The U.S. Judicial Panel on Multidistrict Litigation (JPML) declined Tuesday to expedite its consideration of efforts to consolidate in Georgia federal court the over 30 proposed class action lawsuits that have been filed against Equifax in the days since it disclosed a cyberattack that potentially impacted 143 million consumers’ personal information. The matter is MDL 2800 In re: Equifax Inc. Data Breach Litigation.
Equifax revealed that hackers had exploited a flaw in its website that allowed them to get access to account information for hundreds of millions of customers. Hackers were able to get away with millions of consumers’ sensitive information, including their names, addresses, birthdates and even Social Security numbers in a breach that began in May and was discovered by the company in July. The hackers also gained access to roughly 209,000 customers’ credit card numbers, according to Equifax. Equifax was hit with at least two class actions less than a day after its announcement, and the suits have continued to pile up across the country in the days since, with many more expected. These lawsuits all allege that Equifax’s lacking systems allowed a security breach to occur, violating various statutes and common-law obligations.
The Introduction in the Memorandum in Support of Plaintiff’s Motion for Transfer of Actions to the Northern District of Georgia and for Consolidation, from one of the class actions, provides the justification for the proposed consolidation into an MDL:
Movants are the plaintiffs in two of the 22 cases filed to date against Equifax, Inc. (“Equifax”) relating to the massive data breach first reported by Equifax on September 7, 2017.Generally, plaintiffs in the [a]ctions allege that Equifax, a consumer credit agency, allowed unauthorized individuals to gain access to its data network storing the private personal information of 143 million consumers. Equifax acknowledged that the stolen information included consumers’ names, Social Security numbers, birth dates, addresses and, in some cases, debit and credit card and driver’s license numbers. As alleged in the [a]ctions, the consequences of Equifax’s data breach are severe – the stolen personal and financial information can be used against victims in a variety of ways including identity theft and fraud. All of the [a]ctions allege violations of various state and federal statutes and common law principles against Equifax relating to the breach and all seek certification of a similar class of victims.
Consistent with the Panel’s course in recent data breach litigation, Plaintiffs seek the consolidation and transfer of the [a]ctions to the United States District Court for the Northern District of Georgia, where Equifax is headquartered. All of the class actions filed against Equifax contain common allegations and common questions of fact. Moreover, because Equifax’s actions have received a great deal of publicity, and the number of victims is enormous, numerous tagalong cases will be filed in the future.”
Arguments meriting consolidation into an MDL include Equifax’s corporate headquarters being located in Atlanta, only a few miles from the courthouse, and the district being accessible for the parties and witnesses, considering it’s serviced by the huge Hartsfield-Jackson Atlanta International Airport. Further, the district has extensive experience handling national data breach cases like multidistrict litigation against Home Depot Inc. and a pending suit against Arby’s Restaurant Group Inc. Consumers also argue in their motions that it is appropriate and necessary to consolidate the actions, saying courts regularly try data breach cases in this way because they inherently involve common questions of fact.
Consumers argued that holding off on deciding their Tuesday motion “almost certainly would result in piecemeal litigation of dozens of similar cases across the country, with the attendant inefficiencies, uncertainty, and potential for conflicting actions for the next several months,” contending that the JPML should decide the requests quickly rather than wait for the JPML’s next session on November 30, noting that the breach is huge in scope — having potentially affected nearly half the country — and that Equifax’s actions after announcing it have done nothing but further confuse and worry the public. However, the JPML wasn’t swayed, saying in a text order the same day that it “considers all motions in due course and is not persuaded to depart from its long-standing practice.”
Multidistrict Litigation is the consolidation of many plaintiffs’ cases, both as individual cases and class actions, from federal district courts around the country into one federal district court to streamline discovery and pre-trial proceedings, and to conduct bellwether trials. The Judicial Panel on Multi-District Litigation (JPML) in Washington, D.C., which is comprised of seven federal district court judges, decides whether to consolidate certain cases with other similar cases. The JPML also decides to which court and judge to transfer the cases.
In an MDL, each plaintiff’s lawsuit remains independent. No plaintiff is required to take a settlement as part of a class. If a plaintiff is unable to settle his or her case through the MDL, they may return to their local federal court for additional proceedings or trial. In a class-action lawsuit, all plaintiffs are part of one single lawsuit and are subject to the group settlement and/or trial strategy of the lawyers representing the entire class.
Once the MDL is formed all federal cases nationwide must be transferred and/or filed directly into the MDL. Consolidated plaintiffs have the benefit of group negotiating power during the important pre-trial phase of a lawsuit. A bellwether trial is a preliminary, or “test” trial ordered by the federal court overseeing an MDL. These trials test jury reaction to a case or cases selected as representative of the MDL plaintiff pool. The outcome of an MDL’s bellwether trials may encourage an appropriate group settlement of all cases consolidated under that MDL.