Maryland Federal Court Reinstates Class Certification In Data Breach Class Action

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Emilee N. Crowther

Duane Morris Takeaways: In the proceeding captioned In Re Marriott International Customer Data Security Breach Litigation, MDL No. 8:19-MD-02879, 2023 WL 8247865 (D. Md. Nov. 29, 2023), Judge John Preston Bailey of the U.S. District Court for the District of Maryland granted Plaintiff’s Motion for Class Certification and reinstated several previously-certified classes.  The defendant argued that class certification was improper, in part, because the putative class members signed a Choice of Law Provision that contained a class action waiver.  Conversely, the plaintiffs contended that the defendant waived its defense based on the Choice of Law Provision.  The Court held that (i) the defendant waived its Choice of Law Provision, and (ii) in the absence of an arbitration agreement, the Choice of Law Provision did not override the Rule 23 requirements.  For these reasons, this case serves as an important reminder for companies on the importance of the terms of contractual agreements in the context of seeking to arbitrate cases and potentially avoid class or collective actions.

Case Background

In 2016, Marriott purchased Starwood Hotels & Resorts Worldwide (“Starwood”), and inherited Starwood’s IT infrastructure provided by Accenture LLP (“Accenture”) for all Starwood properties.  Id.  In September 2018, Marriott learned that an unidentified party tried to gain access to the Starwood guest reservation database.  After an investigation, Marriott determined Starwood’s database was compromised from July 2014 through September 2018.  Id. *1.  On November 30, 2018, Marriott disclosed the data breach.  Id.

Thereafter, affected consumers filed suit against Marriott and Accenture nationwide.  Id.  Marriott requested that the actions be consolidated into one multi-district litigation (“MDL”) in the U.S. District Court for the District of Maryland, where Marriott is headquartered.  Id. * 4.  The case was consolidated, and the plaintiffs filed their joint MDL Complaint alleging various state law contract, statutory consumer protection, and state law negligence claims.  Id.  The plaintiffs then moved to certify various classes.  Id. *2.

The putative class included members of the Starwood Preferred Guest Program (“SPG”).  Id. *2.  Members of the SPG program signed a contract that contained a “Choice of Law and Venue” Provision (the “Choice of Law Provision”).  Id.  The Choice of Law Provision stated that any disputes related to the SPG program would “be handled individually without any class action” and would have exclusive jurisdiction in the State of New York.  Id.  Therefore, the defendant asserted that Rule 23(a)’s “typicality” requirement was not met because the class members were SPG program members, and the class contained both members and non-members of the SPG program.  Id.

The District Court agreed with the defendant, and redefined all classes to include only SPG members.  Id. *3.  However, by doing so, every putative class member was “someone who had purportedly given up the right to engaged in just such class litigation.”  In Re Marriott Int’l, Inc., 78 F.4th 677, 682-83 (4th Cir. 2023).  The District Court “did not further consider the import of the class waiver on its certification decision,” id. at 683, and granted certification as to three of the plaintiffs’ Rule 23(b)(3) and four Rule 23(c)(4) damages classes.  In Re Marriott Int’l, Inc., 341 F.R.D 128, 172-73 (D. Md. 2022).  Subsequently, the defendants appealed.

On appeal, the Fourth Circuit held that the District Court erred in failing to address whether or not the SPG members agreed to bar the certification of a class action.  In Re Marriott International, 2023 WL 8247865, at *3.  The Fourth Circuit vacated the class certification and remanded to the District Court to consider the effect of the Choice of Law Provision on the class.  Id.

The District Court’s Decision

The District Court concluded that (i) the defendants waived the Choice of Law Provision, and (ii) absent an arbitration agreement, Rules 23 and 42 prevailed over the parties’ Choice of Law Provision Id. Accordingly, the District Court reinstated the previously-certified classes.

First, the District Court analyzed the plaintiff’s position that the defendants waived the Choice of Law Provision.  It opined that “[w]aiver is the intentional relinquishment or abandonment of a known right.”  United States v. Olano, 507 U.S. 725, 733 (1993) (internal citations omitted).  The District Court reasoned that a party “waives a contractual provision when the party takes actions that are inconsistent with the provision.” In Re Marriott International, 2023 WL 8247865, at *4.  The District Court held the defense “clearly waived 5/6” of its Choice of Law Provision because the defendants: (1) requested consolidation into an MDL, which “is the antithesis of handling each claim on an individual basis”; (2) stated that “separately litigating each of the 59 related actions” would “offer no benefit” and heighten the burdens of all involved; and (3) stated venue was proper in Maryland and requested that the MDL be assigned to Maryland, which was inconsistent with the New York Choice of Law Provision.  Id.  As such, the District Court found that the defendants waived the Choice of Law Provision and all terms contained therein.  Id.

Second, the District Court held that it was not required to enforce the Choice of Law Provision outside of a binding arbitration provision.  Id. *8.  The Choice of Law Provision was “patently distinguishable” from “all of the reported cases on contractual class action waivers” because it did not have a mandatory arbitration clause.  Id. *7.  When parties agree to resolve their case in a non-judicial forum such as arbitration, “the Federal Rules have limited applicability”.  Id. *6. However, in the absence of such an agreement, the District Court opined that “[t]he parties cannot by agreement dictate that a district court must ignore the provisions of Rule 23 of the Federal Rules of Civil Procedure.”  Id. *7.  The District Court found that Rule 23 and Rule 42 do not “call for consideration of the parties’ preferences,” but rather “furtherance of efficient judicial administration.”  Id.  Thus, the District Court was not required to enforce the Choice of Law Provision, and held that the plaintiffs did not waive their right to bring a class action claim.  Id. *8 *(quoting Martrano v. Quizno’s Franchise Co., 2009 WL 1704469, at *20-21 (W.D. Pa. June 15, 2009)).

Implications For Companies

Companies should proactively review their arbitration agreements and class or collective action waivers to ensure that contractually agreed-upon terms can and will be imposed by a court.  Additionally, when faced with multiple nationwide claims, companies should analyze their case defense strategy and make an informed decision before filing and/or joining an MDL.  Finally, as part of any acquisition, companies should have their own data security team thoroughly vet and approve the acquired company’s security infrastructure prior to, or shortly after, the acquisition.

© 2009- Duane Morris LLP. Duane Morris is a registered service mark of Duane Morris LLP.

The opinions expressed on this blog are those of the author and are not to be construed as legal advice.

Proudly powered by WordPress