On The Case

11th Circuit’s strict new rule for data breach standing will figure in Equifax appeal

(Reuters) - Shiyang Huang is not a lawyer. Nor is he a professional objector who makes a living from demanding payments to drop filing vexatious objections to class action appeals. By his account, he’s just a pro se litigant from Topeka who doesn’t think federal courts should be called upon to adjudicate claims by people who haven’t been harmed.

And, suddenly, his arguments could affect the outcome of the biggest data breach settlement in U.S. history.

I’m speaking, of course, of Equifax’s $380.5 million deal, which addressed a 2017 hack of the credit rating firm that compromised personal information about nearly 150 million Americans. Class counsel from Doffermyre Shields Canfield & Knowles, DiCello Levitt Gutzler and Stueve Siegel Hanson filed a 575-page amended complaint in the case in 2018 on behalf of 96 named plaintiffs. U.S. District Judge Thomas Thrash of Atlanta allowed some of the class claims to proceed in a 2019 decision (362 F.Supp.3d 1295). The class reached a settlement that class counsel have described as the most comprehensive recovery ever achieved for data breach victims, including cash payments to some plaintiffs and credit monitoring said to be worth billions of dollars. Judge Thrash approved the deal in Dec. 2019 (2020 WL 256132).

Huang is one of six objectors who asked the 11th U.S. Circuit Court of Appeals to review Judge Thrash’s approval. His appellate brief principally argued that the class plaintiffs failed to establish their constitutional right to sue under Article III because they did not allege a concrete injury from the exposure of their data. Huang cited the U.S. Supreme Court’s rulings in Clapper v. Amnesty International (133 S.Ct. 1138) and Spokeo v. Robins (2016 WL 2842447), which, as you know, made it tougher for plaintiffs to establish standing for prospective injuries or mere statutory violations. Huang noted that after the Clapper decision, several appellate circuits have ruled that data breach victims can’t satisfy Article III requirements by alleging they’re at increased risk of identity theft.

The Equifax trial judge, Huang said, never even grappled with the Article III issue. Judge Thrash’s ruling on Equifax’s dismissal motion said in a footnote that the company had not contested plaintiffs’ constitutional standing, arguing instead that the class failed to allege a tort claim because plaintiffs did not plead a legally cognizable harm. Judge Thrash implied that Article III standing could be revisited at the class certifications stage of the case – but that never happened because the case settled before the class was certified. Huang argued in his 11th Circuit brief that the appeals court cannot address the merits of the settlement before answering the threshold question of plaintiffs’ right to sue.

Class counsel said in their response brief that their complaint established plaintiffs’ Article III standing: Class representatives, they said, claimed to have spent time and money to redress identity theft and fraud and to monitor their credit reports. The class also alleged imminent risk of future identity theft. “These allegations,” the class brief said, “readily meet the injury-in-fact requirement.”

But they don’t, under current 11th Circuit law. Last fall, when Huang and Equifax filed their briefs, the 11th Circuit had not published a definitive decision on standing for plaintiffs in data breach suits. Now it has. The appeals court held last week in Tsao v. Captiva MVP (2021 WL 381948) that data breach victims must show more than an increased risk of identity theft or costs incurred to address that increased risk in order to establish their constitutional right to sue. Tsao, in other words, seems to undermine both of the justifications for standing that class counsel asserted in their brief to the 11th Circuit.

Class counsel Norman Siegel of Stueve Siegel said, however, that the operative class complaint contains allegations that will easily satisfy the 11th Circuit’s newly-articulated standard. “Unlike Tsao, highly confidential personal information including social security numbers were compromised in the Equifax breach,” Siegel said in an email. “Moreover, unlike Tsao, there are several plaintiffs that alleged identity theft and fraud as a result of the Equifax breach.”

Equifax counsel David Balser of King & Spalding said the company does not comment on pending cases.

Another Equifax objector, Ted Frank of the Hamilton Lincoln Law Institute, addressed the Tsao ruling in a letter to the 11th Circuit on Friday. Frank, who is contesting the merits of the Equifax settlement, told the appeals court that the Tsao opinion “expressly rejects” the standing arguments that class counsel cited in their appellate brief. Frank said he believes, however, that the class can establish standing by alleging the theft of their social security numbers – and that the 11th Circuit can permit plaintiffs to amend their pleadings without the delay of remand back to Judge Thrash. (Frank and class counsel have been in a bitter war in this case, so it was a bit of a surprise to see Frank propose an easy fix on the standing issue.)

Huang told me Monday that he’s gratified the 11th Circuit’s Tsao decision has forced the issue of standing in the Equifax appeal, adding jokingly that he’d be happy to substitute the appeal opinion for his brief. “Nobody wanted to talk about (standing) but now they have to,” Huang said. He said in a follow-up email that under 11th Circuit’s en banc decision last October in Muransky v. Godiva (905 F.3d 1200), in which the appeals court dismissed a class action because plaintiffs failed to establish standing, the Equifax case should be tossed. “Otherwise, it’ll be a waste of time and taxpayer money for courts to entertain nonjusticiable cases for years,” Huang said.

The Equifax appeal is set for oral argument on April 20.

(Reporting by Alison Frankel)

The opinions expressed here are those of the author. They do not reflect the views of Reuters News, which, under the Trust Principles, is committed to integrity, independence and freedom from bias.

NOTE: This story has been updated to include comment from Equifax class counsel Norman Siegel.