Data Breach Class Actions and Settlement Notices, Explained

A large breach can affect millions of people in essentially the same way, from the same cause. Individual lawsuits make little sense in that situation, which is why most breach cases proceed as class actions: a small number of named plaintiffs sue on behalf of everyone affected, and the result binds the whole group.

Most people only encounter these cases at the end, when a settlement notice arrives. By then the case may have been pending for a year or more.

How the case starts

Lawsuits are usually filed within days or weeks after a company discloses a breach. When similar cases are filed in several federal courts, they can be consolidated before a single judge as multidistrict litigation, and the court appoints a leadership group of plaintiffs' lawyers to run the combined case.

Certification

A case doesn't become a class action because the complaint says so. The court has to certify the class, under Federal Rule of Civil Procedure 23 in federal court or Code of Civil Procedure § 382 in California state court. Among other things, the plaintiffs must show that the class is too large for everyone to join individually, that there are common questions of law or fact, that the named plaintiffs' claims are typical, and that the named plaintiffs and their lawyers will adequately represent the class.

In breach cases the common questions are usually easy to identify. Was the company's security reasonable? What was exposed? What caused it? Defendants typically argue that individual questions, like whether each person was actually harmed, predominate.

Standing

Federal courts also require each plaintiff seeking damages to have suffered a concrete injury. In TransUnion LLC v. Ramirez (2021), the Supreme Court held that the mere risk of future harm, without more, isn't enough to support standing to recover damages. Breach plaintiffs have responded by pointing to actual misuse of their data, time and money spent protecting themselves, and other present harms. Courts have reached different results. California's statutory damages provision for breaches is significant partly because it reflects a legislative judgment that the exposure itself is a real injury.

Settlement

Most certified breach cases settle, and a class settlement needs court approval. The court decides whether it's fair, reasonable, and adequate, class members get notice and a chance to object or opt out, and then the court holds a final approval hearing.

Settlements commonly include cash payments to class members who submit claims, reimbursement for documented losses up to a per-person cap, payment for time spent dealing with the breach at a set hourly rate for a limited number of hours, a period of credit or identity monitoring, and commitments by the company to improve its security. In very large breaches, the amount per person can be small, and people who documented actual losses generally receive more than those who didn't.

When a class notice arrives

You have four choices.

1. File a claim to receive money or benefits. Reimbursement categories require documentation, and deadlines are strict.
2. Do nothing. You stay in the class and are bound by the settlement's release of claims, but you receive nothing.
3. Opt out. You leave the class, give up any share of the settlement, and keep your right to sue on your own. This usually only makes sense if your individual losses are large.
4. Object. You stay in the class but tell the court why you think the settlement is inadequate, by the deadline in the notice.

Two practical cautions. Class notices are easy to mistake for junk mail, so if a company you've dealt with has had a breach, watch for one. And file through the official settlement website listed in the notice. You don't need to pay any service to submit a claim.

Named plaintiffs

Every class action needs representatives whose claims are typical of the class. Named plaintiffs do more than other class members, such as providing documents, answering written questions, and sometimes giving a deposition, and courts often approve a modest service award for that work. Someone who was affected, suffered concrete harm, and kept good records may be well suited to the role.