Duane Morris Attorneys Ryan Garippo And George Schaller Selected For The Inaugural Edition of Class Action Updates’ List of “Premier Class Action Leaders of Tomorrow”

Duane Morris Takeaway: The Duane Morris Class Action Defense Group is pleased to announce that attorneys Ryan Garippo and George Schaller have been selected as honorees of the inaugural class of Class Action Updates’ Premier Class Action Leaders of Tomorrow Award, which recognizes 12 exceptional rising stars under the age 40 “who are redefining the frontiers of class action litigation through innovative strategies, landmark victories, and unwavering commitment to justice on both sides of the bar.  Selected from a highly competitive pool of nominations, their groundbreaking work promises to inspire the next generation of litigators and fortify the pillars of the legal system.”

Kudos to Ryan and George on this well-deserved accomplishment!

Ohio Federal Court Applies Sixth Circuit’s Heightened Standard To Deny Certification Of Overtime Claims For Alleged Unpaid Pre-Shift Work

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Kathryn Brown

Duane Morris Takeaways: In Arble v. East Ohio Gas Company, et al., No. 5:24-CV-747 (N.D. Ohio Nov. 3, 2025), Judge Benita Y. Pearson of the Northern District of Ohio denied the plaintiffs’ motion for court-facilitated notice to potential opt-in plaintiffs based on application of the Sixth Circuit’s “strong likelihood” standard for FLSA certification. As a result of the court’s ruling, the lawsuit will proceed based on the claims of only three plaintiffs. The decision is essential reading for defendants in the Sixth Circuit seeking to defeat a motion for certification of FLSA claims.

Case Background

Plaintiff filed a complaint on April 26, 2024, on behalf of a putative class and collective action of call center employees against an energy company that provides services throughout Ohio and the United States.

Plaintiff contended that the defendant had an unlawful practice of failing to pay wages to call center employees for time spent logging on and booting up their computer systems. She alleged that as a result of “off the clock” work prior to the start time of the shift, she and other call center workers worked in excess of 40 per workweek without receiving overtime pay. Plaintiff asserted claims of unpaid overtime in violation of the Fair Labor Standards Act and Ohio law.

Two other call center employees filed consent forms to become opt-in plaintiffs in the lawsuit.

On April 1, 2025, Plaintiffs filed a motion for court-facilitated notice to potential opt-in plaintiffs for purposes of their collective action per the FLSA.  Defendants responded in opposition on April 22, 2025. The Court denied the motion as moot after granting Plaintiff’s separate motion to amend the complaint to add a party.  

On July 11, 2025, Plaintiffs filed an amended motion for court-facilitated notice to a putative nationwide collective action of call center workers. Defendants responded in opposition on August 1, 2025. Plaintiffs did not file a reply in further support of the motion.

As Ohio law no longer permits plaintiffs to pursue class action (opt-out) claims for unpaid overtime under Ohio state law, the Plaintiffs’ motion addressed only the standard for court-facilitated notice of FLSA claims to potential opt-in plaintiffs. See Ohio Rev. Code 4111.10(C).

The Court’s Ruling

The Court explained the standard for court-facilitated notice of FLSA claims under the pivotal decision of the Sixth Circuit in Clark v. A&L Homecare & Training Ctr., LLC, 68 F.4th 1003 (6th Cir. 2023). In Clark, the Sixth Circuit abandoned the familiar two-step framework for conditional certification under the FLSA. In its place, the Sixth Circuit announced a new standard for facilitating notice to potential opt-in plaintiffs pursuant to 29 U.S.C. § 216(b) of the FLSA. Under the new standard, plaintiffs must demonstrate a “strong likelihood” that they are similarly situated to others with a showing “greater than the one necessary to create a genuine issue of material fact, but less than the one necessary to show a preponderance.” See Clark, 68 F.4th at 1010.

Upon application of the Clark standard, the Court concluded Plaintiffs fell far short of meeting their evidentiary burden to receive court-facilitated notice of their claims to others. The Court highlighted three primary deficiencies in Plaintiffs’ motion.

First, the Court found the Plaintiffs’ sworn declarations insufficient to show similarity to any other call center workers.  The declarations failed to identify any other call center workers by name, failed to state any dates when Plaintiffs allegedly saw others performing pre-shift work, failed to explain how Plaintiffs knew that others experienced violations of the FLSA, and failed to connect Plaintiffs’ observations to any broader set of call center workers employed by Defendants inside or outside Ohio.  

Next, the Court roundly rejected Plaintiffs’ reading of an employee handbook policy applicable to call center workers. Plaintiffs contended that a policy stating that workers must be on time and available to start work at the beginning of their shift supported their claims of widespread “off the clock” work in violation of the FLSA. The Court reasoned that a mere requirement for employees to be on time for work did not run afoul of the FLSA. Therefore, nothing on the face of the policy warranted court-supervised notice, nor did Plaintiffs explain how the policy proves a violation as to all potential opt-in plaintiffs.

Finally, the Court found no basis in the record to send notice to the membership of a nationwide collective action. Plaintiffs, who each worked in Ohio, presented no evidence of how Defendants staffed or managed any call center outside of Ohio.

The Court reasoned that absent evidence linking Plaintiffs’ allegations to other call center workers, facilitating notice to potential opt-in plaintiffs “would amount to claim solicitation that the Court declines to undertake.” Id. at 6.

Having concluded that no basis existed to expand the scope of Plaintiffs’ claims to potential opt-in plaintiffs under the Clark standard, the Court ordered that the case would proceed based on the claims of three Plaintiffs alone.

Implications For Defendants

In FLSA collective action litigation, the disposition of a motion for notice to potential opt-in plaintiffs is a central inflection point. The Court’s ruling in Arble illustrates the opportunity afforded to defendants in the wake of Clark to shrink the scope of an FLSA lawsuit by dissecting the purported evidence of similarity between the named plaintiff and other employees. Where plaintiffs rely on vague and conclusory allegations of widespread unlawful pay practices, defendants have an opportunity to defeat the plaintiffs’ efforts to expand the universe of party plaintiffs in the case, and thereby gain significant leverage in the lawsuit. Corporate counsel defending similar FLSA claims of unpaid overtime on behalf of a putative collective action ought to take note of the Court’s reasoning in Arble when preparing their defense strategy.

As the Northern District of Ohio’s ruling in Arble reflects, the Sixth Circuit’s “strong likelihood” standard under Clark poses a formidable hurdle for plaintiffs to overcome to obtain court-sanctioned notice to potential opt-in plaintiffs.

Data Security And Privacy Liability – Takeaways From The Sedona Conference Working Group 11 Midyear Meeting In Ft. Lauderdale

By Justin R. Donoho

Duane Morris TakeawaysData privacy and data breach class action litigation continue to explode.  At the Sedona Conference Working Group 11 on Data Security and Privacy Liability, in Fort Lauderdale, Florida, on November 6-7, 2025, Justin Donoho of the Duane Morris Class Action Defense Group served as a moderator for a panel discussion, “Legislative Drafting Considerations: Lessons from Colorado’s Privacy and AI Law Intersection.”  The working group meeting, which spanned two days and had over 40 participants, produced excellent dialogues on this topic and others including website advertising technologies, judicial perspectives on privacy and data breach litigation, onward transfer of consumer PII in M&A and bankruptcy contexts, venue, forum, and choice of law in privacy and data breach class actions, privacy and data security regulator roundtable, revisiting notice and consent for facial recognition, and application of attorney-client privilege in the cybersecurity context.

The Conference’s robust agenda featured dialogue leaders from a wide array of backgrounds, including government officials, industry experts, federal and state judges, in-house attorneys, cyber and data privacy law professors, plaintiffs’ attorneys, and defense attorneys.  In a masterful way, the agenda provided valuable insights for participants toward this working group’s mission, which is to identify and comment on trends in data security and privacy law, in an effort to help organizations prepare for and respond to data breaches, and to assist attorneys and judicial officers in resolving questions of legal liability and damages.

Justin had the privilege of speaking about lessons from the intersection of the Colorado Privacy Act (CPA) and Colorado AI Act (CAIA) and how these lessons might guide future legislatures when drafting AI and data privacy statutes.  Highlights from his presentation included identifying lessons learned from the intersection of the CPA and CAIA and, among them, discussing some of the human steps a company may perform in using an AI hiring tool to avoid triggering the CPA’s opt-out right in factual scenarios where that right might apply, as those human steps are discussed in his article, “Five Human Best Practices to Mitigate the Risk of AI Hiring Tool Noncompliance with Antidiscrimination Statutes,” Journal of Robotics, Artificial Intelligence & Law, Volume 8, No. 4, July-August 2025.

Finally, one of the greatest joys of participating in Sedona Conference meetings is the opportunity to draw on the wisdom of fellow presenters and other participants from around the globe.  Highlights included:

  1. Experts of all stripes presenting a draft opus on advertising technologies that describes ways our laws could move beyond outdated statutes with draconian statutory penalties by focusing instead on any actual harms resulting from such technologies.
  2. A lively dialogue among my panelists and other participants dissecting the Colorado Privacy Act, Colorado AI Act, and those statutes’ application to AI hiring tools in an effort to offer guidance to future legislators drafting similar statutes.
  3. Federal and state judges offering tips for advocacy when presenting technical cybersecurity and data privacy issues to the court.
  4. Panelists with different backgrounds discussing the law regarding when a company that has obtained personal data with consent can and cannot transfer the data in M&A and bankruptcy contexts.
  5. Litigators from both sides of the “v.” debating venue, forum, choice of law, MDL, and CAFA issues in the context of privacy and data breach class actions.
  6. State regulators discussing their increasing data privacy and cybersecurity departments and priorities for enforcement in these areas. 
  7. Data privacy lawyers and experts discussing the evolution of facial recognition technology and the need to tailor notice and consent processes to risks associated with the technologies and use cases involved.
  8. Cybersecurity lawyers and experts discussing best practices for maintaining attorney-client privilege when responding to a cybersecurity incident.

Thank you to the Sedona Conference Working Group 11 and its incredible team, the fellow dialogue leaders, the engaging participants, and all others who helped make this meeting in Fort Lauderdale, Florida, an informative and unforgettable experience.

For more information on the Duane Morris Class Action Group, including its Data Privacy Class Action Review e-book, and Data Breach Class Action Review e-book, please click the links here and here.

The Class Action Weekly Wire – Episode 125: California Federal Court Dismisses Adtech Class Action For “Vague” Invasion Of Privacy Claims

Duane Morris Takeaway: This week’s episode of the Class Action Weekly Wire features Duane Morris partner Jerry Maatman and senior associate Hayley Ryan with their analysis of a California federal court’s dismissal of an advertising technology (“adtech”) class action alleging violations of the federal Video Privacy Protection Act (“VPPA”), the California Invasion of Privacy Act (“CIPA”), and California’s Comprehensive Computer Data Access and Fraud Act (“CDAFA”).

Check out today’s episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Samsung Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.

Episode Transcript

Jerry Maatman: Thank you for being here again. My name is Jerry Maatman, and welcome to the next episode of our podcast series entitled The Class Action Weekly Wire. Joining me today is Hayley Ryan. Thanks so much for joining the podcast.

Hayley Ryan: Great to be here, Jerry. Thanks for having me.

Jerry: Today, we’re going to dive into a very interesting decision, the dismissal of claims in a case entitled DellaSalla v. Samba TV. Can you give our listeners an overview of what this case was about?

Hayley: Absolutely, Jerry. The case was decided on October 30, 2025, by Judge Jacqueline Scott Corley in the U.S. District Court for the Northern District of California. In short, the plaintiffs were a group of smart TV owners who alleged that Samba TV’s advertising technology invaded their privacy and violated a handful of statutes, including the federal Video Privacy Protection Act, or the VPPA, and two California laws: the California Invasion of Privacy Act, or CIPA, and the Comprehensive Computer Data Access and Fraud Act, or CDAFA.

Jerry: Well, those of us in the class action space know that this is the new so-called “tort of the day,” with what are known as adtech privacy class actions, being filed across the United States with hundreds, if not thousands, of these sorts of lawsuits. To you, and I know you follow this area closely, what stood out about this particular ruling?

Hayley: Sure, what’s significant here is the court’s clear message. Privacy class actions can’t just rely on broad or vague allegations. The plaintiffs have to spell out exactly what information was allegedly disclosed, and why that disclosure would be considered highly offensive. That’s particularly important for the common law invasion of privacy claims that often accompany statutory ones.

Jerry: So, as I understand it, the gravamen of the claim was that the TV was intercepting viewing data, what you watched, when you watched it, and then tying that to some sort of ad targeting? Is that what this case was all about?

Hayley: Exactly, Jerry. They claimed that this kind of real-time data collection violated those privacy statutes and amounted to a common law invasion of privacy. But Samba TV pushed back, arguing that none of the California laws applied because the plaintiffs lived in North Carolina and Oklahoma, that the VPPA did not apply because Samba was not a videotaped service provider, and that there was nothing highly offensive about what was allegedly collected.

Jerry: As I read the opinion here, the court endorsed the defense positions and threw out the plaintiffs’ claims. Could you elaborate on the reasoning behind the court’s theories here?

Hayley: Sure. So, the court dismissed all claims. First, on the California statutes, the CIPA and CDAFA, the judge found that they simply do not apply extraterritorially. Because the alleged conduct occurred in North Carolina and Oklahoma, where the plaintiffs reside, and not in California, those claims were dismissed.

Jerry: That seems to be a very helpful gloss on those statutes, because almost all these companies operate in California, even though they may be headquartered in other states, and yet are hauled into court and sued over and over again in these California-based class actions.

Hayley: Yeah, it’s certainly a helpful clarification for companies in California who operate nationwide. And then on the VPPA claim, the court took a close look at the definition of a videotape service provider, which applies to entities engaged in the rental, sale, or delivery of pre-recorded video materials. The plaintiffs tried to stretch that definition, saying Samba TV’s software was part of the TV ecosystem that delivers videos.

Jerry: In essence, the court thought that was stretching the law too far and the parameters of the case just out of control.

Hayley: Right, so Judge Corley said Samba TV was not delivering video content, but that it was analyzing usage data. So, the VPPA did not apply, because collecting data about video watching is not the same as delivering video content itself.

Jerry: That, you know, actually makes good sense to me. What about the common law invasion of privacy claim? How did the judge interpret that and rule on that particular cause of action?

Hayley: Yeah, so this was probably the most interesting part of the opinion. The court found that the plaintiffs’ allegations were too vague because they failed to identify any specific shows or videos they watched. They did not describe what was supposedly private about the data, and they did not explain how tying it to an anonymized identifier was highly offensive. So, the court found that the plaintiffs did not plausibly allege a violation of privacy.

Jerry: That seems to be a very common sense reading of the law, because these cases come down to ‘my viewing data or my keystrokes were viewed, and therefore my privacy was violated.’ What do you think is the big takeaway from this decision for companies?

Hayley: So, I think that there are three main takeaways. First, plaintiffs can’t use state privacy laws like the CIPA and the CDAFA if they’re outside of California. Second, the VPPA doesn’t apply to analytics or adtech companies that merely collect viewing data. They have to actually deliver or sell video content. And third, for common law invasion of privacy claims, vague allegations just won’t cut it, and plaintiffs need specificity and a plausible showing of offensiveness.

Jerry: Seems to me that defendants are going to be citing this ruling in many of their briefs in the coming months in privacy and adtech-related class actions for the notion that tracking doesn’t equate to invasion or a viable cause of action.

Well, thanks for breaking down this decision and explaining it to our listeners, and thanks for your thought leadership in this area. Great to have you with us.

Hayley: Thanks, Jerry, and thanks, listeners. It was a pleasure to be here.

California Federal Court Dismisses Adtech Class Action For Failure To Specify Highly Offensive Invasion Of Privacy

By Gerald L. Maatman, Jr., Justin R. Donoho, Tyler Zmick, and Hayley Ryan

Duane Morris Takeaways:  On October 30, 2025, in DellaSalla, et al. v. Samba TV, Inc., 2025 WL 3034069 (N.D. Cal. Oct. 30, 2025), Judge Jacqueline Scott Corley of the U.S. District Court for the Northern District of California dismissed a complaint brought by TV viewers against a TV technology company alleging that the company’s provision of advertising technology in the plaintiffs’ smart TVs committed the common law tort of invasion of privacy and violated the Video Privacy Protection Act (“VPPA”), the California Invasion of Privacy Act (“CIPA”), and California’s Comprehensive Computer Data Access and Fraud Act (“CDAFA”).  The ruling is significant as it shows that in the hundreds of adtech class actions across the nation alleging that adtech violates privacy laws, plaintiffs do not plausibly state a common law claim for invasion of privacy unless they specify in the complaint the information allegedly disclosed and explain how such a disclosure was highly offensive.  The case is also significant in that it shows that the VPPA does not apply to video analytics companies, and that California privacy statutes do not apply extraterritorially to plaintiffs located outside California.

Background

This case is one of a legion of class actions that plaintiffs have filed nationwide alleging that third-party technology captured plaintiffs’ information and used it to facilitate targeted advertising. 

This software, often called advertising technologies or “adtech,” is a common feature of millions of consumer products and websites in operation today.  In adtech class actions, the key issue is often a claim brought under a federal or state wiretap act, a consumer fraud act, or the VPPA, because plaintiffs often seek millions (and sometimes even billions) of dollars, even from midsize companies, on the theory that hundreds of thousands of consumers or website visitors, times $2,500 per claimant in statutory damages under the VPPA, for example, equals a huge amount of damages.  Plaintiffs have filed the bulk of these types of lawsuits to date against healthcare providers, but they have filed suits against companies that span nearly every industry including retailers, consumer products, universities, and the adtech companies themselves.  Several of these cases have resulted in multimillion-dollar settlements, several have been dismissed, and the vast majority remain undecided. 

In DellaSalla, the plaintiffs brought suit against a TV technology company that embedded a chip with analytics software in plaintiffs’ smart TVs.  Id. at *1, 5.  According to the plaintiffs, the company intercepted the plaintiffs’ “private video-viewing data in real time, including what [t]he[y] watched on cable television and streaming services,” and tied this information to each plaintiff’s unique anonymized identifier in order to “facilitate targeted advertising,” all allegedly without the plaintiffs’ consent.  Id. at *1.  Based on these allegations, the plaintiffs claimed that the TV technology company violated the CIPA, CDAFA, and VPPA, and committed the common-law tort of invasion of privacy. 

The company moved to dismiss, arguing that the CIPA and CDAFA did not apply because the plaintiffs were located outside California, that the VPPA did not apply because the TV technology company was not a “video tape service provider,” and that the plaintiffs failed to plausibly allege a highly offensive violation of a privacy interest.

The Court’s Decision

The Court agreed with the TV technology company and dismissed the complaint in its entirety, with leave to amend any existing claims but not to add any additional claims without further leave.

On the CIPA and CDAFA claims, the Court found that the plaintiffs did not allege that any unlawful conduct occurred in California.  Instead, the plaintiffs alleged that the challenged conduct occurred in their home states of North Carolina and Oklahoma.  Id. at *1, 3-4.  For these reasons, the Court dismissed the CIPA and CDAFA claims, finding that these statutes do not apply extraterritorially.  Id.

On the VPPA claim, the Court addressed the VPPA’s definition of  “video tape service provider,” which is “any person, engaged in the business … of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.”  Id. at *5.  The plaintiffs argued that the TV technology company was a video tape service provider “because its technology is incorporated in Smart TVs, which deliver prerecorded videos.  [The defendant] advertises its technology precisely as providing a ‘better viewing experience’ ‘immersive on-screen experiences’ and a ‘more tailored ad experience’ through its technology.”  Id.  The Court rejected this argument. It held that “[t]his allegation does not plausibly support an inference, [the defendant]—an analytics software provider—facilitated the exchange of a video product. Rather, the allegations support an inference [the defendant] collected information about Plaintiffs’ use of a video product, but not that it provided the product itself.”  Id. (emphasis added).

On the common law claim for invasion of privacy, the TV technology company argued that this claim failed because the plaintiffs “have no expectation of privacy in the information it collects and Plaintiffs have not alleged a highly offensive intrusion.”  In examining this argument, the Court noted that Plaintiff had only provided “vague references” to the information supposedly intercepted.  Id. at *4.  This information included video-viewing data generally (none specified) tied to an anonymized identifier.  Id. at *1, 5.  Thus, the Court agreed with the defendant’s argument and found that plaintiffs identified “no embarrassing, invasive, or otherwise private information collected” and no explanation of how the tracking of video viewing history with an anonymized ID caused plaintiffs “to experience any kind of harm that is remotely similar to the ‘highly offensive’ inferences or disclosures that were actionable at common law.”  Id. at *5.  In sum, the Court concluded that “Plaintiffs have not plausibly alleged a highly offensive violation of a privacy interest.”

Implications For Companies

DellaSala provides powerful precedent for any company opposing adtech class action claims (1) brought under statutes enacted in states other than the plaintiffs’ place of residence; (2) brought under the federal VPPA where the company allegedly transmitted video usage information, as opposed to any videos themselves; and (3) alleging common-law invasion of privacy, where the plaintiffs have not specified the information disclosed and why such a disclosure is highly offensive. 

The last point is a recurring theme in adtech class actions.  Just as this plaintiff suing a TV technology company did not plausibly state a common-law claim for invasion of privacy without identifying the videos watched and any highly offensive harm in associating those videos with an anonymized ID, so did a plaintiff not plausibly state a claim for invasion of privacy by way of alleging adtech’s disclosure of protected health information (“PHI”), without specifying the PHI allegedly disclosed (as we blogged about here).  These cases show that for adtech plaintiffs to plausibly plead claims for invasion of privacy, they at least need to identify what allegedly private information was disclosed and explain how the alleged disclosure was highly offensive.

New York State (Court) Of Mind: New York Federal Court Remands Allstate Data Breach Case To State Court For Lack Of Federal Question Jurisdiction

By Gerald L. Maatman, Jr., Ryan T. Garippo, and Elizabeth G. Underwood

Duane Morris Takeaways: On October 28, 2025, Judge Lewis A. Kaplan of the U.S. District Court for the Southern District of New York granted the People of the State of New York’s (the “State”) motion to remand in New York v. Nat’l Gen. Holdings Corp., No. 25 Civ. 03608, 2025 U.S. Dist. LEXIS 212731 (S.D.N.Y. Oct. 28, 2025).  The State alleged that National General Holdings Corporation violated various state laws related to data protection programs and notifications to affected individuals when data breaches in 2020 and 2021 exposed the corporation’s customer information.  This case reinforces the concept that a plaintiff is indeed the master of the complaint and can strategically craft their complaint to ensure that a case is litigated in state court.

Case Background

The State sued Allstate Insurance Company when one of its units, National General Holdings Corporation (the “Defendants”), was involved in two data breaches in 2020 and 2021, exposing nearly 200,000 consumers’ drivers’ license numbers to hackers.  The State alleged that the Defendants failed to protect customers’ sensitive information and did not inform customers that their data was stolen.

Importantly, the complaint did not assert any cause of action under federal law.  Instead, the complaint alleged that the Defendants violated three federal statutes, including the Gramm-Leach-Bliley Act (“GLBA”), the Health Insurance Portability and Accountability Act (“HIPAA”), and the Health Information Technology for Economic and Clinical Health Act (“HITECH”).  The State brought the action against the defendants pursuant to New York State General Business Law (“GBL”) §§ 349, 350, 899-aa, and 899-bb, and New York Executive Law § 63(12).

Based on the inclusion of allegations that they violated federal law, the Defendants removed the action to the U.S. District Court for the Southern District of New York pursuant to 28 U.S.C. §§ 1331 and 1441, invoking the Court’s ability to decide a federal question.  The State, however, moved to remand the case and for attorney’s fees incurred due to the removal.

Magistrate Judge Robert Lehrburger concluded in a report and recommendation that the Court lacked federal subject matter jurisdiction to hear the case because the causes of action (1) were not created by federal law and (2) did not satisfy the standard set forth in Gunn v. Minton, 568 U.S. 251 (2013), and Grable & Songs Metal Products, Inc. v. Darue Engineering & Manufacturing, 545 U.S. 308 (2005) (the “Gunn-Grable” test).  ECF 55.  Under the Gunn-Grable test, federal question jurisdiction exists only when a federal issue is “(1) necessarily raised, (2) actually disputed, (3) substantial, and (4) capable of resolution in federal court without disrupting the federal-state balance approved by Congress.”  Gunn, 568 U.S. at 258.

In his report and recommendation, Magistrate Judge Lehrburger determined that the third element as to whether a federal issue was “substantial” was not satisfied.  This inquiry looks to “the importance of the issue to the federal system as a whole,” not just the issues of one case.  Id. at 260.  In this case, the Defendants argued that the substantiality requirement was met because of the substantial federal interests in data privacy and national security; however, Magistrate Judge Lehrburger found these arguments were unpersuasive and recommended that the Court remand the case but not award attorney’s fees to the State.

The Court’s Opinion

In an opinion written by Judge Lewis Kaplan, the Court agreed with Magistrate Judge Lehrburger’s reasoning and held that the case did not pass the Gunn-Grable test.

The Court determined that Magistrate Judge Lehrburger correctly rejected the Defendants’ argument that the State’s claims satisfy the Gunn-Grable test as to the “substantiality” element.  First, the Court found that the Defendants’ argument as to whether the New York State Attorney General had the authority to enforce the federal GLBA was “entirely inapt” because the complaint did not allege any GLBA claims.  Nat’l Gen. Holdings Corp., 2025 U.S. Dist. LEXIS 212731, at *3.  Second, the Court held that the federal government’s interest in data privacy was insufficient to meet the Gunn-Grable test.  Third, the Court determined that the federal law questions implicated by the state law claims, including whether defendants are insulated from liability under state law if the defendants’ data protection programs and data breach notification procedures were in compliance with federal law, “are inherently fact-intensive and therefore likely would not provide guidance in future cases.”  Id. at *4.

Moreover, the Court also rejected the Defendants’ argument that whether the GLBA preempts the New York Attorney General from bringing the state law claims is a substantial federal question, reasoning that the question was not “necessarily raised” and that preemption is an affirmative defense that may not serve as the basis for subject-matter jurisdiction.  Id. at 4–5.  Finally, the Court held that none of the three exceptions to the well-pleaded complaint rule applied because the Defendants did not assert the first two exceptions, and the third exception would have had to pass the Gunn-Grable test, which it did not.

Implications For Companies

Nat’l Gen. Holdings Corp. serves as a cautionary reminder of the uphill battles that corporate defendants often face to remove to and then keep bet-the-company litigation in federal court.

Although it is not uncommon for a corporation to prefer “federal courts because it fears a corporate defendant . . . will not get a fair trial in state court,” the road to get there is not always guaranteed.  See, e.g., Hosein v. CDL West 45th Street, LLC, No. 12 Civ. 06903, 2013 WL 4780051, at *3 (S.D.N.Y. June 12, 2013).  As on display here, the Nat’l Gen. Holdings Corp. opinion shows that corporate defendants may not even get to litigate in a federal forum even when there are allegations that they violated federal law.

As a result, corporate counsel should be aware that relying on a state law claim involving an embedded federal issue, as the basis for federal subject-matter jurisdiction, may not be successful in 100% of cases, but it may be worth a chance to attempt to remove the case to federal court if it is the company’s only opportunity to obtain a fair trial.

© 2009- Duane Morris LLP. Duane Morris is a registered service mark of Duane Morris LLP.

The opinions expressed on this blog are those of the author and are not to be construed as legal advice.

Proudly powered by WordPress