Shiyang Huang v. Equifax Inc.

999 F.3d 1247
Court of Appeals for the Eleventh Circuit·Decided June 3, 2021·No. 20-10249·Published·Cited by 73 cases

Opinion

[PUBLISH]

IN THE UNITED STATES COURT OF APPEALS

FOR THE ELEVENTH CIRCUIT

No. 20-10249

D.C. Docket No. 1:17-md-02800-TWT In re Equifax Inc. Customer Data Security Breach Litigation

SHIYANG HUANG, et al., Movants-Appellants,

BRIAN F. SPECTOR, et al., Plaintiffs-Appellees,

versus

EQUIFAX INC., et al.,

Defendants-Appellees.

Appeals from the United States District Court for the Northern District of Georgia

(June 3, 2021)

Before MARTIN, GRANT, and BRASHER, Circuit Judges. MARTIN, Circuit Judge:

This appeal arises from the 2017 data privacy breach of Equifax Inc. and its affiliates (collectively “Equifax”). After the breach came to light, scores of class actions against Equifax flooded the courts. The cases were consolidated in the Northern District of Georgia, where Plaintiffs and Equifax eventually settled their dispute, resulting in “the largest and most comprehensive recovery in a data breach case in U.S. history by several orders of magnitude.” But try as they might, the parties could not please everyone. Of the approximately 147 million class members, 388 people objected to the settlement. Even so, the District Court approved the settlement, certified the settlement class, awarded attorney’s fees and expenses, and approved incentive awards for the class representatives. Several of the objectors appealed, challenging the District Court’s approval order as well as some related rulings.

This case highlights the role objectors play in the settlement of class actions.

We begin with the knowledge that settlements are “highly favored in the law” because “they are a means of amicably resolving doubts and uncertainties and preventing lawsuits.” In re Nissan Motor Corp. Antitrust Litig., 552 F.2d 1088, 1105 (5th Cir. 1977) (quotation marks omitted).1 The settlement here is a prime example. Absent the settlement, the class action could have faced serious hurdles

1 In Bonner v. City of Prichard, 661 F.2d 1206 (11th Cir. 1981) (en banc), we adopted as binding precedent all decisions of the former Fifth Circuit handed down before October 1, 1981. Id. at 1209.

to recovery, and now the class is entitled to significant settlement benefits that may not have even been achieved at trial. And you need not take our word for this. The Federal Trade Commission, the Consumer Financial Protection Bureau, and the Attorneys General for 48 states, the District of Columbia, and Puerto Rico all support the settlement.

Yet as we mentioned, not everyone bound by this class action settlement agrees with it, and class members who oppose the settlement have the right to object. See Fed. R. Civ. P. 23(e)(5)(A). Often times objectors play a “beneficial role in opening a proposed settlement to scrutiny and identifying areas that need improvement.” David F. Herr, Annotated Manual for Complex Litigation § 21.643 (4th ed. 2021) [hereinafter “Manual for Complex Litigation”]. And because objectors have the right to object, it is our obligation to closely review the issues they present. Consistent with our obligation, we have studied the hundreds of pages of briefing, sifted through the flurry of Rule 28(j) letters, and familiarized ourselves with the enormous record in this case. After this careful consideration, and with the benefit of oral argument, we affirm the District Court’s rulings in full, subject to one small asterisk. Specifically, after the District Court approved incentive awards for the class representatives, a panel of this Court held that such awards are prohibited. See Johnson v. NPAS Sols., LLC, 975 F.3d 1244, 1260 (11th Cir. 2020). As in NPAS Solutions, we must reverse the District Court’s

ruling on the incentive awards alone and remand this case to the District Court solely for the limited purpose of vacating those awards. See id.

I. BACKGROUND

In 2017, Equifax, a consumer reporting agency, announced it had been subject to a data privacy breach affecting the personal information of almost 150 million Americans. The breach involved some of the most sensitive personal information possible: all nine digits of Americans’ Social Security numbers, coupled with their names, dates of birth, and addresses, among other things. Over 300 class actions against Equifax were filed across the nation, all of which came to be consolidated and transferred by the Judicial Panel on Multidistrict Litigation to then-Chief Judge Thomas W. Thrash in the Northern District of Georgia.2 The District Court established separate tracks for the consumer claims and the financial institution claims. This appeal relates to the consumer claims.

In 2018, Plaintiffs filed a 559-page consolidated class action complaint against Equifax. The complaint included 96 named plaintiffs who brought a host of statutory and common law claims under federal and state law. These claims included violations of the Fair Credit Reporting Act, the Georgia Fair Business Practices Act, and various state consumer protection and data breach statutes.

2 Chief Judge Thrash ended his service as Chief Judge for the Northern District of Georgia earlier this year. For consistency, we refer to him by his former title.

Plaintiffs also brought claims for negligence, negligence per se, unjust enrichment, and breach of contract. Plaintiffs alleged that, due to the data breach, they are “subject to a pervasive, substantial and imminent risk of identity theft and fraud.” They also alleged that they have spent time, money, and effort attempting to mitigate the risk of identity theft and that many have already been victims of identity theft.

Equifax filed a motion to dismiss the complaint in its entirety, which the District Court granted in part and denied in part. The District Court dismissed the Fair Credit Reporting Act claims, the Georgia Fair Business Practices Act claims, as well as some state statutory claims. However, it allowed the negligence and negligence per se claims under Georgia law, as well as other state statutory claims, to go forward. All the while, the parties engaged in robust settlement negotiations. Layn Phillips, a retired federal district court judge with experience in data breach cases, served as the mediator. The parties’ efforts paid off. After 18 months of negotiations, they reached a settlement agreement. The parties then consulted and negotiated with various federal and state regulators and revised their agreement as a result of those consultations. Ultimately, the Federal Trade Commission, the Consumer Financial Protection Bureau, and the Attorneys General for 48 states, the District of Columbia, and Puerto Rico settled with Equifax, agreeing that the

settlement fund in this case provides redress to consumers. In July 2019, the parties presented their final settlement agreement to the District Court.

The District Court described the parties’ settlement as “the largest and most comprehensive recovery in a data breach case in U.S. history by several orders of magnitude.” Under the terms of the settlement, Equifax agreed to pay an initial $380.5 million into a fund to benefit the class members and to pay attorney’s fees and expenses, incentive awards, as well as notice and administration costs. The settlement includes the following benefits for each class member: 3

• Reimbursement for up to $20,000 of documented, out-of-pocket losses fairly traceable to the data breach (e.g., the cost of freezing a credit file, professional fees due to identity theft);

• Compensation of $25 per hour for up to 20 hours (subject to a $38 million cap) for time spent taking preventative measures or dealing with identity theft, with no documentation needed for the first 10 hours;

• Four years of three-bureau credit monitoring and identity protection services through Experian;

• An additional six years of one-bureau credit monitoring and identity protection services through Equifax, which will be provided separately by Equifax and not paid for from the settlement fund;

Free access — add to your briefcase to read the full text and ask questions with AI

Shiyang Huang v. Equifax Inc., 999 F.3d 1247 (11th Cir. 2021).

999 F.3d 1247 (Shiyang Huang v. Equifax Inc.) — published by Counsel Stack Legal Research, free access to 12M+ legal documents.

Related