4th Circuit Vacates Class Certification in Consumer Data Breach Case
The Fourth Circuit recently published its opinion reversing the District Court’s class certification consolidating customer lawsuits stemming from the 2018 data breach of a multinational hotel corporate franchise.
This ruling comes after the District Court certified classes of consumers for breach of contract, alleged violations of state consumer protection laws for the Defendant Corporation’s failure to take reasonable steps to protect consumer data from the foreseeable risk of a cyberattack, as well as certifying issues of negligence. Defendant Corporation ultimately appealed the District Court’s certification to the Fourth Circuit.
In reviewing Defendant’s Appeal, the Fourth Circuit concluded that the District Court erred in failing to consider the implications of a class action waiver signed by all potential class members and the effect this waiver would have on the entire certification order.
In its opinion honing in on the question of waiver, the Fourth Circuit decertified several statewide classes of consumers based on the alleged waiver of their right to sue contained in the agreement signed by consumers when registering for the Defendant Corporation’s rewards program. Although Plaintiffs argued that Defendant Corporation’s failure to raise this potential waiver issue in the prior three years of litigation amounted to waiving the objection, the Fourth Circuit found this argument to pertain to the enforceability of the waiver and not the issue of standing necessary for class certification under Federal Rule of Civil Procedure 23.
Beyond this determination, the Fourth Circuit concluded that additional specifics, including additional certification of class issues, of this case could not be addressed until the question of contractual class waiver was resolved. Accordingly, the Fourth Circuit vacated the District Court’s certification and remanded the case for further proceedings regarding the enforceability of the alleged class waiver.
