Blog Entry: Eighth Circuit Vacates Data Breach Class Action Settlement; Gently Rebukes Trial Court

Target Corporation announced a data breach in 2013, which occurred, as it noted in an SEC filing, when “an intruder stole certain payment card and other guest information from  [its] network.”  Estimates as to the number of affected customers varied, but all agreed it was huge:  deep into the millions.

Multiple class actions were filed and consolidated in the District of Minnesota.  The parties eventually agreed to a class-wide settlement, and their proposed agreement was presented to the district court for approval.  Several objections were asserted.  The district court certified the class, approved the settlement, and overruled the objections.  Target agreed to pay $10 million to the class, and separately, class counsel would receive up to $6.75 million in fees.

Two objectors appealed to the Eighth Circuit Court of Appeals, which, on February 1, 2017, vacated and remanded.  Why?  Because it found that the “lack of legal analysis” in the district court’s orders “suggests that class certification was the product of summary conclusion rather than rigor.”  It therefore held that “the district court abused its discretion by failing to rigorously analyze the propriety of certification, especially once new arguments challenging the adequacy of representation were raised after preliminary certification.”

The Eighth Circuit also noted that when the district court preliminarily approved the settlement, it “replace[d] analysis of the certification prerequisites with a recitation of Rule 23 and a conclusion that certification is proper,” and that the district court’s comments regarding the propriety of the settlement were “conclusions, not reasons, and on their own … do not constitute a rigorous analysis of whether certification is proper in this case.”

But take note:  the appeals court did not reject the settlement.  “To be clear,” it declared, “we take no position on the propriety of class certification.  We only conclude at this point that the record is inadequate for our review because the district court has not conducted a meaningful analysis of class certification.”

Upon remand, one would expect the district court to articulate in granular detail the reasons it certified the class and approved the settlement.  And one would also expect the objectors to renew their objections.  And in the end, another appeal may ensue.  Or may not.  We’ll keep you posted.

The case is In re Target Corporation Customer Data Security Breach Litigation, — F.3d —- (2017), Eighth Circuit Court of Appeals, case nos. 15-3909, 15-3912, 16-1203, 16-1245 and 16-1408, and the decision can be found at https://goo.gl/kGmdu6.