Kenneth Canfield of Doffermyre Shields Canfield & Knowles, Atlanta, enters the Richard B. Russell Federal Courthouse in Atlanta. (Photo: John Disney/ALM)

The chief judge of the Northern District of Georgia on Thursday gave final approval to a $1.4 billion settlement agreement between Equifax and a class of 147 million consumers whose financial and personal data was exposed.

U.S. District Chief Judge Thomas Thrash Jr. also approved $77.5 million in legal fees and more than $1.4 million in expenses sought by the plaintiff consumers' class counsel for their role in negotiating what Thrash called "a historically significant data breach settlement."

"I don't think anyone can credibly argue it doesn't provide substantial relief for the class now and in the future," Thrash said at the end of a four-hour final approval hearing Thursday.

In granting class counsel's fee request in full, Thrash said attorneys put in more than 33,000 hours, defeated Equifax's motion to dismiss more than 400 claims that formed the basis of the multidistrict litigation and engaged in a "complex and highly adversarial" mediation. "In my opinion, plaintiffs' counsel took a serious risk in this litigation that could have terminated in Equifax's favor," he said.

The judge said the fee award is about 20% of $380 million set aside to provide consumers with extended credit monitoring, identity protection and repair services or reimburse them for expenses if their identities were stolen.

Thrash said attorney fee awards in data breach cases involving The Home Depot, Arby's, Target, and Anthem ranged from 27%-30%.

The judge also rejected arguments that substantial nonmonetary benefits included in the settlement couldn't be considered in calculating the fee award. "I think the result that has been achieved in this case has been exceptional and warrants approving the award," he said.

In approving the settlement, Thrash said that consumer anger about the Equifax data breach was unprecedented. "I've never seen anything like it in any other consumer data breach case I have handled," he said. "Nobody chooses to give information to Equifax. Equifax gets information from banks, merchants, landlords and employers. Then Equifax makes money selling that information back to banks, merchants and employers."

Thrash first issued his preliminary approval of the deal July 22. More than 400 cases filed across the nation following Equifax's September 2017 announcement of the unprecedented breach were consolidated in multidistrict litigation in the Northern District of Georgia in Atlanta.

Counsel for Equifax and for the class of 147 million consumers all have called the proposed settlement "unprecedented" in its scope and acknowledged in court papers that it was reached only after a series of contentious and difficult settlement negotiations.

The global settlement also resolves separate claims and enforcement actions by the U.S. Federal Trade Commission, the Consumer Financial Protection Bureau and a multistate group of attorneys general from 48 of the nation's 50 states, the District of Columbia and Puerto Rico.

Equifax is represented by a team of King & Spalding lawyers led by partners David Balser and Phyllis Sumner.

In asking Thrash to approve the settlement, Balser said the proposed settlement agreement "reflects the maximum Equifax is willing to do to resolve these claims."

The consumer class counsel team includes Kenneth Canfield of Atlanta's Doffermyre Shields Canfield & Knowles; Norman Siegel of Stueve Siegel Hanson in Kansas City, Missouri; and Amy Keller of Dicello Levitt Gutzler in Chicago.

Canfield said the consumer response to the settlement notice has been "overwhelmingly positive" and "unusually high."  He said there have been more than 130 million visits to the class website, and 15 million people have already filed claims to date. "I am unaware of any class action that has had this type of response," he said.

Thrash approved the deal despite an objection filed by Ted Frank, director of the Center for Class Action Fairness at the Hamilton Lincoln Law Institute in Washington, D.C. Frank targeted what he called an "excessive" legal fee request, suggesting it should be slashed to $16 million. Frank also argued the true value of the proposed settlement was $162 million.

In court papers, Equifax attorneys said nearly 65% of the total objections filed were submitted via a chatbot run by a third party claims filing service called Class Action.

Two state attorneys general—Massachusetts' Maura Healey and Indiana's Curtis Hill Jr.—also filed amicus briefs supporting objectors, calling on Thrash to reject the settlement unless it's modified to ensure that their separate state enforcement actions against Equifax won't be invalidated by the deal.

Thrash said their objections were invalid because the two states aren't class members and therefore have no standing to object.

Thrash said nothing  in the settlement that prevents the Massachusetts and Indiana AGs from pursuing state claims or consumer enforcement actions in their respective state courts.

Under the terms of the consumer settlement, Equifax will pay $380.5 million earmarked for class benefits, fees, expenses and service awards, as well as notice and administration costs. Those benefits include up to 10 years of free credit monitoring or a one-time cash payment of up to $125 subject to a $31 million total cap and reimbursement of up to $20,000 for out-of-pocket losses fairly traceable to the data security breach.

Equifax also will pay up to an additional $125 million, if needed, to satisfy claims for consumers' out-of-pocket losses from efforts to defend against identity theft and $1 billion spent over five years to upgrade the company's data security and related technology.

Because there is no cap on the settlement, Equifax could pay as much as $2 billion more, if all 147.4 million class members sign up for 10 years of free credit monitoring, the class lawyers said. No settlement funds will revert to Equifax.