Doe v. Quest: The Standing Defense to Federal Privacy Actions
This recent decision out of the Southern District of New York demonstrates a powerful tool for privacy-action defendants in federal court: the motion to dismiss for lack of standing under Fed. R. Civ. P. Rule 12(b)(1). Doe v. Quest Diagnostics, Inc., No. 15 CV 8992-LGS (S.D.N.Y. March 23, 2017).
Plaintiff Doe, a medical patient, sued her provider for faxing records containing personal information to the wrong fax number. She also sued Quest, the lab for which the fax was intended, alleging that Quest ought to have changed its fax number once it knew that faxes were being misdirected. Op. at 3-4.
In any federal lawsuit, a Plaintiff bears the burden to establish constitutional standing: invasion of a legally protected interest which is concrete and particularized, actual or imminent, and fairly traceable to the defendant's conduct. In the 2016 case Spokeo v. Robins, 136 S.Ct. 1540 (2016), the U.S. Supreme Court developed the "particularized" requirement of standing to require that the alleged injury "affect the plaintiff in a personal way." Id. at 1548.
Defendants in information-breach cases have found Spokeo to be a powerful tool against plaintiffs alleging tenuous privacy injuries.
The tool worked in the Quest case. On Quest's motion to dismiss, the Court agreed that Plaintiff's claims based on a misdirected fax fail the Spokeo test for standing. "Inadvertently sending information to a disinterested wrong number does not present . . . the degree of risk of exposing a plaintiffs private information to unknown hackers who are actually seeking the information." Op. at 8.
No constitutionally cognizable injury means no jurisdiction: game over for Doe's privacy claims against Quest.
Mullen P.C. counsels clients involved in privacy and information security investigations and litigation.