegations concerning the purported deceptive sale of PII in the absence of cognizable harm arising from the disclosure of PII.

In Silha v. ACT, Inc. and the College Board, the representative plaintiffs filed a class action complaint in the Northern District of Illinois against ACT, Inc. (“ACT”) and The College Board (“TCB”), the national testing agencies that administer the American College Test and the Scholastic Aptitude Test to millions of students each year.[1]  As part of the examination process, and in order to facilitate the exchange of information between students and educational organizations, some students, including the purported class representatives, authorized the defendants to share their PII with educational institutions, including colleges and universities, scholarship organizations, and government agencies, as part of an information exchange program.[2]  In order to take part in this optional exchange program, which does not cost the participants any additional money beyond the cost of the exam, students had to consent to and affirmatively authorize those entities to share their PII with participating educational organizations.[3] 

In their complaint, plaintiffs alleged that defendants sold or licensed their PII for a profit of at least $.33 per student each time the PII was sold or licensed.[4]  Plaintiffs contended that defendants failed to disclose that the students’ PII, including names, addresses, dates of birth, phone numbers, and other personal identifiers, would be sold to educational organizations for profit.[5]  Consequently, plaintiffs claimed that defendants engaged in deceptive trade practices by concealing the sale or licensing of their PII as part of the information exchange program and invaded their privacy.[6]  Defendants moved to dismiss for lack of standing and failure to state a claim.[7]  Following the dismissal of the action by the Northern District of Illinois for lack of standing, plaintiffs appealed to the Seventh Circuit.[8]

In an opinion issued on November 18, 2015, the Seventh Circuit affirmed the district court’s dismissal of the complaint, finding that plaintiffs’ well-pleaded factual allegations did not support a finding that plaintiffs were harmed such that plaintiffs had standing to sue under Article III.[9]  To establish Article III standing, a plaintiff is required to demonstrate an injury-in-fact, that is fairly traceable to alleged actions of the defendant, for which the Court can offer redress.[10]  As part of the analysis, the Seventh Circuit affirmatively adopted the Twombly-Iqbal “plausibility” pleading requirement for evaluating motions to dismiss for lack of standing brought pursuant to Rule 12(b)(1) of the Federal Rules of Civil Procedure.[11]  The Seventh Circuit held that “a plaintiff’s claim of injury in fact cannot be based solely on a defendant’s gain [and] it must be based on a plaintiff’s loss.”[12]  Critically, the Seventh Circuit stated that plaintiffs had consented to and affirmatively authorized defendants to share their PII with third parties.[13]  The Court noted that plaintiffs were not made worse off by defendants’ alleged collection of a fee from the participating educational organizations or their failure to disclose the sale, and contrary to their allegations, the Court noted that plaintiffs benefitted from their participation in the information exchange program because it facilitated their receipt of information about colleges, universities, scholarships, and other educational opportunities.[14]  Further, plaintiffs failed to allege they suffered a loss of anything of value as a result of the purported deceptive conduct, and the Court rejected the notion that plaintiffs’ PII was somehow diminished by the sale to the educational organizations.[15] 

The Silha decision reflects the Seventh Circuit’s unwillingness to allow plaintiffs to plead speculative injury arising out of the alleged improper use or disclosure of PII.  At least in the Seventh Circuit, when dealing with sensitive issues like the improper disclosure or sale of PII of consumers, even when the consumers may be minors as was the case in Silha, a person who claims injury based solely on a gain to a defendant without alleging a plausible personal loss may fail to satisfy the standing requirements necessary to pursue the claims in federal court. Therefore, where courts follow the reasoning in Silha, consumers will need to articulate a plausible theory of harm from an unknown use of their PII to state a plausible claim for relief when bringing a class action (or individual) complaint seeking relief sounding in deceptive trade practices, identity theft, or invasion of privacy. 

Notes:
[1] Silha v. ACT, Inc. and the College Board, No. 15-1083, 2015 WL 7281602, at *1 (7th Cir. Nov. 18, 2015).