The legal system has long taken a “no harm, no foul” approach to certain legal disputes: If you haven’t actually been injured by the other party’s actions, you’ll have a hard time convincing the court that your lawsuit shouldn’t be thrown out. But the internet, where incorrect information can be disseminated globally within seconds (and may never truly be erased), is causing courts to reconsider the question: When can you sue a company for an intangible harm?

One case — Spokeo Inc. v. Robins — has already been to the Supreme Court, and may get there again after today’s ruling by the Ninth Circuit Court of Appeals.

To backtrack (cue the flashback music), Spokeo is a “people search engine,” aggregating publicly available data into a searchable database. In addition to making some of this information available for free, Spokeo markets its database to businesses, claiming that it provides “reliable,” “fresh and accurate” data gleaned from 12 billion records.

That’s not me

Nearly a decade ago, a man named Thomas Robins learned that his relevant Spokeo listing was neither reliable nor accurate. While it did have his correct name, address, and the names of his siblings, Spokeo also listed Robins as married father in his 50s, with a graduate degree and employed in a professional or technical field. The report described Robins’ economic health as “Very Strong” and placed him within the top 10% in terms of personal wealth.

Putting aside the fictional wife and children for a moment, Robins was more concerned about the possible implications of the education, employment, and wealth information. At the time, he was without a job and looking for work. Robins said he worried that potential employers who saw this profile might think him overqualified for the types of employment he was hoping to find.

Robins also felt that Spokeo had broken federal law by publishing and marketing this incorrect information. The Fair Credit Reporting Act (FCRA) sets strict requirements on “consumer reporting agencies.”

The most well-known consumer reporting agencies are the credit report companies, like Experian and TransUnion, but the FCRA actually has a generous definition that encompasses any person or company “which, for monetary fees… regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties.”

Spokeo has a disclaimer on its site stating that it is “not a consumer reporting agency” as defined by the FCRA and that Spokeo “should not be used to make decisions about employment, tenant screening, or any purpose covered by the FCRA.”

But just because you say you’re not something doesn’t make it true. For the purposes of the legal proceedings so far, the courts have assumed the Spokeo does indeed meet the agency definition.

Legal ping-pong

Robins sued Spokeo in federal court in 2010, only to have the case dismissed [PDF] because the judge found that Robins did not have sufficient standing to bring the lawsuit.

“Plaintiff only expresses that he has been unsuccessful in seeking employment, and that he is ‘concerned that the inaccuracies [in] his report will affect his ability to obtain credit, employment, insurance, and the like’,” wrote the District Court judge. “Plaintiff’s concern that he will be adversely affected by Defendant’s website in the future, is an insufficient injury to confer standing.”

This ruling was subsequently overturned [PDF] by the Ninth Circuit in 2014, saying that the law doesn’t require demonstration of actual harm if the plaintiff is alleging willful violation of the FCRA.

SCOTUS calls a mulligan

But that was far from the end, Spokeo appealed this ruling to the Supreme Court, and in 2016 the nation’s highest court ruled on the case without actually settling the important question.

Rather than determine whether or not Robins had standing to bring the lawsuit, the Supremes decided [PDF] to send the case back to the Ninth Circuit with the instruction that they address the question of whether the alleged injury was “concrete” in nature. At the same time, SCOTUS clarified that “concrete” does not necessarily mean “tangible.”

In some respects, the SCOTUS ruling was a minor victory for Spokeo and its supporters in the online and tech industry, as the court did say that not every minor error is sufficiently concrete to merit an FCRA claim.

“An example that comes readily to mind is an incorrect ZIP code,” wrote Justice Samuel Alito for the majority. “It is difficult to imagine how the dissemination of an incorrect ZIP code, without more, could work any concrete harm.”

Additionally, even though the language of the FCRA appears to indicate that plaintiffs can file lawsuits in certain cases without having to demonstrate actual harm, SCOTUS clarified that for a federal court to hear any legal dispute, the Constitution requires that there must be some sort of non-abstract harm involved.

One more time, with feeling

So the Spokeo case returned to the Ninth Circuit, which today ruled [PDF] that Robins’ claims do indeed meet the requirements set out by the Supreme Court.

The three-judge panel held that the intent of congress in creating the FCRA was to protect consumers’ concrete interests with regard to reports about their personal and financial information. Furthermore, the panel determined that if a credit reporting agency gets a person’s age, marital status, education, and employment history wrong, it could have a real, harmful effect on that person’s chances of getting a job.

Though this ruling isn’t as important as it would have been if the Supreme Court had reached the same conclusion, it may serve as a precedent in similar disputes. These sorts of cases — lawsuits over potential harm based on false information posted online — are only going to grow in number as we learn how to apply centuries of bricks-and-mortar legal thinking to an internet where everything can be simultaneously ephemeral and permanent.

For example, there’s the ongoing dispute involving health insurance provider CareFirst.

Customers of the company have been suing CareFirst over a 2015 data breach that compromised account information for more than 1 million people. These plaintiffs have largely not alleged specific harms that resulted from the breach, but contend that having their personal data out there in the hands of criminals is enough of a potential harm to justify the lawsuit.

At least two federal court judges have dismissed cases against CareFirst for lack of standing, but the D.C. Circuit Court of Appeals recently breathed new life into one lawsuit, finding that the lower court judge had given “an unduly narrow reading” to the allegations.

What now?

This is far from the end for this dispute. The Ninth Circuit ruling says nothing about the actual merits of Robins’ claims, only that the allegations are sufficient for the case to continue.

There are two ways this could go: Spokeo could appeal this latest Ninth Circuit opinion to the Supremes since it would raise questions that weren’t answered in the previous SCOTUS ruling. Without that appeal, the case goes back to the District Court judge for further hearings, motions, and whatnot.

In a statement provided to Consumerist, it looks like Spokeo may be okay with this going back to the lower court, banking on the low likelihood that it will be certified as a class action.

Spokeo says it “disappointed” by the Ninth Circuit’s conclusion that Robins has standing to file the suit. The company adds that it will “not only vigorously defend the merits (including that its services do not violate the Fair Credit Reporting Act), but also seek to confirm Justice Kagan’s observation during the oral argument that ‘the class, as [Plaintiff] defined it, is not going to be certified.'”

Jay Edelson, an attorney for Mr. Robins, says he is very pleased with the decision, and that he believes today’s opinion will establish the “definitive decision” for what it takes to decide if a plaintiff has standing in such a case.

“Congress is allowed to define what constitutes an injury and pass a law, the violation of which can give rise to standing,” explains Edelson. “The Court firmly rejected the ‘something more’ doctrine that Spokeo has been pushing for years. As the Court explained, litigants need not show ‘additional injury’ beyond what Congress has articulated.”

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.