The issue of when plaintiffs have the right to sue under the Fair Credit Reporting Act for injury may still not be settled despite a U.S. Supreme Court ruling and a subsequent rehearing by a federal appeals court on remand.

The Supreme Court held in Spokeo v. Robins, in a ruling that some experts believe may influence data breach cases, that plaintiffs must show evidence of “concrete” injury to successfully file suit in its 6-2 ruling issued in June 2016. A three-judge panel of the 9th U.S. Circuit Court of Appeals in San Francisco ruled in the plaintiffs favor earlier this month when the case was remanded.

The issue over when a plaintiff has standing to sue has led to several hundred cases in federal and state courts since the Supreme Court’s Spokeo ruling, and the courts continue to disagree as to when plaintiffs have standing to sue, said James A. McKenna, a principal with Jackson Lewis P.C. in Chicago.

The plaintiff in the case was Thomas Robins, who claimed inaccurate information provided by Pasadena, California-based Spokeo, which runs a people-search website, harmed his employment prospects. Mr. Robins alleged that the site contained several inaccuracies, including his age, marital status and level of education.

In a 2014 ruling, the 9th U.S. Circuit Court of Appeals in San Francisco reversed a lower court ruling and held that Mr. Robins had adequately alleged an “injury-in-fact,” which was a requirement for him to sue under Article III of the U.S. Constitution.

The Supreme Court vacated the 9th Circuit ruling, but did not issue a final ruling in the case. It said the 9th Circuit ruling’s analysis was incomplete in failing to address whether the alleged injury was sufficiently concrete.

In its Aug. 1 ruling, a three-judge appeals court panel unanimously agreed it was. The FCRA procedures “at issue in this case were crafted to protect consumers (like Robins’s) concrete interest in accurate credit reporting about themselves,” said the appellate panel ruling.

“It does not take much imagination to understand how inaccurate reports on such a broad range of material facts about Robins’s life could be deemed a real harm,” said the ruling, holding that Mr. Robins’ alleged injuries are sufficiently concrete and remanding the case for further proceedings.

“I don’t think it broke any new ground,” said Rod M. Fliegel, a shareholder with law firm Littler Mendelson P.C. in San Francisco, of the 9th Circuit ruling.

The FCRA was enacted in the 1970s, and inaccurate reporting about individuals “has long been recognized as potentially actionable, so all the court said was, ‘We find it actionable in federal court because the plaintiff had alleged sufficient injury to his employment prospects and also he alleged emotional distress.’”

The Spokeo case, though, has been cited as a possible indication of how the U.S. Supreme Court may eventually rule on the issue of whether data breach victims can sue if there has been only potential, but no actual, harm created from the theft of their personal information.

Scott L. Vernick, a partner with Fox Rothschild L.L.P. in Philadelphia, said in cases where there has not yet been actual damage caused by a data breach, “the pendulum went from standing to no standing, and now it’s more mixed depending on which court you’re in.”

Ana Tagvoryan, a partner with Blank Rome L.L.P. in Los Angeles, said the “ruling substantially limits the arguments that a defendant can make in terms of standing and concrete harm in federal court.”

It will help in the defense of data breach cases, she said, but “plaintiffs will still have to identify a statute that has been violated,” she said. “Otherwise, I think the Spokeo case would not be very relevant,” she said.

Pamela Q. Devata, a partner with Seyfarth Shaw L.L.P. in Chicago, said both defense and plaintiff attorneys “obviously have been using the Supreme Court Spokeo decision to make standing arguments” at both the federal and state court levels, although the majority of cases have been at the state court level.

This is because, she said, the Spokeo case “really deals with when someone will have standing under Article III of the Constitution to bring a case in federal court,” and to avoid being challenged on that ground plaintiffs counsel have been bringing more cases in state court.

Meanwhile, “There’s been a split in federal courts, especially in FCRA cases, as to what constitutes standing” following the Supreme Court ruling, said Ms. Devata. The 9th Circuit ruling shows that oftentimes the rulings will be “factually specific,” she said.

There have been 500 to 1,000 decisions, at an average daily rate of two or three, that have interpreted the decision based on statutes including the FCRA as well as the Telephone Consumer Protection Act of 1991 and the Truth in Lending Act, among others, said Mr. McKenna.

He said the issue may eventually be reconsidered by the U.S. Supreme Court. The U.S. Supreme Court has been asked to consider a case in the employment context, Sarmed Syed et al. v M-1, L.L.C. et al., which deals with Spokeo’s application, Mr. McKenna said.

The 9th Circuit held in its January 2017 ruling in Syed that an employer that provided a job applicant with a background check disclosure and consent form at the same time as a liability waiver violated the FCRA, in the first appeals court ruling on this issue.

“I think in the next year or two there will be another case before the U.S. Supreme Court deciding what Spokeo means,” although it may not be Syed, Mr. McKenna said.