On March 20, 2013, the United States District Court for the District of Maine denied a motion brought by plaintiffs in In re Hannaford Brothers Company Data Security Breach Litigation that would have allowed the suit to proceed as a class action. The decision, which concluded that plaintiffs had failed to meet the predominance requirement of Federal Rule of Civil Procedure 23(b)(3), demonstrates the difficulty of certifying a class in the data breach context, where claims often turn on individual issues of causation and damages. Perhaps most significantly, the decision signals that in order for data breach plaintiffs to meet their burden as to predominance, they must first obtain a supporting opinion from an expert.
The Hannaford case began in 2008, when a putative class of Hannaford customers filed suit against the company following Hannaford’s announcement that cyber criminals had stolen customer debit and credit card information from its network systems. Following rulings by the District Court, the United States Court of Appeals for the First Circuit, and the Supreme Court of Maine, the claims against Hannaford were pared down to negligence and breach of implied contract, and the proposed class was limited to customers who, as a result of the data breach, made out-of-pocket payments to cancel their cards or obtain identity theft protection products.
On September 4, 2012, plaintiffs moved to certify the proposed class under Rule 23(b)(3). In order to certify a class under Rule 23(b)(3), a plaintiff must satisfy the numerosity, commonality, typicality, and adequacy requirements of Rule 23(a), and must additionally show that “questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” See Fed. R. Civ. P. 23(b)(3) (emphasis added). The court ruled on each of these requirements, but it was the court’s holding on predominance that was dispositive.
The court began its analysis of the predominance requirement by noting that although questions relating to Hannaford’s conduct were common to the class, the actual impact of the data breach – i.e., the specific mitigation steps each plaintiff took and whether he or she suffered a fraudulent charge – differed from plaintiff to plaintiff. The court acknowledged that previous certification decisions have turned on whether these differences are labeled as pertaining to damages or causation, but it described this “labeling distinction” approach as unhelpful. Instead, the court chose to focus on the practical reality of whether the trial would “work (or not work)” should it proceed as a class action.
Plaintiffs argued that the trial would be straightforward, because they would be able to show by statistical proof the total damages caused to the class. Specifically, they asserted that experts would testify by statistical probability what proportion of the mitigation costs incurred by class members were attributable to the Hannaford breach. They further argued that this evidence would enable a jury to award a lump sum damages award, which could then be administered to the individual claimants. By contrast, Hannaford argued that such a trial would violate the Rules Enabling Act, their due process rights, and fundamental principles of fairness, because it would deprive them of their right to cross-examine each class member. They argued that such cross-examination was necessary in order to ascertain whether the mitigation costs expended were reasonable for each plaintiff in light of the specific circumstances present for that individual, such as whether he or she suffered a fraudulent charge.
The court stated that although Hannaford’s position would be overly restrictive if construed broadly, it was clear that plaintiffs had failed to show “predominance” in this case. The court acknowledged that courts have certified classes in other cases based on the lump-sum-damages approach advocated by plaintiffs, but noted that in those cases, plaintiffs generally had already offered expert opinion testimony as to the ability to prove total damages to the class. Here, plaintiffs had not presented any expert opinion testimony stating that total damages could be proven by statistical methods – they had only represented that they could offer such testimony at a later time. The court added that it could not take judicial notice that there would be such testimony. In the absence of expert opinion testimony, the court held, plaintiffs had failed to support their contention that total damages could be proven by the statistical methods, and thus had failed to meet their burden as to “predominance.” Accordingly, the court denied the plaintiffs’ motion to certify the class.
The Hannaford decision has important implications for class actions, particularly those relating to data security. The variation in impact to members of a proposed class is not unique to the customers in Hannaford, but, in fact, can be found in almost every putative data breach class, where the existence of or details surrounding claimed instances of identity theft vary from person to person. Moreover, for plaintiffs’ attorneys seeking certification of data breach classes, the Hannaford decision prescribes a difficult path forward. Obtaining expert opinion testimony is often a challenging exercise, which plaintiffs will now be under greater pressure to undertake prior to obtaining any assurance from the court that a lump-sum-damages approach will be approved. Indeed, expending such costs at this early stage could prove risky, as there is no guarantee that the motion for certification will ultimately be approved. This is particularly true in light of other data breach decisions, such as the District of Massachusetts’ decision in In re TJX Companies Retail Security Breach Litigation, in which courts have held that individual differences as to causation or reliance precluded certification. Under Hannaford, however, plaintiffs in data breach cases will have no other choice – if they want their suits to proceed as class actions, they will have to obtain an expert opinion prior to certification.