The Impact Of The Supreme Court’s Recent Decision In Clapper v. Amnesty International USA On Privacy And Data-Security Litigation

On February 26, 2013, the Supreme Court decided Clapper v. Amnesty International USA, which clarified the standard to establish Article III standing for claims based on impending or future harm. The Supreme Court, in a 5-4 decision by Justice Samuel A. Alito, Jr., held that plaintiffs must demonstrate harm that is “certainly impending,” not speculative, to satisfy the injury-in-fact requirement of standing. The Court also held that plaintiffs may not “manufacture” standing “by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.” The decision has important implications for suits in federal court relating to Internet privacy and data security. Plaintiffs in such cases often rely on fear of future harm—that the defendant's conduct has left them susceptible to identity theft or future privacy breaches, for example—or that they have incurred costs in order to avoid future harm. Federal courts will lack jurisdiction over such claims unless plaintiffs can show that the harm or injury that they allege is certainly impending, rather than merely possible. Issue Before the Court

The plaintiffs in Clapper were a group of attorneys and nonprofit organizations who alleged that their work requires them to engage in sensitive and sometimes privileged telephone and e-mail communications with people outside the United States. They sought to challenge the constitutionality of Section 702 of the Foreign Intelligence Surveillance Act of 1978, codified at 50 U.S.C. § 1881a (“Section 1881a”). That statute allows the Attorney General and the Director of National Intelligence, with the approval of the Foreign Intelligence Surveillance Court, to authorize the surveillance of non-U.S. persons located outside the United States. The issue in the case was whether the plaintiffs had standing to bring their challenge. To establish standing to sue in federal court, a plaintiff must plead and then prove an injury that is:

concrete, particularized, and actual or imminent;

fairly traceable to the defendant's action; and

redressable by a favorable court ruling.

The plaintiffs maintained that they met this standard, and, in particular, theinjury-in-fact requirement that the injury be concrete, particularized, and actual or imminent, because some of the people abroad with whom they communicate were likely targets of FISA surveillance, and because the plaintiffs ceased engaging in some communications and undertook costly...