The following post, written by Special Counsel Andrew Phillips, was first published on McGuireWoods’s Password Protected blog. I’m delighted to reprint it here.
As anticipated in our previous discussion of the Ashley Madison data breach litigation, lawyers representing the various putative classes have begun sparring over their preferred venues. The Missouri Jane Doe – who filed the first putative class action – pushed the Judicial Panel on Multidistrict Litigation to consolidate all of the Ashley Madison litigation before the U.S. District Court for the Eastern District of Missouri, which she argued has the requisite data breach class-action experience and is centrally situated for management of a nationwide class. Since then, other plaintiffs have chimed in, advocating forums in California, Illinois and Texas.
Plaintiffs may prefer different forums for both practical and tactical reasons. Practical considerations include the location of witnesses and evidence, the action’s nexus to the forum, and the court’s docket conditions and MDL experience. Tactical concerns include favorable legal precedent, securing a plaintiff‑friendly forum, or simply the “home field advantage” of litigating before a familiar court and jurist. While the various Jane and John Does suing Ashley Madison each pay lip service to the practical, tactical considerations are apparent.
This seems particularly true for those advocating for the Northern District of Illinois. Illinois is the only proposed venue within the Seventh Circuit. And as regular Password Protected readers know, the Seventh Circuit, in Remijas v. Neiman Marcus Group, became the first federal appellate court to find that consumer data breach victims had Article III standing to pursue a class action even in the absence of unreimbursed charges or identity theft. Neiman Marcus has vigorously opposed that decision via a motion for en banc review, arguing that Remijas conflicts with the Supreme Court’s opinion in Clapper v. Amnesty Int’l USA and the Third Circuit’s decision in Reilly v. Ceridian Corp. However, those advocating an Illinois‑based MDL are clearly banking on Remijas to support a more expansive view of standing than might be found in other circuits. Not surprisingly, no plaintiff has advocated jurisdiction in the Third Circuit (covering Delaware, New Jersey, Pennsylvania and the U.S. Virgin Islands), which has refused to find standing among consumer data breach victims.
The focus on standing jurisprudence makes sense because it presents a formidable hurdle to class certification. After all, the breach did not just divulge typical identifying or financial information, but also potentially embarrassing information regarding members’ private sexual fantasies and potential infidelity. And, this more scandalous category of data is cited in support of some plaintiffs’ emotional distress claims. Whether those claims are certifiable is highly questionable, so it makes sense that some plaintiffs are pursuing a forum that has recently taken a more liberal view of the types of injuries that can give rise to Article III standing in a putative data breach class action. However, a Seventh Circuit MDL forum also carries risk: If Neiman Marcus prevails on its motion for en banc review and Remijas is overturned, the Seventh Circuit could transform from ostensibly favorable to decidedly hostile practically overnight.
McGuireWoods LLP data privacy and class action attorneys will continue to closely monitor this litigation. The case is In Re: Ashley Madison Customer Data Security Breach, Case No. 2669 before the U.S. Judicial Panel on Multidistrict Litigation.