Defendant's Attorney: Sarah B. Cornelia, Barton W. Cox, Jason K. Fagelman, Brian Christopher Lawrence, Kelsey Ann Maher, Spencer Persson, Philip A. Tarpley, James Steven Toscano,
Description: Tampa, Florida consumer law lawyers represented Plaintiffs who sued Defendant for negligently failing to protect their credit card information from hackers.
Brinker International, Inc. (“Brinker”), the owner of Chili’s
restaurants, faced a cyber-attack in which customers’ credit and
debit cards were compromised. Chili’s customers have brought a
class action because their information was accessed (and in some
cases used) and disseminated by cybercriminals.
Plaintiff sought to have the District Court d to certify two classes under Federal Rules of Civil Procedure 23(a) and
23(b)(3),5 seeking both injunctive and monetary relief: 1) a nationwide class (or alternatively a statewide class) for negligence and 2)
a California statewide class for California consumer protection
claims based on its unfair business practices state laws. They were
defined as follows:
1. All persons residing in the United States who
made a credit or debit card purchase at any affected Chili’s location during the period of the
Data Breach (the “Nationwide Class”).
2. All persons residing in California who made a
credit or debit card purchase at any affected Chili’s
location during the period of the Data Breach (the
“California Statewide Class”).
The District Court then certified the nationwide class for the
negligence claim as follows:
All persons residing in the United States who made a
credit or debit card purchase at any affected Chili’s location during the period of the Data Breach (March
and April 2018) who: (1) had their data accessed by
cybercriminals and, (2) incurred reasonable expenses
or time spent in mitigation of the consequences of the
Data Breach (the “Nationwide Class”).
The District Court also certified a separate California class under
the state unfair competition laws:
All persons residing in California who made a credit
or debit card purchase at any affected Chili’s location
during the period of the Data Breach (March and
April 2018) who: (1) had their data accessed by cybercriminals and, (2) incurred reasonable expenses or
time spent in mitigation of the consequences of the
Data Breach (the “California Statewide Class”).
We then permitted Brinker to appeal these class certifications pursuant to Federal Rule of Civil Procedure 23(f).
Outcome: In our analysis of a damages methodology based on averages, the focus is on “whether the sample at issue could have been
used to establish liability in an individual action.” Tyson Foods,
Inc. v. Bouaphakeo, 577 U.S. 442, 458, 136 S. Ct. 1036, 1048 (2016).
In this case, each Chili’s customer fitting within the class definitions
experienced a similar injury of a compromised card combined with
some effort to mitigate the harm caused by the compromise. So,
the damages methodology is not “enlarg[ing] the class members’
substantive rights” by giving class members an award for an injury
they could not otherwise prove in an individual action. Id. (internal
alterations, quotation marks, and citation omitted). Through the
District Court’s rigorous analysis, it found that at the class certification stage the damages model was sufficient, and it would be a
“matter for the jury” to decide actual damages at trial. Id. at 459,
136 S. Ct. at 1049. Any individual inquiry into particularized damages resulting from the data breach, such as damages recoverable
due to uncompensated loss caused by compromised personal information, does not predominate over the three categories of common damages inquiries analyzed by the plaintiffs’ expert. We do
not think, therefore, that the District Court’s determination on this
point was an abuse of discretion, so we do not disturb it here.
VACATED IN PART AND REMANDED
Plaintiff's Experts:
Defendant's Experts:
Comments: