In early November, we wrote about a new Eleventh Circuit decision on Article III standing law which directly held that it was not enough to allege a statutory violation and instead there must be a concrete injury to sustain an action in federal court. Muranksy v. Godiva Chocolatier, Inc., 979 F. 3d 917 (11th Cir. 2020). We noted the sharp divide in the Court and that it was an en banc decision. Now, the Eleventh Circuit has returned to the standing doctrine and applied it in a data breach case, further solidifying the requirement that a class action plaintiff must have a concrete injury to satisfy Article III standing.

On February 4, 2021, the Eleventh Circuit affirmed the trial court’s dismissal of a class action complaint alleging PDQ, a fast casual restaurant, exposed the plaintiff and other customers to a risk of future identity theft. In Tsao v. Captiva MVP Restaurant Partners, LLC, the plaintiff alleged in 2018 PDQ became aware that a hacker exploited PDQ’s point of sale system and gained access to customers’ personal data, including their credit and debit card information. PDQ notified its customers that all locations were affected by the attack and that PDQ customers’ personal data “may” have been accessed.

The plaintiff made two food purchases at PDQ during the data breach period. Following the notice by PDQ, the plaintiff contacted his banks to cancel his credit cards and filed a class action complaint in the Middle District of Florida. The plaintiff alleged he and class members suffered a variety of injuries including “theft of their personal information,” “unauthorized charges on their debit and credit card accounts” and “ascertainable losses in the form of the loss of cash back or other benefits.”

The Eleventh Circuit analyzed the trial court’s dismissal under the framework of Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1546-47 (2016) and Clapper v. Amnesty Int’l USA, 568 U.S. 398 (2013). The Court explained that these cases mean: (1) “a plaintiff alleging a threat of harm does not have Article III standing unless the hypothetical harm alleged is either ‘certainly impending’ or there is a ‘substantial risk’ of such harm”, and (2) “if the hypothetical harm alleged is not ‘certainly impending,’ or if there is not a substantial risk of the harm, a plaintiff cannot conjure standing by inflicting some direct harm on itself to on itself to mitigate a perceived risk.”

The Eleventh Circuit measured the risk by refereeing a 2007 GAO report on data breaches, holding that the report demonstrated why there was no “substantial risk” of identity theft, stating (1) the plaintiff had not alleged that social security numbers, birth dates, or driver’s license numbers were compromised in the data breach, and (2) the card information allegedly accessed by the PDQ hackers “generally cannot be used alone to open unauthorized new accounts.” Further, the court noted that the GAO Report suggests that most data breaches have not resulted in detected incidents of fraud on existing accounts.

The Court held that if it ignored the GAO Report, the plaintiff had not “met his burden to show that the there is a ‘substantial risk’ of harm, or that such harm is ‘certainly impending.’” The Court wrote:

First, we recently held in Muransky that conclusory allegations of an “elevated risk of identity theft”—or, as Tsao puts it, a “continuing increased risk” of identity theft—“[are] simply not enough” to confer standing. Muranksy, 979 F.3d at 933. Tsao’s allegations about the “increased risk” of identity theft are supported only by reports defining identity theft, outlining the general risks of identity theft, or stating that identity thieves have stolen $112 billion in the last six years. These reports do nothing to clarify the risks to the plaintiffs in this case, and Tsao’s threadbare allegations of “increased risk” are insufficient to confer standing.

Second, Tsao offers only vague, conclusory allegations that members of the class have suffered any actual misuse of their personal data—here, “unauthorized charges.” But again, conclusory allegations of injury are not enough to confer standing. See Iqbal, 556 U.S. at 678, 129 S. Ct. at 1949. Of course, as our sister Circuits have recognized, evidence of actual misuse is not necessary for a plaintiff to establish standing following a data breach. See, e.g., Beck, 848 F.3d at 275 (stating that district court did not impermissibly require plaintiffs to demonstrate actual misuse). However, without specific evidence of some misuse of class members’ data, a named plaintiff’s burden to plausibly plead factual allegations sufficient to show that the threatened harm of future identity theft was “certainly impending”—or that there was a “substantial risk” of such harm—will be difficult to meet. Cf. Resnick v. AvMed, Inc., 693 F.3d 1317, 1323 n.1 (11th Cir. 2012) (finding that plaintiffs who suffered “actual” identity theft had standing but noting that “speculative” identity theft may not be sufficient to confer standing). As the case law discussed above confirms, most plaintiffs that have failed to offer at least some evidence of actual misuse of class members’ data have fared poorly in disputes over standing. See Op. at 14–21.

Third, Tsao immediately cancelled his credit cards following disclosure of the PDQ breach, effectively eliminating the risk of credit card fraud in the future. Of course, even if Tsao’s cards are cancelled, some risk of future harm involving identity theft (for example, the use of Tsao’s name) still exists, but that risk is not substantial and is, at best, speculative.

Finally, the Court confronted the argument that the plaintiff’s mitigation efforts were a concrete injury. Plaintiff claimed he spent time and effort to cancel his credit card, that he lost the opportunity to accrue rewards points and that the cancellation restricted his access to his credit cards. The Eleventh Circuit directly rejected this argument, holding a plaintiff cannot “conjure standing [] by inflicting injuries on himself to avoid an insubstantial, non-imminent risk of identity theft.”

In short, the Eleventh Circuit emphasized conclusory allegations that plaintiff and class members suffered an “elevated risk of identity theft” are “simply not enough” to confer standing. Without some evidence of specific misuse of the class members’ data, the plaintiff could not support the conclusory allegation of a threatened harm of future identity theft.

Tsao further gives teeth to the Article III standing requirement of a concrete injury in the Eleventh Circuit, especially in class actions alleging a generalized future risk of harm. However, because these issues have provoked circuit splits, there is a fair chance this issue could end up before the United States Supreme Court.

This Tuesday, the United States Court of Appeals for the Eleventh Circuit reversed course on an emerging trend of case law concerning the ascertainability standard for class actions under Fed. R. Civ. P. 23, holding proof of administrative feasibility in identifying absent class members was not required at the class certification stage.

This debate has consumed class action law for at least the last 7 years and caused Circuit splits. Under the administrative feasibility standard originally annunciated by the Third Circuit and then applied by the Eleventh Circuit in unpublished decisions, courts required putative class representatives to prove identification of absent class members would be “a manageable process that does not require much, if any, individual inquiry” to obtain class certification. Carrera v. Bayer Corp., 727 F.3d 300, 308 (3rd Cir. 2013); Karhu v. Vital Pharms., Inc., 621 Fed. Appx. 945, 947 (11th Cir. 2015). The First and Fourth Circuits also applied a close version of this standard. In re Nexium Antitrust Litigation, 777 F.3d 9 (1st Cir. 2015); EQT Prod. Co. v. Adair, 764 F.3d 347 (4th Cir. 2014). However, more recent cases seem to be moving towards the plaintiffs. The Second, Sixth, Seventh, Eighth, and Ninth circuits have now rejected this “heightened” ascertainability standard, and some judges on the Third Circuit have expressed a desire to re-examine the standard.

In Cherry v. Dometic Corporation, — F. 3d –, 2021 WL 346121 (11th Cir. Feb. 2, 2021), 18 Plaintiffs filed a putative class action against Dometic, the manufacturer of gas-powered refrigerators used in recreational vehicles, alleging a defect. At the class certification stage, Plaintiffs sought to certify a class of all persons in selected states who purchased certain models of the refrigerators since 1997. Dometic argued Plaintiffs failed to show the class was “ascertainable” because Plaintiffs did not establish the administrative feasibility of identifying absent class members. Dometic argued, based on non-binding Eleventh Circuit precedent, that administrative feasibility was a prerequisite for class certification. The district court agreed and denied class certification. Plaintiffs appealed, asking the Eleventh Circuit to clarify that administrative feasibility is not an element of the ascertainability standard and, therefore, not a prerequisite to class certification.

The Eleventh Circuit agreed and reinstated the case. Chief Judge Pryor held that although ascertainability was an “implied prerequisite” of Rule 23(a)’s text, Eleventh Circuit precedent did not “mandate proof of administrative feasibility.” Instead, Chief Judge Pryor held Rule 23’s text contained no administrative feasibility requirement. While no form of the word “ascertainability” appears in Rule 23, Eleventh Circuit precedent requires a court to determine whether a proposed class is “adequately defined and clearly ascertainable” before determining whether the elements of Rule 23 are satisfied. “Unlike traditional ascertainability,” Chief Judge Pryor reasoned, “administrative feasibility does not bear on the ability of a court to consider the enumerated elements of” Rule 23(a) – numerosity of class members, commonality of questions of law or fact, typicality of claims, and adequacy of class representation. In so doing, the Court limited the ascertainability inquiry to whether the class was adequately defined such that its membership is “capable of determination” – without any regard for how feasible it might be to make the determination.

Chief Judge Pryor further held consideration of administrative feasibility was only appropriate in Rule 23(b) classes as part of the manageability criterion of Rule 23(b)(3)(D), which requires courts to consider the difficulty in managing a class action when determining whether a class action would be superior to other available methods for adjudicating a controversy, like mass joinder cases or MDLs. This analysis, however, is only a balancing test determining whether a class will create more problems than it solves. Chief Judge Pryor reasoned that if a class presents “unusually difficult manageability problems,” then the remedy is for the court to require more detail on Plaintiffs’ plan for notifying the class and managing the action. By relegating any administrative feasibility consideration to Rule 23(b)(3)(D)’s manageability analysis, the Court firmly established, [a]dministrative feasibility alone will rarely, if ever, be dispositive.”

For Chief Judge Pryor, the administrative feasibility requirement is a textualism debate about Rule 23’s plain language. For practitioners, it is a real world debate with important implications.  Consider, for example, the trend of lawsuits about disclosures on food containers. While some retailers (for instance, electronic retailers such as Amazon), might have records which identify purchasers, many other retailers will not. How would a plaintiff propose to identify such a class? We shall have to wait to see how courts apply this new test and to see whether the Supreme Court will resolve the split in the Circuits over this standard. For class action practitioners in the Eleventh Circuit, however, this decision is a significant change in the law requiring careful analysis of future actions.

Please call Gregory C. Cook if you have questions.

Last night, Congress passed a new COVID-19 stimulus package containing an important amendment to the CARES Act which should foreclose any possibility the Plaintiffs in the Agent Fee class actions currently pending across the country can successfully argue banks must pay them “agent fees” for preparing PPP loan applications. The amendment establishes that, contrary to the Plaintiffs’ assertions, banks are not required to pay agent fees absent a written agreement with the agent to do so. Congress gave the amendment retroactive effect so it applies to every PPP loan made to date.

The amendment reads:

b) FEE LIMITS.—

(1) IN GENERAL.—Section 7(a)(36)(P)(ii) of the Small Business Act (15 U.S.C.

2636(a)(36)(P)(ii)) is amended by adding at the end the following: “If an eligible recipient has knowingly retained an agent, such fees shall be paid by the eligible recipient and may not be paid out of the proceeds of a covered loan. A lender shall only be responsible for paying fees to an agent for services for which the lender directly contracts with the agent.”.

(2) EFFECTIVE DATE; APPLICABILITY.—The amendment made by paragraph (1) shall be effective as if included in the CARES Act (Public Law 116–136; 134 Stat. 281) and shall apply to any loan made pursuant to section 7(a)(36) of the Small Business Act (15 U.S.C. 636(a)(36)) before, on, or after the date of enactment of this Act, including forgiveness of such a loan.

The Agent Fees Plaintiffs previously refused to agree that a compensation agreement was required, primarily relying on language in an “SBA Factsheet” stating “Agent fees will be paid out of lender fees” received for originating PPP loans. However, 10 different federal judges have disagreed and dismissed Agent Fee class actions, holding neither the CARES Act nor its implementing regulations require lenders to pay agent fees absent a specific agreement to do so. (You can read about the first eight of these ten dismissals here. The last two dismissals – Brunner Accounting Group v. SVB Financial Group (C.D. Cal.) and Radix Law, PLC v. JP Morgan Chase Bank, N.A. (D. Ariz) – came in just days before the stimulus). We predicted such rulings were necessary to harmonize any fees allowed by the PPP with SBA’s existing regulatory structure. Now, the new stimulus has enshrined this principle in law.

Plaintiffs have also previously relied on CARES Act language precluding a borrower from paying agent fees out of PPP loan proceeds and Factsheet language stating “Agents may not collect any fees from the applicant” in support of their claims that banks must pay the fee. The courts uniformly rejected these arguments as well. The amendment’s express authorization for borrowers to pay agents out of non-PPP funds makes this argument even less persuasive now.

While it is impossible to predict whether Plaintiffs will attempt to avoid this direct language, it would certainly appear that the new stimulus will effectively put an end to the PPP agent fee litigation once it is signed into law.

Please contact Gregory C. Cook if you have questions.

Twice this year, Balch & Bingham reported on the wave of “Agent Fee” class actions against lenders who made PPP loans under the CARES Act. At one point, there were over sixty such lawsuits spread across the federal courts, alleging that banks were required to pay CPAs and others who assisted borrowers with loan applications.

Since then, eight different federal judges have now ruled in favor of the banks and dismissed Agent Fee class actions. These cases recognized “every court that has decided this issue has held that the CARES Act does not require lenders to pay agent fees absent an agreement to do so” and dismissed a myriad of federal and state law claims for fees. For the Agent Fee Plaintiffs, there is no end to these mounting losses in sight, and there is real reason to question whether these suits will continue.

The most recent decisions came from Alabama and California. In Alabama, a federal judge dismissed Leigh, King, Norton, Underwood LLC v. Regions, 2:20-cv-00591 (N.D. Al.) as moot after learning the Plaintiff had actually cashed a check from Regions in payment of the alleged agent fees. Shortly thereafter, two different California judges dismissed the identical agent fee cases of Am. Video Duplicating Inc. v. Citigroup Inc., No. 20-03815 (C.D. Cal.) and Am. Video v. City Nat. Bank, 2:20-cv-04036 (C.D. Cal.). Last week, in a final blow seemingly sealing off any path for Plaintiffs, another California judge dismissed Lopez v. Bank of America, 20-cv-04172-JST (N.D. Cal.). While Lopez was granted 30 days to file an amended complaint, the court expressed doubt that he “could ever establish the entitlement to agent fees that is a predicate to each of his claims.”

These decisions add to the banks’ four previous motion to dismiss victories in Sport & Wheat CPA, PA v. Servisfirst Bank et al., No. 3:20-cv-05425 (N.D. Fla.), the first-filed Agent Fees case in the country, Johnson, et al v. JPMorgan Chase, et al., 20-cv-4100 (S.D.N.Y.), which was decided by the highly respected Judge Jed S. Rakoff, Steven L. Steward & Associates, P.A. v. Truist Bank and Truist Financial Corp., 6:20-cv-1083 (M.D. Fla.), and Sanchez v. Bank of South Texas, 7:20-cv-00139 (S.D. Tex.).

Banks scored other important victories along the way. Even before courts started granting motions to dismiss, the Judicial Panel on Multidistrict Litigation rejected efforts to drag over 100 unrelated banks across the country and consolidate all 62 then-pending putative class actions in a multidistrict litigation. Amidst Plaintiffs’ mounting motion to dismiss losses, the court in Unbehagen Tax & Accounting, Inc. v. JP Morgan Chase Bank, NA, 8:20-cv-01709 (M.D. Fla.) dealt Plaintiffs a procedural blow by severing claims against over two dozen unrelated banks and ordering Plaintiffs to dismiss their omnibus lawsuit and refile separate actions against each bank. (A Balch client was initially sued in Unbehagen but was dismissed before the court issued its severance order.). The Unbehagen Plaintiffs dismissed without refiling. Some other Plaintiffs have also been dismissing cases voluntarily. Some of the dismissed actions are merely duplicative of cases against the same defendant, even by the same set of Plaintiffs’ counsel.

Unless an appellate court unexpectedly reinstates a case, it appears as though the banks are headed for total victory.

Please contact Gregory C. Cook if you have questions.

This past June, in Barnes v. U.S. National Bank, No. 2180699, the Alabama Court of Civil Appeals held that a mortgagee’s notice of acceleration failed to strictly comply with the notice provisions contained in Paragraph 22 (“Paragraph 22”) of the Fannie Mae/Freddie Mac Uniform Mortgage. As a result, the Court held that the foreclosure sale was void.

Continue Reading Alabama Court of Civil Appeals Doubles Down on “Strict Compliance” with Notice Provisions of Standard Mortgage’s Paragraph 22

Earlier this year, Balch & Bingham reported on the dismissal of one of the first class actions challenging financial institutions for charging multiple “overdraft” or not sufficient funds (“NSF”) fees for the same transaction or “item.” In these cases, Plaintiffs allege financial institutions may only charge an overdraft fee once for each “item” – be it a debit, check, draft, withdrawal, ACH payment request, etc. – no matter how many times merchants represent the transaction or item to the bank for payment. Last week, the Tennessee Court of Appeals became the first appellate court to affirm the dismissal of one of these cases. Continue Reading Tennessee Court of Appeals Becomes First Appellate Court to Affirm Dismissal of Class Action Challenging Multiple “Overdraft” or NSF Fees for Same Transaction or “Item.”

The federal courts have been struggling for several years to clarify Article III standing law. Is it enough that a plaintiff satisfy the elements of a federal consumer protection statute? Is it enough that a data breach have happened? Or, must the plaintiff show that they have actually been damaged or that there is a substantial risk that they will be damaged? On October 28, 2020 the Eleventh Circuit handed down a sharply split en banc decision applying the U.S. Supreme Court’s Article III standing decision, Spokeo Inc. v. Robins, 136 S. Ct. 1540 (2016). The court held directly held that it is not enough that a statutory violation have occurred. Even though defendant Godiva Chocolates violated the Fair and Accurate Credit Transactions Act (“FACTA”), the Court held that the named class plaintiff lacked standing to bring the action because he did not allege any concrete injury.

Continue Reading Giving Teeth to Article III Standing Requirements in the Eleventh Circuit.

Earlier this year, Balch & Bingham reported on the wave of “Agent Fee” class actions against lenders who made PPP loans under the CARES Act. At one point, there were over sixty such lawsuits, spread across the federal courts, alleging that banks were required to pay CPAs and others who assisted borrowers with loan applications.  Since then, however, virtually every ruling has been in favor of the banks, and now there is real reason to question whether these suits will continue.

Continue Reading RETREAT! “Agent Fee” Class Actions Moving Against Plaintiffs

In a landmark decision Monday, the United States District Court for the Northern District of Florida dismissed a putative class action involving “agent fees” for Paycheck Protection Program (“PPP”) loans under the federal Coronavirus Aid, Relief, and Economic Security (“CARES”) Act. This lawsuit, Sport & Wheat CPA, PA v. Servisfirst Bank et al., No. 3:20-cv-05425-TKW-HTC (N.D. Fla.) claimed to represent a class of accounting firms and other consultants that allegedly worked as agents on behalf of applicants for PPP loans – typically small business clients. Plaintiff contended the CARES Act and implementing regulations required lenders to pay them “agent fees” for preparing loan applications.

Continue Reading Florida Judge Dismisses First-Filed PPP Agent Fee Class Action, Holds the CARES Act Contains No Requirement Agents be Paid