Statutory Damages Class Actions

Almost one year ago, we wrote  about the impact of Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016) on Fair and Accurate Credit Transaction Act (FACTA) class actions and offered practical pointers for defendants confronting FACTA class claims. As we explained, because often the only “harm” from alleged FACTA violations is a theoretical increase in the risk of a potential future injury, such as identity theft, FACTA plaintiffs have difficulty meeting Article III’s injury-in-fact requirement. On March 8, 2019, the Third Circuit Court of Appeals issued its highly anticipated decision in another FACTA case, Kamal v. J. Crew Group, Inc., 2019 WL 1087350, which continues the post-Spokeo trend of requiring a plaintiff to allege more than some speculative, theoretical threat of future harm to establish Article III standing from a FACTA violation.

Third Circuit Reinforces That FACTA Class Actions Remain Ideal Targets for Spokeo ChallengesFACTA strictly—which is to say, draconically—forbids merchants from printing more than the last five digits of a credit or debit card number on any electronically printed receipt provided to the card holder at the point of sale, and provides potentially onerous penalties for violations. Ahmed Kamal, the putative class representative, alleged that J. Crew printed the first six and last four digits of his cards on three separate transactions in 2014 and 2015. After his original complaint was dismissed for failure to allege a concrete injury, Kamal asserted in an amended complaint that he was injured by J. Crew’s disclosure of his private information and by a resulting increased exposure to future identity theft or credit card fraud.  The district court, relying on Spokeo, dismissed the case, ruling that Kamal failed to identify an injury-in-fact sufficient to confer Article III standing. Kamal’s privacy concerns, in the court’s eyes, fell short of recognized privacy interests and instead amounted to a “bare procedural violation divorced from any concrete harm,” and the court determined that J. Crew’s actions had not materially increased Kamal’s risk of identity theft or fraud. Kamal disagreed and appealed.

On appeal, the Third Circuit, following the Supreme Court’s instruction in Spokeo, analyzed whether Kamal’s alleged injuries of disclosure of private information and increased risk of identity theft or fraud enjoyed a “close relationship” to any harms that traditionally have provided a basis for common law privacy torts and breach of confidence. Kamal argued that he faced a real risk of identity theft because the first six digits identified his issuing bank and card type and that the receipts further identified his card issuer by name. The court declined to exalt this possibility of future events into a present injury. It noted that the information was not disclosed to a third party. Indeed, it appeared only on a printed receipt provided to Kamal. The Third Circuit recognized that receiving a printed copy of your own credit card number is not an injury that bears a “close relationship” with harms that traditionally provide a basis for analogous common law claims. Similarly, the court found Kamal’s argument that J. Crew created a risk of identity theft or card fraud unpersuasive. Notably, the risk could only be material if the receipts fell into a nefarious third party’s hands, and only if that third party would be able to obtain the remaining card digits and the expiration date, security code or other information needed to use the card—none of which had occurred in that case. The court declined to find a concrete injury from this “speculative chain of events.”

The lack of a “close relationship” between the alleged injuries and the harms associated with analogous common law claims led the Third Circuit to hold that Kamal lacked Article III standing to bring the FACTA class action. But there is a procedural wrinkle worth highlighting: The Third Circuit vacated the district court’s order dismissing the lawsuit with prejudice—even though Kamal had requested the order with prejudice as a final order for appeal—and remanded the case for the limited purpose of entering an order of dismissal without prejudice. The Third Circuit reasoned that because Kamal did not have standing, the district court lacked subject matter jurisdiction over decisions on the merits over the case and, therefore, it was improper to grant a dismissal for lack of standing with prejudice.

Kamal reinforces several of the main takeaways for defendants that we set forth in our previous post:  (1) Class actions based on federal statutory violations may be vulnerable to concrete injury, Article III standing challenges, particularly where, as in Kamal and many other FACTA class actions, the alleged harm is a theoretical, conjectural increase in the risk of future injury; and (2) even if the court does not ultimately dismiss the case, contesting plaintiffs’ allegations of injury on Spokeo grounds may result in individualized allegations of harm ultimately helpful to oppose class certification. But Kamal also shows the limits of a successful jurisdictional challenge, as the Third Circuit’s decision to remand the case shows. Several conflicting strategic considerations inform how companies can best challenge federal statutory class actions, and there is no one-size-fits-all solution.

TIME STOPS FOR NO ONE: The Supreme Court Addresses Timeliness Issues in Two Separate Class CasesThe U.S. Supreme Court suddenly seems to have a little time on its hands. Or at least on its mind. In two different class action cases on its docket this week, the question at hand was timeliness.

First, in Nutraceutical Corp. v. Lambert, the Supreme Court ruled that Rule 23(f)’s 14-day time limit for filing a Rule 23(f) petition for permission to appeal from an order granting or denying class certification is not flexible and is not subject to equitable tolling. The window for filing a Rule 23(f) petition opens when the certification order is entered and slams shut exactly 14 days later, at least absent a motion to reconsider filed within that 14-day window.

Plaintiff’s counsel seemed to have a little judicial help in getting themselves wrapped around the timeliness axle. The case was filed as a class action alleging misleading marketing of a dietary supplement in contravention of California law. The trial court initially granted class certification, but on February 20, 2015, changed its mind and decertified the class. At a status conference 10 days later, would-be class counsel informed the district judge that plaintiff would be filing a motion to reconsider. The trial court told plaintiff to file any such motion on or before March 12, a deadline that was some 20 days after the decertification order. However, neither plaintiff nor the court mentioned anything about a 23(f) appeal. Plaintiff’s counsel filed a motion to reconsider on March 12, and the trial court denied it on June 24, 2015. Fourteen days after that, plaintiff’s counsel filed a 23(f) petition with the Ninth Circuit.

The Ninth Circuit tried to cut plaintiff’s counsel some slack. It ruled that the time limit of Rule 23(f) was not jurisdictional, and therefore was subject to equitable tolling. The court found that the plaintiff qualified for equitable tolling because his counsel “informed the [District Court] orally of his intention to seek reconsideration” within Rule 23(f )’s 14-day window, relied on the district court’s sua sponte March 12 deadline for filing reconsideration, and “otherwise acted diligently.” Therefore, the petition for permission to appeal would be deemed timely. For good measure, the Ninth Circuit also granted permission to appeal and reversed the decertification order.

But the Supreme Court said “not so fast.” It agreed that Rule 23(f)’s time limit is not jurisdictional, but explained that was not the end of the story. “Whether a rule precludes equitable tolling turns not on its jurisdictional character but rather on whether the text of the rule leaves room for such flexibility.” Here, Federal Rules of Appellate Procedure 2 and 26(b) expressly combine to remove Rule 23(f) appeals from among those provisions of the rules that may be suspended in the discretion of the appellate court, the latter stating that a court of appeals “may not extend the time to file . . . a petition for permission to appeal.” This was the end of the inquiry as far as SCOTUS was concerned. The very textualist opinion was unanimous and was written by Justice Sotomayor.

The opinion notes, but pointedly does not endorse, the fact that every circuit court to address the issue so far has ruled that a motion for reconsideration filed within the 14-day window after the order on class certification postpones the time for 23(f) appeal. But this is not a matter of tolling, the court explained: A “timely motion for reconsideration filed within a window to appeal does not toll anything; it renders an otherwise final decision of a district court not final for purposes of appeal.” Interestingly, the court also punted back to the Ninth Circuit two arguments the plaintiff made that his appeal was timely even without equitable tolling. The first was his argument that even if his motion for reconsideration was not filed within 14 days of the decertification order, it was filed within the time allowed for reconsideration motions, and a timely reconsideration motion should cause the time to appeal to run from the disposition of the reconsideration motion, not from the original order decertifying the class. The second was his argument that the denial of reconsideration was itself an order subject to 23(f) appeal as an order denying class certification. All of these reserved questions will surely be litigated, and in time could end up back in front of the Supreme Court.

Meanwhile, in Rotkiske v. Klemm, the High Court just agreed to decide whether the one-year statute of limitations for class and individual claims brought under the Fair Debt Collection Practices Act begins to run from the moment of the violation or from the plaintiff’s discovery of the facts giving rise to the violation. The Third Circuit says it runs from the moment of violation regardless of the time of discovery. The Fourth and Ninth Circuits disagree. The issue is important to class action practice because the FDCPA is one of those many “gotcha” statutes that offer classwide statutory damages for technical violations, and a discovery rule could reopen endless events of the past to fresh litigation today.

We will continue to monitor the ripples from both of these cases.

Illinois Supreme Court Adopts Expansive Interpretation of Standing under Illinois BIPA, Potentially Opening the Flood Gates for Class ActionsIn a much-anticipated ruling, the Illinois Supreme Court recently held that allegations of actual injury are not required to seek damages under Illinois’ Biometric Information Privacy Act (BIPA or the Act). The case is Rosenbach v. Six Flags Entertainment Corporation, and after Rosenbach, “an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an ‘aggrieved’ person and be entitled to seek liquidated damages and injunctive relief pursuant to the Act.” This ruling will likely continue the trend of an increasing number of class actions against companies that have failed to strictly comply with BIPA’s requirements.

Passed in 2008, the Illinois BIPA was the first statute of its kind. Under the Act, private entities collecting biometric information, such as retina or iris scans, finger or palm prints, voiceprints, and facial geometry scans, are required to comply with certain written notice, consent, and disclosure requirements. The Act provides a private right of action, allowing “[a]ny person aggrieved by a violation of th[e] Act” to bring suit to recover liquidated or actual damages, attorneys’ fees, litigation expenses and other relief, including injunctive relief.  Although relatively few class actions were filed under BIPA in its early years, the pace has picked up of late. At the risk of an understatement, we expect that trend to continue in the wake of Rosenbach.

In Rosenbach, the plaintiff brought a class action against Six Flags under BIPA on behalf of her 14-year-old son, after Six Flags scanned and collected her son’s fingerprint as part of his application for a season pass to the Chicago-land amusement park. Rosenbach alleged that Six Flags violated BIPA by failing to provide written notice of the purpose of the scan or how long the information would be stored and by failing to obtain written consent from either her or her son. Rosenbach also alleged that “she never would have purchased a season pass for her son” if she had known that his fingerprint would be electronically scanned.

Six Flags argued that Rosenbach could not be considered an “aggrieved” person because she failed to allege an actual injury. Illinois’ intermediate appellate court agreed. It likened the determination of whether or not a person is “aggrieved” under the Act to the determination of injury-in-fact and concluded that to be “aggrieved” a plaintiff must allege actual harm. The court downplayed Rosenbach’s allegations that she never would have bought a season pass for her son had she known about the electronic fingerprint requirement.

The Illinois Supreme Court reversed and adopted a truly expansive view of what it means to be “aggrieved”: a person subjected to any BIPA violation, no matter how slight, is aggrieved under the Act.  Because the Act protects a person’s fundamental right to control his or her biometric information, the court concluded that even technical or procedural violations of the Act “constitute[] an invasion, impairment, or denial” of that fundamental right. Thus, any violation, by itself, creates a “real and significant” injury, regardless of whether or not that violation results in any additional harm to the plaintiff.

We pause here to note that the court did not address Illinois’ constitutional standing, only statutory standing under Illinois’ statute. Illinois courts have historically interpreted Illinois’ constitutional standing requirements consistently with the federal standards. It is hard not to see Rosenbach as a departure from Illinois’ historical constitutional standing jurisprudence. In concluding that any alleged violation of BIPA is sufficient to permit a plaintiff to seek damages under the Act, the Illinois Supreme Court seemingly pivoted away from its own (and the U.S. Supreme Court’s) jurisprudence, which condition standing on proof of a real, concrete injury-in-fact. We caution, however, against over reading Rosenbach in this regard: Six Flags does not appear to have raised the issue of constitutional standing.

Perhaps because constitutional standing was not teed up, the court also failed to engage several federal cases that have dismissed BIPA claims for lack of Article III standing where the plaintiffs failed to allege an injury-in-fact. For example, in Santana v. Take-Two Interactive Software, the Second Circuit applied Spokeo and concluded that mere technical violations of BIPA, such as the failure to strictly comply with the Act’s notice, consent, and disclosure requirements, that do not result in any actual harm are insufficient to confer standing under Article III. Rosenbach’s analysis of what it means to be “aggrieved” under the Act potentially is inconsistent with Santana’s analysis of injury-in-fact.

On the near horizon, expect a flood of new class actions to be filed under BIPA on behalf of consumers, employees, and anyone else whose biometric data was taken without consent or without the statutorily mandated disclosures. Under Rosenbach’s expansive interpretation of what makes someone “aggrieved” under the Act, those actions will almost certainly have statutory standing. But defendants should not necessarily assume that Rosenbach also means that any alleged violation of BIPA is sufficient to confer constitutional standing under the Illinois Constitution, let alone the U.S. Constitution. That issue will have to work its way through the courts.

Turning to practical matters, potential defendants should get ready. Part of getting ready is planning for litigation defense. We expect many defendants will continue to raise constitutional standing arguments in BIPA class actions that are predicated on technical, procedural violations of the statute that resulted in no harm or prejudice, whether proceeding in state or in federal court. But, as these jurisdictional arguments continue to mature, companies need to be examining their use of biometric data and whether their biometric data practices and procedures fully comply with BIPA. Plaintiffs will likely view any biometric data retained or used by a company as an inviting litigation target, and the threat of liquated damages and attorneys’ fees for successful plaintiffs creates a powerful incentive to bring “touch foul” lawsuits.

Companies should also keep an eye on other states. With BIPA in the headlines, other states’ legislatures may decide to adopt similar laws. There is also the possibility of increased regulatory activity in states with existing biometric privacy laws that do not provide for a private right of action, such as Texas and Washington.

Lastly, companies will increasingly be forced to ask whether the business case for biometrics is worth the risk. Biometrics exist and have flourished because they are easy to use. If litigation drastically increases the risk of creating practical biometric systems, companies have to reevaluate the costs and benefits of implementing such a system in the first place.