February 23, 2017

In a published decision issued on February 1, 2017, the United States Court of Appeals for the Eighth Circuit remanded for further consideration the lower court’s final approval of a consumer class action settlement in In re: Target Corporation Customer Data Security Breach Litigation, Case No. 0:14-md-02522 (8th Cir. Feb. 1, 2017) (“Target Corp.”).

In Target Corp., 112 consumer representatives filed a class action lawsuit against Target Corporation (“Target”) arising out of a 2013 third-party security breach that allegedly impacted up to 110 million Target customers.

The parties settled and sought certification of a single class:

All persons in the United States whose credit or debit card information and/or whose personal information was compromised as a result of the [2013 Target] data breach.

In effect, the class captured class members of three types: (1) those who had documented monetary losses from the security breach; (2) those who claimed undocumented monetary losses; and (3) those who had suffered no monetary loss.

The settlement provided for a $10 million settlement fund for the settlement class (separate and apart from attorneys’ fees), which was to be distributed according to injury:  class members with documented loss would be paid first and could recover up to $10,000 with the balance being distributed equally among the class members with undocumented losses. The uninjured class members would receive nothing.

The district court approved the settlement over the objection of an uninjured class member (“Olson”) who argued that the settlement did not satisfy Rule 23(a)’s adequacy requirement. Specifically, Olson argued that an intraclass conflict existed because the uninjured class members were represented only by injured class members such that the class representatives could not adequately represent the class as defined. Ultimately, Olson argued that the lower court should have certified a separate subclass with independent representation for those class members like him.

Interestingly, the Eighth Circuit remanded not because it found that a conflict existed or that there were other problems with the settlement. Instead, it remanded upon finding that the district court failed to engage in the “rigorous analysis” required by Rule 23 with respect to Rule 23(a)’s adequacy requirement. The Eighth Circuit noted that a district court’s final approval order must include a statement of the basic facts sufficient to allow meaningful appellate review. By simply reciting the Rule 23(a) requirement (as most courts do), the Eighth Circuit found that the district court abused its discretion by failing to rigorously analyze the propriety of certification, especially once new arguments challenging the adequacy of representation were raised after preliminary approval.  It therefore remanded with instructions to the district court to conduct a rigorous analysis and to articulate the facts supporting its conclusions as to:

    • Whether an intraclass conflict existed;
    • Whether the class representatives were able to fairly and adequately protect the interests of all class members; and
    • Whether any existing conflict necessitated subclasses.

The Target Corp. decision is one of the first, if not the first, post-Spokeo opinions to place standing squarely at issue in settling data breach class action litigation. Spokeo, of course, requires a tangible or intangible loss rather than reliance on a statutory violation alone. Target Corp., then, highlights the issue of what to do with the uninjured in the settlement context. If they are excluded, then they dilute the value of the release because they can sue once their injury manifests. If they are included, then they dilute the fund for the actually injured. Of course, one overarching consideration is whether an uninjured class member has standing to object in the first place. While we perhaps shouldn’t read much into the Eighth Circuit’s decision, it will be interesting to see how the district court deals with the standing issue on remand.