InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
1st Circuit confirms standing for data breach victims
On June 30, the U.S. Court of Appeals for the First Circuit overruled a district court’s dismissal of a putative class action against a home delivery pharmacy service for allegedly failing to prevent a 2021 data breach that exposed the personally identifiable information (PII) of over 75,000 patients. The class action complaint alleged state law claims for negligence, breach of implied contract, unjust enrichment, invasion of privacy, and breach of fiduciary duty, and sought damages and injunctive relief. The putative class was comprised of U.S. residents whose PII was compromised in the data breach. The two named plaintiffs were former or current patients whose PII were compromised in the data breach, and one of the two named plaintiffs had her stolen PII used to file a fraudulent tax return. The district court dismissed the lawsuit for lack of Article III standing.
Affirming in part and reversing in part, the 1st Circuit held that the complaint “plausibly demonstrates” the plaintiffs’ standing to seek damages, applying the principles articulated by the Supreme Court in TransUnion LLC v. Ramirez, which clarified the type of concrete injury necessary to establish Article III standing (covered by InfoBytes here).
First, the court concluded that, with respect to the named plaintiff whose PII was used to file a fraudulent tax return, the complaint’s “plausible allegations of actual misuse” of the stolen PII constituted a “concrete injury in fact” for purposes of Article III standing. According to the 1st Circuit, there existed “an “obvious temporal connection” between the timing of the data breach and the filed return, among other facts. The appellate court also found that the fraudulent tax return could make it probable that more of the named plaintiff’s information could be further misused—changing the risk of future misuse from speculative to “imminent and substantial.”
Second, with respect to the named plaintiff for whom there was no allegation of actual misuse of PII, the court reasoned that “the complaint plausibly alleges a concrete injury in fact based on the material risk of future misuse of [plaintiff’s] PII and a concrete harm caused by exposure to this risk.” The appellate court also found that, because the data here was compromised in a “targeted attack,” then “it stands to reason that [such data] is more likely to be misused…and the risk of future misuse is heightened when the compromised data is particularly sensitive.”
Third, the court concluded that the complaint plausibly alleged a “separate concrete, present harm” caused by exposure to the risk of future harm, “based on the allegations of the plaintiffs’ lost time spent taking protective measures [against further identity theft] that would otherwise have been put to some productive use.” “The loss of this time is equivalent to a monetary injury, which is indisputably a concrete injury,” the appellate court wrote, adding that it joins other circuits in holding that time spent responding to a data breach is sufficient to establish standing.
Finally, the court held that plaintiffs lacked standing to pursue injunctive relief “because their desired injunctions would not likely redress their alleged injuries” as any such relief would only safeguard against future breaches and would not protect “plaintiffs from future misuse of their PII by the individuals they allege now possess it.”
1st Circuit: Bankruptcy Code “unequivocally strips tribes” of their sovereign immunity to sue
On May 6, the U.S. Court of Appeals for the First Circuit reversed a district court’s decision, ruling that American tribes are not exempt from federal law barring suits against debtors once they file for bankruptcy. The debtor (plaintiff) in 2019 took out a $1,100 payday loan from a creditor (appellee), who is a subsidiary of a tribe. He voluntarily filed a Chapter 13 bankruptcy petition, listing his debt to the appellee, which had increased to approximately $1,600, as a nonpriority unsecured claim. He also listed the appellee on the petition’s creditor matrix, and his attorney mailed the appellee a copy of the proposed Chapter 13 plan. When the plaintiff filed the petition, the Bankruptcy Code imposed an automatic stay enjoining “debt-collection efforts outside the umbrella of the bankruptcy case.” The appellee continued to attempt to contact the plaintiff regarding the debt, but the plaintiff had allegedly previously notified the appellee’s representatives that he had filed for bankruptcy. Two months after the plaintiff filed the petition, he claimed that his “mental and financial agony would never end,” and blamed his agony on the appellee’s “regular and incessant telephone calls, emails and voicemails.” To stop the appellee’s collection efforts, the plaintiff relocated to enforce the automatic stay against the appellee and its corporate parents and sought an order prohibiting future collection efforts, as well as damages, attorney's fees, and expenses. In response, the tribe and its affiliates asserted tribal sovereign immunity and moved to dismiss the enforcement proceeding. The bankruptcy court agreed with the tribe and granted the motions to dismiss.
On the appeal, the tribe argued that the Bankruptcy Code cannot abrogate tribal sovereign immunity because it never uses the word “tribe.” The appellate court noted that the argument “boils down to a magic-words requirement” that tribes must be mentioned in order to be covered by a law, but U.S. Supreme Court precedent “forbids us from adopting a magic-words test.” However, the appellate court further noted that Congress did not determine that tribes were subject to the Code, stating that “[e]ven if Congress need not use magic words to make clear that its abrogation provision applies to Indian tribes, it must at least use words that clearly and unequivocally refer to Indian tribes if it wishes to make that abrogation provision apply to them.” The appellate court ruled that Congress took away tribes' sovereign immunity as “domestic governments” covered by the Bankruptcy Code, stating that even though tribes are not explicitly named in the Code, “we have no doubt that Congress understood tribes to be domestic dependent nations,” and since those “are a form of domestic government, it follows that Congress understood tribes to be domestic governments.”
1st Circuit vacates ruling in Maine FCRA case
On February 10, the U.S. Court of Appeals for the First Circuit vacated a district court’s ruling that the FCRA preempts amendments to the Maine Fair Credit Reporting Act that govern how certain debts are reported to credit reporting agencies. As previously covered by InfoBytes, a trade association—whose members include the three nationwide consumer credit reporting agencies (CRAs)—sued the Maine attorney general and the superintendent of Maine’s Bureau of Consumer Credit Protection (collectively, “defendants”) for enacting the 2019 amendments, which, among other things, place restrictions on how medical debts can be reported by the CRAs and govern how CRAs must investigate debt that is allegedly a “product of ‘economic abuse.’” The trade association argued that the amendments, which attempt to regulate the contents of an individual’s consumer report, are preempted by the FCRA, and contended that language under FCRA Section 1681t(b)(1)(E) should be read to encompass all claims relating to information contained in consumer reports. The district court agreed, ruling that, as a matter of law, the amendments are preempted by § 1681t(b)(1)(E). According to the court, Congress’ language and amendments to the FCRA’s structure “reflect an affirmative choice by Congress to set ‘uniform federal standards’ regarding the information contained in consumer credit reports,” and that “[b]y seeking to exclude additional types of information” from consumer reports, the amendments “intrude upon a subject matter that Congress has recently sought to expressly preempt from state regulation.” The defendants appealed.
On appeal, the plaintiff argued that the phrase “relating to information contained in consumer reports” broadly preempts all state laws, but the appellate court was not persuaded and concluded that the broad interpretation “is not the most natural reading of the statute’s syntax and structure.” The 1st Circuit found “no reason to presume that Congress intended, in providing some federal protections to consumers regarding the information contained in credit reports, to oust all opportunity for states to provide more protections, even if those protections would not otherwise be preempted as ‘inconsistent’ with the FCRA under 15 U.S.C. § 1681t(a).” In addition, the court reminded the plaintiff that “even where Congress has chosen to preempt state law, it is not ousting states of regulatory authority; state regulators have concurrent enforcement authority under the FCRA, subject to some oversight by federal regulators.” As such, the appellate court held that the FCRA did not broadly preempt the entirety of Maine’s amendments, and remanded the case back to the district court to determine the scope under which the amendments may be preempted by the FCRA.
1st Circuit: Original creditor’s arbitration agreement applies to debt buyer
On November 25, the U.S. Court of Appeals for the First Circuit affirmed a grant of a motion to compel arbitration in a debt collection action, concluding that a debt buyer holds the same arbitration rights as the original creditor under a cardmember agreement entered into with the plaintiff. The debt buyer purchased a pool of defaulted credit card debts from the original creditor, including the plaintiff’s charged-off account. After a municipal judge ruled that the debt buyer could not prove it owned the unpaid debt, the plaintiff filed a class action lawsuit alleging, among other things, that the debt buyer and its law firm (collectively, “defendants”) violated the FDCPA by attempting to collect the debt after the statute of limitations had expired. The defendants filed a motion to compel arbitration, and the district court approved the magistrate judge’s recommendation that an enforcement clause in the cardholder agreement between the plaintiff and the original creditor be enforced. The plaintiff appealed, arguing that the defendants should not be able to compel arbitration because they were not the signatories of the original cardholder agreement.
On appeal, the 1st Circuit concluded that the plaintiff offered no support for deviating from the “long-standing given in contract law. . .that ‘an assignee stands in the shoes of the assignor,’” holding that the original creditor’s rights were assigned to the debt buyer and its agents, including the right to invoke the cardmember agreement’s arbitration provision.
1st Circuit: Statute of limitations starts on loan closing
On January 17, the U.S. Court of Appeals for the First Circuit affirmed the dismissal of claims against a mortgage holder and a loan servicer (defendants), concluding the allegations were barred on statute-of-limitations grounds. In 2018, ten years after the borrower defaulted on her loan, she filed a suit against the defendants “alleging that the loan was predatory because at its inception the lender knew or should have known that she would not be able to repay it.” The borrower alleged first that the defendants violated the Massachusetts Consumer Protection Act (MCPA) by committing unfair and deceptive practices when trying to enforce a “predatory mortgage loan,” and second that the defendants violated the Massachusetts Fair Debt Collection Practices Act (MFDCPA) by collecting or attempting to collect on the loan in an unfair, deceptive, or unreasonable manner. The district court dismissed the first claim as time-barred, stating that the four-year statute of limitations period began when the borrower closed on the loan in 2005. The district court also ruled that Chapter 93, Section 49 of the MDFCPA does not provide a private right of action for the second claim.
The 1st Circuit affirmed on appeal, determining that, with respect to the borrower’s MCPA claim, the four-year limitations period “began to run on the signing date when interest began to accrue,” and that the borrower failed to show that any of the defendants’ later collection actions triggered a new limitations period. Concerning the borrower’s MFDCPA claim that the collection efforts were “unfair because they constituted enforcement of inherently unfair and deceptive loan terms,” the appellate court concluded it was unnecessary to decide the issue of whether the borrower held a private right of action under the MFDCPA because the borrower’s claim is time-barred.
1st Circuit asks Massachusetts high court to resolve foreclosure question
On July 29, the U.S. Court of Appeals for the 1st Circuit certified to the Massachusetts Supreme Judicial Court the question of whether a national bank’s foreclosure notice was valid under Massachusetts law. According to the order, the appellate court granted the bank an en banc rehearing of its February decision, which concluded that the bank’s foreclosure notice was defective and therefore, it could not properly foreclose the mortgage. The court had reasoned that the notice, which stated that the homeowners “could avoid foreclosure if, but only if, the [homeowners] paid the balance due on or before the specified foreclosure date,” was defective because the mortgage required the homeowners to pay the amount at least five days before the foreclosure date. In its petition for rehearing en banc, the bank argued that a Massachusetts state banking regulation required it to use the specific language it had in the notice and that the panel erred in its reading of existing state court precedent. The appellate court noted that the position is debatable and that in a diversity jurisdiction action the court “cannot properly overturn governing state precedent.” Therefore, the appellate court withdrew its earlier opinion, vacated the judgment, and certified to the Massachusetts Supreme Judicial Court the question of whether the statement in the foreclosure notice would render the notice inaccurate or deceptive, voiding the subsequent foreclosure sale under Massachusetts law.
1st Circuit: “Sustained Overdraft Fees” are not interest under the National Bank Act
On March 26, the U.S. Court of Appeals for the 1st Circuit affirmed a district court’s decision to dismiss putative class action allegations that a bank charged usurious interest rates on its overdraft products, finding that the bank’s “Sustained Overdraft Fees” are not interest under the National Bank Act (NBA). The plaintiff filed a lawsuit against the bank in 2017, alleging that sustained overdraft fees should be considered interest charges subject to Rhode Island’s interest rate cap of 21 percent, and that because the alleged annual interest rates exceeded the cap, the fees violated the NBA. The district court, however, dismissed the case, ruling that the sustained overdraft fees were service charges, not interest charges.
On appeal, the split three-judge panel held that, because the sustained overdraft fees did not constitute interest payments under the NBA and the OCC’s regulations interpreting the NBA, the class challenges cannot move forward. The panel stated that the agency’s interpretation in its 2007 Interpretive Letter is due “a measure of deference.” The panel found the agency’s interpretation persuasive because “[f]lat excess overdraft fees (1) arise from the terms of a bank’s deposit account agreement with its customers, (2) are connected to deposit account services, (3) lack the hallmarks of an extension of credit, and (4) do not operate like conventional interest charges.”
In dissent, Judge Lipez noted that, while the OCC interpretive letter laid out a clear case for overdraft fees as service, not interest charges, it was silent on the question of “Sustained Overdraft Fees.” He wrote that “[s]ilence, however, is not guidance, and we would thus need to infer a ruling on a debated issue from between the lines of the Letter.” Furthermore, he could “not see how we can defer to an interpretation that the OCC never clearly made on an issue that it previously described as complex and fact-specific.”
1st Circuit holds homeowners who defaulted on an allegedly unlicensed mortgage loan cannot escape time bars for their claims
On August 23, the U.S. Court of Appeals for the 1st Circuit held that homeowners who defaulted on a refinance loan on their Massachusetts property could not void the transaction or enjoin their property’s foreclosure sale. The appellate court determined that the homeowners’ claims that the lender violated the Fair Debt Collection Practices Act, the Real Estate Settlement Procedures Act, the Truth in Lending Act, and the Massachusetts consumer protection statute were all time-barred. The homeowners argued that the statute of limitations never began to run because the lender was not licensed to lend money in the state, making the original note and mortgage “akin to forgeries and thus ‘void ab initio,’” but the court held that there was “no authority for this unusual proposition.” The court also refused to toll the limitations period under the doctrine of fraudulent concealment, which requires the plaintiff “to make a threshold showing of due diligence,” because the homeowners filed their claims more than five years after they retained counsel and ten years after they granted the mortgage at issue.