Last week the Sixth Circuit Court of Appeals affirmed a lower court ruling mandating the dismissal of a data privacy litigation brought against an e-commerce platform in light of a binding arbitration agreement.  In re Stockx Customer Data Sec. Breach Litig., 2021 U.S. App. LEXIS 35813 (6th Cir. Dec. 2, 2021).  The Sixth Circuit also held that challenges raised to the validity of the agreement to arbitrate were for the arbitrator to decide, not the Court.  This case fits within a backdrop of recent decisions kicking privacy class actions into arbitration.  Read on to learn more.

First, some background.  StockX is an e-commerce website, where users can buy and sell a variety of luxury merchandise.  Although anyone can browse merchandise on StockX, only users with an account can bid on or sell an item.  However, to create a StockX account, a user must agree to StockX’s Terms of Service and Privacy Policy.  Notably, since 2015, StockX’s Terms of Service always included: (1) an arbitration agreement; (2) a delegation provision; (3) a class action waiver; and (4) instructions for how to opt-out of the arbitration agreement.

Plaintiffs filed a nationwide putative class action against StockX, as a result of its purported failure to protect millions of StockX user’s personal account information from a cyber-attack in May 2019.  Unsurprisingly, StockX moved to compel arbitration of their claims and sought dismissal of the litigation on this basis.  The district court granted StockX’s motion.  Plaintiffs then appealed to the Sixth Circuit, arguing that there was an issue of fact as to whether four of the named Plaintiffs agreed to the StockX’s Terms of Service.  Plaintiffs additionally argued that the defenses of infancy and unconscionability rendered the Terms of Service and the embedded arbitration agreement (including the delegation provision) unenforceable.

Applying Michigan law, the Sixth Circuit rejected Plaintiffs’ arguments.  According to the Court, “[b]ecause we conclude that a contract exists and that the delegation provision itself is valid, the arbitrator must decide in the first instance whether the defenses of infancy and unconscionability allow Plaintiffs to avoid arbitrating the merits of their claims.”  As the Sixth Circuit explained:

There is a delegation provision in this case.  It states that “the arbitrator . . . shall have exclusive authority to resolve any dispute arising out of or relating to the interpretation, applicability, enforceability or formation of [the] Agreement to Arbitrate, any part of it, or of the Terms including, . . . any claim that all or any part of [the] Agreement to Arbitrate or the Terms is void or voidable.”  Such language alone is clear and unmistakable evidence requiring that an arbitrator shall decide the “applicability, enforceability,” or validity of both the arbitration provision and the entire contract.

On this basis, the Sixth Circuit affirmed dismissal of the case and ordered compelled arbitration of Plaintiffs’ claims.  This case demonstrates that defendants who may be named in future filed data privacy litigations should consider, if not already in place, whether they want to adopt arbitration and class action waiver provisions in their customer agreements (including delegation provisions).  For more developments on this area of the law, stay tuned.  CPW will be there to keep you in the loop.