InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
3rd Circuit vacates dismissal of data breach suit
On September 2, the U.S. Court of Appeals for the Third Circuit vacated the dismissal of a class action alleging that a defendant pharmaceutical research company’s negligence led to a data breach. According to the opinion, the plaintiff, who is a former employee of the defendant’s subsidiary, provided her sensitive personal and financial information in exchange for the defendant’s agreement, pursuant to the plaintiff’s employment agreement, to “take appropriate measures to protect the confidentiality and security” of this information. After plaintiff ended her employment with the company, a hacking group accessed the defendant’s servers through a phishing attack and stole sensitive information pertaining to current and former employees. In addition to exfiltrating the data, the hackers installed malware to encrypt the data stored on the defendant’s servers and held the decryption tools for ransom. The defendant informed current and former employees of the breach and encouraged them to take precautionary measures. To mitigate potential harm, the plaintiff took immediate action by conducting a review of her financial records and credit reports for unauthorized activity, among other things. As a result of the breach, the plaintiff alleged that she has sustained a variety of injuries—primarily the risk of identity theft and fraud—in addition to the investment of time and money to mitigate potential harm. The district court granted the defendant's motion to dismiss based on lack of Article III standing, concluding “that [the plaintiff's] risk of future harm was not imminent, but ‘speculative,’ because she had not yet experienced actual identity theft or fraud.”
On the appeal, the 3rd Circuit noted that the district court “erred in dismissing [the plaintiff’s] contract claims, which are raised in Counts III (breach of implied contract) and IV (breach of contract),” arising from her employment agreement. The appellate court wrote that the plaintiff “has alleged an injury stemming from the breach—the risk of identity theft or fraud—that is sufficiently imminent and concrete,” because the defendant “expressly contracted to ‘take appropriate measures to protect the confidentiality and security’ of plaintiff’s information in [the plaintiff’s] employment agreement.” The appellate court also noted that in an “increasingly digitalized world, an employer's duty to protect its employees’ sensitive information has significantly broadened.” The 3rd Circuit vacated the judgment on all counts and remanded the dispute to the district court for consideration of the merits of the claims.
District Court denies request to reverse summary judgment in FDIA suit
On August 29, the U.S. District Court for the Eastern District of Pennsylvania denied a consumer plaintiff’s request to reconsider its summary judgment order against him in a Federal Deposit Insurance Act (FDIA) suit. According to the opinion, the plaintiff accrued debt to a federally-insured, state-chartered bank, which had then assigned that debt to defendants, who were not state-chartered, federally-insured banks. The plaintiff’s debt included interest charges that had accrued at an annual rate between 24.99 percent and 25.99 percent, which the plaintiff argued could not be collected by defendants because the interest exceeded the six percent allowed under Pennsylvania's usury law. The court ruled in favor of the defendants, relying on a recently promulgated FDIC rule that determined that state usury laws are preempted by section 27 of the FDIA in cases where state usury law interferes with state-chartered, federally-insured banks' ability to make loans or when they interfere with a state-chartered, federally-insured bank’s assignee’s efforts to collect on those loans. The plaintiff requested the reconsideration of the district court's summary judgment decision and filed a notice of appeal to the U.S. Court of Appeals for the Third Circuit. In his motion for reconsideration, the plaintiff argued that the court’s previous summary judgment decision was “erroneous” because: (i) the 3rd Circuit held in In re: Community Bank of Northern Virginia that “the FDIA unambiguously excludes non-bank purchasers of debt from its coverage and that deference to the FDIC’s contrary interpretation would, therefore, be inappropriate”; (ii) the FDIC’s rule cannot apply to his debts because such an application would be impermissibly retroactive; and (iii) LIPL fits within the FDIC rule’s exception for “licensing or regulatory requirements.”
The court denied the plaintiff’s motion for reconsideration, holding that the plaintiff “failed to identify an appropriate basis for reconsideration,” as the consumer’s arguments are “either a new argument that could have been presented before judgment was entered or a reprisal of an argument that the Court addressed in its original decision.” The court further noted that it would be “inappropriate for the Court to grant a motion to reconsider under either of those circumstances.” The court went on to determine that the new arguments advanced by the plaintiff were unpersuasive in any event, finding that the 3rd Circuit had not held section 27 of the FDIA to be unambiguous in its meaning and that application of the FDIC’s rule did not create an impermissible retroactive effect.
3rd Circuit vacates dismissal of FCRA lawsuit regarding sovereign immunity
On August 24, the U.S. Court of Appeals for the Third Circuit vacated the dismissal of an FCRA lawsuit, holding that the federal government does not have sovereign immunity under the statute and can be held liable for reporting requirement violations. The plaintiff sued the Department of Agriculture (USDA) and a student loan servicer for allegedly reporting two loans as past due even though he claimed both were closed with a $0 balance. The plaintiff notified the relevant consumer reporting agency who in turn notified the USDA and the servicer. When neither entity took action to investigate or correct the disputed information, the plaintiff sued all three parties for damages under Section 1681n and 1681o of the FCRA. The USDA moved to dismiss for lack of subject matter jurisdiction based on sovereign immunity claims, which the district court granted on the grounds that the United States and its agencies are not subject to liability under the FCRA—a decision in line with opinions issued by the 4th and 9th Circuits.
On appeal, the 3rd Circuit disagreed, instead siding with opinions issued by the D.C. and 7th Circuits that reached the opposite conclusion. According to the 3rd Circuit, the federal government and its agencies enjoy sovereign immunity from civil suits unless Congress unambiguously waives it within a statute. The FCRA provides that any “person” who either negligently or willfully violates the statute is liable to the consumer for civil damages, the appellate court wrote, noting that the term “person” is defined to include any “government or governmental subdivision or agency.” The appellate court stressed that Congress need not express its intent in any particular way, and that courts need only look at the statutory text to discern Congress’ intent. Where Congress wanted to use a narrower definition of “person” in the FCRA, it did so, the appellate court said, pointing to where the FCRA specifically excludes the federal government from the statutory obligations for persons who make adverse employment decisions based on credit reports. “We presume, therefore, that Congress’s failure to do so in §§ 1681n and 1681o was deliberate and intended to convey the full statutory definition,” the 3rd Circuit wrote, finding that Congress unambiguously waived the government’s sovereign immunity in enacting FCRA.
3rd Circuit: District Court erred in applying ascertainability precedent when denying class action certification
On August 24, the U.S. Court of Appeals for the Third Circuit vacated a ruling denying class certification in an action concerning inaccurate consumer reports, holding that the district court misinterpreted Section 1681g(a) of the FCRA and erred in applying the appellate court’s ascertainability precedent. According to the plaintiffs, the defendant, a consumer reporting agency (CRA), provided inaccurate consumer reports as part of a rental application process. The plaintiffs further alleged that the defendant refused to correct the information on the reports unless plaintiffs “obtained proof of the error from [the defendant’s] sources” despite failing to provide the identity of the sources to the plaintiffs. Plaintiffs responded by filed a putative class action alleging the defendant “violated its obligation under the FCRA to disclose on request ‘[a]ll information in the consumer’s file at the time of the request’ and ‘the sources of that information.’” However, the district court denied class certification on the grounds that class members “failed to satisfy Rule 23(b)(3)’s predominance and superiority requirements and that their proposed class and subclass were not, in any event, ascertainable.”
On appeal, the 3rd Circuit closely reviewed when the provisions of § 1681g(a) were applicable. The appellate court first determined the disclosure requirements of § 1681g(a) could only be triggered by a direct request from a consumer, and not a third-party request as the plaintiffs had argued. In so doing, the appellate court found that the district court was “right to distinguish between consumers who made direct requests under § 1681g and consumers who received courtesy copies of the property managers’ Rental Reports,” and affirmed the denial of the “All Requests” class sought by plaintiffs. The appellate court next determined that the district court incorrectly narrowed the disclosure requirements of § 1681g(a) to where a request was specifically made for a consumer’s “file” as opposed to a request for a “report.” The appellate court concluded that “[n]othing in the statute’s text, context, purpose, or history indicates that any magic words are required for a consumer to effect a ‘request’ under § 1681g(a) or that a consumer’s request for ‘my consumer report’ is any less effective at triggering the CRA’s disclosure obligations than a request for ‘my file.’” As a result, the appellate court vacated the district court’s finding as to the predominance requirement of class certification and remanded for the district court “to consider whether Rule 23(b)(3)’s predominance and superiority requirements are satisfied with respect to” consumers in a purported subclass who had made a direct request for a report or file.
The appellate court concluded by determining the district court had additionally errored in its analysis of ascertainability of the proposed class by requiring too high a standard for administrative feasibility. The district court had ruled that where identification of putative class members would require a file-by-file review, ascertainability was “not administratively feasible.” The appellate court disagreed, stating that ascertainability does not mean that “no level of inquiry as to the identity of class members can ever be undertaken,” as it “would make Rule 23(b)(3) class certification all but impossible.” The appellate court instead held that “a straightforward ‘yes-or-no’ review of existing records to identify class members is administratively feasible even if it requires review of individual records with cross-referencing of voluminous data from multiple sources.”
3rd Circuit overturns decision in WESCA suit
On August 16, the U.S. Court of Appeals for the Third Circuit overturned a district court’s decision in a Wiretapping and Electronic Surveillance Control Act (WESCA) suit against a retailer and third-party marketing company (collectively, “defendants”). According to the opinion, the plaintiff searched the retailer’s website while the “browser simultaneously communicated” with both the retailer and a third-party marketing service. The messages to the third party marketing service alerted it to how the plaintiff was interacting with the website, including which pages she visited, when she filled in an email address, and when she added an item to her cart. The plaintiff filed suit against the defendants for using a software that used a code that placed “cookies on the user’s browser so that her activity on the webpage had an associated visitor ID,” and “told the user’s browser to begin sending information to [the third party marketing service] as she navigated through the website, such as communicating that the user had clicked the ‘add to cart’ button or tabbed out of a form field,” in violation of WESCA. The district court dismissed the common law claim and subsequently granted summary judgment to the defendants on the WESCA claim, finding that the defendants were exempt from liability as direct parties to the electronic communications.
The 3rd Circuit reversed and remanded, stating that the district court “never addressed whether [the retailer] posted a privacy policy and, if so, whether that policy sufficiently alerted [the plaintiff] that her communications were being sent to a third-party company.” The appellate court further disagreed “with the District Court’s holding that [the third party marketing company] is exempt from liability because it was a direct party to [the plaintiff’s] communications and that interception only occurred at the site of [the third party marketing company] servers in Virginia.”
3rd Circuit adopts new “reasonable reader” standard for evaluating accuracy of credit reports
On August 8, the U.S. Court of Appeals for the Third Circuit issued an opinion in a matter consolidated on appeal concerning claims of alleged violations of the FCRA brought by several student loan borrowers. According to the opinion, each of the three borrowers defaulted on their student loan payments. The original lenders closed the accounts and transferred the loans to other lenders after the borrowers were more than 120 days late in their payments. The borrowers claimed that a “pay status” notation included in each of their credit reports, which read “Account 120 Days Past Due Date,” was inaccurate and could create the misleading impression that the borrowers were currently four months behind on payments when they did not owe a balance to the previous creditors. The consumer reporting agency (CRA) responsible for the credit reports at issue countered that the notations accurately reflected the historical status of the closed accounts. The borrowers appealed, arguing that the district court misapplied the “reasonable creditor” standard and that the credit reports did not meet the FCRA’s “maximum possible accuracy” requirement.
On appeal, the 3rd Circuit agreed with the CRA’s interpretation, holding that the credit reports “contain multiple conspicuous statements reflecting that the accounts are closed and Appellants have no financial obligations to their previous creditors.” As such, “[t]hese statements are not in conflict with the Pay Status notations, because a reasonable interpretation of the reports in their entirety is that the pay status of a closed account is historical information,” the appellate court wrote. However, while the 3rd Circuit affirmed previous rulings dismissing the cases issued by the U.S. District Court for the Eastern District of Pennsylvania, it concluded that the “reasonable creditor” standard that the district court applied did not accurately reflect how the FCRA contemplates a range of permissible users, such as employers, investors, and insurers, and not just creditors. To account for this, the 3rd Circuit adopted a new standard for evaluating whether credit reports are inaccurate or misleading when read in their entirety by a “reasonable reader,” and applied that test in its precedential opinion. “A court applying the reasonable reader standard to determine the accuracy of an entry in a report must make such a determination by reading the entry not in isolation, but rather by reading the report in its entirety,” the appellate court said.
3rd Circuit: Student loan servicer’s calling system is not an autodialer under the TCPA
On June 14, the U.S. Court of Appeals for the Third Circuit affirmed a district court’s ruling in favor of a defendant student loan servicer, holding that it is not enough for telecommunication equipment to be capable of using a random or sequential number generator to dial telephone numbers in order to meet the definition of an automatic telephone dialing system (autodialer). Instead, to constitute a violation of the TCPA, the telecommunication system must actually employ such random- or sequential-number generation when placing the actual call. The plaintiffs filed a putative class action complaint against the defendant alleging it used an autodialer to call class members’ cell phones without their prior express consent. The defendant countered that the TCPA claims fail because its calling system “lacked the capacity to generate random or sequential telephone numbers and then dial those numbers.” As such, it could not be an autodialer. The district court granted summary judgment in favor of the defendant, ruling that the defendant did not use an autodialer to place the calls at issue as the calling system did not have “the necessary present capacity to store or produce telephone numbers using a random or sequential number generator.”
On appeal, the 3rd Circuit disagreed with the district court’s finding that the defendant’s telecommunication system was not an autodialer, noting that the district court used too narrow a definition of the term “equipment” and holding that “an [autodialer] may include several devices that when combined have the capacity to store or produce telephone numbers using a random or sequential number generator and to dial those numbers.” Thus, the 3rd Circuit held that the district court erred in accepting defendant’s argument that the defendant’s telephone system was not an autodialer because the defendant’s SQL Server (which was capable of generating random and sequential numbers) was independent of the defendant’s dialing system.
Nonetheless, the 3rd Circuit affirmed the district court’s ruling on the basis that it did not matter whether the defendant’s calling system could be classified as an autodialer under the TCPA because the phone numbers were drawn from a contact list stored on the defendant’s SQL Server and not randomly generated. As such, the appellate court held that the plaintiffs’ claims fail because the defendant did not actually use random- or sequential-number generation when it placed the specific calls in question.
While agreeing with the decision to affirm, one of the judges argued that the majority focused on the wrong question. “In my view, the fundamental question is: what is an [autodialer] under Section 227(a)(1)? I would hold that a dialing system must actually use a random or sequential number generator to store or produce numbers in order to qualify as an [autodialer] under § 227(a)(1),” the concurring judge wrote. “Because [defendant’s] dialing system did not do so, it is not an [autodialer], and [defendant] is entitled to summary judgment.”
3rd Circuit affirms decision that creditors can collect after issuing 1099-C notice
On June 14, the U.S. Court of Appeals for the Third Circuit affirmed a district court’s dismissal of a class action alleging a national bank (defendant) violated state laws in New Jersey by attempting to collect on a debt after it had issued a 1099-C notice to the plaintiff to cover the debt that was discharged. According to the opinion, the defendant obtained a judgment against the plaintiff and his wife for an unpaid debt, which the plaintiff did not satisfy. The defendant issued an IRS 1099-C form to the plaintiffs, indicating that $199,427.80 of the $244,248.49 was discharged. After issuing the 1099-C, the defendant notified the plaintiff that such filing had not caused the defendant to release the judgment and that the plaintiff needed to either pay the judgment or reach a settlement. The plaintiff sued, alleging the defendant violated the New Jersey Consumer Fraud Act and other state laws based on defendant’s issuance of a 1099-C IRS Form for cancellation of debt. The district court granted a motion to dismiss filed by the defendant, which the plaintiff appealed.
On appeal, the plaintiff argued the creditors should not send 1099-C notices unless the debt has actually been canceled, and that sending such a notice while still intending to collect on the debt constitutes an “unlawful practice.” The 3rd Circuit disagreed, holding that the text of the governing IRS regulation, 26 C.F.R. § 1.650P-1(a)(1), indicates that “the filing of a Form 1099-C is a reporting requirement that does not depend on whether the debt has been ‘actually discharged,’ or the debtor has actually been released from his obligations on the underlying debt.” The appellate court further noted that “[t]he satisfaction of this reporting requirement, additionally, does not operate to forgive or extinguish a debtor’s obligations to repay the debt at issue.”
3rd Circuit confirms adversary proceeding required to discharge student debt in bankruptcy
On March 25, the U.S. Court of Appeals for the Third Circuit affirmed a district court’s dismissal of an FDCPA and FCRA case against a student loan servicer and three credit reporting companies for attempting to collect a loan debt after it had been discharged in bankruptcy. After the discharge and completion of his bankruptcy case, the plaintiff filed suit, alleging the defendants violated the FDCPA and the FCRA by attempting to collect student loan debt that had been discharged. The district court granted the defendants’ motion to dismiss, ruling that the plaintiff failed to state a claim because under Section 523(a)(8) of the Bankruptcy Code, student loan debt is presumptively non-dischargeable and the plaintiff had not filed an adversary proceeding to determine otherwise.
On appeal, the plaintiff “argued that he was not required to file an adversary proceeding in Bankruptcy Court to determine the dischargeability of his student loan debt,” and that the Bankruptcy Court’s determination that the plaintiff was indigent rebuts “the presumption that his debt was nondischargeable by satisfying the exception in §523(a)(8) for undue hardship.” However, the appellate court held that “a finding of indigence is not the same as an undue hardship determination under §538(a)(8)” and that while the Bankruptcy Code does not require an adversary proceeding to discharge student loan debt, the procedures established in the Bankruptcy Rules do include such a requirement by providing that adversary proceedings include “a proceeding to determine the dischargeability of a debt” and are commenced by serving a summons and complaint on affected creditors. Accordingly, the appellate court affirmed dismissal.
Appeals Court to consider whether CFPA covers trusts
On February 11, the U.S. District Court for the District of Delaware stayed a 2017 CFPB enforcement action against a collection of Delaware statutory trusts and their debt collector after determining there may be room for reasonable disagreement related to questions of “covered persons” and “timeliness.” As previously covered by InfoBytes, last December the court ruled that the CFPB could proceed with the enforcement action, which alleged, among other things, that the defendants filed lawsuits against consumers for private student loan debt that they could not prove was owed or that was outside the applicable statute of limitations. The court concluded that the suit was still valid and did not need ratification in light of the U.S. Supreme Court’s 2020 decision in Seila Law v. CFPB (which determined that the director’s for-cause removal provision was unconstitutional but was severable from the statute establishing the Bureau—covered by a Buckley Special Alert), upending its previous dismissal of the case, which had held that the Bureau lacked enforcement authority to bring the action when its structure was unconstitutional. At the time, the court also disagreed with the defendants’ argument that, as trusts, they are not “covered persons” under the Consumer Financial Protection Act (CFPA). While the defendants argued that they used subservicers to collect debt and therefore did not “engage in” providing services listed in the CFPA, the court stated that the trusts were still “engaged” in their business and the alleged misconduct even though they contracted it out.
However, the court now certified two questions for appeal to the U.S. Court of Appeals for the Third Circuit. The first question centers on whether the defendants qualify as “covered persons” subject to the Bureau’s enforcement authority. The court concluded that another court may rule differently on this “novel” issue. “I was the first judge to decide whether the Bureau may bring enforcement actions against creditors like the Trusts who contract out debt collection and loan servicing,” the judge wrote, noting that the judge previously assigned to the case had also “expressed ‘some doubt’ that the Trusts are covered persons.” The second question addresses the Bureau’s efforts to continue the case after Seila. The defendants argued that the suit should be dismissed because the initial filing was invalid due to the director’s unconstitutional insulation and was not ratified within the statute of limitations. In December the court had held that the Bureau did not need to ratify the suit because—pointing to the majority opinion in the Supreme Court’s decision in Collins v. Yellen (covered by InfoBytes here)—“‘an unconstitutional removal restriction does not invalidate agency action so long as the agency head was properly appointed[,]’” and therefore the agency’s actions are not void and do not need to be ratified, unless a plaintiff can show that “the agency action would not have been taken but for the President’s inability to remove the agency head.” The court now acknowledged, however, that Collins “is a very recent Supreme Court decision” whose scope is still being “hashed out” in lower courts, which therefore “suggests that there is room for reasonable disagreement and thus supports an interlocutory appeal here.”