In Re FACEBOOK INTERNET TRACKING LITIGATION

Filing 132

REPLY (re #101 MOTION to Dismiss Defendant Facebook, Inc.s Motion to Dismiss Plaintiffs Second Amended Consolidated Class Action Complaint (Fed. R. Civ. P. 12(b)(1) & 12(b)(6)) ) Plaintiffs' Response to Facebook's Supplemental Spokeo Brief filed byPerrin Aikens Davis, Brian K. Lentz, Cynthia D. Quinn, Matthew J. Vickery. (Attachments: #1 Exhibit A, #2 Exhibit B, #3 Exhibit C)(Straite, David) (Filed on 6/10/2016)

1
2
3
4
5

Stephen G. Grygiel (admitted pro hac vice)
SILVERMAN THOMPSON
SLUTKIN WHITE LLC
201 N. Charles Street, 26TH Floor
Baltimore, MD 21201
Tel.: [phone]
Fax: [phone]
[e-mail]

Laurence D. King (206423)
Mario M. Choi (243409)
KAPLAN FOX & KILSHEIMER LLP
350 Sansome Street, 4th Floor
San Francisco, CA 94104
Tel.: [phone]
Fax: [phone]
[e-mail]

6
7
8
9
10
11
12

Frederic S. Fox (admitted pro hac vice)
David A. Straite (admitted pro hac vice)
KAPLAN FOX & KILSHEIMER LLP
850 Third Avenue, 14th Floor
New York, NY 10022
Tel.: [phone]
Fax: [phone]
[e-mail]

UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
SAN JOSE DIVISION

13
14
15

No. 5:12-md-02314-EJD
IN RE: FACEBOOK, INC. INTERNET
TRACKING LITIGATION

16
17

PLAINTIFFS’ RESPONSE TO FACEBOOK’S
SUPPLEMENTAL SPOKEO BRIEF

18
19
20
21
22
23
24
25
26
27
28
PLAINTIFFS’ RESPONSE TO FACEBOOK’S SUPPLEMENTAL SPOKEO BRIEF
No. 5:12-md-02314-EJD

1

I.

INTRODUCTION
Plaintiffs respectfully respond to Facebook’s brief dated May 31, 2016 (“Facebook Spokeo

2
3

Brief”) [ECF No. 128]. Spokeo, a procedural decision, confirmed that Article III injury-in-fact has two

4

distinct elements, “particularized” injury and “concrete” injury. The Court articulated no new

5

substantive rule, and overturned no prior Court authority. The violation of a legal right traditionally

6

recognized at common law can be concrete harm, and Congress still has the right to create new legally

7

protected interests where none existed at common law. The violation of the traditional common law

8

right or invasion of the new legal interest can satisfy both elements even absent economic loss.
Despite Spokeo’s limited holding, Facebook remarkably posits that Congress is now

9
10

Constitutionally prohibited from outlawing unauthorized spying on electronic communications unless

11

the victim also suffers economic injury as a consequence. Nothing in Spokeo supports this view.

12

II.

13

INVASION OF PRIVACY IS CONCRETE HARM UNDER SPOKEO
Facebook argues that the Second Amended Complaint (“SAC”) fails to plead economic harm

14

caused by Facebook’s post-logout tracking. See Facebook Spokeo Brief at 1 (“Plaintiffs did not show

15

they lost the opportunity to sell their browsing histories”); id. at 3 (“The SAC . . . contains no allegations

16

that the value of their information has been diminished.”). As an initial matter, Facebook is incorrect.

17

The SAC has an entire section alleging the economic value of the data Facebook misappropriated,

18

building on allegations in the First Amended Complaint. See SAC ¶¶ 129-143; see also Order on

19

Motion to Dismiss dated October 23, 2015 [ECF No. 87], 2015 WL 6438744, at *6 (N.D. Cal., Oct. 23,

20

2015) (“Unlike other data privacy cases, Plaintiffs have alleged the existence of a limited market for

21

their browsing histories.”). The trend in this District and elsewhere is to consider these allegations

22

sufficient to establish economic harm even absent further allegations of diminished ability to sell the

23

data. See, e.g., In re: Anthem, Inc. Data Breach Litig., No. 15-md-2617-LHK, 2016 WL 3029783, at

24

*15 (N.D. Cal. May 27, 2016) (plaintiffs need only allege “that there was either an economic market for

25

their PII or that it would be harder to sell their own PII, not both”) (italics in original).

26

More fundamentally, as plaintiffs’ opening Spokeo brief [ECF No. 129] noted, injury-in-fact

27

need not be economic to invoke this Court’s jurisdiction. “‘Concrete’ is not, however, necessarily

28

synonymous with ‘tangible.’” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1549 (2016). Some of our most
-1PLAINTIFFS’ RESPONSE TO FACEBOOK’S SUPPLEMENTAL SPOKEO BRIEF
No. 5:12-md-02314-EJD

1

precious rights are intangible, including the freedom of religion, the right to vote, freedom of speech,

2

and the right to be free from libel and slander. The loss of these rights is concrete harm even if

3

unaccompanied by loss of treasure.

4

The right of privacy pre-dates the Republic and is enshrined in “specific guarantees in the Bill of

5

Rights.” Griswold v. Connecticut, 381 U.S. 479, 484 (1965). Justice Brandeis, in his Olmstead dissent

6

that forms the foundation of modern Fourth Amendment jurisprudence, called the right of privacy “the

7

most comprehensive of rights and the right most valued by civilized men.” Olmstead v. United States,

8

277 U.S. 438, 478 (1928) (Brandeis, J., dissenting); accord, Kewanee Oil Co. v. Bicron Corp., 416 U.S.

9

470, 487 (1974) (privacy is a “most fundamental human right”).

10

Like other intangible rights, the right to privacy does not exist solely to prevent other harms.

11

The violation itself can be the harm. 1 When Warren and Brandeis first proposed a tort for the invasion

12

of privacy, they noted that some invasions constitute harm per se, like some species of libel or slander,

13

and proposed the same for the tort of invasion of privacy. Samuel D. Warren and Louis D. Brandeis,

14

“The Right to Privacy,” 4 HARV. L. REV. 193 (1890). Fifteen years later, Georgia’s Supreme Court

15

became the first to recognize a tort for the invasion of privacy: “The right of privacy has its foundation

16

in the instincts of nature. It is recognized intuitively, consciousness being the witness that can be called

17

to establish its existence . . . [it] is therefore derived from natural law.” Pavesich v. New England Life

18

Ins. Co., 50 S.E. 68, 69-70 (Ga. 1905). As Warren and Brandeis advocated, the Georgia Supreme Court

19

held that money damages are not required: “It is a tort, and it is not necessary that special damages

20

should have accrued from its violation in order to entitle the aggrieved party to recover.” Id. at 73.

21

Other states quickly followed Georgia’s lead so that by the time the Restatement of Torts was

22

drafted, a tort for interference with privacy rights had become blackletter law. See Restatement (First)

23

of Torts § 867 (1939) (“Interference with Privacy”); see id., cmt. b (“This interest appears only in a

24

comparatively highly developed state of society”). Today, 44 states and the District of Columbia

25
1

26
27
28

See, e.g., Mendelson v. McCabe, 144 Cal. 230 (1904) (trespass actionable even without actual
damage); Vermont Microsystems, Inc. v. Autodesk, Inc., 88 F.3d 142, 151 (2d Cir. 1996)
(misappropriation of trade secrets actionable even if plaintiff cannot show lost profits); Spokeo, 136 S.
Ct. at 1551 (Thomas, J., concurring) (“Many traditional remedies for private-rights causes of action –
such as for trespass, infringement of intellectual property, and unjust enrichment – are not contingent on
a plaintiffs’ allegation of damages beyond the violation of his private legal right.”).
-2PLAINTIFFS’ RESPONSE TO FACEBOOK’S SUPPLEMENTAL SPOKEO BRIEF
No. 5:12-md-02314-EJD

1

recognize various privacy torts, see Exhibit A, Table 1, and the last few holdouts protect privacy

2

statutorily. See Exhibit A, Table 2. When the Second Restatement was issued in 1977, four distinct

3

privacy torts had evolved, see generally Restatement (Second) of Torts §§ 652A-652E, and at least for

4

intrusion upon seclusion (652B) and misappropriation (652C), monetary losses are not required. Id. §

5

652H (damages recoverable for “special damages,” or “mental distress,” or the harm to the victim’s

6

“interest in privacy” generally); id., cmt. a (invasion of seclusion or loss of exclusive use of identity is

7

harm without more; only 652D and 652E require harm to reputation or other consequential injury). The

8

text of each relevant Restatement section is provided in Exhibit A, Table 3. The loss of privacy alleged

9

in this case is thus an intangible harm that “has a close relationship to a harm that has traditionally been

10

regarded as providing a basis for a lawsuit in English or American courts.” Spokeo, 136 S. Ct. at 1549.

11

The invasion of privacy is concrete injury even if the victim is unaware of the invasion. For

12

example, in 2008, Yahoo! Inc. challenged an order forcing it to monitor the email of certain customers.

13

At oral argument, the panel asked, “What is your injury?” See Declassified Transcript of Oral Argument

14

before FISA Court of Review on June 19, 2008 at 7, attached hereto as Exhibit B. Yahoo responded

15

that “an intrusion into someone’s privacy” is harm, even “if the government makes no further use of it.”

16

Id. at 14. Yahoo further argued that “wiretapping individuals’ private communications is the greatest

17

harm an individual can experience.” Id. at 16. Finally, Yahoo argued, as plaintiffs do here, that the

18

aggregation of intercepted communications is a particularly serious privacy harm: “I understand your

19

point that they don’t know they’re experiencing that harm, so it can’t be that great, but the government

20

building a database on millions of people in the United States, even if they don’t know it, I would argue

21

would be a grave harm.” Id.

22

Likewise, in a joint letter sent to Congress this week, privacy advocates and technology

23

companies voiced opposition to a proposed ECPA amendment expanding the FBI’s ability to obtain

24

sensitive online data, including IP addresses in users’ web browsing histories. See Exhibit C.

25

Facebook signed the letter. Although the bill would not grant access to the “contents” of

26

communications (for example, full URLs), the letter notes even mere IP addresses and metadata, when

27

aggregated, “would paint an incredibly intimate picture of an individual’s life” and raises “civil liberties

28

and human rights concerns.” Plaintiffs agree, and have so argued in this case. ECF No. 104-3 at 24-26.
-3PLAINTIFFS’ RESPONSE TO FACEBOOK’S SUPPLEMENTAL SPOKEO BRIEF
No. 5:12-md-02314-EJD

1
2

III.

CONGRESS MAY CREATE LEGAL RIGHTS PREVIOUSLY NOT RECOGNIZED AT
COMMON LAW, THE INVASION OF WHICH IS CONCRETE HARM
Even if an invasion of privacy were not a concrete harm as traditionally regarded by English or

3

American common law, Congress has the power to create a right the invasion of which can be a concrete

4

harm. Spokeo, 136 S. Ct. at 1549. This has always been the case, and the Spokeo Court simply repeated

5

long-established law. As Professor Erwin Chemerinsky of the University of California at Irvine noted:

6
7
8
9

Significantly, the court did not change the law: Congress, by statute, can create rights
the infringement of which is sufficient for standing to sue in federal courts. The court
approvingly quoted Justice Anthony Kennedy’s opinion in Lujan v. Defenders of
Wildlife that “Congress has the power to define injuries and articulate chains of
causation that will give rise to a case or controversy where none existed before.”

10

Erwin Chemerinsky, “These Two Decisions Highlight How Scalia’s Absence Has Affected the Court,”

11

www.abajournal.com (Jun. 2, 2016).

12

Facebook overstates Spokeo’s meaning in arguing that a bare violation of a statute no longer

13

suffices for standing. Facebook Spokeo Brief at 2 (“That is no longer true.”). Respectfully, it is still

14

true. The Court held that the bare violation of a “right granted by statute can be sufficient in some

15

circumstances to constitute injury in fact. In other words, a plaintiff in such a case need not allege any

16

additional harm beyond the one Congress has identified.” Spokeo, 136 S. Ct. at 1549 (italics in

17

original) (emphasis added). Spokeo, citing Lujan, did hold that injury is not automatic whenever a

18

statute is violated, and a court must determine whether the harm caused by the violation is what

19

Congress intended to prevent. But if so, the bare statutory violation confers standing.

20

In updating the wiretap laws in 1986 (the ECPA), Congress sought to protect the privacy of

21

electronic communications. “[T]he law must advance with the technology to ensure the continued

22

vitality of the fourth amendment. … Congress must act to protect the privacy of our citizens. If we do

23

not, we will promote the gradual erosion of this precious right.” S. Rep. 99-541 at 5; accord, H.R. Rep.

24

99-647 at 19. Neither the Senate nor House Reports identifies mitigation of economic loss as the

25

purpose of the statute, and the private right of action in the ECPA contains no jurisdictional threshold

26

like other statutes. Cf., e.g., Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (requiring monetary

27

damages as element of the claim). Likewise, the purpose of the California Invasion of Privacy Act

28

(“CIPA”) is “to protect the right of privacy.” In re: Yahoo Mail Litig., 7 F. Supp. 3d 1016, 1036 (N.D.
-4PLAINTIFFS’ RESPONSE TO FACEBOOK’S SUPPLEMENTAL SPOKEO BRIEF
No. 5:12-md-02314-EJD

1

Cal. 2014); Cal. Penal Code § 630 (“The Legislature hereby declares” that electronic surveillance “has

2

created a serious threat to the free exercise of personal liberties and cannot be tolerated in a free and

3

civilized society.”). 2 The California Legislature provided a private right of action for anyone “injured”

4

by unauthorized wiretapping even in the absence of monetary damages, underscoring that an invasion of

5

privacy can be harm even without out-of-pocket loss. See Kearney v. Salomon Smith Barney, Inc., 39

6

Cal.4th 95, 116 (2006).

7

Plaintiffs allege that Facebook intercepted communications, violating their substantive statutory

8

privacy rights. Facebook did not commit a minor “procedural violation” but rather inflicted the very

9

harm that Congress and the California Legislature tried to prevent. Plaintiffs thus suffered actual,

10

concrete harm caused by the statutory violation even without alleging special economic damages as a

11

result. Under Spokeo, these statutory violations are sufficient to confer standing.

12

IV.

13

THE THIRD CIRCUIT DECISION IN RE: GOOGLE INC. COOKIE PLACEMENT
CONSUMER PRIVACY LITIGATION REMAINS GOOD LAW FOLLOWING SPOKEO

14

Finally, Facebook argues that Spokeo implicitly overruled the Third Circuit’s ruling on standing

15

in In re: Google Inc. Cookie Placement Consumer Privacy Litig., 806 F.3d 125 (3d Cir. 2015).

16

However, the Third Circuit’s analysis comports with Spokeo’s holding in every respect. The Third

17

Circuit found particularized harm because the defendants wrote tracking cookies to the plaintiffs’

18

personal computers and tracked their web browsing. Id. at 134. For the common law claims, the

19

plaintiffs alleged a serious invasion of privacy under California law, id. at 149-152, and for the statutory

20

claims, the plaintiffs alleged a violation of the very privacy rights the statutes were designed to protect.

21

Id. at 134-35. And rejecting defendants’ argument that harm must be pecuniary to be concrete, id., the

22

court anticipated the same holding in Spokeo. Facebook is therefore only advancing the formalistic

23

proposition that a court must confine a standing analysis to a single section of the opinion, or separately

24

label portions of the analysis “particularized injury” and “concrete injury.” Spokeo speaks to a

25

procedural requirement, not a formatting requirement, and Google Cookie Placement remains good law.

26

///

27
28

2

For purposes of today’s brief, plaintiffs do not dispute Facebook’s contention that Spokeo would apply
to claims under state statutes. See Facebook Spokeo Brief at 4.
-5PLAINTIFFS’ RESPONSE TO FACEBOOK’S SUPPLEMENTAL SPOKEO BRIEF
No. 5:12-md-02314-EJD

1

Dated: June 10, 2016

Respectfully submitted,

SILVERMAN, THOMPSON, SLUTKIN &
WHITE LLC

KAPLAN, FOX & KILSHEIMER LLP

By: /s/ Stephen G. Grygiel
Stephen G. Grygiel (admitted pro hac vice)
201 N. Charles St., #2600
Baltimore, MD 21201
Telephone [phone]
Facsimile: [phone]
[e-mail]

By:
/s/ David A. Straite
Frederic S. Fox (admitted pro hac vice)
David A. Straite (admitted pro hac vice)
850 Third Avenue
New York, NY 10022
Telephone: [phone]
Facsimile: [phone]
[e-mail]

2
3
4
5
6
7
8
9

Interim Co-Lead Counsel

10

Laurence D. King (206423)
Mario M. Choi (243409)
350 Sansome Street, 4th Floor
San Francisco, CA 94104
Tel.: [phone]
Fax: [phone]
[e-mail]

11
12
13
14

Interim Co-Lead Counsel

15
16
17

ATTESTATION PURSUANT TO CIVIL LOCAL RULE 5-1(i)(3)
18
19
20
21
22
23
24

I, David A. Straite, attest that concurrence in the filing of this document has been obtained from
the other signatory. I declare under penalty of perjury under the laws of the United States of America
that the foregoing is true and correct.
Executed this 10th day of June, 2016, at San Francisco, California.
/s/ David A. Straite
DAVID A. STRAITE

25
26
27
28
-6PLAINTIFFS’ RESPONSE TO FACEBOOK’S SUPPLEMENTAL SPOKEO BRIEF
No. 5:12-md-02314-EJD