The common law trends in bet the company class actions have been overall favorable for defendant businesses in 2019. The U.S. Supreme Court issued two more decisions enforcing arbitration agreements and class action waivers. District courts from the U.S. Courts of Appeals for the Sixth and Seventh Circuits have consistently ruled that Bristol-Myers Squibb precludes nationwide class actions in jurisdictions other than where a defendant is subject to general jurisdiction. Depending on the venue and the nature of the claim, defendants can expect to win some (though not all) standing challenges where plaintiffs have arguably suffered no actual harm. With the enactment of the California Consumer Privacy Act (CCPA) in January 2020, defendants can expect a thornier landscape going forward. But as long as courts continue applying the same principles trending in 2019, defendants have various tools to defeat the expected influx of consumer privacy and data breach class actions.

Courts Continue Enforcing Arbitration Agreements and Class Action Waivers

During the first half of 2019, the Supreme Court has continued to emphasize the FAA's liberal federal policy favoring arbitration agreements.

In the first week of 2019, Justice Brett Kavanaugh issued his first opinion for the court in Henry Schein v. Archer & White Sales, which unanimously reaffirmed that arbitration agreements must be enforced according to their terms. Under the FAA, parties may agree that an arbitrator will resolve all contract-related disputes, including "gateway" questions of whether a particular dispute is subject to arbitration. Pre-Schein, various federal courts across the nation recognized an exception to that FAA rule: the court could resolve the arbitrability question if an argument for arbitration was "wholly groundless," even if the parties had contractually delegated the gateway question to the arbitrator. In Schein, the Supreme Court disagreed. The court stated that the FAA does not contain a "wholly groundless" exception and ruled that "when the parties' contract delegates the arbitrability question to an arbitrator, the courts must respect the parties' decision as embodied in the contract," even if the argument that the arbitration agreement applies to the dispute is without merit. In rejecting the wholly groundless exception, the court emphasized that federal courts "may not engraft our own exceptions onto the statutory text" of the FAA.

In April 2019, the Supreme Court issued another pro-arbitration decision in Lamps Plus v. Varela. In Lamps Plus, an employee filed a class action against his employer after a data breach caused the release of employees' personal identifying information. The employer moved to compel individual arbitration under the employment contract. The district court denied the motion and ordered classwide arbitration. The Ninth Circuit affirmed, holding that the contract's general dispute resolution provisions were ambiguous as to class arbitration and construing that ambiguity against the employer. In a 5-4 decision, the Supreme Court reversed. Writing for the majority, Chief Justice John Roberts accepted the Ninth Circuit's conclusion that the contract was ambiguous. He reasoned, however, that this ambiguity could not provide "the necessary 'contractual basis' for compelling class arbitration." The court reiterated that class arbitration is both "markedly different from the 'traditional individualized arbitration contemplated by the FAA,'" and "undermines the most important benefits of that familiar form of arbitration." The Supreme Court held that classwide arbitration is not available unless the parties' agreement explicitly states their intent to arbitrate claims on a class-wide basis.

The court's pro-arbitration decisions have spurred various interest groups to lobby Capitol Hill for legislation limiting the reach of arbitration and class action waiver provisions. On Sept. 20, 2019, the U.S. House of Representatives passed H.R. 1423, the Forced Arbitration Injustice Repeal Act (FAIR), sponsored by Rep. Hank Johnson, D-Ga., and co-sponsored by a bipartisan list of 222 members of Congress. FAIR would amend the FAA to prohibit mandatory arbitration or class action waiver of employment, civil rights, antitrust and consumer claims. The bill mandates that state and federal judges, rather than a private arbitrator, would decide on the applicability of this new prohibition to a particular dispute. The bill would also guarantee that workers can seek judicial enforcement of any state or federal statutory or constitutional right, regardless of any collective bargaining agreement between labor organizations and employers. Although there is bipartisan support for this bill in the House, it will likely perish in the Senate or by presidential veto during this cycle.

Courts Split on Whether 'BMS' Decision Limits Nationwide Class Actions

Since the Supreme Court's 2017 ruling in Bristol-Myers Squibb v. Superior Court of California, San Francisco County (BMS), two primary legal questions have emerged for courts applying BMS to a class action: does BMS apply where the court's subject matter jurisdiction is based on a federal question instead of diversity?; and does BMS apply to unnamed class members?

There is general agreement among lower courts that BMS applies where a court's subject matter jurisdiction is based on diversity. Several courts in California, however, have held that BMS is inapplicable where jurisdiction is based on a federal question. These courts argue that the federal courts represent the same "federal sovereign," not individual state sovereigns, and as a result the jurisdictional due process analysis for a federal question—which is controlled by the Fifth Amendment—does not involve the same interstate sovereignty concerns analyzed under the Fourteenth Amendment in BMS. Furthermore, courts argue that BMS is inapplicable where Congress has created a federal claim to address nationwide harms.

Other district courts, including several in the First, Sixth and Seventh Circuits, have rejected the distinction between federal question and diversity jurisdiction. These courts argue that unless a federal statute permits nationwide service of process, BMS applies with equal force to a federal question case because the Federal Rules of Civil Procedure limit a district court's jurisdiction to the same reach as a state court in that district, and therefore the due process analysis is effectively the same under the Fifth and Fourteenth Amendments. Courts have also argued that BMS applies regardless of the basis for jurisdiction because the due process analysis is not different under the Fifth versus Fourteenth Amendments.

Once a court determines that BMS' analysis could apply to a case given the subject-matter jurisdiction, it must next determine whether BMS should apply to unnamed class members. Courts across the country have diverged sharply on this question. Many courts in the Ninth Circuit have rejected the application of BMS to unnamed class members on the basis that there is a difference between class actions and mass actions. Those courts argue: precedent does not require the citizenship of unnamed class members to be taken into account when assessing personal jurisdiction for a class action; Rule 23 provides additional due process protections for defendants that are not present in a mass action; Rule 23 is a valid exercise of congressional authority in shaping federal court jurisdiction; and the federalism concerns in BMS are not present where a court properly exercises jurisdiction over a defendant in a nationwide class action permitted by Rule 23.

District courts from the Sixth and Seventh Circuits disagree and have applied BMS to absent class members on the grounds that BMS articulates a straightforward due process analysis that applies to all plaintiffs. Furthermore, these courts have held that the Supreme Court's concerns about federalism in BMS suggest the court would bar nationwide class actions in forums other than where the defendant is subject to general jurisdiction and that applying a different due process analysis to absent class members would violate the Rules Enabling Act.

The stakes are high in resolving whether BMS applies to unnamed class members. A rule that precludes absent class members with no connection to the forum would effectively destroy nationwide class actions in jurisdictions other than where a defendant is subject to general jurisdiction. This result could make it more difficult for plaintiffs to mount class action challenges, however it could also lead to a splintered process of class actions involving the same defendant and claims being filed in multiple forums. No federal appeals court has yet interpreted BMS' impact on unnamed class members. In the meantime, divergent rulings on BMS have led to forum shopping between districts that typically rule BMS applies to class actions (such as Illinois) and those that typically rule the opposite (such as California). Unless forthcoming rulings from the circuit courts harmonize these divergent rulings, this issue is likely to end up back at the Supreme Court.

Courts Lack Consensus Regarding What Constitutes a Concrete Injury

Three years after the Supreme Court's landmark ruling in Spokeo, there is still significant disagreement among the lower courts about what constitutes a concrete and particularized injury to establish standing. While some courts have dismissed class actions where the named plaintiff lacks standing under Spokeo, many more courts have found standing exists based on a technical violation of a statutory provision regardless of whether the plaintiff suffered an actual injury.

Defendants have generally had success dismissing cases for lack of standing under Spokeo in the context of the Fair and Accurate Credit Transactions Act (FACTA), a statute that prohibits retailers from printing more than the last five digits of a credit card on a transaction receipt, and the Cable Communications Policy Act, which requires cable operators to destroy personally identifiable information which is no longer needed. In the past two years the Second, Seventh, Third, and Ninth Circuits have affirmed dismissal of FACTA claims and both the Seventh and Eighth Circuits have affirmed dismissal of Cable Communications Policy Act claims. In those cases, the plaintiff failed to plead that information was disclosed to a third party and as a result the courts held that the consumer suffered no concrete harm.

Circuit courts have been less willing to dismiss claims under Spokeo in the context of the Telephone Consumer Protection Act (TCPA) and Video Privacy Protection Act (VPPA), the latter of which prohibits "a video tape service provider [from] knowingly disclosing, to any person, personally identifiable information concerning any consumer of such provider." The Third, Ninth and Eleventh Circuits have found a concrete harm under the TCPA where, for example, a plaintiff suffered wasted time and expense receiving unwanted calls and faxes, or under the VPPA because protected information was disclosed to third parties, even if there is no other showing of a concrete harm. These rulings appear at odds with Spokeo's directive that a plaintiff demonstrate a "real" and not "abstract" injury.

Cases involving the Fair Credit Reporting Act (FCRA), the statute at issue in Spokeo, demonstrate the same inconsistencies in Spokeo's application. Decisions from the Third, Seventh, Ninth and DC Circuits found standing in situations where the plaintiff arguably suffered no actual injury, such as where a defendant allegedly failed to provide the consumer with a copy of a credit report, disclosed personal information without authorization, or failed to provide required consumer disclosures. In contrast, the Fourth and Seventh Circuits found no harm sufficient to confer standing where a consumer was able to exercise his or her rights under the FCRA despite alleged inaccurate or incomplete information in a credit report, or where alleged incomplete consumer disclosures resulted only in "a statutory violation completely removed from any concrete harm or appreciable risk of harm."

Defendants can expect many courts will continue to confer standing to consumers even where they have arguably suffered no actual harm. The lack of consensus regarding what counts as a concrete injury means defendants must strictly comply with consumer protections statutes to avoid being dragged into court.

The New Frontier: Data Security Class Actions

New consumer privacy class actions continue testing the boundaries of what constitutes a concrete injury. In December 2018, a court in Illinois dismissed a lawsuit alleging that Google violated the Illinois Biometric Information Privacy Act (BIPA) by creating and storing "face templates" based on pictures uploaded to Google Photos. The plaintiffs alleged they never gave consent for Google to create and use face templates. The court held that mere retention of private information, on its own, is not a concrete injury and the plaintiffs testified that they did not suffer any physical, financial or emotional injury as a result of Google's alleged conduct. However, on Jan. 25, the Illinois Supreme Court held that a violation of BIPA on its own, without additional evidence of harm, is sufficient to allege a claim. The ruling is not binding on a federal court interpreting federal standing law. The decision may, therefore, lead plaintiffs to file more BIPA cases in state court in an attempt to escape the standing question.

Courts in data breach cases diverge on the question of whether a plaintiff can demonstrate standing where stolen information has not been used and there is only the risk of future identity theft. The Supreme Court has never ruled directly on this issue and many had hoped that it would have the opportunity to do so in the Zappos data breach case. In 2018, the Ninth Circuit held that a plaintiff class comprised of Zappos.com customers whose information was disclosed in a data breach had pleaded standing despite the fact the class members' stolen information had not been used. The defendant filed a petition of certiorari that presented the issue, but on March 26, the Supreme Court denied cert.

Courts in California will likely face a flood of data breach class action suits alleging violations of the CCPA. The CCPA gives consumers a private right of action against businesses who fail to implement and maintain reasonable security measures to protect such information. A business is defined as any entity for profit or financial benefit, that collects consumers' personal information (or on behalf of which that information is collected), and either: has a gross revenue in excess of $25 million; buys, receives for commercial purposes, shares for commercial purposes, or sells the personal information of 50,000 or more consumers, households, or devices; or derives 50% or more of its annual revenues from selling consumers' personal information.

Earlier this year the California Senate withheld SB 561, an amendment that sought to dramatically expand the CCPA's private right of action and remove safe harbors in situations in which a business does not comply with a consumer's request concerning data usage, retention and disclosure. Creative plaintiffs, however, will look for other ways to pursue CCPA claims in these situations. For example, plaintiffs counsel may file claims under California's Unfair Competition Law (UCL) (Cal. Bus. & Prof. Code Section 17200, et seq.). The UCL's unlawful prong has been an avenue for plaintiffs to pursue private claims under statutes that lack their own private right of action. The California Supreme Court has limited UCL claims where the legislature specifically intends to preclude a private right of action. Therefore, defendants may argue CCPA's explicit statement that (other than the data breach private right of action) it is not intended to "serve as the basis for a private right of action under any other law" precludes UCL unlawful claims. These issues will likely be tested in the courts.

Camille Penniman is the senior vice president of Legal, Fry Cook and Cashier at Raising Cane's Chicken Fingers. She is an accomplished in-house counsel with significant experience in corporate, litigation, intellectual property, employment and franchise issues.

Joshua Briones, managing member of Mintz, Levin, Cohn, Ferris, Glovsky and Popeo's Los Angeles office, is a commercial litigator focused on defending consumer class actions. He has represented clients in a wide range of industries, including financial services, life sciences, manufacturing, and retail, in cases involving false advertising, unfair trade practices, and other claims.

Crystal Lopez is an associate in the firm's Los Angeles office whose practice focuses on class action defense, with an emphasis on consumer fraud, data privacy, marketing, accessibility, technology and compliance issues. She has defended corporate clients against class actions at all stages of litigation.