Implications Of Judge Jackson’s Confirmation For Data Privacy And Cybersecurity Litigations Going Forward – Privacy Protection

As CPW previously reported, President Biden nominated D.C. Circuit Judge
Ketanji Brown Jackson to the Supreme Court to fill a vacancy opened
when Justice Stephen Breyer announced his retirement. Judge
Jackson graduated with honors from Harvard University and Harvard
Law School, where she served as editor of the Harvard Law Review.
Following her graduation, she clerked for Justice Stephen Breyer
and served as a public defender. She was confirmed to serve as a
judge on the U.S. District Court for the District of Columbia in
2013. She occupied this role until last year when she was confirmed
to the U.S. Court of Appeals for the D.C. Circuit last year. Judge
Jackson has ruled upon over 500 cases during her tenure on the
bench. Further information regarding her prior rulings on issues
that may arise in data privacy and cybersecurity litigations is
provided below.

I. Article III Standing

As readers of CPW already know, a party wishing to sue in
federal court bears the burden of establishing Article III
standing, which requires that a plaintiff
demonstrate: (1) an injury in
fact; (2) the injury was caused by the
defendant's conduct; and (3) the
injury can likely be redressed by a favorable judicial decision.
Five years after the Supreme Court's significant holding
in Spokeo, Inc. v. Robins, 136 S. Ct. 1540, the Court
reconsidered the question of what constitutes an "injury in
fact" under Article III in Ramirez. In doing so, the Court held
that "[o]nly plaintiffs concretely
harmed by a defendant's statutory violation
have Article III standing to seek damages against that private
defendant in federal court." (emphasis added). The Court
reaffirmed that "Article III standing requires a concrete
injury even in the context of a statutory violation," and it
was not the case that "a plaintiff automatically satisfies the
injury-in-fact requirement whenever a statute grants a person a
statutory right and purports to authorize that person to sue to
vindicate that right." As the Court explained, "[a]n
injury in law is not an injury in fact." The Court's
opinion resolved a circuit split on whether increased risk of
future harm could constitute an injury in fact sufficient to confer
standing.

In total, Judge Jackson has sat on a D.C. Circuit panel in
approximately 40 cases addressing Article III standing. In many of
those cases, Judge Jackson supported the dismissal of cases for a
plaintiff's failure to demonstrate the presence of Article III
standing. These cases reiterated the well-established principle
that alleging an injury in fact that is concrete and particularized
and actual or imminent is crucial to surviving a motion to dismiss
for lack of Article III standing. Consistent with her rulings on
other legal issues, Judge Jackson's standing opinions are
consistently well-reasoned and discuss an otherwise nuanced topic
in an accessible manner. For example, in one of Justice
Jackson's most cited cases discussing standing, she held that
the plaintiff did not have an injury in fact and specifically
lacked an economic injury. In reaching her conclusion, she provided
two methodical reasons for rejecting the plaintiff's alleged
economic injury and finding that plaintiff had no Article III
standing. 

Additionally, in Betz v. Aidnest, Judge Jackson
dismissed a Telephone Consumer Protection Act ("TCPA")
suit on jurisdictional grounds before even considering whether the
plaintiff alleged a plausible claim. 2018 U.S. Dist. LEXIS 183632
(D.C.C. Oct. 26, 2018). Judge Jackson adopted the magistrate
judge's report and recommendation, dismissing the
plaintiff's suit for lack of personal jurisdiction. In another
case where the plaintiff sued an organization for allegedly
violating its internet-usage privacy policy, Judge Jackson
dismissed the case because the plaintiff lacked Article III
standing. 

Judge Jackson reasoned that the plaintiff did not allege that
the organization violated its privacy policy, so no cognizable
injury could have resulted; moreover, it was implausible that the
plaintiff suffered economic harm.

II. Rulings Regarding Consumer Privacy and Other Related
Areas

In consumer privacy class actions, Judge Jackson has
additionally demonstrated a pragmatic willingness to approve class
action settlements under appropriate circumstances. For example,
Judge Jackson's record includes a sizeable TCPA
settlement. SeeRogers v. Lumina Solar, Inc.,
2020 U.S. Dist. LEXIS 108259 (D.D.C. June 19, 2020). Judge Jackson
also settled a class action under the Fair Credit Reporting Act
("FCRA") requiring the defendant to remove certain
utility liens from all consumer credit reports the defendant
generated, not just those belonging to class members.

In the Fourth Amendment context, Justice Jackson has shown an
ability to balance both the government's and private
citizens' interests. In United States v. Campos,
2018 LEXIS 207456 (D.D.C. Dec. 10, 2018), Justice Jackson denied
the defendant's motion to suppress information collected from
her cell phone during a wiretap. Justice Jackson reasoned that the
federal court had jurisdiction to authorize the wiretap and that
traditional law enforcement methods were insufficient to
investigate the defendant's alleged drug conspiracy.

Regarding Freedom of Information Act ("FOIA"), Justice
Jackson has further shown a pragmatic approach to determining
whether the public should access government records. Justice
Jackson has both denied and approved citizens' FOIA requests.
In EPIC v. Department of Justice, 13-cv-1961 (D.D.C.
2013), Justice Jackson ordered the Department of Justice to provide
additional information justifying its decision to withhold certain
records before ultimately ruling that the records were exempt from
disclosure.

III. Conclusion

In addition to the observations and trends noted above, Judge
Jackson's rulings on privacy rights do not appear to be
substantively different from those of Justice Breyer. Many consider
Judge Jackson ideologically similar to Justice Breyer, and her
experience clerking for him undoubtedly shaped her jurisprudence.
Justice Breyer was fairly reliable in upholding digital privacy
rights. For example, Justice Breyer sided in favor of digital
privacy in Van Buren v. United States, and he penned
a partial dissent in Barr v. Association of Political
Consultants. Judge Jackson has given no reason to believe she
would rule much differently. 

However, one thing is for certain: if confirmed, Judge Jackson
will have substantially more opportunities to shape data privacy
laws in the years to come.

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.