Spokeo suit tests limits of privacy

For anyone who feels powerless about controlling their personal information in a world of search engines and public databases, take heart. A recent court ruling suggests you might have more muscle than you thought.

The case involves a Pasadena company called Spokeo, which operates a “people search” website that instantaneously pulls together information from publicly available sources.

The company says it helps users “know more about the people in their lives.” It does this by providing “access to social-media profiles, court records, criminal records, names, addresses, phone numbers, email addresses, marital status and more.”

Spokeo (rhymes with Tokyo) is one of dozens of such online services that have turned once-difficultto-obtain data into a readily available commodity, making it much harder for people to keep sensitive or embarrassing personal info under wraps.

A Virginia resident named Thomas Robins sued Spokeo in 2011, alleging that the information about him on the site was largely erroneous. According to the

suit, Spokeo “incorrectly stated that he was in his 50s, that he was married, that he was employed in a professional or technical field, and that he has children.”

Robins alleges that Spokeo violated federal law by not making reasonable efforts to confirm the info before selling it to third parties. The lawsuit says Robins, who was unemployed at the time, may have lost job opportunities as a result of Spokeo’s inaccurate information.

This caused “actual harm in the form of anxiety, stress, concern, and/or worry about his diminished employment prospects,” it says.

“Spokeo’s business model was predicated on putting up tons of information about people and wreaking havoc on people’s lives,” Robins’ lawyer, Jay Edelson, told me.

For the last six years, the two sides have been wrangling over Robins’ standing to bring the lawsuit. The initial complaint was tossed out by a district judge on the grounds that Robins hadn’t shown he experienced genuine harm.

After all, the allegedly inaccurate information about Robins doesn’t seem that inflammatory, and he doesn’t say for sure that he lost a job opportunity as a result of Spokeo’s site.

Nevertheless, the U.S. 9th Circuit Court of Appeals reinstated the lawsuit, saying the case had sufficient merit to move forward. Then, at Spokeo’s request, the U.S. Supreme Court weighed in.

In a 6-2 ruling, the high court ruled that Robins must show “real” harm for his lawsuit to go forward. It told the 9th Circuit to take another look.

And now it has. A threejudge panel of the appellate court ruled the other day that “Robins had alleged injuries that were sufficiently concrete” to merit a lawsuit.

Marc Rotenberg, president of the Electronic Privacy Information Center, said the decision means “consumers will now have their day in court.”

“There is no guarantee of success,” he said. “But at least courts will now be expected to hear consumer privacy cases. And if more of these cases are heard, companies will eventually develop better data protection practices.”

Edelson said his next step is to seek class-action status for Robins’ lawsuit, which potentially could open the case to thousands of people who believe their personal info was misused by Spokeo.

“Companies like this touch a lot of people and they’re doing a lot of damage,” he said.

As it happens, one of my columns is cited in Robins’ lawsuit. The column was from June 2010, after I’d sat down for a chat with the co-founder and chief executive of Spokeo, Harrison Tang.

The jaw-dropping takeaway from that conversation was how aggressively Tang, now 34, protected his own privacy even as he exposed others’ lives to scrutiny. He wouldn’t even let me into Spokeo’s offices, choosing instead to meet at a Pasadena coffee shop.

More telling, Tang had removed his own personal information from the site’s searches. “I was getting a lot of emails and threats,” he told me. “It was decided by others at the company, and by lawyers, that it would be better if I opted out.”

A Spokeo spokeswoman, Vanessa Waite, declined to make Tang available for another interview. Instead, she provided a statement saying that “Spokeo is disappointed that the Ninth Circuit concluded that the alleged inaccuracies about Mr. Robins satisfied the Supreme Court’s actual harm standard.”

The company says it will “vigorously defend” its position when the case returns to the District Court.

I’ve had a love/hate relationship with people-search sites. As a reporter, it’s undeniably useful to have online services that can quickly comb through public records and make information available.

As a consumer, I’m frustrated that personal information that once was largely out of reach to all but the most diligent seekers is now easily obtained. These services are a stalker’s best friend.

I also resent that peoplesearch companies are profiting from my info without my say-so. And I’m especially troubled that so much of what’s on these sites is flat-out wrong.

Spokeo’s fine print ducks responsibility for the accuracy of its information. “Spokeo does not verify this public information,” it declares, and “makes no guarantees to Spokeo users about the accuracy, legitimacy or legality of any information or how recently any information was collected or updated.”

In other words, it could be total garbage — not our problem.

But that’s exactly what Robins is getting at in his lawsuit. He never gave permission for Spokeo to maintain a digital dossier on his life, nor did he authorize the company to sell his information for a fee of $13.95 a month, or $29.70 for six months’ membership.

“In the Spokeo case, the company argued that people can only sue when they can identify, for example, a job interview lost because of Spokeo’s unreasonable record-keeping,” said Lauren Willis, a Loyola Law School professor.

The 9th Circuit, she said, decided in its latest ruling “that you can sue a company when it does not take sufficient care to ensure accuracy and produces false reports about you, even if you cannot identify a particular job opportunity you lost or car loan for which you were overcharged.”

You can opt out from having your information listed on Spokeo, but I found the process needlessly complex and confusing. Also, the site says that even if you opt out, it will still display any court records that pertain to you unless you can prove the records have been expunged or sealed.

In 2012, Spokeo paid $800,000 to settle Federal Trade Commission charges that it sold people’s information “to companies in the human resources, background screening and recruiting industries” without taking steps to comply with the federal Fair Credit Reporting Act.

The site now stresses that the company isn’t a credit reporting agency and thus isn’t subject to the law, which requires that credit agencies “follow reasonable procedures to assure maximum possible accuracy.”

Willis said it’s debatable whether Spokeo can evade legal responsibilities by simply declaring that it’s not a credit reporting agency, particularly if its reports are available to employers and lenders. She cited the “walks like a duck” legal theory.

My solution is creation of a do-not-aggregate list, modeled on the do-not-call list. Consumers would be able, through the FTC, to opt out of having their personal information compiled for commercial purposes by people-search businesses that fail to meet the standards of the Fair Credit Reporting Act.

Any company that includes someone’s information after such an opt-out would be in violation of the law and subject to a penalty. The fine for violating the do-not-call list currently is as much as $40,654 per call.

Spokeo’s Tang didn’t want his own info out there. He’s no different from the rest of us.

David Lazarus’ column runs Tuesdays and Fridays. He also can be seen daily on KTLA-TV Channel 5 and followed on Twitter @Davidlaz. Send your tips or feedback to david.lazarus @latimes.com.