Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<b><i>Authors: <a href="http://www.bakerlaw.com/EricaGannKitaev">Erica Gann Kitaev</a> and <a href="http://www.bakerlaw.com/PaulGKarlsgodt">Paul Karlsgodt </a></i></b>

In 2013, theories of injury and damages revealed themselves to be deciding factors at the class certification stage of litigation and whether plaintiffs are able to prove damages on a class-wide basis.  Even in those cases where some members of the proposed class can show that they suffered injury, the existence and nature of any injuries tend to vary greatly amongst putative class members.  One key decision issued in 2013 reinforced the conclusion that variation in the existence and extent of any damages suffered by the victims of a privacy breach can prevent class treatment, but another illustrated that the availability of statutory damages may be used to overcome this problem.

First, In March, the United States District Court for the District of Maine denied the plaintiffs’ motion to certify a class in <i>In re Hannaford Brothers Company Data Security Breach Litigation</i>.<a title="" href="#_ftn1">[1]</a> The court’s analysis was a victory for the class action defense bar because it turned on the issue of the plaintiff’s inability to prove total damages.  Without a reliable method to demonstrate the damages of class members, the court held, plaintiffs could not meet the predominance requirement of Rule 23(b)(3).

<i>Hannaford</i> arose out of a criminal attack on the payment card system network at the Hannaford Bros. grocery chain, which potentially affected over 4 million credit and debit card numbers.  Notably, at the time of its decision on certification, the court was adjudicating the case on remand from the First Circuit, which had affirmed the viability of the plaintiffs’ negligence and implied breach of contract claims because they had alleged damages as foreseeable costs, including fees for replacing cards and the cost of identity theft protection products, to mitigate harm arising from the data breach.<a title="" href="#_ftn2">[2]</a>

On remand, the plaintiffs filed their motion for class certification in line with the First Circuit decision by limiting the proposed class to “Hannaford customers who incurred out-of-pocket costs in mitigation efforts that they undertook in response to learning of the data intrusion.” Nevertheless, the court held plaintiffs could not overcome the predominance requirement because they had not identified a purported expert with a method to show class-wide damages.  The <i>Hannaford</i> court held that although plaintiffs had established commonality as to purported liability, without an expert to show lump-sum damages, they would be left with a series of mini-trials to determine individualized damages.

Conversely, in <i>comScore v. Dunstan</i>, in June, the Seventh Circuit upheld the certification of data privacy class action for alleged privacy violations under various federal statutes, including the Stored Communications Act (SCA) and the Electronic Communications Privacy Act (ECPA).  According to the complaint, comScore, “an Internet research corporation that provides marketing data to a wide variety of clients, generally in the form of aggregated reports about online consumer behavior,” obtained information including “username and passwords,” “PDFs,” and “every file on the monitored consumer’s computer” through software distributed by either “paying affiliate partners to post comScore’s advertisements on their websites in an effort to solicit consumers to download comsScore’s Surveillance Software” or “paying developers to bundle the Surveillance Software with the third-party application provider’s software.”  The expansive class included all individuals “who have had comsScore’s Surveillance Software installed on their computer(s).”

The Northern District of Illinois granted certification in April on the statutory claims, which carried with them statutory damages. The court found that the “plaintiffs raise[d] a variety of common questions that can be resolved on a classwide basis” under these statutes—which define statutory penalties per violation—and that it would be “far more efficient to resolve all of the common issues in a single proceeding, and then to hold individual hearings on damages if necessary, than it would be to litigate all of the common issues repeatedly in individual trials.”<a title="" href="#_ftn3">[3]</a>

Notably, in its appeal to the Seventh Circuit, comScore argued that “individualized issues inherent in cases of this type make them particularly unsuited to class treatment” because plaintiffs would not be able to prove that the entire class, which could potentially include “tens of millions of people,” had “even downloaded comScore’s software, a prerequisite to membership in the class.” The court rejected this argument and, without releasing a written opinion, denied leave to appeal certification<a title="" href="#_ftn4"><sup>[4]</sup></a> of the 10-million member internet privacy class—“the largest privacy case ever certified on an adversarial basis.”

The key difference between <i>Hannaford </i>and <i>comScore </i>is that the damages in <i>comScore </i>were statutory in nature.  Thus, the efficacy of the argument that data privacy class action plaintiffs cannot prove damages on a class-wide basis appears to have been compromised where the damages are statutory in nature.
<div>

<hr align="left" size="1" width="33%" />

<div>

<a title="" href="#_ftnref1">[1]</a> <i>In re Hannaford Brothers Company Data Security Breach Litigation</i>, 293 F.R.D. 21. (D. Me. 2013).

</div>
<div>

<a title="" href="#_ftnref2">[2]</a> <i>Hannaford</i> was adjudicated prior to the Supreme Court’s decision in <i>Clapper</i>, and the issues were decided in the context of a Rule 12(b)(6) motion to dismiss.

</div>
<div>

<a title="" href="#_ftnref3">[3]</a> <a href="http://web2.westlaw.com/find/default.wl?rs=WLW13.10&amp;db=BC-COMPANYSRBD&amp;vr=2.0&amp;docname=CIK(0001158172)&amp;lvbp=T&amp;rp=%2ffind%2fdefault.wl&amp;utid=2&amp;fn=_top&amp;findtype=l&amp;mt=NewLitigator&amp;returnto=BusinessNameReturnTo&amp;sv=Split" target="_top" rel="noopener"><i>Harris v. comScore, Inc.</i></a>, 292 F.R.D. 579 (N.D.Ill. April 2, 2013).

</div>
<div>

<a title="" href="#_ftnref4">[4]</a> <i>comScore v. Dunstan</i>, No. 13-cv-8007 (7th Cir. Jun. 11, 2013).

</div>
</div>

Class Action – Damages and Class Treatment – 2013 Year in Review