73 F.4th 883
11th Cir.2023Background
- Between March–April 2018 Chili’s systems were hacked; plaintiffs allege ~4.5 million card records were posted for sale on Joker Stash (dark web).
- Three named plaintiffs: Theus (Texas) experienced unauthorized charges and incurred mitigation efforts; Franklin (California) had unauthorized charges but his dining dates fell outside affected windows; Steinmetz (Nevada) canceled his card but had no fraudulent charges and his dining date was outside the affected window.
- Plaintiffs sought certification of (a) a nationwide negligence class and (b) a California statewide UCL-type class; district court certified both classes with class definitions requiring (1) data accessed by cybercriminals and (2) incurred reasonable mitigation expenses/time.
- Eleventh Circuit reviewed certification on Rule 23(f) interlocutory appeal; panel applied Article III standing and Rule 23 predominance principles (including TransUnion and Tsao guidance).
- Court held Theus has Article III standing; Franklin and Steinmetz do not (traceability/date issues). The panel vacated in part and remanded for the district court to clarify class definitions and redo certain predominance/California-class analyses; it affirmed that a common damages methodology existed at certification stage but a judge dissented on that point.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing for named plaintiffs | Hackers posted/used stolen data (dark web misuse) and plaintiffs incurred mitigation, so named plaintiffs have concrete injury | Many named plaintiffs lack traceability to an affected transaction/date; mere risk/exposure is insufficient | Only Theus has standing (financial loss/unauthorized charges traceable to breach); Franklin and Steinmetz lack traceability to the breach dates |
| Class definition / predominance (standing of absent class members) | Class limited to persons whose data was accessed/misused and who incurred mitigation, so absent members will have standing | Broad wording "data accessed" may include uninjured members and make predominance fail | Remand: district court must clarify/refine class definitions or re-run predominance analysis because current language may sweep in uninjured members; must ensure absent members would have standing before damages awarded |
| California statewide class (state-law claims) | California class is appropriate as certified | No named plaintiff has standing to pursue California claims | Vacated California class: without a named plaintiff with standing on California claims the class cannot survive; remand required |
| Damages methodology (average-based/common model) | Expert’s average-based model (rewards loss, time, out-of-pocket) provides a classwide, mechanical method for damages | Model is overinclusive; would award damages to class members who suffered none and prevents individualized defenses | Majority: district court did not abuse discretion at certification stage—reliable damages methodology shown; dissent (Branch, J.) would reject the averages model as improperly awarding damages not tied to individual injury |
Key Cases Cited
- Cordoba v. DIRECTV, LLC, 942 F.3d 1259 (11th Cir. 2019) (only named plaintiffs must show Article III standing at class-certification)
- TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (2021) (mere risk of future harm insufficient for damages standing; each class member must have Article III injury to recover)
- Tsao v. Captiva MVP Rest. Partners, LLC, 986 F.3d 1332 (11th Cir. 2021) (post-breach misuse/posting is required to establish concrete injury from a data breach absent other harms)
- Comcast Corp. v. Behrend, 569 U.S. 27 (2013) (damages model at class certification must measure only damages attributable to the theory of liability)
- Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442 (2016) (representative/average evidence can be used in limited circumstances to prove classwide liability)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (Article III standing elements and burden of proof vary by litigation stage)
- Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338 (2011) (rigorous Rule 23 analysis; proponent must demonstrate Rule 23 requirements)
- Amgen Inc. v. Conn. Ret. Plans & Tr. Funds, 568 U.S. 455 (2013) (merits may be considered only insofar as relevant to Rule 23 prerequisites)