Scottrade wins dismissal of data breach class action in the 8th Circuit

Thompson Coburn has helped securities brokerage firm Scottrade, Inc., secure dismissal of a data breach class action on the merits with prejudice in the 8th Circuit. The 8th Circuit’s opinion, which is the first circuit level opinion to squarely address the merits of data breach class actions, sends a clear message that this type of “no damage” class action litigation is not welcome in the 8th Circuit.

The 8th Circuit held that although the plaintiff in the case alleged enough to meet the minimal requirements of Article III standing, his claims were nonetheless clearly meritless and should be dismissed with prejudice. In dismissing the class action, the 8th Circuit agreed with Scottrade’s position that the plaintiff’s allegations and claims of harm resulting from the data breach were “not plausible,” “bare bones,” and “virtually unintelligible.” The Court also wrote in its opinion that “[m]assive class action litigation should be based on more than allegations of worry and inconvenience.” 

The appellate ruling stemmed from the district court’s July 2016 dismissal of four putative class actions filed against Scottrade relating to a 2013 data breach. The district court dismissed the four class actions on the basis that the plaintiffs lacked Article III standing. One of the plaintiffs, Matthew Kuhns, appealed the dismissal, arguing that he had pleaded sufficient facts to establish a “substantial risk” of injury based on the data breach. Scottrade filed a protective cross appeal arguing that even if Kuhns’ allegations were sufficient to meet the bare procedural minimums for Article III standing, his claims should still be dismissed due to his failure to allege that he or anyone else had suffered actual damage as a result of the data breach.

After the 8th Circuit docketed Kuhns’ appeal, his counsel filed two identical putative class action lawsuits in California and Florida state court on behalf of two co-plaintiffs who did not join in the 8th Circuit appeal. Scottrade was able to secure stays of both of those cases pending the outcome of Kuhns’ 8th Circuit appeal. Days before oral argument, Kuhns moved to voluntarily dismiss his appeal in favor of the California action. Scottrade successfully opposed that motion, arguing not only that it was an untimely display of procedural gamesmanship, but that the issues raised in the 8th Circuit appeal were important ones of first impression that should be decided by the appellate court. 

Consistent with its recent opinion in Carlsen v. GameStop, and a number of other circuits to consider the standing issue in data breach cases, the 8th Circuit held that Kuhns’ allegations were sufficient to establish Article III standing, at least with regard to his breach of contract claim. However, because Scottrade filed a protective cross-appeal, the court went on to rule that Kuhns’ allegations were insufficient to plausibly state a claim against Scottrade related to the data breach. In so ruling, the 8th Circuit rejected the implied premise behind many data breach class actions that “because data was hacked [the] protections must have been inadequate” as nothing more than a “naked assertion devoid of further factual enhancement.” 

Scottrade was represented in the district court litigation and on appeal by Chris Hohn, Tom Douglass, and Dave Mangian. Chris Hohn argued the case in front of the 8th Circuit.