When hackers steal consumer data, injury to consumers is not a foregone conclusion. This is particularly so where credit and debit card numbers are stolen.  Banks, not consumers, bear the cost of fraudulent charges.  Consumers’ credit ratings are unaffected by such charges, and stolen payment card numbers cannot be used to steal consumers’ identities.   As a result, it can be difficult for consumers in payment card data breach cases to prove damages or injury.

This problem manifested itself in an unusual way in connection with an objection to the consumer class settlement in the Target data breach litigation. The proposed settlement released claims of all consumers whose card data had been stolen, but only paid settlement consideration to class members who alleged or could prove actual losses arising from the settlement. A member of the class who did not allege any losses objected to certification of the settlement class, asserting that there was an intra-class conflict between consumers who would receive payments from the settlement and those who would not.  He argued that failure to make payments to his class unfairly favored class members claiming injury over those who had not yet suffered injury, but might be injured in the future.  As a result, the objector argued that class certification was barred by Amchem Prods., Inc. v. Windsor, 521 U.S. 591 (1997), which held that class certification is not appropriate where there is an intra-class conflict between class members receiving settlement consideration and those who do not.

The District Court overruled this objection, merely stating that the court had “certified a settlement class in the preliminary approval order, and will not revisit that determination here.”  On appeal, the the Eighth Circuit deemed the District Court’s cursory resolution of that objection to be insufficient as a matter of law.  In Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338 (2011), the Supreme Court mandated that courts engage in a “rigorous analysis” when determining whether a proposed class satisfies the requirements for class certification under Rule 23.  By summarily rejecting the objection to class certification, the District Court failed to satisfy Wal-Mart’s “rigorous analysis” requirement.  As a result, the Eighth Circuit vacated the settlement approval order and remanded the case to the District Court to allow further proceedings to address whether the proposed settlement class indeed suffers from a fatal intra-class conflict that precludes certification under Amchem.

The irony of this disposition is that the objector successfully derailed the Target consumer settlement by confessing his own lack of injury.  As the Supreme Court recently reaffirmed in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), “injury in fact” is an indispensable element of standing to sue in federal court under Article III of the United States Constitution.  The objector’s argument highlights that he and all of the other individuals in what he calls the “no-recovery subclass” have suffered no injury in fact.  Under Article III and Spokeo, the objector and others like him, as a consequence of their conceded lack of injury, would have no standing to bring suit on their own.  How, then, can it be appropriate to certify a class that includes these non-injured class members?

The inclusion of both injured and uninjured individuals in the certified class appears not to have been addressed in connection with the request to certify a settlement class.  The reason why is obvious; once a case settles the parties are aligned in their interest to certify as large a class as possible.  Larger classes support larger class counsel fee applications, while at the same time giving defendants the benefit of the broadest possible claim preclusion. Neither party had any incentive to upset the apple cart by flagging pesky issues like subject matter jurisdiction.  But defects in Article III jurisdiction are not waivable; a federal court cannot render binding judgment in a matter over which it lacks subject matter jurisdiction.  Any defects in jurisdiction over the putative class must be addressed before the court can enter final judgment in favor of the class.

That said, it is far from certain that standing issues would result in any exclusion of uninjured consumers from the Target consumer class.  While some federal appeals courts expressly disapprove of including uninjured class members in a certified class, see, e.g., In re Rail Freight Surcharge Antitrust Litig., 725 F. 3d 244 (D.C. Cir. 2013), others have held that the inclusion of uninjured class members does not disqualify a class from being certified, see, e.g., In re Nexium Antitrust Litig., 777 F.3d 9 (1st Cir. 2015).  The Supreme Court had an opportunity in its last term to resolve this split in Tyson Foods, Inc. v. Bouaphakeo, 136 S. Ct. 1036 (2016), but declined to do so.  The Eighth Circuit has yet to come down on either side of this debate.

Given this uncertainty, standing issues pose challenges for both sides on remand.  To avoid the whole question of whether a mixed class can be certified, plaintiffs could argue, as often in the case in payment card data breach cases, that class members who incurred no out of pocket losses were injured for purposes of Article III because they suffered inconvenience or other such effects.  But if that argument is correct, how can a settlement that deprives such class members of any share of the settlement payments be fair and adequate as to all class members?  If not, would it be fair to all class members to spread the existing settlement fund across a larger number of class members?  Would Target be willing to settle for a larger settlement fund amount that provides payment to the larger group of claimants, or would it instead argue for exclusion of uninjured class members, so as to avoid paying a higher settlement price?  How these issues play out on remand could further develop the law governing certification of classes that include uninjured class members.