Sample Solution

Without a statute that provides a private right of action, even when a plaintiff has suffered economic harm as a result of trying to mitigate an anticipated future privacy violation, the Supreme Court has held that such an injury is too speculative for standing. In Clapper v. Amnesty International USA, the Court held that plaintiffs could not “manufacture standing” based on their fears of a speculative future harm and the money they spent in order to safeguard against surveillance of their client communications. This strict reading of the imminence requirement for standing further restricts the situations in which a privacy plaintiff may bring a claim absent a showing of an imminent violation.

In Europe, the GDPR has enabled litigants with a new set of rights, including the right to complain, select representatives, and receive judicial remedy when firms fail to comply with the GDPR. Just hours after the GDPR came into effect, Austrian activist Max Schrems’ non-profit None of Your Business (NOYB) filed complaints against Google, Facebook, Instagram and WhatsApp, arguing that they act illegally by forcing users to accept intrusive terms of service or lose access.

The complaints demand investigations by the European supervisory authorities, and under Article 83, propose fines of up to four percent of the companies’ worldwide annual turnover of the preceding year—the maximum possible fine under the GDPR. Importantly, claims by advocacy groups, such as NYOB, under the GDPR need not allege injury or harm—which would be required for class actions in U.S. federal court—but only failure to comply with regulation, even if no harm results. This allows privacy plaintiffs to overcome a difficult hurdle, as there are frequently no concrete harms for courts to latch onto in privacy claims. While class actions can be viewed as a convenient, effective remedy for harm, they also