What's the harm when a firm spreads misinformation about you? Supreme Court punts, #zipcodeharms trends

What is Spokeo? It's good to know. (Spokeo.com)

What's the harm if someone gets your zip code wrong in a database? Well, that question ended up at the center of a Supreme Court ruling today -- and a popular Twitter hashtag, #zipcodeharms. I'll get to that in a minute.

But first, is it a good or a bad thing when all parties can claim victory after a Supreme Court decision? I'm not sure -- but that's what happened Monday when the Supremes issued a down-the-middle ruling in what was supposed to be a landmark case about consumer privacy, Internet "slander," and the future of class action lawsuits.

I've written a few times about the case, which pitted small-time online background company Spokeo against a consumer who said the firm spread bad information about him that hurt his employment prospects. Spokeo, which doesn't have a great reputation and had been hit with an FTC fine over a different issue, somehow had big-name supporters, like Google and the U.S. Chamber of Commerce. On the other side, consumer groups lined up for the consumer's right to sue a company that allegedly violated his privacy -- and the Fair Credit Reporting Act.

The case attracted a lot of attention because it was among the first to test the Court's appetite to declare digital privacy invasions and harms. But even more was at stake: Part of Spokeo's case -- supported by industry heavy-hitters - rested on the notion that the consumer in question, and all others like him, suffer no real harm when data collectors get things wrong. And if there is no harm, there is no case. (No "standing.") Saying someone is unemployed in a report is not like breaking their leg, the thinking went, so there's nothing to sue over.

Such a finding would have flown in the face of Congressional intent. Congress has passed several laws, including the Fair Credit Reporting Act, that specify statutory damages for consumers if companies break the law. Class action lawyers use these provisions as a weapon to keep companies compliant -- if there were no punishment, there would be no compliance. A popular example is the Telephone Consumer Protection Act, which created the Do Not Call list and enables lawsuits that can net consumers $500 per violation.

Spokeo "won," sort of. The Supreme Court affirmed that some kind of harm, over and above a technical violation of law, must occur for consumers to win damages. It then sent the case back to the appeals court for a re-examination of the harm in question.

On the other hand, the justices affirmed that harms can be "intangible" and "difficult to prove or measure."

So, both sides claimed victory. Here's Spokeo:

"With its opinion in the Spokeo v. Robins case, the Supreme Court has squarely rejected the contention that merely alleging a violation of a statute alone gives a plaintiff standing to bring a claim under federal law on behalf of a class of hundreds of thousands or millions of people," Spokeo said on its website. "The Court’s standard will make it much harder to turn individual cases like this one into million-member class actions. Spokeo looks forward to the chance to continue advocating against no-injury class action lawsuits that threaten American businesses and the overall economy."

And here's a quick take from Public Citizen, a consumer advocacy organization:

"The Court's opinion acknowledges that Congress's objective in FCRA was to curb the dissemination of false information, and it appears to recognize, at least implicitly, that a plaintiff about whom significant falsehoods are disseminated, or who faces a risk of dissemination of false information, will likely have suffered a sufficiently concrete injury," it said in a blog post.

If you've been following along, you are probably wondering how someone is supposed to prove "harm" by the publication of data that may or not cause them trouble some day. You might not care, or even know, that you are listed in a data broker's files as related a person who committed manslaughter (as I was a few years ago). And maybe no one will ever find out. Or maybe someone will find out 10 years from now, and it will cost you a job, or a date. How can a consumer prove that they've suffered harm when it hasn't happened yet? The Supreme Court doesn't seem very inclined to tackle that question at the moment. In the majority opinion, this appeared:

"It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm."

So, back to the hashtag. Privacy experts quickly seized on what they saw as a mistake in the logic:

Ryan Calo, a professor at the University of Washington, made the point elegantly on Twitter:

"I don't get interviewed for a job that requires employees to reside in the city. #spokeo#zipcodeharms," he wrote. Then, "My kid gets kicked out of our public school because we supposedly don't live there #spokeo#zipcodeharms."

Still, many consumer advocates found things to be happy about in the ruling.

"The court could have done immeasurable harm to consumer and civil rights laws and they did not," said Ira Rheingold, Executive Director of the National Association of Consumer Advocates. "I think for the most part it’s a good decision for consumers. It reaffirms that Congress can create statutory rights for consumers. While this has always been everyone’s working assumption – Spokeo was an attempt by the Chamber, et. al. to strip this right away from consumers. The Court – at least – firmly rejected this effort, which is extremely important."

And Joel Winston, a consumer law attorney in New York, was even more effusive.

"The decision ... is a nuanced ruling that resoundingly affirms the ability of Congress to create statutory rights and protections," he said. "This is a win for the rule of law. Statutory rights are everywhere and are relied upon by persons and companies alike. (i.e., intellectual property law (copyright and trademarks) and social security income payments (Social Security Laws provide administrative/ statutory rights to payment and appeal).

"Finally, this is a resounding affirmation of the application of the Fair Credit Reporting Act to the digitization of credit reporting and the ubiquitous collection of personal data. The Court's opinion in Spokeo reinforces the strength of the Fair Credit Reporting Act to regulate the credit reporting industry and protect individuals from unfair and harmful behavior."

For a very nuanced look at the legal issues, read Adam Klein's blog post at Lawfare. "The Court has threaded the needle well here," he writes.

If you've read this far, perhaps you'd like to support what I do. That's easy. Sign up for my free email list or click on an advertisement.