A recent decision from a federal court in the Northern District of California has added a new and interesting chapter to the decades-long saga of Article III standing in privacy and surveillance cases. A line of Supreme Court cases from Laird v. Tatum (1972) to Clapper v. Amnesty Int’l USA (2013) have addressed the issue of standing to challenge government surveillance programs, and have held that “chilling effects” on First Amendment freedoms cannot come from mere knowledge of a surveillance program. Judge Lucy Koh, in her September 4 decision In re Adobe Sys. Privacy Litig., has left open the question of whether Laird–Clapper jurisprudence is the last word in standing for surveillance claims. And while the Northern District of California is a long way from the Supreme Court, her decision is an interesting development toward the concept of recognizable harms stemming from government surveillance, even when the plaintiff cannot show that they themselves were specifically targeted.
Article III standing doctrine has proved to be a consistent obstacle in U.S. courts for those seeking redress for perceived privacy harms stemming from difficult to prove government surveillance or corporate data breaches. A relatively recent doctrine with only a few moving parts, standing has nevertheless produced a wide array of confusing and incoherent decisions, and has been described by scholars as “the Rorschach test of federal courts.” Expressing his own frustration with the absence of a consistent doctrine, Justice Douglas once wrote that “[g]eneralizations about standing to sue are largely worthless as such.” The theoretical foundation of the doctrine—ensuring that the plaintiff before the bar is the right party to bring that claim before that defendant in a federal court of limited jurisdiction—is sound, and seeks a “constitutional minimum” of standing based upon Article III’s “case” or “controversy” requirement (Lujan, 1992).
This filtration function is supposed to focus the court’s attention on the party, rather than the merits of the party’s claim, and holds that a plaintiff must show (1) an “injury in fact” that is (2) caused by the defendant’s alleged conduct, and (3) is “redressable by a judicial ruling” before their claim can heard by a federal court. Beyond this “constitutional minimum,” federal courts have occasionally added prudential standing requirements, such as a requirement that a plaintiff or injury be within the “zone of interests” protected by the statute or constitutional provision at issue (Camp, 1970).
Critics of standing doctrine, especially in privacy-related matters, point out that courts will often reject claims of harm as too speculative or attenuated, when even more speculative risks have been accepted in other contexts, such as in damages arguments. Further, research has long shown that even the mere awareness of government surveillance, under which an individual could reasonably expect herself to be observed, can yield very real chilling effect injuries, including self-censorship and an increased reluctance to associate with certain people or groups. Foucault would, of course, argue that this is the entire point of surveillance. For a particularly pernicious realization of this philosophy, one need not look further than the now-infamous FBI COINTELPRO documents from the late 1960s and early 1970s, which sought to maintain control over subversive organizations (where J. Edgar Hoover unilaterally defined “subversive” in this context) by creating a level of paranoia that hindered their ability to meet and speak freely. Finally, scholars have argued that injury analysis under standing doctrine is remarkably inconsistent, value-based, and malleable, and is thus subject to a judge’s experiences and worldview, which likely do not match those of the plaintiff.
With respect to privacy and surveillance cases, standing doctrine has developed in a line of Supreme Court cases most recently revisited in the Court’s 2013 decision in Clapper. In Clapper, the original plaintiffs were U.S.-based attorneys, media and human rights organizations, and journalists who challenged section 702 of the Foreign Intelligence Surveillance Act of 1978 (“FISA”) (as added to FISA in 2008). Plaintiffs alleged that because their work required them to communicate with people outside the United States who were likely targets of surveillance under section 702, they were harmed based on “an objectively reasonable likelihood that their communications [would] be acquired [under section 702] at some point in the future.”
The Clapper Court, rearticulating the “case or controversy” constitutional minimums required by Article III, held that the “objectively reasonable likelihood” standard was inconsistent with the “injury in fact” precondition, which requires that a “threatened injury must be certainly impending,” stating that “allegations of possible future injury are not sufficient.” The Court observed that the plaintiffs only articulated a “highly speculative fear” that they would be targeted under section 702, which was based on a “highly attenuated” chain of possibilities that did not result in a “certainly impending” injury.
This line of reasoning denying plaintiffs standing in Clapper has since become a primary tool for defendants—government and corporate—in privacy-related cases, where courts have historically been reluctant to find “injury in fact” when property or liberties are not clearly at stake. Plaintiffs with claimed likely injuries stemming from government surveillance face an especially difficult task, since evidence regarding state surveillance programs is often difficult to come by—for obvious reasons.
Plaintiffs in privacy-related actions against corporations and other private organizations have faced a different set of standing challenges. In 2010, the Ninth Circuit addressed Article III standing in the context of private data breaches in Krottner v. Starbucks Corp. In Krottner, a laptop was stolen from Starbucks that contained the unencrypted names, addresses, and Social Security numbers of just under 100,000 Starbucks employees. Starbucks argued that the employees did not have standing to sue because there was no indication that any of the personal information in question had been misused or that any economic loss had occurred as a result of the data theft. The Krottner court disagreed, holding that “the possibility of future injury may be sufficient to confer standing” where the plaintiff is “immediately in danger of sustaining some direct injury as a result of the challenged conduct.” The Ninth Circuit further held that the Starbucks employees’ claims described “a credible threat of real and immediate harm stemming from the theft of a laptop containing their unencrypted data,” and held that the plaintiffs “sufficiently alleged an injury-in-fact for purposes of Article III standing.”
The plaintiffs in In re Adobe Sys. claimed similar injuries to those in Krottner, citing a 2013 data breach where hackers were able to access the personal and financial information of at least 38 million customers. Adobe argued that the Supreme Court’s decision in Clapper overruled Krottner re: standing, and moved the court to reject the plaintiffs’ claims of possible future injury and deny them Article III standing.
It is worth noting at this point that the Supreme Court has itself granted standing in cases where a party’s claims of injury are as (or more) remote than those found in surveillance cases such as Clapper. For example, in 2010 in Monsanto v. Geertson Seed Farms, the plaintiffs-respondents, a number of organic alfalfa farmers, argued that they could be harmed if the deregulation of Monsanto’s genetically-modified seed spread to fields containing their organic seeds. During oral argument, Justice Scalia expressed no small amount of skepticism over these claims, and signaled that they were likely too attenuated to support standing. The Court, however, held that the plaintiffs-respondents had demonstrated sufficient injury to meet standing requirements, even if they could not prove actual contamination. In an especially ironic twist, the Court would later cite Monsanto in their discussion of standing in Clapper, which held that, since plaintiffs could not prove actual surveillance, there could be no standing.
To frame this issue another way: how can we reconcile the different results in Clapper and Monsanto? Both cases involved probabilistic claims of injury based on reasonable assumptions, but neither could point to actual proof of injury by the defendants. The key differentiator for this Court appears to come down to economics. In Monsanto, the Court ultimately convinced itself (through rather convoluted reasoning) that, even though plaintiffs could point to no actual injuries, their standing was supported by evidence that they would likely suffer economic injury, even if the feared cross-contamination of seeds did not occur. It therefore appears that surveillance plaintiffs either need to find a way to convince this Court that “real” (i.e., non-self-inflicted) economic harms can stem from government surveillance programs, or find a way to pry loose the faulty reasoning in Laird and Clapper—the “mere knowledge” of widespread government surveillance can result in very real constitutional harms.
The Adobe court stated, however, that “Clapper did not change the law governing Article III standing,” and held that the plaintiffs suing Adobe had standing to bring their claims. The court first observed that the Supreme Court acknowledged that standing precedent “[did] not uniformly require plaintiffs to demonstrate that it is literally certain that the harms they identify will come about” in order to have standing to sue. In fact, the Supreme Court has found standing based only on a “substantial risk that the harm will occur, which may prompt plaintiffs to reasonably incur costs to mitigate or avoid that harm,” and the Clapper Court expressly declined to overturn that line of case law. The Adobe court stated that Clapper “merely held that the Second Circuit had strayed” from “well-established standing principles by accepting a too-speculative theory of future injury.”
But what does Adobe mean for plaintiffs in government surveillance cases, where constitutional claims are raised and separation of powers issues abound? The Adobe court was quick to point out that Clapper’s “standing inquiry [was] especially rigorous when reaching the merits of the dispute would force [the Court] to decide whether an action taken by one of the other two branches of the Federal Government was unconstitutional.” The Supreme Court’s doctrine of avoiding constitutional adjudication except when absolutely necessary provides a powerful basis behind many of the justiciability doctrines, and this reluctance has manifested in various ways with respect to standing. In Clapper, for example, Justice Alito noted that an important basis of their ruling was founded on separation of powers principles, that “serve[] to prevent the judicial process being used to usurp the powers of the political branches,” giving wide latitude to the Executive Branch’s power over the “fields of intelligence gathering and foreign affairs.” Claims of harms due to surveillance usually require persuading federal courts to recognize that private rights of action under constitutional language can overcome the Court’s reticence to examine the constitutionality of legislative or executive actions. Since Laird, courts have barred nearly all claims of injury based on “mere knowledge” or the “mere possibility” that they might be illegally surveilled under a (possibly unconstitutional) government program. Reasoning like that found in Adobe, however, may be a sign that future surveillance harms will soon be recognized as an “injury in fact,” and will free courts from the flawed legacy of Laird and Clapper.