SCOTUS Won’t Review Ikea ZIP Code Collection Claim

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Jimmy H. Koo

The U.S. Supreme Court Oct. 2 denied Ikea U.S. West Inc.'s request to review whether a plaintiff alleging a state privacy statute violation who didn’t suffer any concrete injury can sidestep federal court jurisdiction ( Ikea U.S.A. W., Inc. v. Medellin , U.S., No. 17-65, review denied 10/2/17 ).

The Supreme Court’s refusal to hear the case removes another opportunity for the justices to clarify what level of harm is necessary for legal standing to sue under Article III, an issue that has made it difficult for some privacy cases to proceed.

The case raised issues about what courts should do about statutes that allow plaintiffs to collect damages for statutory violations without further harm, in light of the the Supreme Court’s 2016 Robins v. Spokeo Inc. ruling, which held that a plaintiff must allege a concrete and particularized injury to have legal standing to sue. The issue has held great interest in personal information privacy and data breach cases where plaintiffs allege harm based on the prospect of future injury from an event, such as identity theft, but may not have the kind of concrete injury Spokeo describes.

Courts have disagreed on applying Spokeo’s concreteness requirement, reaching different conclusions regarding whether a violation of a statute, without further injury to consumers, such as identify theft or fraudulent charges, is sufficient to grant standing.

Here, named plaintiff Rita Medellin filed a class complaint based on Ikea’s alleged technical violation of a California statute. The statute prohibits businesses from asking cardholders to provide personal identification information during credit card transactions, and Ikea allegedly asked customers for their ZIP codes to complete credit card transactions. A federal trial court granted class status, but later decertified the class. The Spokeo ruling came down after the trial court’s ruling.

Medellin appealed to the U.S. Court of Appeals for the Ninth Circuit. In an unpublished order, the court vacated the trial court’s class decertification and ordered the lower court to dismiss the case for lack injury without prejudice to refile claims. The ruling opened the door for Medellin alone to pursue the case in state court.

Furniture and home furnishings giant Ikea asked the Supreme Court to review whether the Ninth Circuit sufficiently considered whether violations of the California statute at issue, the Song-Beverly Credit Card Act, create a credible threat of harm that is real and immediate, and not conjectural or hypothetical.

Ikea argued that judicial economy is threatened if single members of a class can eliminate jurisdiction for other parties by conceding that they haven’t suffered any concrete injury. Ikea had also asked the Supreme Court to review whether standing to sue may be negated by a plaintiff’s concession of not suffering an injury.

The D.C. Circuit has held that a mere request from a company for a consumer’s ZIP code, without a showing actual injury, isn’t sufficient to grant standing to sue under Spokeo.

Robins Kaplan LLP represented Ikea. Blood Hurst & O’Reardon LLP represented Medellin.

To contact the reporter on this story: Jimmy H. Koo in Washington at

To contact the editor responsible for this story: Donald Aplin at

For More Information

Full text of the order denying review is available at

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Bloomberg Law: Privacy & Data Security