Last week, the United States Court of Appeals for the Eleventh Circuit affirmed the $380.5M settlement in the Equifax data breach class actions – a settlement which the district court called “the largest and most comprehensive recovery in a data breach case in U.S. history by several orders of magnitude.” The appeal was brought by 6 objectors out of the 147 million class members whose data was involved in the breach. The Eleventh Circuit’s 64-page ruling covers the waterfront of class action law and provides important insight into how the Eleventh Circuit views two key issues: (1) standing to sue for a data breach; (2) attorneys’ fees and incentive awards in class action settlements; and (3) the breadth of a district court’s discretion in managing the class action process.

First, Objectors claimed class members who did not have (or have not yet had) their identities stolen as a result of the data breach did not have standing to sue. Objectors argued these class members suffered no injury in fact simply by virtue of their data being exposed. The Eleventh Circuit disagreed, holding that the risk of these class members’ identities being stolen was “certainly impending,” and this risk was sufficient to confer standing. Over the last year, the Eleventh Circuit has issued several decisions on standing.  Compare Muransky v. Godiva Chocolatier, Inc. 979 F.3d 917, 924, 927 (11th Cir. 2020) (en banc) (mere “elevated risk of identity theft” is insufficient). In fact, and at least one judge on the Eleventh Circuit appears to be rethinking the intellectual foundations of this doctrine. See Sierra v. City of Hallandale Beach, 996 F.3d 1110, 1115 (11th Cir. 2021) (Newson, J., concurring).  For the present, the Equifax decision on standing should probably be seen as based upon the scope of the information which was taken in the data breach, which included: names, birthdates, social security numbers, addresses, driver’s license numbers, and tax identification numbers. Objectors also claimed that the settlement did not redress class members’ injuries since nothing about the settlement prevented third parties from using class members’ data. The Eleventh Circuit quickly dismissed this argument as well, noting Objectors’ focus was misplaced: The Plaintiffs had sued Equifax – not third parties. Because the settlement obligated Equifax to reimburse class members up to $20,000 of out-of-pocket expenses incurred because of the data breach, reimburse class members $25 per hour for up to 20 hours spent taking preventative measures to guard against identity theft, and provide 10 years of free credit monitoring and seven years of identity restoration services, the Court reasoned that the settlements would help to limit Plaintiff’s injuries.

Of particular interest to readers of this blog is the Eleventh Circuit’s discussion of Class Counsel’s attorneys’ fees award. Objectors challenged the $77.5M attorneys’ fees award as unreasonable. One Objector claimed the court must employ an “economies of scale” analysis to fees awards in cases of this size – which the Objector termed “megafund” cases. The Eleventh Circuit rejected this argument out of hand because there is no requirement under either Federal Rule of Civil Procedure 23 or governing case law that the court weigh economies of scale in determining the reasonableness of an attorneys’ fees award in any case, regardless of size. The Court also noted that requiring consideration of economies of scale would create perverse incentives by encouraging quick settlements at sub-optimal levels. Instead, the Court held other factors taken into consideration by the district court reasonably captured considerations related to economics of scale.

The Court affirmed the $77.5M attorneys’ fees award, using the “percentage method” to evaluate the reasonableness of the award. This was the same method the district court used in setting the fees award. The percentage method calculates fees as percentage of the total settlement fund. Courts consider a 20-30% fee to be per se reasonable, with a 25% fee being the benchmark in some decisions. Class Counsel’s fees award in Equifax was only 20.6% of the $380.5M settlement, and therefore, well within the range of reasonable attorneys’ fees awards.

Another question which often arises in class settlements is the requirements placed by the district court upon objectors.  On the one hand, the federal courts encourage objectors to raise legitimate questions regarding settlements. On the other hand, the courts have been plagued by serial objectors as documented in the committee hearings leading to the recent changes to Rule 23.  The procedures in the Equifax case are somewhat more onerous than some prior settlements but this did not appear to trouble the Eleventh Circuit.  The district court required all objections to provide the objector’s name and address, the objector’s personal signature, the grounds for the objection, a list of previous objections in recent class actions, and dates on which the objector was available to be deposed. In addition, if the objector had counsel who intended to speak at the fairness hearing, the objection needed to include the legal and factual basis for the objection and the evidence to be offered at the hearing. Finally, if the objector had counsel who sought compensation from anyone other than the objector, the objection needed to include a list of counsel’s previous objections in recent class actions, counsel’s experience in class action litigation, and information on the fees sought. The district court imposed these requirements because objectors had appeared “out of the blue” in previous class actions and created a “really chaotic process” it hoped to avoid in Equifax. The district court noted these requirements would also rout out lawyer-driven objections filed with ulterior motives. An Objector claimed these requirements infringed on objectors’ rights to be heard and be represented by counsel and were unduly burdensome. The Eleventh Circuit disagreed, noting the district court had broad discretion to manage class actions and that Objectors failed to show the district court abused that discretion. The Eleventh Circuit found the district court’s stated intent of avoiding a “chaotic process” was sufficient reason to impose additional administrative requirements. The Eleventh Circuit held these additional requirements were “not particularly burdensome” because most of the requirements were only clerical in requiring objectors to provide certain information. The Court also reasoned that although the deposition requirement was potentially burdensome, depositions are “a normal part of litigation.” While the Eleventh Circuit noted there may be a legitimate concern that discovery requirements such as sitting for deposition could deter objectors, the district court found this concern was at odd with the number of objections received – 388 in total – and concluded it did not dissuade objection in this case. The Eleventh Circuit agreed. However, the Eleventh Circuit reminded the district court that whether any set of objection requirements constituted an abuse of discretion would be a case-specific inquiry because the breadth of the district court’s discretion to manage the class settlement process “ebbed and flowed” with “the size and administrative difficulties of each class action.” Given that the Equifax class contained nearly 150 million members, the Eleventh Circuit affirmed the imposition of additional administrative requirements for objectors to its settlement.

The Eleventh Circuit only reversed one part of the settlement – the incentive fees award to the named class members. In some circuits, incentive fees are routinely awarded to named plaintiffs as a “thank you” for bringing the lawsuit on behalf of the other class members. Although the district court initially included incentive fees in its approval of the settlement, a subsequent Eleventh Circuit case held incentive fees awards are prohibited. See Johnson v. NPAS Sols., LLC, 975 F.3d 1244, 1260 (11th Cir. 2020). The Johnson Plaintiffs have petitioned the Eleventh Circuit for rehearing en banc. In the meantime, the Court reversed this portion of the order approving the Equifax settlement and remanded the case to the lower court for the limited purpose of vacating the incentive fees award.

Please contact Gregory C. Cook if you have questions.

In early November, we wrote about a new Eleventh Circuit decision on Article III standing law which directly held that it was not enough to allege a statutory violation and instead there must be a concrete injury to sustain an action in federal court. Muranksy v. Godiva Chocolatier, Inc., 979 F. 3d 917 (11th Cir. 2020). We noted the sharp divide in the Court and that it was an en banc decision. Now, the Eleventh Circuit has returned to the standing doctrine and applied it in a data breach case, further solidifying the requirement that a class action plaintiff must have a concrete injury to satisfy Article III standing.

On February 4, 2021, the Eleventh Circuit affirmed the trial court’s dismissal of a class action complaint alleging PDQ, a fast casual restaurant, exposed the plaintiff and other customers to a risk of future identity theft. In Tsao v. Captiva MVP Restaurant Partners, LLC, the plaintiff alleged in 2018 PDQ became aware that a hacker exploited PDQ’s point of sale system and gained access to customers’ personal data, including their credit and debit card information. PDQ notified its customers that all locations were affected by the attack and that PDQ customers’ personal data “may” have been accessed.

The plaintiff made two food purchases at PDQ during the data breach period. Following the notice by PDQ, the plaintiff contacted his banks to cancel his credit cards and filed a class action complaint in the Middle District of Florida. The plaintiff alleged he and class members suffered a variety of injuries including “theft of their personal information,” “unauthorized charges on their debit and credit card accounts” and “ascertainable losses in the form of the loss of cash back or other benefits.”

The Eleventh Circuit analyzed the trial court’s dismissal under the framework of Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1546-47 (2016) and Clapper v. Amnesty Int’l USA, 568 U.S. 398 (2013). The Court explained that these cases mean: (1) “a plaintiff alleging a threat of harm does not have Article III standing unless the hypothetical harm alleged is either ‘certainly impending’ or there is a ‘substantial risk’ of such harm”, and (2) “if the hypothetical harm alleged is not ‘certainly impending,’ or if there is not a substantial risk of the harm, a plaintiff cannot conjure standing by inflicting some direct harm on itself to on itself to mitigate a perceived risk.”

The Eleventh Circuit measured the risk by refereeing a 2007 GAO report on data breaches, holding that the report demonstrated why there was no “substantial risk” of identity theft, stating (1) the plaintiff had not alleged that social security numbers, birth dates, or driver’s license numbers were compromised in the data breach, and (2) the card information allegedly accessed by the PDQ hackers “generally cannot be used alone to open unauthorized new accounts.” Further, the court noted that the GAO Report suggests that most data breaches have not resulted in detected incidents of fraud on existing accounts.

The Court held that if it ignored the GAO Report, the plaintiff had not “met his burden to show that the there is a ‘substantial risk’ of harm, or that such harm is ‘certainly impending.’” The Court wrote:

First, we recently held in Muransky that conclusory allegations of an “elevated risk of identity theft”—or, as Tsao puts it, a “continuing increased risk” of identity theft—“[are] simply not enough” to confer standing. Muranksy, 979 F.3d at 933. Tsao’s allegations about the “increased risk” of identity theft are supported only by reports defining identity theft, outlining the general risks of identity theft, or stating that identity thieves have stolen $112 billion in the last six years. These reports do nothing to clarify the risks to the plaintiffs in this case, and Tsao’s threadbare allegations of “increased risk” are insufficient to confer standing.

Second, Tsao offers only vague, conclusory allegations that members of the class have suffered any actual misuse of their personal data—here, “unauthorized charges.” But again, conclusory allegations of injury are not enough to confer standing. See Iqbal, 556 U.S. at 678, 129 S. Ct. at 1949. Of course, as our sister Circuits have recognized, evidence of actual misuse is not necessary for a plaintiff to establish standing following a data breach. See, e.g., Beck, 848 F.3d at 275 (stating that district court did not impermissibly require plaintiffs to demonstrate actual misuse). However, without specific evidence of some misuse of class members’ data, a named plaintiff’s burden to plausibly plead factual allegations sufficient to show that the threatened harm of future identity theft was “certainly impending”—or that there was a “substantial risk” of such harm—will be difficult to meet. Cf. Resnick v. AvMed, Inc., 693 F.3d 1317, 1323 n.1 (11th Cir. 2012) (finding that plaintiffs who suffered “actual” identity theft had standing but noting that “speculative” identity theft may not be sufficient to confer standing). As the case law discussed above confirms, most plaintiffs that have failed to offer at least some evidence of actual misuse of class members’ data have fared poorly in disputes over standing. See Op. at 14–21.

Third, Tsao immediately cancelled his credit cards following disclosure of the PDQ breach, effectively eliminating the risk of credit card fraud in the future. Of course, even if Tsao’s cards are cancelled, some risk of future harm involving identity theft (for example, the use of Tsao’s name) still exists, but that risk is not substantial and is, at best, speculative.

Finally, the Court confronted the argument that the plaintiff’s mitigation efforts were a concrete injury. Plaintiff claimed he spent time and effort to cancel his credit card, that he lost the opportunity to accrue rewards points and that the cancellation restricted his access to his credit cards. The Eleventh Circuit directly rejected this argument, holding a plaintiff cannot “conjure standing [] by inflicting injuries on himself to avoid an insubstantial, non-imminent risk of identity theft.”

In short, the Eleventh Circuit emphasized conclusory allegations that plaintiff and class members suffered an “elevated risk of identity theft” are “simply not enough” to confer standing. Without some evidence of specific misuse of the class members’ data, the plaintiff could not support the conclusory allegation of a threatened harm of future identity theft.

Tsao further gives teeth to the Article III standing requirement of a concrete injury in the Eleventh Circuit, especially in class actions alleging a generalized future risk of harm. However, because these issues have provoked circuit splits, there is a fair chance this issue could end up before the United States Supreme Court.

This Tuesday, the United States Court of Appeals for the Eleventh Circuit reversed course on an emerging trend of case law concerning the ascertainability standard for class actions under Fed. R. Civ. P. 23, holding proof of administrative feasibility in identifying absent class members was not required at the class certification stage.

This debate has consumed class action law for at least the last 7 years and caused Circuit splits. Under the administrative feasibility standard originally annunciated by the Third Circuit and then applied by the Eleventh Circuit in unpublished decisions, courts required putative class representatives to prove identification of absent class members would be “a manageable process that does not require much, if any, individual inquiry” to obtain class certification. Carrera v. Bayer Corp., 727 F.3d 300, 308 (3rd Cir. 2013); Karhu v. Vital Pharms., Inc., 621 Fed. Appx. 945, 947 (11th Cir. 2015). The First and Fourth Circuits also applied a close version of this standard. In re Nexium Antitrust Litigation, 777 F.3d 9 (1st Cir. 2015); EQT Prod. Co. v. Adair, 764 F.3d 347 (4th Cir. 2014). However, more recent cases seem to be moving towards the plaintiffs. The Second, Sixth, Seventh, Eighth, and Ninth circuits have now rejected this “heightened” ascertainability standard, and some judges on the Third Circuit have expressed a desire to re-examine the standard.

In Cherry v. Dometic Corporation, — F. 3d –, 2021 WL 346121 (11th Cir. Feb. 2, 2021), 18 Plaintiffs filed a putative class action against Dometic, the manufacturer of gas-powered refrigerators used in recreational vehicles, alleging a defect. At the class certification stage, Plaintiffs sought to certify a class of all persons in selected states who purchased certain models of the refrigerators since 1997. Dometic argued Plaintiffs failed to show the class was “ascertainable” because Plaintiffs did not establish the administrative feasibility of identifying absent class members. Dometic argued, based on non-binding Eleventh Circuit precedent, that administrative feasibility was a prerequisite for class certification. The district court agreed and denied class certification. Plaintiffs appealed, asking the Eleventh Circuit to clarify that administrative feasibility is not an element of the ascertainability standard and, therefore, not a prerequisite to class certification.

The Eleventh Circuit agreed and reinstated the case. Chief Judge Pryor held that although ascertainability was an “implied prerequisite” of Rule 23(a)’s text, Eleventh Circuit precedent did not “mandate proof of administrative feasibility.” Instead, Chief Judge Pryor held Rule 23’s text contained no administrative feasibility requirement. While no form of the word “ascertainability” appears in Rule 23, Eleventh Circuit precedent requires a court to determine whether a proposed class is “adequately defined and clearly ascertainable” before determining whether the elements of Rule 23 are satisfied. “Unlike traditional ascertainability,” Chief Judge Pryor reasoned, “administrative feasibility does not bear on the ability of a court to consider the enumerated elements of” Rule 23(a) – numerosity of class members, commonality of questions of law or fact, typicality of claims, and adequacy of class representation. In so doing, the Court limited the ascertainability inquiry to whether the class was adequately defined such that its membership is “capable of determination” – without any regard for how feasible it might be to make the determination.

Chief Judge Pryor further held consideration of administrative feasibility was only appropriate in Rule 23(b) classes as part of the manageability criterion of Rule 23(b)(3)(D), which requires courts to consider the difficulty in managing a class action when determining whether a class action would be superior to other available methods for adjudicating a controversy, like mass joinder cases or MDLs. This analysis, however, is only a balancing test determining whether a class will create more problems than it solves. Chief Judge Pryor reasoned that if a class presents “unusually difficult manageability problems,” then the remedy is for the court to require more detail on Plaintiffs’ plan for notifying the class and managing the action. By relegating any administrative feasibility consideration to Rule 23(b)(3)(D)’s manageability analysis, the Court firmly established, [a]dministrative feasibility alone will rarely, if ever, be dispositive.”

For Chief Judge Pryor, the administrative feasibility requirement is a textualism debate about Rule 23’s plain language. For practitioners, it is a real world debate with important implications.  Consider, for example, the trend of lawsuits about disclosures on food containers. While some retailers (for instance, electronic retailers such as Amazon), might have records which identify purchasers, many other retailers will not. How would a plaintiff propose to identify such a class? We shall have to wait to see how courts apply this new test and to see whether the Supreme Court will resolve the split in the Circuits over this standard. For class action practitioners in the Eleventh Circuit, however, this decision is a significant change in the law requiring careful analysis of future actions.

Please call Gregory C. Cook if you have questions.

Last night, Congress passed a new COVID-19 stimulus package containing an important amendment to the CARES Act which should foreclose any possibility the Plaintiffs in the Agent Fee class actions currently pending across the country can successfully argue banks must pay them “agent fees” for preparing PPP loan applications. The amendment establishes that, contrary to the Plaintiffs’ assertions, banks are not required to pay agent fees absent a written agreement with the agent to do so. Congress gave the amendment retroactive effect so it applies to every PPP loan made to date.

The amendment reads:


(1) IN GENERAL.—Section 7(a)(36)(P)(ii) of the Small Business Act (15 U.S.C.

2636(a)(36)(P)(ii)) is amended by adding at the end the following: “If an eligible recipient has knowingly retained an agent, such fees shall be paid by the eligible recipient and may not be paid out of the proceeds of a covered loan. A lender shall only be responsible for paying fees to an agent for services for which the lender directly contracts with the agent.”.

(2) EFFECTIVE DATE; APPLICABILITY.—The amendment made by paragraph (1) shall be effective as if included in the CARES Act (Public Law 116–136; 134 Stat. 281) and shall apply to any loan made pursuant to section 7(a)(36) of the Small Business Act (15 U.S.C. 636(a)(36)) before, on, or after the date of enactment of this Act, including forgiveness of such a loan.

The Agent Fees Plaintiffs previously refused to agree that a compensation agreement was required, primarily relying on language in an “SBA Factsheet” stating “Agent fees will be paid out of lender fees” received for originating PPP loans. However, 10 different federal judges have disagreed and dismissed Agent Fee class actions, holding neither the CARES Act nor its implementing regulations require lenders to pay agent fees absent a specific agreement to do so. (You can read about the first eight of these ten dismissals here. The last two dismissals – Brunner Accounting Group v. SVB Financial Group (C.D. Cal.) and Radix Law, PLC v. JP Morgan Chase Bank, N.A. (D. Ariz) – came in just days before the stimulus). We predicted such rulings were necessary to harmonize any fees allowed by the PPP with SBA’s existing regulatory structure. Now, the new stimulus has enshrined this principle in law.

Plaintiffs have also previously relied on CARES Act language precluding a borrower from paying agent fees out of PPP loan proceeds and Factsheet language stating “Agents may not collect any fees from the applicant” in support of their claims that banks must pay the fee. The courts uniformly rejected these arguments as well. The amendment’s express authorization for borrowers to pay agents out of non-PPP funds makes this argument even less persuasive now.

While it is impossible to predict whether Plaintiffs will attempt to avoid this direct language, it would certainly appear that the new stimulus will effectively put an end to the PPP agent fee litigation once it is signed into law.

Please contact Gregory C. Cook if you have questions.

Twice this year, Balch & Bingham reported on the wave of “Agent Fee” class actions against lenders who made PPP loans under the CARES Act. At one point, there were over sixty such lawsuits spread across the federal courts, alleging that banks were required to pay CPAs and others who assisted borrowers with loan applications.

Since then, eight different federal judges have now ruled in favor of the banks and dismissed Agent Fee class actions. These cases recognized “every court that has decided this issue has held that the CARES Act does not require lenders to pay agent fees absent an agreement to do so” and dismissed a myriad of federal and state law claims for fees. For the Agent Fee Plaintiffs, there is no end to these mounting losses in sight, and there is real reason to question whether these suits will continue.

The most recent decisions came from Alabama and California. In Alabama, a federal judge dismissed Leigh, King, Norton, Underwood LLC v. Regions, 2:20-cv-00591 (N.D. Al.) as moot after learning the Plaintiff had actually cashed a check from Regions in payment of the alleged agent fees. Shortly thereafter, two different California judges dismissed the identical agent fee cases of Am. Video Duplicating Inc. v. Citigroup Inc., No. 20-03815 (C.D. Cal.) and Am. Video v. City Nat. Bank, 2:20-cv-04036 (C.D. Cal.). Last week, in a final blow seemingly sealing off any path for Plaintiffs, another California judge dismissed Lopez v. Bank of America, 20-cv-04172-JST (N.D. Cal.). While Lopez was granted 30 days to file an amended complaint, the court expressed doubt that he “could ever establish the entitlement to agent fees that is a predicate to each of his claims.”

These decisions add to the banks’ four previous motion to dismiss victories in Sport & Wheat CPA, PA v. Servisfirst Bank et al., No. 3:20-cv-05425 (N.D. Fla.), the first-filed Agent Fees case in the country, Johnson, et al v. JPMorgan Chase, et al., 20-cv-4100 (S.D.N.Y.), which was decided by the highly respected Judge Jed S. Rakoff, Steven L. Steward & Associates, P.A. v. Truist Bank and Truist Financial Corp., 6:20-cv-1083 (M.D. Fla.), and Sanchez v. Bank of South Texas, 7:20-cv-00139 (S.D. Tex.).

Banks scored other important victories along the way. Even before courts started granting motions to dismiss, the Judicial Panel on Multidistrict Litigation rejected efforts to drag over 100 unrelated banks across the country and consolidate all 62 then-pending putative class actions in a multidistrict litigation. Amidst Plaintiffs’ mounting motion to dismiss losses, the court in Unbehagen Tax & Accounting, Inc. v. JP Morgan Chase Bank, NA, 8:20-cv-01709 (M.D. Fla.) dealt Plaintiffs a procedural blow by severing claims against over two dozen unrelated banks and ordering Plaintiffs to dismiss their omnibus lawsuit and refile separate actions against each bank. (A Balch client was initially sued in Unbehagen but was dismissed before the court issued its severance order.). The Unbehagen Plaintiffs dismissed without refiling. Some other Plaintiffs have also been dismissing cases voluntarily. Some of the dismissed actions are merely duplicative of cases against the same defendant, even by the same set of Plaintiffs’ counsel.

Unless an appellate court unexpectedly reinstates a case, it appears as though the banks are headed for total victory.

Please contact Gregory C. Cook if you have questions.

This past June, in Barnes v. U.S. National Bank, No. 2180699, the Alabama Court of Civil Appeals held that a mortgagee’s notice of acceleration failed to strictly comply with the notice provisions contained in Paragraph 22 (“Paragraph 22”) of the Fannie Mae/Freddie Mac Uniform Mortgage. As a result, the Court held that the foreclosure sale was void.

Continue Reading Alabama Court of Civil Appeals Doubles Down on “Strict Compliance” with Notice Provisions of Standard Mortgage’s Paragraph 22

Earlier this year, Balch & Bingham reported on the dismissal of one of the first class actions challenging financial institutions for charging multiple “overdraft” or not sufficient funds (“NSF”) fees for the same transaction or “item.” In these cases, Plaintiffs allege financial institutions may only charge an overdraft fee once for each “item” – be it a debit, check, draft, withdrawal, ACH payment request, etc. – no matter how many times merchants represent the transaction or item to the bank for payment. Last week, the Tennessee Court of Appeals became the first appellate court to affirm the dismissal of one of these cases. Continue Reading Tennessee Court of Appeals Becomes First Appellate Court to Affirm Dismissal of Class Action Challenging Multiple “Overdraft” or NSF Fees for Same Transaction or “Item.”

The federal courts have been struggling for several years to clarify Article III standing law. Is it enough that a plaintiff satisfy the elements of a federal consumer protection statute? Is it enough that a data breach have happened? Or, must the plaintiff show that they have actually been damaged or that there is a substantial risk that they will be damaged? On October 28, 2020 the Eleventh Circuit handed down a sharply split en banc decision applying the U.S. Supreme Court’s Article III standing decision, Spokeo Inc. v. Robins, 136 S. Ct. 1540 (2016). The court held directly held that it is not enough that a statutory violation have occurred. Even though defendant Godiva Chocolates violated the Fair and Accurate Credit Transactions Act (“FACTA”), the Court held that the named class plaintiff lacked standing to bring the action because he did not allege any concrete injury.

Continue Reading Giving Teeth to Article III Standing Requirements in the Eleventh Circuit.

Earlier this year, Balch & Bingham reported on the wave of “Agent Fee” class actions against lenders who made PPP loans under the CARES Act. At one point, there were over sixty such lawsuits, spread across the federal courts, alleging that banks were required to pay CPAs and others who assisted borrowers with loan applications.  Since then, however, virtually every ruling has been in favor of the banks, and now there is real reason to question whether these suits will continue.

Continue Reading RETREAT! “Agent Fee” Class Actions Moving Against Plaintiffs