Locke Lord QuickStudy: 7th Circuit: Consumers are Not Injured by the Undisclosed Sale of Personally-Identifiable Information

On November 18, 2015, the U.S. Court of Appeals for the 7th Circuit held that consumers who authorized defendants to share their personally-identifiable information (PII) with third parties were not injured when defendants sold the PII for a profit, even though defendants never informed the consumers the information would be sold. Silha v. ACT, Inc., No. 15-1803, slip op. (7th Cir. Nov. 18, 2015). Given the lack of injury, the Court affirmed the dismissal of the consumers’ complaint for lack of standing. The decision shows a consumer must be able to articulate a plausible harm from an unknown use of their PII in order to sue. 

The Plaintiffs Knew Their PII Would be Shared with Third Parties
Plaintiffs were high-school students who registered to take two college-admission exams—the ACT and SAT—which defendants administered and for which the students paid defendants a fee. In the course of registration, the students provided PII to defendants, including their name, address, gender, race, email address, phone number, and intended college major. 

When they registered, the students agreed to participate in an information-exchange program under which defendants could share the students’ PII with third parties, including educational organizations, colleges, and universities. Participation in the information exchange was optional (the students had to affirmatively check “yes”), and did not affect the price of the exams.

Defendants Sold the PII Without Disclosing the Sale to Plaintiffs 
Defendants’ registration materials informed the students that defendants would “share” or “send” their PII to third parties. The students alleged that defendants actually sold or licensed the PII and thereby made a profit of at least 33 cents per student per buyer. The students claimed defendants deceived them into believing no profit would be made from their PII.

The students filed a class action against defendants under the Illinois Consumer Fraud and Deceptive Business Practices Act, seeking to represent a class of other students who provided PII to defendants. The students also asserted claims for breach of contract, unjust enrichment, and invasion of privacy.

The Court Finds Plaintiffs Were Not Injured, and Thus Lack Standing to Sue
The 7th Circuit affirmed the district court’s dismissal of the students’ complaint under Federal Rule of Civil Procedure 12(b)(1), finding the students could not establish they were injured by the sale of their PII, so they lacked Article III standing to sue. 

The Court began by noting that a plaintiff must always establish standing by showing they suffered an actual and concrete “injury in fact” that is fairly traceable to the defendant’s conduct. Silha, slip op. at 5. The defendants here brought a facial challenge to standing, meaning defendants argued that the students had not alleged facts showing that jurisdiction existed. Id. at 6. Because defendants were challenging the sufficiency of the students’ allegations, the Court used the Twombly/Iqbal plausibility standard to evaluate whether standing existed. Id. at 7–8 (“the Twombly/Iqbal facial plausibility requirement for pleading a claim is incorporated into the standard for pleading subject matter jurisdiction.”). Thus, the Court looked to see whether the well-pleaded factual allegations gave rise to a plausible conclusion that the students were injured.

Applying Twombly/Iqbal, the Court found no factual allegations supporting the conclusion the students had been injured by the sale of their PII. The Court stated that any such injury “cannot be based solely on a defendant’s gain; it must be based on a plaintiff’s loss.” Silha, slip op. at 9. Thus, the Court rejected the students’ argument that defendants’ profit supported standing. Id at 10 (“The fact that Defendants allegedly collected a fee from participating educational organizations and did not disclose this sale did not make Plaintiffs worse off.”). 

Even consumers whose PII is disclosed without authorization can face obstacles to demonstrating standing. See, e.g., Goodman v. HTC America, Inc., No. C11-1793MJP, 2012 WL 2412070, * 5 (W.D. Wash. June 26, 2012) (“misappropriation of personally identifiable information does not allege injury in fact, absent a separate statutory or constitutional right, because no plaintiff alleges that his data was compromised or that he actually suffered any harm.”). But even more so here, the students’ authorization sharply undermined their claim of standing even though the circumstances of that disclosure were different than the students expected. Because the students knew their PII would be shared with third parties, the Court found the students were in the exact same position as they would have been if defendants had not charged a fee for the information, i.e., their information had been shared with third parties. Silha, slip op. at 10 (“In both potential scenarios—one with a fee paid to Defendants and one without a fee paid to Defendants—Plaintiffs’ PII would have been conveyed to participating educational organizations in an identical manner ….”). 

The Court did note a possible injury the students could have alleged. The Court said the students may have shown standing by alleging that, had they known their PII would be sold, they could have negotiated for a share of the proceeds (33 cents/student). Silha, slip op. at 10–11. But the Court found no facts were alleged supporting that inference. Id. at 11 (“Plaintiffs provide no factual support for the necessary inferential steps for this argument, including their desire and ability to demand, negotiate, and receive a portion of the PII proceeds from Defendants.”). While this creates the possibility that a future plaintiff in similar circumstances could allege standing, the unique and individualized nature of the required allegations would make class certification of any such class very difficult.