Should Victims of Data Breaches Be Able to Recover Absent a Showing of Identity Theft?

by Jeff Sovern

Most courts have rebuffed suits by consumers against companies that suffered data breaches when the consumers could not show that they had been victimized by identity thieves. For example, in Bell v. Acziom Corp., 2006 WL 2850042 (E.D.Ark. 2006), the court found that the plaintiff lacked standing when she alleged that defendant’s failure to prevent the breach of security had “jeopardized her privacy and left her at a risk of receiving junk mail and of becoming a victim of identify theft.” The court observed that “Plaintiff does not know whether her name and information were contained within the databases stolen by Levine. More than three years after the theft, Plaintiff has not alleged that she has suffered anything greater than an increased risk of identity theft.”

But Ruiz v. Gap, Inc., 540 F.Supp.2d 1121, 1126 (N.D. Cal. 2008), is a recent case going the other way.  After Ruiz applied for a job at the Gap, a Gap contractor lost two laptops containing Ruiz’s Social Security number and other personal information. Ruiz sued in negligence, among other claims, arguing that as a result of the loss he faced an increased risk of identity theft. The court denied the Gap’s motion to dismiss the negligence claim, finding that Ruiz had standing, but noting that it “is far from clear what damages, if any, Ruiz will be able to recover if he eventually prevails on his negligence claim.”  We don't know what will happen at the summary judgment stage, but this is more encouragement than most consumer-plaintiffs whose data has been compromised have received.  Will consumers eventually be able to recover for anxiety caused by breaches?  Because the data of a great many consumers has been compromised, if courts start allowing recovery for the increased risk of identity theft when no identity theft has occurred, businesses (and universities too, for that matter) face enormous exposure.  Of course, that exposure would increase the incentive to be careful with consumer data. 

Sixth Circuit: Class Members Have Right to Appeal Approval of a Class Settlement in Rule 23(b)(3) Opt-Out Cases

by Brian Wolfman

Check out Fidel v. Farley, No. 06-5550 (July 18, 2008), a brand-spanking-new decision from the Sixth Circuit. Farley holds that class member-objectors to an opt-out class action settlement have the right to appeal a district court's approval of the settlement without having intervened in the case. Here's some background:

Settling parties in class actions love to concoct ways to prevent objectors from overturning their settlements. In the bad old days, one of their favorite techniques was to stop objectors from appealing a district court's approval of a settlement by claiming that the objectors needed to intervene before they had "standing" to appeal. A bunch of courts of appeals accepted that argument, but the Supreme Court squarely rejected it in Devlin v. Scardelletti, 536 U.S. 1 (2002). Or so many of us thought. Devlin was a non-opt-out class action, and so, after Devlin, settling parties began arguing that the Supreme Court's ruling did not apply to Rule 23(b)(3) opt-out cases -- that is, to the great majority of class actions! There wasn't a hint in Devlin that was what the Court had in mind, so I figured there was no way that argument was going anywhere. Not quite. Shortly after Devlin, the Arkansas Supreme Court bought the argument in a case under Arkansas Rule 23 (which is based on the federal rule), and the Eighth Circuit claimed in dicta that the argument had "considerable merit."  In 2004, however, the Ninth Circuit had the good sense to hold that Devlin applies to opt-out cases, see Churchill Village, L.L.C. v. General Electric, 361 F.3d 566, 572 (9th Cir. 2004), and now the Sixth Circuit has too.

In case you care, the Arkansas Supreme Court and Eighth Circuit decisions annoyed me. So, I published an article that I'd love someone to read explaining that it is downright nutty to limit Devlin to non-opt-out cases.

RNC Gives Up Trademark Claims Against Political Speech

by Paul Alan Levy

I am pleased to announce that, in a response to public outcry as well as the prospect of a declaratory judgment, the Republican National Committee has renounced the vast majority of the trademark claims that it advanced with a threat of litigation against CafePress for allowing its users to sell Tshirts and other items displaying images that included the acronym “GOP” and the “official elephant logo” in which it has a registered trademark.

Under the terms of the agreement, the RNC agreed to drop most of the claims it had advanced against CafePress and its users.  Those CafePress users who do no more than put the “official elephant logo” or the initials “GOP,” on a tshirt, will use a licensing provision on the RNC web through which, the RNC has represented, permission is freely given. While the request for a licence is being considered, the products will remain on the CafePress site.   CafePress has not agreed to remove them even if the license is refused.   At the same time, the RNC admits that it has no claim against anybody who combines either an elephant or the acronym GOP with expressive words or design elements (whether positive or negative toward the Republicans.

More Reading for CAFA Crazies: Ninth Circuit Holds That CAFA Does Not Override Anti-Removal Provision of Securities Act of 1933

In Luther v. Countrywide Home Loans Servicing LP, No. 08-55865 (July 16, 2008), the Ninth Circuit held that the Class Action Fairness Act's broad grant of federal removal jurisdiction over diversity class actions does not override the anti-removal provision of the Securities Act of 1933.  Here's how the court summarized its decision:

Section 22(a) of the Securities Act of 1933 creates concurrent jurisdiction in state and federal courts over claims arising under the Act. It also specifically provides that such claims brought in state court are not subject to removal to federal court. We hold today that the Class Action Fairness Act of 2005, which permits in general the removal to federal court of high-dollar class actions involving diverse parties, does not supersede § 22(a)’s specific bar against removal of cases arising under the ’33 Act.

Must Read: New York Times Series on Consumer Debt

I'd bet you are tired of hearing that this or that is a "must read." But if you are interested in American consumer debt, you really will want to read this article in today's New York Times. It's the beginning of a series on the topic, complete with online video and interactive features. Get this: The average American household has about $118,000 in debt but saves only $392 per year (an unbelievably low .4% of disposable income), the lowest level since the Great Depression. In the 1940's, annual household savings were $12,807, or 26% of household income. In 1957, 42% of households had no debt; today, that figure is 26%. In 1961, 53% of homeowners had no mortgage debt; today, 31%. And, in 1967, 6% of households carried a credit card balance while 40% do so so today. The average American family today has 13 credit cards and over $8500 in credit card debt.

Credit Card Truncation Cases and Annihilating Damages

by Jeff Sovern

The credit card truncation cases raise an issue of what to do about potentially annihlating damages.  First, a review: in 2003, when Congress enacted FACTA, it added to the Fair Credit Reporting Act a new provision, §1681c(g), which prohibits retailers from printing on receipts more than the last five digits of a credit card or the card’s expiration date.  The statute gave most retailers three years to comply, but many did not take advantage of that window. In fact, when the statute went into effect, many retailers were surprised by class action suits seeking significant damages under the FCRA.  Last month, Congress passed the Credit and Debit Card Receipt Clarification Act, which added a provision to §1681n which prevents consumers from obtaining statutory damages for willful violations of the provision barring printing of the expiration date, but does not affect damages for printing the full card number.  So consumers who can show a willful violation can still recover statutory damages for receipts which included the full card number, and the statutory damages for a willful violation can be substantial: at least $100 and up to $1,000.  A retailer whose sales typically are much less than $100 might be put out of business by such an award in a class action.  To make matters worse, in many cases consumers won't even be damaged by the printing of a receipt with their credit card number.

So what are courts to do?  One option is to refuse to certify a class on the theory that, under Federal Civil Rule 23(b)(3), a class action is not superior to other available methods for the fair and efficient adjudication of the controversy.  That approach has a long history in consumer law.  To quote our casebook at page 785-86:

In the landmark case of Ratner v. Chemical Bank New York Trust Co., 54 F.R.D. 412 (S.D.N.Y.1972), United States District Judge Frankel denied class certification in a TILA case because the potential $13 million award (130,000 credit card holders each receiving the $100 minimum penalty) “would be a horrendous, possibly annihilating punishment, unrelated to any damage to the purported class or to any benefit to defendant, for what is at most a technical and debatable violation of the Truth in Lending Act.”  Other courts followed Judge Frankel's lead, and TILA class actions were becoming scarce.

One Class's Field Test of the Magnuson-Moss Disclosure Rules

§ 702.3(a) of the Magnuson-Moss Warranty regulations requires that sellers:

of a consumer product with a written warranty shall make a text of the warranty readily available for examination by the prospective buyer by:

(1) Displaying it in close proximity to the warranted product, or

(2) Furnishing it upon request prior to sale and placing signs reasonably calculated to elicit the prospective buyer's attention in prominent locations in the store or department advising such prospective buyers of the availability of warranties upon request.

The goal of the provision is obviously to enable consumers to shop for better warranty coverage if they are so inclined.  Our casebook suggests a field test of this provision in Problem 2-25, page 215: students are invited to visit local retailers selling appliances and determine compliance with the reg.  One professor who required students to conduct the field test was kind enough to share the student papers with me.  Most of the results would probably have disappointed  the drafters of Magnuson-Moss.  Though a salesperson at one store did offer to pull all the warranties out of the boxes (apparently making the student feel guilty) and another actually did so, others were less helpful.

Several of the salespeople responded by offering the terms of an extended warranty (which clearly doesn't comply with the reg) or by suggesting that the students check the warranties online (which is a closer question but in my view doesn't satisfy the reg either unless the store enables the customer to find the warranty on the web at the store).  My own personal favorite paper was written by a student who first encountered a salesperson who said all the warranties were the same and thought that the requirement was satisfied by the extended warranty brochure which, for comparison's purposes, included a summary of a typical manufacturer's warranty.  The student then asked for the manager.  After some back-and-forth, the manager asked another salesperson to get a warranty for a different product by the same manufacturer, saying that it was the same thing.  The manager's check of the manufacturer's web site found a general description of its warranty, but also elicited the news that the manufacturer provides in-home service for one year, something the manager hadn't known (so much for all warranties being the same).   Meanwhile, the salesperson had returned with the manual for the wrong product, which in any event did not contain the warranty.  Eventually, the manager became convinced that the student was a secret shopper checking up on him.  He disappeared into the back for at least ten minutes, and finally returned with the warranty for the correct product.  He also brought the student into the staff break room where he showed the student a plaque he had won for scoring a ten on a previous visit from a secret shopper.

Some other entertaining tidbits: one salesperson suggested that if a student was so interested in reading a warranty, she should just buy a TV.  Another pointed to a small card displaying the price and a description of the warranty as "one year parts and labor."  The card also stated that additional terms of the warranty were available upon request.  The clerk insisted that all of the information was available on the card and refused to give any other information.  Still another clerk said that getting the warranty would require ninety minutes because it had to be found on the web and printed out.

I suspect that if consumers genuinely cared about warranty terms, sellers would be more accustomed to such queries and would be better able to provide the warranties.  So maybe the field exercise tells us as much about consumers as it does about sellers.  If consumers don't care enough to ask for the warranties, is any purpose served by requiring sellers to have them on hand (which, in any event, often seems not to occur, if these experiences are representative)?

Can the RNC forbid the use of an elephant or "GOP" to identify Republicans?

by Paul Alan Levy

The latest abuse of trademark law to suppress discussion of topics of substantial public interest comes from not from a company, like most of the trademark abuses previously discussed on this blog, such as here and here, but from the Republican National Committee, which has threatened to sue CafePress.com because its users are selling t-shirts, stickers and other items bearing designs that refer to Republicans and Republican candidates using the initials "GOP" or using various portrayals of elephants.

Although these references have been in popular use since the 1870's, and owe more to Thomas Nast than to the Republicans themselves, back in the 1997 and 1995, respectively, the RNC trademarked the initials "GOP" and a stylized elephant showing three stars across its body.  Relying on these trademarks, the RNC has been trying to suppress the use of the initials or an elephant to refer to Republicans generally, such as in the images that appear above and on the left.

Symbols and initials often provide a popular way to refer to major figures in our society or our culture, and threats of litigation such as these impoverish our public discourse.  More generally, we might ask why the RNC has chosen an election year to try to suppress speech about the Republican Party, especially since many of the images are highly favorable to their cause.  Many of the CafePress users appear to be Republican grassroots activists.  Is this the right year for RNC staff members to start going after their own supporters?

Lab Experiment on Whether Payday Lending Helps Consumers Survive Financial Setbacks

Bart J. Wilson of George Mason, David W. Findlay and James W. Meehan both of Colby, Charissa P. Wellford, and Karl Schurter of Virginia have teamed up to write "An Experimental Analysis of the Demand for Payday Loans."  Here's the abstract:

The payday loan industry is one of the fastest growing segments of the consumer financial services market in the United States. The purpose of our study is to design an environment similar to the one that payday loan customers face. We then conduct a laboratory experiment to examine what effect, if any, the existence of payday loans has on individuals' abilities to manage and to survive financial setbacks. Our primary objective is to examine whether access to payday loans improves or worsens the likelihood of survival in our experiment. We also test the degree to which people's use of payday loans affects their ability to survive financial shocks. We find that payday loans help the subjects to absorb expenditure shocks and, therefore, survive. However, subjects whose demand for payday loans exceeds a certain threshold level are at a greater risk than a corresponding subject in the treatment in which payday loans do not exist.

Times Articles on Mortgage Regulation, Privacy, and Marketing

by Jeff Sovern

Here is the article in today's Times on the new Fed rules that Alan blogged about yesterday.  Saturday's edition noted in "By Large Margin, Senate Votes to Help Homeowners and Overhaul Loan Agencies" that the Senate had approved the bill intended to help borrowers avoid foreclosure.  The bill now returns to the House.  Sunday's issue included "The Silence of the Lenders," which tells the story of the email Angelo R. Mozillo, Countrywide's chief executive called "[d]isgusting."  The email was from a borrower, Dan A. Bailey, Jr., and sought a loan modification that would permit him to keep his home.  As the headline implies, the article is about how borrowers are having difficulties getting the attention of loan servicers. Excerpts:

* * * As of the most recent quarter, 2.67 percent of the loans that Countrywide services were more than 90 days delinquent. (The Bank of America Corporation acquired Countrywide on July 1 and is now overseeing the Countrywide portfolio.)

Lenders and servicers like Countrywide are inundated with requests for help from borrowers who cannot afford their loans. Alas, these companies’ operations weren’t set up for such work; servicing units were originally intended to collect monthly checks from borrowers and then disburse the payments to mortgage holders. During the boom years, there was little need to advise borrowers or restructure loans.

* * *

That said, foreclosures are vastly outnumbering loan workouts today, a year and a half after the subprime mortgage debacle began creeping into the headlines. In May, for example, even as Hope Now conducted 70,000 loan modifications, an estimated 85,000 families lost their homes to foreclosure. That same month, 276,000 loans either entered or completed foreclosure.