InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
District Court preliminarily approves $2.35 million settlement for card data breach
On November 8, the U.S. District Court for the Northern District of Texas issued an order accepting a magistrate judge’s report preliminarily approving a consolidated class action settlement related to a restaurant chain’s payment card data breach. Class members alleged that hackers gained unauthorized access to the restaurant chain’s computer servers and payment card environment between April 2019 and October 2020, resulting in hundreds of thousands of consumers’ financial information, including credit and debit card numbers, expiration dates, cardholder names, and internal card verification codes, being compromised. Hackers then allegedly advertised the stolen information for sale on the dark web. Several lawsuits were filed alleging violations of numerous state laws that were eventually consolidated with this action. The parties negotiated a settlement prior to class certification, which would require the restaurant chain to provide a $2.35 million all-cash non-reversionary qualified settlement fund and adopt several data-security measures. Class members also would be able to file claims for out-of-pocket losses, elect for a cash payments, and request credit monitoring services.
The magistrate judge’s report recommended that the proposed class settlement be preliminarily approved as it “will likely be found fair at the final approval stage” and the offered relief “is both procedurally and substantively adequate.” The magistrate judge disagreed with objections raised by certain plaintiffs who argued, among other things, “that the proposed settlement is ‘substantively inadequate’ because the amount of funds available per potential class member is ‘far too low.’” However, according to the magistrate judge’s report, when compared to other settlements approved in other data breach cases, it is “clear that the proposed settlement is at least in line with if not better than what any proposed plaintiff could have expected coming into the litigation.” The magistrate judge also refuted the objecting plaintiffs’ assertion that the proposed settlement treats class members differently by providing plaintiffs who can establish out-of-pocket losses with up to $5,000, California residents without losses with $100, and non-California residents without losses with $50. “The Settling Plaintiffs have adequately demonstrated why this extra recovery for California class members [is] equitable, if not equal. Namely, class members from California could bring California state law claims which provide for $100-$750 in statutory damages,” the report said, adding that “class members from California have a stronger basis for damages than do class members from outside the state—who may only be able to show nominal or incidental damages as a result of [the restaurant chain’s] breach of contract—and so their modestly increased recovery is justified.”
District Court: Unclear when networking site became aware of data scraping
On November 3, the U.S. District Court for the Northern District of California issued an order ruling on cross-motions for summary judgment in an action concerning whether a now-defunct plaintiff data analytics company breached a user agreement with a defendant professional networking site by using an automated process to extract user data (a process known as “scraping”) for the purposes of selling its analytics services to businesses. The defendant claimed that the user agreement prohibits scraping, and sent the plaintiff a cease-and-desist letter demanding it stop and alleging violations of the Computer Fraud and Abuse Act (CFAA) as well as various state laws. In response, the plaintiff sued the defendant, arguing that it had a right to access the public pages, and later sought a preliminary injunction, which the district court granted.
As previously covered by InfoBytes, earlier this year, the U.S. Court of Appeals for the Ninth Circuit, on remand from the U.S. Supreme Court, affirmed the district court’s order preliminarily enjoining the defendant from denying the plaintiff access to publicly available member profiles. The 9th Circuit had previously affirmed the preliminary injunction, but was called to further consider whether the CFAA applies to the plaintiff’s data scraping after the U.S. Supreme Court vacated the appellate court’s judgment in light of its ruling in Van Buren v. United States. The 9th Circuit found that the ruling in Van Buren, in which the Supreme Court suggested the CFAA only applies in cases where someone is accused of hacking into or exceeding their authorized access to a network that is protected, or in situations where the “gates are up,” narrowed the CFAA’s scope and most likely did not apply to cases involving data scraped in bulk by automated bots from public websites. The appellate court concluded, among other things, that the defendant showed that it “currently has no viable way to remain in business other than using [the networking site’s] public profile data” for its analytic services and “demonstrated a likelihood of irreparable harm absent a preliminary injunction.” Moreover, the 9th Circuit rejected the defendant’s claims that the plaintiff violated the CFAA.
In partially granting the defendant’s motion and denying the plaintiff’s, the district court ruled that the plaintiff breached its user agreement by directing the creation of fake accounts and copying of url data as part of its scraping process. Nonetheless, the district court noted there remains a legitimate dispute over whether the defendant waived its right to enforce the user agreement after the plaintiff openly discussed its business model, including its reliance on scraping, at conferences it organized that were attended by defendant’s executives. Moreover, questions remain for trial as to when the defendant became aware of the plaintiff’s scaping, whether it should have taken “steps to legally enforce against known scraping” sooner, and whether the defendant can raise certain defenses to its breach of contract claim tied to the plaintiff’s data scraping and unauthorized use of data.
SBA seeks to end SBLC moratorium
On November 7, SBA published a proposed rule in the Federal Register seeking to lift the moratorium on licensing new small business lending companies (SBLCs) and adding a new type of entity called a “Mission-Based SBLC.” The moratorium was imposed in 1982, after the agency lacked adequate resources to effectively service and supervise additional SBLCs participating in SBA’s 7(a) loan program beyond the 14 it was authorized to approve. According to SBA, while the majority of 7(a) lenders are federally-regulated depository institutions, “SBLCs are regulated, supervised, and examined solely by SBA” and “are subject to specific regulations regarding formation, capitalization, and enforcement actions.” SBA explained that there are capital market gaps in certain markets that “continue to struggle to obtain financing on non-predatory terms.” The proposed rule seeks to lift the licensing moratorium and further create the Mission-Based SBLC to help bridge the financing gap. Mission-Based SBLCs will be nonprofit entities that will help SBA meet the needs of underserved communities and increase opportunities for access to capital in precisely targeted capital market gaps. Comments on the proposed rule are due January 6, 2023.
NYDFS issues RFI on private student loan refinancing
On November 8, NYDFS issued a request for information (RFI) to student loan advocates, lenders, regulators, servicers, and other stakeholders, seeking information regarding private student loan refinancing in New York. The Private Student Loan Refinancing Task Force, tasked with “study[ing] and analyz[ing] ways lending institutions that offer non-federal student loans to students of New York institutions of higher education can be incentivized and encouraged to create student loan refinance programs,” issued questions to solicit information from stakeholders to inform a forthcoming report. According to the announcement, the Task Force is seeking responses to questions concerning private sector refinancing of student loans. The questions include, among other things: (i) “What options are available for student loan borrowers to refinance private student loans both in New York State and outside the state?”; (ii) “What options are available for student loan borrowers to refinance federal student loans both in New York State and outside the state?”; (iii) “What is the volume of private student loans refinanced, the terms of the borrowers’ prior loans, the terms of the borrowers’ refinancing loans, the unmet need for student loan refinancing, and the impact of these refinancing loans in New York and nationwide?”; (iv) “What is the volume of federal student loans refinanced, the terms of the borrowers’ prior loans, the terms of the borrowers’ refinancing loans, the unmet need for student loan refinancing, and the impact of these refinancing loans in New York and nationwide?”; and (v) “What publicly available data should the Task Force review? Is there privately owned data that could be made available to the Task Force?” Responses are due by December 8.
Mortgage servicer must pay $4.5 million in payment service fee suit
On November 7, the U.S. District Court for the Southern District of West Virginia granted final approval of a class action settlement, resolving allegations that a defendant mortgage servicer charged improper fees for optional payment services in connection with mortgage payments made online or over the telephone. The plaintiffs' memorandum of law in support of its motion for final approval of the settlement alleges the defendant engaged in violations of the West Virginia Consumer Credit Protection Act, breach of contract, and unjust enrichment with respect to the fees. According to the memorandum, before deduction of attorneys’ fees and expenses, administrative costs, and any service award, the $4.5 million settlement fund represents approximately $216 per fee paid to the defendant by the putative class members. The court also approved $1.5 million in attorney’s fees, plus $4,519.20 in expenses, along with a $15,000 service award for the settlement class representative.
District Court approves $14 million wireless rates settlement
On November 8, the U.S. District Court for the Northern District of California granted final approval to a $14 million settlement resolving allegations that a telecommunications company made misleading claims regarding its administrative fees. According to the plaintiffs’ memorandum of points and authorities in support of motion for preliminary approval of class settlement, current and former wireless-service customers of the defendant (plaintiffs) with post-paid wireless service plans were charged an improper administrative fee. The plaintiffs alleged, generally, that the defendant’s representations and advertisements regarding the monthly price of its post-paid wireless service plans were misleading because the prices did not include the administrative fee, and that the defendant implemented and charged the administrative fee in a deceptive and unfair manner. According to the terms of the $14 million settlement agreement, $3.5 million of the award will cover attorney fees and costs, with additional funds allocated to cover litigation expenses.
North Carolina Supreme Court orders appeals court to review HAMP fraud claims
On November 4, the Supreme Court of North Carolina determined that an appeals court erred by remanding a case concerning a defendant bank’s Home Affordable Modification Program to a trial court with instructions to make factual findings and conclusions of law on the defendant’s motion to dismiss. Plaintiffs sued the defendant alleging fraud and other related claims arising out of the bank’s mortgage modification program. The trial court dismissed the claims for failure to state a claim pursuant to North Carolina’s Rule of Civil Procedure 12(b)(6), after concluding that plaintiffs’ claims were time barred and “that ‘the claims of all [p]laintiffs who were parties to foreclosure proceedings [were] barred by the doctrines of res judicata and collateral estoppel.’” Plaintiffs appealed. A divided panel of the Court of Appeals remanded the case to the trial court claiming that “it could not ‘determine the reason behind the grant’ and could not ‘conduct a meaningful review of the trial court’s conclusions of law.’” The North Carolina Supreme Court countered, however, that there exists “no legal basis or practical reason for the Court of Appeals to remand the case to the trial court to make factual findings and conclusions of law” as “a trial court is not required to make factual findings and conclusions of law to support its order unless requested by a party”—a request neither party made. According to the North Carolina Supreme Court, the appeals court erred by not conducting a de novo review of the sufficiency of the plaintiffs’ allegations. The North Carolina Supreme Court ordered the appeals court to address whether the plaintiffs’ allegations, if treated as true, are sufficient to state a claim upon which relief can be granted.
District Court certifies class in FDCPA suit
On November 4, the U.S. District Court for the District of New Jersey granted a plaintiffs’ motion for class certification in an FDCPA suit related to credit reporting language used in collection letters. According to the opinion, the plaintiffs received collection letters from the defendant with a statement that read: “Our records indicate there is still a balance on this past due account. Please respond to this letter within seven days or we may take additional collection efforts. The creditor shown above has authorized us to submit this account to the nationwide credit reporting agencies. As required by law, you are hereby notified that a negative credit report reflecting your credit record may be submitted to a credit reporting agency if you fail to fulfill the terms of your credit obligations.” The plaintiffs alleged FDCPA violations against the defendant, claiming that the letters constituted false and misleading collection efforts because the defendants did not intend to report the debts to credit reporting agencies within seven days of the letters’ receipt, as the defendant’s policy was to report debts “approximately sixty (60) days from placement absent contract instructions from its client.” The court noted that the collection letter in question was sent to 984 individuals, meeting the numerosity component for class certification. The court also held that, because all members of the class share the same FDCPA claim, the commonality and predominance components of certification were satisfied. The court also ruled that typicality, adequacy, ascertainability, and superiority components were met, and certified the class.
District Court preliminary approves $4.3 million data breach settlement
On November 4, the U.S. District Court for the Eastern District of Michigan granted preliminary approval of a $4.3 million class action settlement regarding a data breach, following the filing of the plaintiffs’ unopposed motion for preliminary approval of class action settlement. After a plaintiff consolidated her suit with other similar lawsuits, the plaintiff class sued the defendant for negligence, unjust enrichment, and breach of contract, alleging their personal information was stolen from the defendant during a malware attack due to lack of cybersecurity measures. The settlement provides for, among other things, three years of free credit-monitoring services for the plaintiff class, up to $2,500 per member to cover out-of-pocket expenses related to the breach, up to $80 per member to cover lost time remedying issues related to the breach, $75 per member for California residents for claims under state statutes, and a year of password-managing services. The plaintiffs are seeking service awards of $1,500 for each of the 15 representative plaintiffs. The motion also noted that class counsel will ask the court for just over $1.4 million in attorneys’ fees to be deducted from the settlement fund.
Massachusetts settles with debt payment processor
On November 7, the Massachusetts attorney general announced a settlement with a payment processing company to resolve claims that it provided substantial assistance to a debt settlement provider engaged in unlawful business practices that charged consumers premature and inflated fees in violation of state and federal law. According to an assurance of discontinuance filed in Suffolk Superior Court, the company processed settlement and fee payments for consumers enrolled in various debt settlement programs, including those offered by a debt settlement provider that was previously fined $1 million by the AG’s office for allegedly harming financially-distressed consumers. (Covered by InfoBytes here.) The newest settlement resolves claims that the company transferred unlawful fee payments to the debt settlement provider despite having knowledge of the alleged misconduct and even after the provider was sued by the AG’s office. Without admitting any facts, liability, or wrongdoing, the company has agreed to pay $600,000 to the Commonwealth, and will, according to the announcement, “make meaningful business practice changes that would prevent it from transferring untimely fees from any Massachusetts consumer account to any debt settlement company.”