Ne. Eng'rs Fed. Credit Union v. Home Depot, Inc. (In Re Home Depot Inc.)

931 F.3d 1065
CourtCourt of Appeals for the Eleventh Circuit
DecidedJuly 25, 2019
Docket17-14741
StatusPublished
Cited by104 cases

This text of 931 F.3d 1065 (Ne. Eng'rs Fed. Credit Union v. Home Depot, Inc. (In Re Home Depot Inc.)) is published on Counsel Stack Legal Research, covering Court of Appeals for the Eleventh Circuit primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Ne. Eng'rs Fed. Credit Union v. Home Depot, Inc. (In Re Home Depot Inc.), 931 F.3d 1065 (11th Cir. 2019).

Opinion

TJOFLAT, Circuit Judge:

*1071 Following a data breach at Home Depot, the information for tens of millions of credit cards was stolen, and a class of banks who issued the cards sued Home Depot to recover their resulting losses. Home Depot eventually settled with the class. As part of the settlement, Home Depot agreed to pay the reasonable attorney's fees of Class Counsel. The agreement specified that the attorney's fees would be paid separate from and in addition to the class fund, but the parties left the amount of those fees undetermined.

The District Court awarded Class Counsel $15.3 million in fees. It reached this award using the lodestar method, finding Class Counsel's hours to be reasonable and applying a multiplier of 1.3 to account for the risk the case presented. The Court also used the percentage method as a cross-check to ensure the amount of fees was reasonable.

On appeal, Home Depot argues that the District Court abused its discretion by applying a multiplier and by compensating Class Counsel for certain time spent on the case-namely, the substantial time spent litigating about a private dispute-resolution process separate from the litigation. Home Depot also says that the District Court's order is not capable of meaningful review. For its part, Class Counsel brings a conditional cross-appeal taking issue with how the District Court conducted the percentage cross-check.

The main issue underlying the appeal is whether the fee arrangement outlined in the settlement should be characterized as a constructive common fund or as a fee-shifting contract. We hold that this is a contractual fee-shifting case, and the constructive *1072 common-fund doctrine does not apply. Once we identify the proper legal framework, the parties' challenges are more easily resolved. We affirm the District Court's decision in all respects except one: it was an abuse of discretion to use a multiplier to account for risk in a fee-shifting case.

I.

Disputes over attorney's fees are fact-intensive inquiries. As such, a thorough review of the facts is necessary to decide this case.

A.

In 2014, Home Depot experienced a massive data breach. It started when hackers installed malware on Home Depot's self-checkout kiosks. The malware would siphon off the personal financial information of customers who paid at the kiosks using a credit or debit card. The hackers then made this information, including names, card numbers, expiration dates, and security codes, available for sale on a black-market website. Approximately fifty-six million cards were compromised. It did not take long for a large number of fraudulent transactions to occur using the stolen information.

A flood of lawsuits followed. Consumers whose personal information was stolen and banks that issued the compromised cards filed over 50 class actions. The United States Judicial Panel on Multidistrict Litigation consolidated these cases in the Northern District of Georgia, where the District Court split the litigation into two tracks: one for the consumers and one for the banks. This appeal arises from the bank track. 1 The District Court appointed Class Counsel to manage the sprawling litigation and ordered Class Counsel to submit quarterly reports to the Court in camera showing the hours billed and expenses incurred.

The banks filed a consolidated complaint accusing Home Depot of failing to secure its data. They brought claims for negligence and negligence per se on behalf of a national class, and for violations of state consumer-protection statutes on behalf of eight state-specific subclasses. They alleged that, as a result of the data breach, they were forced to cancel and reissue the compromised cards, investigate claims of fraudulent activity, and reimburse customers for fraudulent charges (among other things). The banks sought monetary damages for the cost of these responses, as well as declaratory and injunctive relief to force Home Depot to improve its security measures.

Home Depot moved to dismiss the complaint on numerous grounds. In the interim, and at the urging of the District Court, the parties proceeded with preliminary discovery. After the District Court ruled on the motion to dismiss, denying it in part, Home Depot answered the complaint. Shortly afterwards, the District Court stayed further action in the case pending settlement negotiations.

B.

While the litigation unfolded, another process played out that is central to this appeal: the card-brand recovery process. The card brand recovery process is essentially a private dispute-resolution arrangement between Home Depot, the banks, and the card brands (e.g., Visa and Mastercard). It's separate from the litigation, and instead is based on contracts with merchants (like Home Depot) that outline *1073 the terms for accepting credit and debit cards as payment. The process is relevant to this appeal because Class Counsel took issue with events that occurred in the card-brand recovery process that affected the class action, and Home Depot argues that Class Counsel should not be compensated for the substantial time spent pursuing the matter.

Here's how the card-brand recovery process works: The card brands, Visa and MasterCard, have contracts with the banks that issue their branded cards to customers. In turn, the banks have contracts with the merchants who accept the cards as payment. 2 These contracts include regulations for protecting payment-card data against the threat of a data breach. The contracts also establish procedures for merchants to reimburse the banks for losses in the event that card information is compromised in a data breach. As part of the procedure, the card brands investigate to determine if a breach occurred and the financial impact of the breach. The card brands then impose assessments on the merchant to reimburse the banks for their losses.

That process is what happened in this case. Following the breach, Visa and Mastercard together assessed $120 million against Home Depot to be paid to banks. 3 Home Depot had the option to challenge the assessment and possibly pay a reduced amount. In fact, Mastercard could not recall when a merchant had ever paid the full amount. But instead of fighting the assessments, Home Depot offered to pay the full amount plus a premium.

Home Depot did so in exchange for the banks releasing their claims against Home Depot. Normally, when a merchant pays these assessments, it does not include a release from liability. In Home Depot's view, if it was going to pay the assessments, it ought to be released from liability too. So Home Depot reached out to Visa, Mastercard, and some of the larger banks to negotiate a deal. These banks were putative class members, who represented up to 80% of the compromised payment cards.

These parties worked out a deal in which Home Depot would pay the full amount of the assessment, plus about a 10% premium payable to the banks that released their claims against Home Depot.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Cite This Page — Counsel Stack

Bluebook (online)
931 F.3d 1065, Counsel Stack Legal Research, https://law.counselstack.com/opinion/ne-engrs-fed-credit-union-v-home-depot-inc-in-re-home-depot-inc-ca11-2019.