6th Circuit affirms decision compelling arbitration in data breach case

Courts Privacy/Cyber Risk & Data Security Class Action Arbitration Data Breach Appellate Sixth Circuit

On December 2, the U.S. Court of Appeals for the Sixth Circuit affirmed a district court’s decision dismissing a nationwide putative class action against an e-commerce provider, holding that challenges raised to the validity of an agreement to arbitrate were for the arbitrator to decide, not the court. According to the opinion, the plaintiff class, including four minor individuals, filed suit after the defendant allegedly failed to protect millions of customers’ personal account information that was then obtained in a 2019 data breach. The opinion noted that the defendant’s Terms of Service contained an arbitration agreement, a delegation provision, a class action waiver, and instructions regarding how to opt-out of the arbitration agreement. The district court granted the defendant’s motion to dismiss and compel arbitration after rejecting the plaintiffs’ arguments that the arbitration clause is “invalid” and “unenforceable” as to the minor plaintiffs under the infancy doctrine.

On appeal, the plaintiffs argued that there was an issue of fact regarding whether four of the plaintiffs had agreed to the Terms of Service, and that the defenses of infancy and unconscionability rendered the Terms of Service invalid. According to the appellate court, though “a contract exists and . . . the delegation provision itself is valid, the arbitrator must decide in the first instance whether the defenses of infancy and unconscionability allow plaintiffs to avoid arbitrating the merits of their claims.” The appellate court further agreed with the district court that “[i]t’s not about the merits of the case. It’s not even about whether the parties have to arbitrate the merits. Instead, it’s about who should decide whether the parties have to arbitrate the merits.”