Skip to main content

Hannaford Data Breach Class Action Certification: Denied

Written by Kevin McGinty

Damages issues continue to bedevil would-be data breach class action plaintiffs.  A long and growing line of cases holds that consumers cannot maintain claims arising from theft of their personal or financial data without alleging that the theft resulted in financial injury.  One notable exception to this trend was the First Circuit’s 2011 ruling in Anderson v. Hannaford Bros. Co., Nos. 10-2384, 10-2450 (1st Cir. Oct. 20, 2011), which, as previously reported in this blog, held that where a breach resulted from targeted efforts of hackers to access and steal credit card data, out-of-pocket mitigation costs (such as credit insurance and fees associated with new credit cards) were reasonably foreseeable expenses and, therefore, were legally cognizable damages.  In so ruling, the First Circuit reversed an order dismissing the case for lack of actionable injury, permitting the case to proceed to a motion for class certification.  It was at that stage, however, that damages issues again surfaced to preclude certification of a plaintiff class.  In a March 20 decision, U.S. District Court Judge Brock Hornby denied plaintiffs’ motion to certify a class to pursue recovery of amounts spent for credit monitoring and associated expenses, holding that proving such damages for members of the class required highly individualized determinations that could not be tried through proof common to the class as a whole.

Under the Federal Rules of Civil Procedures, a class action to seek money damages cannot be certified unless issues common to the class as a whole predominate over issues affecting only individual plaintiffs.  After the First Circuit’s ruling in Anderson, the question of whether Hannaford had negligently breached data security duties owed to its customers was common to the class as a whole.  The class also alleged a common injury – the reasonable costs of credit insurance and other actions to avoid or mitigate credit risk.  However, what actions each class member took and the costs each incurred were not susceptible of common proof.  There were a range of costs incurred and actions taken, some of which were arguably duplicative or unnecessary.  Hannaford successfully argued that the questions of whether individual consumer actions were reasonable and what such actions reasonably should have costs could not be determined without taking testimony from every member of the class.  Once individual trials are required it is no longer appropriate to try a case as a class action.  Judge Hornby agreed, and ruled that the need to conduct individualized damages trials prevented certification of the plaintiff class.

One noteworthy aspect of Judge Hornby’s opinion is his rejection of the argument that certification of a plaintiff class would not be appropriate because a voluntary refund program offered by Hannaford was superior to the proposal to seek substantially duplicative relief at trial subject to set-off for class counsel fees.  As this writer previously noted in a 2011 article for Law360, certain courts have declined to certify classes based on a determination that voluntary settlement programs offered a superior means of resolving the dispute.  See, e.g., Webb v. Carter’s Inc., 272 F.R.D. 489, 504-05 (C.D. Cal. 2011); In re ConAgra Peanut Butter Prods. Liab. Litig., 251 F.R.D. 689, 700–01 (N.D. Ga. 2008); In re Phenylpropanolamine (PPA) Prods. Liab. Litig., 214 F.R.D. 614, 622 (W.D. Wash. 2003); Berley v. Dreyfus & Co., 43 F.R.D. 397, 398-99 (S.D.N.Y. 1967).  Judge Hornby declined to follow these cases on the ground that the Federal Rules require proof that the class action is a superior means of adjudication, and that the voluntary refund programs concerned settlement, not adjudication.  In a similar vein, the Seventh Circuit’s decision in In re Aqua Dots Prods. Liability Litig., 654 F.3d 748, 752 (7th Cir. 2011), rejected the argument that class certification could be denied based on the superiority of a voluntary refund program. The Seventh Circuit, however, affirmed denial of class certification on the alternative ground that class counsel who insisted on pursuing less efficient class remedies that would cost more than the voluntary refund program did not adequately represent the interests of the class.  Judge Hornby rejected this argument as well, focusing on the particular role of class counsel in ensuring that class members had a remedy that might not otherwise be available.

The Hannaford case illustrates how damages issues, even in cases articulating a viable common damages theory, can still frustrate class certification.  Further, while Judge Hornby declined to find that a fair and effective remediation program provides a defense against class certification, such programs still provide a way to mitigate class damages, reduce potential overall exposure and retain customer goodwill.

Subscribe To Viewpoints


Cynthia J. Larose

Member / Co-Chair, Privacy & Cybersecurity Practice

Cynthia J. Larose is Chair of the firm's Privacy & Cybersecurity Practice, a Certified Information Privacy Professional-US (CIPP-US), and a Certified Information Privacy Professional-Europe (CIPP-E). She works with clients in various industries to develop comprehensive information security programs on the front end, and provides timely counsel when it becomes necessary to respond to a data breach.