EFF to Supreme Court: Users Must Be Able to Hold Tech Companies Accountable in Lawsuits When Their Data is Mishandled

Washington, D.C.—The Electronic Frontier Foundation (EFF) today urged the Supreme Court to rule that consumers can take big tech companies like Facebook and Google to court, including in class action lawsuits, to hold them accountable for privacy and other user data-related violations, regardless of whether they can show they suffered identical harms.

Standing up to defend the ability of tech users to hold powerful companies responsible for protecting the massive amounts of personal data they capture and store every day, EFF and co-counsel Hausfeld LLP told the high court that—contrary to the companies’ claims—Congress rightfully ensured that users could sue when those companies mishandle sensitive, private information about them.

EFF filed a brief today with the Supreme Court in a case called TransUnion v. Ramirez. In the case, TransUnion misidentified plaintiff Sergio Ramirez and over 8,000 other people as included on the U.S. terrorist list. As a result, Ramirez was flagged as a terrorist when he tried to purchase a car. TransUnion is fighting to keep the other consumers it tagged as terrorists from suing it as a group with Ramirez. The company argues that they don’t have standing to sue under the law and shouldn’t be part of the “class” of plaintiffs in the lawsuit because they weren’t harmed in the same way as Ramirez.

Facebook, Google, and tech industry trade groups are siding with TransUnion. They filed a legal brief pushing for even more limitations on users and others impacted by a wide range of privacy and data integrity violations. The companies argue that users whose biometric information is misused or are improperly tracked or wiretapped should also be denied the opportunity to sue if they did not lose money or property. Even those who can sue must all have been harmed in the exact same way to file a class action case, the companies argue.

“Facebook and the other tech giants gather and use immense quantities of our personal data each day, but don’t want to be held accountable by their users in court when they go back on their privacy promises, or unlawfully mishandle user data,” said EFF Executive Director Cindy Cohn. “This logic—that the courthouse door should remain closed unless their users suffer financial or personal injuries even when the companies flagrantly violate the law—is cynical and wrong. Intangible harms have long been recognized as harms under the law, and Congress and the states must be allowed to pass laws that protect us. In today’s digital economy, all of us depend on these companies to ensure that the data they have about us is accurate and safeguarded. When it’s mishandled, we should be able to take those companies to court.”

Class action rules require people suing as a group to have the same claims based upon the same basic facts, not the exact same injuries, EFF told the Supreme Court. Facebook and other tech companies are asking the court to change that, which will make it harder for users to hold them accountable and utilize class action lawsuits to do so.

“When users lose control of their data, or the correctness of their data is compromised, those are serious harms in and of themselves, and they put users at tremendous risk” said EFF Senior Staff Attorney Adam Schwartz. “Companies that gather and use vast amounts of users’ personal, private information are trying to raise the bar on their own accountability when they fail to protect people’s data. We are telling the Supreme Court: don’t let them.”

For the brief:
https://www.eff.org/document/transunion-amicus-brief

For more on users’ right to sue:
https://www.eff.org/deeplinks/2019/01/you-should-have-right-sue-companies-violate-your-privacy