Apple Inc. (“Apple”) made headlines most recently for its $1.05 billion victory over Samsung in patent litigation in the U.S. District Court for the Northern District of California. That victory has overshadowed, for now, another lawsuit against Apple in the Northern District of California alleging that Apple violated consumers’ privacy rights by allowing application developers to collect “personal information” from their “iDevices” (e.g., iPhones, iPads) without the users’ consent.
“In re iPhone Application Litigation,” the lawsuit is notable because it concerns an emerging consumer privacy issue that is working its way through the courts: Do consumers suffer any actual injury when information regarding how their smartphones, tablets and computers are used and where they are located is collected or accessed by third parties?
The GeoLocation Class is made up of only those iPhone purchasers who switched off the “Location Services” setting on their iPhones, which they believed would prevent their iPhones from storing information about their physical location and transmitting that information to Apple. Plaintiffs allege that, despite turning off this setting, the iPhones continued to store and send this “geolocation” information to Apple.
In July 2010, about a year before this lawsuit was filed, Apple’s General Counsel sent a letter to Congress explaining its collection and tracking of location data practices in response to a request from Congressmen Joe Barton and Edward Markey. Apple’s letter stated that, to address privacy concerns, users could disable the iPhone’s location collection and tracking features. In 2011, it was widely publicized that, contrary to the representations in Apple’s letter, Apple continued to collect geolocation data even when users disabled these features. Apple claimed that the collection was inadvertent. Some expressed disbelief. Others, like Plaintiffs in the iPhone Application Litigation, sought damages.
Apple Obtains Dismissal of Plaintiffs’ Initial Complaint for Lack of Article III Standing
Apple successfully moved to dismiss Plaintiffs’ first consolidated complaint (filed April 2011) on the ground that Plaintiffs did not have Article III standing because Apple’s allegedly unlawful conduct did not cause any actual injury to Plaintiffs. (For the Court’s order, go to http://scholar.google.com/scholar_case?case=11552215207215157219.) Article III limits the jurisdiction of federal courts to cases where the plaintiff has alleged an actual “case or controversy.” A plaintiff satisfies this requirement by alleging: (1) an “injury in fact” that is “concrete and particularized” and “actual and imminent”, (2) that the injury is “fairly traceable” to the action of the defendant, and (3) that it is likely that the injury will be redressed by a favorable decision on plaintiff’s claim. Friends of the Earth, Inc. v. Laidlaw Envt’l Servs. (TOC), Inc., 528 U.S. 167, 180-81 (2000). Dismissing Plaintiffs’ claims, the Court found that “[d]espite a lengthy Consolidated Complaint, Plaintiffs do not allege injury in fact to themselves.” The Court granted Plaintiffs leave to file an amended complaint to remedy this deficiency.
Plaintiffs File an Amended Complaint; Apple Moves to Dismiss Claiming that Plaintiffs Still Fail to Plead Any Actual Injury
The Court held that Plaintiffs had Article III standing to assert all of their claims. (For other reasons, principally Plaintiffs’ failure to state a claim, the Court dismissed with prejudice all but two of the ten claims that Plaintiffs brought against Apple. Review the Court’s order at http://scholar.google.com/scholar_case?case=17290609987961065746&q=IN+RE+IPHONE+APPLICATION+LITIG&hl=en&as_sdt=2,36.) This reversed the Court’s position in dismissing Plaintiffs’ initial complaint, and meant that Plaintiffs alleged a “concrete and particularized” injury fairly traceable to Apple’s conduct. The Court noted that Plaintiffs’ initial complaint was deficient because it “relied heavily upon a theory that collection of personal information itself created a particularized injury for the purposes of Article III standing.” Like other courts, it was not persuaded that the “personal information” at issue had “independent economic value,” such that Plaintiffs could have sold it to the highest bidder but for Apple’s or Apps developers’ actions. Plaintiffs’ amended complaint alleged standing because they “articulated additional theories of harm beyond their theoretical allegations.”
Plaintiffs’ additional theories of harm were that the collection, storage and transmittal of personal and geolocation information consumed their iDevices’ resources (such as storage space, battery life and bandwidth) and created an increased risk to the security of “sensitive personal information.” Plaintiffs also alleged that they detrimentally relied on Apple’s representations regarding the privacy protections in place to protect them. As an alternative basis for its decision, the Court held that Apple’s alleged violation of certain statutes, such as the Wiretap Act and the Stored Communications Act, conferred Article III standing to Plaintiffs. This latter holding is based on the premise that in passing a statute like the Wiretap Act, for example, Congress created a personal right to be free from unauthorized interception of electronic communications. The invasion of that right constitutes a concrete injury, regardless of whether or not there are any other consequences of the interception.
Courts, like the Court in the iPhone Application Litigation, Require Concrete Allegations of Actual Harm to Plead Article III Standing
The Court’s holding on the standing issue shows how the law is evolving concerning the collection and use of information, including “anonymized” information, regarding consumers’ use of smartphones and other devices. In separate cases involving JetBlue, Specific Media and Linkedin, courts have declined to find Article III standing where plaintiffs have alleged merely a conjectural harm – e.g., someone could have taken the information at issue and stolen my identity – or some harm based on a diminution of the theoretical value of the information itself, despite attorneys’ citations to expert opinions and scholarly articles expounding on the economic value of such information in the marketplace.
Courts have found Article III standing where plaintiffs allege that the collection or use of the information at issue had a physical impact on the performance of their device. In the Apple case, the Court was not deterred by the fact that the physical impact might be extremely small – Apple asserted that location information occupied at most ¼ of 1% of an iPhone’s storage capacity. Other courts might challenge the plausibility of such allegations. The same judge who ruled on Apple’s motion to dismiss also found Article III standing in a lawsuit against Facebook where Plaintiffs specifically articulated how the information collected and used by Facebook had actual, not merely theoretical, value. In that case, Facebook converted information regarding users’ “likes” of certain products into commercial endorsements ostensibly by those users, which Facebook posted on their friends’ pages as paid advertising. It was not difficult for the court to reason, for pleading purposes, that Facebook had converted its users’ statutory right of publicity for its own financial gain. (For information regarding Facebook’s attempts to settle this lawsuit, see Ron Raether’s blog entry at http://businesslitigationinfo.com/business-litigation/archives/court-rejects-preliminary-approval-of-facebook-settlement-%e2%80%93-is-there-way-to-navigate-mega-sized-class-actions/#more-977.)
In sum, courts have found that the collection of information about consumers’ use of their smartphones can cause them to suffer a “concrete and particularized” injury under Article III. As in the iPhone Application Litigation, however, courts demand specific, factual allegations that are grounded in real world economics to find Article III standing and will not accept naked assertions that plaintiffs suffered some conjectural or theoretical harm.