The Supreme Court on Monday sided with an online “people search” company in a closely-watched case over when and how consumers can sue for privacy violations.
The case involved a data broker, Spokeo, that told the world that a Virginia man Thomas Robins was in his 50’s, married, affluent and held a graduate degree — none of which was true. In response, the 29-year-old Robins filed a lawsuit saying the false online information had caused him harm.
The Supreme Court, however, disagreed and reversed a lower court’s ruling by a 6-2 vote. In an opinion by Justice Samuel Alito, it found the lower court had failed to consider whether Robins had suffered a “concrete” harm.
“We have made it clear time and time again that an injury in fact must be both concrete and particularized,” wrote Alito, who added that certain types of mistakes wouldn’t qualify. “An example that comes readily to mind is an incorrect zip code. It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.”
The ruling means the case will go back to the 9th Circuit Court of Appeals for the judges to take a closer at how or if Robins had been harmed.
The opinion also amounts to a victory for companies that handle consumer data since a loss for Spokeo would have opened the door to other class action complaints, like the one filed by Robins, and potentially billions of dollars in damages. In a blog post, the company hailed the ruling for affirming the need for consumers to point to a “real” harm.
“Spokeo looks forward to the chance to continue advocating against no-injury class action lawsuits that threaten American businesses and the overall economy,” said the blog post.
An attorney for Robins, meanwhile, predicted he would prevail when the case returns to the lower court.
“[W]e are very confident that Robins — and his class — will ultimately get to present their case to a jury,” said Jay Edelson of Edelson LLC. “We have more work to do, but this decision puts us 90% there.”
The decision drew mixed early reaction from the legal community on Twitter, some of whom complained that the court’s zip code example was flawed. Here are observations from two law professors:
One of the only specific examples in entire Spokeo privacy opinion and it's clearly wrong. Because redlining. https://t.co/nloQiVQ95a
— William McGeveran (@BillMcGev) May 16, 2016
My kid gets kicked out of our public school because we supposedly don't live there#spokeo#zipcodeharms
— Ryan Calo (@rcalo) May 16, 2016
The case is not a total victory for Spokeo and other companies, however, since it invites lower courts to continue exploring the issue of when consumers are harmed by publishing their information online. The ruling concluded:
Because the Ninth Circuit failed to fully appreciate the distinction between concreteness and particularization, its standing analysis was incomplete. It did not address the question framed by our discussion, namely, whether the particular procedural violations alleged in this case entail a degree of risk sufficient to meet the concreteness requirement. We take no position as to whether the Ninth Circuit’s ultimate conclusion—that Robins adequately alleged an injury in fact—was correct.
Some lawyers on Twitter suggested the ruling is not decisive, and the issues in the case are likely to resurface:
https://twitter.com/sbagen/status/732218458830741504
https://twitter.com/dispositive/status/732220772274438144
Re: Spokeo, it just shouldn't have taken #SCOTUS so long to hand down an 11-page vacate-and-remand. Another example of the Scalia effect?
— Steve Vladeck (@steve_vladeck) May 16, 2016
Monday’s ruling also sidestepped another major legal issue in the case: whether consumers can bring a class action suits over so-called “statutory violations.”
These refer to laws that provide automatic penalties for certain actions, even if they amount to minor technical violations. Companies fear such laws will encourage frivolous lawsuits led by plaintiff-side lawyers eager to cash in.
Get Data Sheet, Fortune’s technology newsletter.
In the case of Robins, his privacy claim alleged in part that Spokeo had violated information provisions in the Fair Credit Reporting Act of 1970.
The Spokeo case alarmed a broad segment of corporate America, including the tech sector. When the case went to the Supreme Court, firms like Google, Facebook and Netflix all argued in support of Spokeo, claiming a ruling for Robins would threaten them with a cascade of lawsuits even in cases on inconsequential privacy violations.
In a dissent, Justice Ruth Bader Ginsburg, disagreed that the lower court had failed to identify a concrete injury. She argued that Robins had already showed enough harm.
“Far from an incorrect zip code, Robins complains of misinformation about his education, family situation, and economic status, inaccurate representations that could affect his fortune in the job market,” wrote Ginsburg in a decision joined by Justice Sonia Sotomayor.
Justice Clarence Thomas added a concurrence in support of the majority.
This story was updated several times.
