Our Litigators of the Week are the quartet of plaintiffs' lawyers who led the class action stemming from Equifax's massive data breach: Amy Keller of Dicello Levitt Gutzler; Norman Siegel of Stueve Siegel Hanson; Roy Barnes, the former governor of Georgia and principal of the Barnes Law Group; and Ken Canfield of Doffermyre Shields Canfield & Knowles.

The 2017 breach exposed the Social Security numbers, birth dates, addresses and, in some cases, the driver's license and credit card numbers of over 147 million consumers.

The MDL was one piece of a global settlement, which also involved enforcement actions by 50 U.S. states and territories, the Federal Trade Commission and the Consumer Financial Protection Bureau. 

The regulators “agreed that the fund in this case–as originally negotiated by class counsel and as supplemented by relief the regulators obtained–will be the vehicle for all consumer redress necessitated by the breach,” according to the plaintiffs lawyers. 

The total cost to Equifax, with consumer redress and improvements to the company's data security, will be at least $1.38 billion.

Keller, Siegel, Barnes and Canfield discussed the case with Lit Daily. 

Who is your client and what was at stake?

Norm Siegel: Over 147 million U.S. consumers, or over half of the adult population. A small percentage of the class had a direct relationship with Equifax, but all were impacted by the breach.

Tell us a bit about your opponent.

Norm Siegel: Equifax is one of the three major credit reporting agencies in the United States along with TransUnion and Experian.  

Amy Keller: Credit reporting agencies collect information about consumers' credit information and resell it to other businesses in the form of a consumer's credit report.  Consumers do not choose to give their information to the credit reporting agencies; it's automatic.

Roy Barnes: Like so many of the major corporations in Georgia, Equifax is represented by King & Spalding, a firm with many of the ablest lawyers in the state.  We knew that we would have to be at the top of our game to succeed in this case.

When and how did you become involved in the case? 

Norm Siegel: I was lead counsel in the Home Depot data breach litigation before Judge Thrash in the same district. We were contacted by impacted consumers immediately after the breach and filed the same day. 

Amy Keller: Our team filed some of the first class action lawsuits against Equifax in the wake of the announcement of the 2017 data breach. Each of our firms was contacted by consumers whose data was compromised by the breach given our extensive experience with consumer protection and data breach litigation. For example, both Norm Siegel and Ken Canfield led data breach cases against Home Depot before Judge Thrash in the same district. I'm part of the team leading the data breach litigation against Marriott and Starwood. 

Ken Canfield:  On the afternoon of September 7, 2017, I had just settled several other class actions and was hiking in Colorado with my wife Shelley, talking about how it might be time for me to do something else in life when my cell phone blew up.  Lawyers around the country were reaching out to me about suing Equifax within minutes after the breach was announced.  When the dust settled, I was fortunate to be part of a dream team of data breach lawyers and have never regretted my decision to get involved.  

How did you coordinate working together? Who were the key members of your team?

Norm Siegel: An experienced and diverse leadership team was imperative from the beginning. After hundreds of nationwide, class action cases were transferred to the Northern District of Georgia and were consolidated before Chief Judge Thomas Thrash, we requested (and the court-ordered) a co-lead counsel trio of Ken Canfield, Amy Keller, and myself.

We assembled our 13-member team with the lawyers who have handled the largest data breach cases litigated to date including cases against Target, Home Depot, Anthem, and Yahoo. The team worked together cooperatively throughout the case to match the effort and quality of work—if not the resources—available to our opponent.

Roy Barnes: I told Judge Thrash when he heard leadership applications that getting together on a case like this was like getting married. Most of us had practiced together and worked with each other on previous cases, and we had a good sense of how to communicate and what everybody's strengths were. 

Explain the components of the settlement.

Norm Siegel: This is the largest settlement in a data breach case by several orders of magnitude. First, the settlement creates a non-reversionary fund of $380.5 million that will be supplemented by another $125 million if needed. 

This fund will be used to pay out-of-pocket losses related to the breach and, importantly, up to 20 hours of lost time at $25 per hour. Second, the settlement provides for four years of high-quality three-bureau monitoring, a benefit worth $1,200 per class member. Following that, an additional six years of single bureau monitoring is available, an additional benefit worth $720 per class member. As part of this program, all class members, whether or not they make a claim, will have access to identity restoration services for seven years. 

Third, Equifax will be obligated to overhaul its data security practices and spend at least $1 billion in incremental security upgrades. This provision is enforceable through a consent order that we negotiated as part of the settlement. 

Amy Keller: Importantly, if more than seven million consumers sign up for credit monitoring services, Equifax will have to pay even more into the settlement fund, increasing their potential exposure under the settlement to nearly $3 billion.

What was the toughest point of negotiations?

 Norm Siegel: This was a long process covering over 18 months of intense negotiations, including five separate sessions with an experienced mediator. There was no time when the negotiations weren't difficult. 

After we struck our settlement with Equifax we were asked to consider proposals by federal and state regulators to modify our deal. That process proved challenging because it invited a multi-party negotiation regarding modifications to a deal that was 18 months in the making. That negotiation took over three months alone, but the final product was improved and we are grateful for the regulators' support. 

Roy Barnes: In years past, I would represent folks going through a divorce. In those cases, I learned that the biggest arguments were rarely about money. In this case, we insisted on business practice changes that Equifax would have to make to keep this from happening again. It took a lot of time and effort and work with experts to come to an agreement that both sides could live with. Small changes in wording can have a big impact on things like this. At the end of the day, we expect these changes will be effective, as do many regulators if you compare their consent orders to ours. 

What do you think is the most important element for consumers from the settlement?

 Norm Siegel: It will be different things for different consumers. For some, it may be the ability to recover significant out of pocket losses and time they suffered as a result of the breach. For others, it may be access to quality credit monitoring and restoration services over the next several years. And for still others, it may be just knowing that Equifax will be compelled to significantly improve the way it handles consumer data to minimize the chance of another breach. The settlement was specifically crafted to address all of these elements. 

Ken Canfield:  This settlement is historic, not only for the amount of the relief made available to class members, but because of an unprecedented notice program that uses tools from contemporary commercial and political advertising (such as focus groups, an opinion survey, and quantitative testing) to more effectively reach class members and maximize their participation. Class members will benefit by better understanding their rights and options and, we hope, lead to them filing more claims. Also, we expect this program will set the benchmark for notice in future class actions, benefiting consumers for years to come.  

What was the most challenging part of the case for you?

 Norm Siegel: As chairman of the settlement committee, the most challenging part of the case was keeping several complex and technical components of the settlement moving forward in harmony, while also working with the team to navigate the case through the litigation, including a very challenging motion to dismiss. 

Amy Keller: With a case this large, the mountain of information our team had to assemble, process, and provide to our experts was staggering. Ensuring that we were able to assess Equifax's liability, and how to address its security flaws through our negotiated consent order, were imperative to finalizing our settlement.

Roy Barnes: I have said that there are some things in life that cannot be solved with money and that this case is not one of those things. However, figuring out how to get money in class members' pockets through the settlement was something we had to put a lot of thought into. Not everybody in the class will have suffered major financial account fraud, for example. Still, those people who had to go through the hassle of having their information stolen deserve compensation, and we think that we designed a settlement that has accomplished this.   

What personal strengths did you tap into as you were working on the case?

Norm Siegel: Collaboration. This was by many accounts the most complex and challenging case most of our leadership has worked on in over 100 years of collective practice. We were blessed with a team that set personal agendas and ego aside and applied a true partnership approach to the case. 

Amy Keller: A fresh perspective. As the youngest woman selected to lead a nationwide, multidistrict litigation, I would hope I brought new perspectives and ideas to the table, helping the team take creative approaches to the litigation and, ultimately, claims processing.

Now that the case is behind you, what did you learn about handling such a massive undertaking?

Norm Siegel: No collaboration, no success. 

 Amy Keller: No trust, no success. Our team was so successful because we also trusted one another, and we were able to accomplish a lot in a very short period of time because of that.

What's your takeaway about the security of personal data held by corporations?

Norm Siegel: This is a unique case because the vast majority of victims have no relationship with Equifax. But just as with the large data breach cases that came before it, the Equifax breach demonstrates that corporations have yet to prioritize data security. It is impossible to envision this trend slowing, at least until Congress gets serious about legislation. In the meantime, state law—and the ability to hold these negligent corporations to account through the class action device—will serve as the mechanism to hold these corporations responsible. 

Amy Keller: We're only seeing the tip of the iceberg regarding the type of information credit reporting agencies, data brokers, and large corporations retain about American consumers. And what we know so far is staggering. 

Perversely, many corporations take the position that, even though they are making a profit off of brokering your information, they owe you no duty to keep your information safe. I echo the comments from my colleagues about the need to improve current legislation. Although we were able to achieve a lot through this settlement, it really pushed the boundaries of the law as we know it. Stronger consumer protections would have required Equifax to pay so much more.

Roy Barnes: I learned when I was governor of Georgia that you can have all the policies in the world but they are worthless if they are not enforced. Companies need to commit to implementing the policies that they have on paper.

How do you see this case affecting the safeguarding of consumer data?

Norm Siegel: There have been scores of significant data breaches since the announcement of the Equifax breach. Until Congress passes a law that sets a high bar for data security and provides a mechanism for civil enforcement if those standards are not met, consumer data will continue to be vulnerable and Americans at risk of further harm. We should not give in to the sense of inevitability about the lack of privacy of our personal information, and instead, push lawmakers for reform. 

Amy Keller: There are two positive things that came out of the breach. First, consumers have a better understanding of how the credit reporting system works and how vitally important it is to freeze their credit.  

Second, we know that the class action device remains a powerful mechanism to achieve consumer redress. But make no mistake—consumers feel the effects of data breaches for years. While our settlement gives these consumers real relief and the tools necessary to protect themselves against identity theft, lawmakers need to do more.