Jennifer A. Riley – Page 2 – Class Action Defense

September 5, 2023September 5, 2023 by Gerald L. Maatman, Jr.

Arizona Federal Court Grants Pest Control Company’s Motion To Dismiss Data Breach Class Claims

By Gerald L. Maatman, Jr., Jennifer A. Riley, and George J. Schaller

Duane Morris Takeaways: In Gannon v. Truly Nolen of America Inc., No. 22-CV-428 (D. Ariz. Aug. 31, 2023), Judge James Soto of the U.S. District Court for the District of Arizona granted Defendant’s motion to dismiss with prejudice on negligence, breach of contract, and consumer fraud claims related to a data breach class action. For companies facing data breach claims in class actions, this decision is instructive in terms of how courts consider cognizable damages, especially when damages allegations are inadequately plead.

Case Background

Defendant Truly Nolen of America Inc. (“Defendant” or the “Company”), is an Arizona corporation that provides pest control services across the United States and in 30 countries around the world. Id. at 2. The Company experienced a data breach between April 29, 2022 and May 11, 2022. On May 11, 2022, the Company learned the breach occurred and identified personally identifiable information (“PII”) and personal health information (“PHI”) that was compromised. Id. In August of 2022, Defendant sent notice letters to individuals whose data may have been compromised. Id.

The Named Plaintiff, Crystal Gannon (“Plaintiff”), alleged that she received her notice letter regarding the data breach in August of 2022. Id. at 3. In her First Amended Complaint (“FAC”), Plaintiff sought to represent two proposed classes of plaintiffs, including one for a Nationwide Class and one for an Arizona Sub-class, related to the data breach. Id.

Plaintiff alleged numerous claims such as negligence, invasion of privacy, breach of implied contract, breach of the implied covenant of good faith and fair dealing, and violation of the Arizona Consumer Fraud Act (“Fraud Act”). Id. In response, Defendant filed a motion to dismiss on the grounds that Plaintiff’s case was without basis and the entire case was subject to dismissal. Id.

The Court’s Decision

The Court held that there was no valid basis for Plaintiff’s negligence claim. Id. at 4. Plaintiff argued that the Health Insurance Portability and Accountability Act (“HIPAA”) and the Federal Trade Commission Act (“FTCA”) created a duty in Arizona from which relief could be sought. Id. The Court disagreed. It found that neither the HIPAA nor the FTCA provided a private right of action. Id. The Court reasoned that “[p]ermitting HIPAA to define the ‘duty and liability for breach is no less than a private action to enforce HIPAA, which is precluded.’” Id. The Court applied the same logic to the FTCA. Id.

On negligence damages, the Court held that Plaintiff’s FAC failed “to show identity theft or loss in continuity of healthcare of any class members – only the possibility of each.” Id. Under Arizona law, negligence damages require more than merely a threat of future harm, and on their own, threats of future harm are not cognizable negligence injuries. Id. 4-5. Similarly, as to out-of-pocket expenses, the Court opined that Plaintiff failed to demonstrate that her expenses were necessary because she did not properly show that Defendant’s identity monitoring services were inadequate. Id. at 5. Finally, the Court recognized that merely alleging a diminution in value to somebody’s PII or PHI was insufficient. Id. Therefore, the Court dismissed Plaintiff’s negligence claims.

Turning to Plaintiff’s breach of contract claims, the Court determined that Plaintiff did not show cognizable damages, a reasonable construction for the terms of the contract, or consideration for the existence of an implied contract. Id. at 6. The Court held that Plaintiff’s FAC allegations only reflected speculative damages and did not allege proof of real damages. Id. at 5. The Court opined that Plaintiff’s “vaguely pleaded” contract terms failed to show any language that would inform the terms of the agreement and Plaintiff did not point to any conduct or circumstances from which the terms could be determined. Id. at 5-6. Finally, the Court determined that even if Defendant had an obligation to protect the data at issue, such pre-existing obligations did not serve as consideration for a contract. Id. Therefore, the Court dismissed all breach of implied contract claims. Id.

On the claim for breach of the implied covenant of good faith and fair dealing, Plaintiff argued that Defendant breached by failing to maintain adequate computer systems and data security practices, failed to timely and adequately disclose the data breach, and inadequately stored PII and PHI. Because Plaintiff failed to show an enforceable promise, the Court held there could be no breach, and all claims for breach of the implied covenant of good faith and fair dealing were dismissed. Id. at 6.

The Court also dismissed Plaintiff’s Fraud Act claims because Plaintiff failed to show cognizable damages. Id. at 7. The Court reasoned “[p]laintiff cannot simply argue that the system is inadequate because a negative result occurred.” Id. The Court also reasoned that Plaintiff failed to demonstrate that Defendant’s security was inadequate when compared to other companies or any set of industry standards. Id. As to Plaintiff’s privacy claims, the Court held that there were no cognizable claims for invasion of privacy or breach of privacy, and Plaintiff did not dispute these claims in her response. Id.

Accordingly, the Court granted Defendant’s motion to dismiss as to all claims, denied Plaintiff leave to amend her complaint, and dismissed the case with prejudice. Id.

Implications For Companies

Companies confronted with data breach lawsuits should take note that the Arizona federal court in Gannon relied heavily on inadequately pleaded allegations in considering cognizable damages for purposes of granting Defendant’s motion to dismiss. Further, from a practical standpoint, companies should carefully evaluate pleadings for insufficient or speculative assertions on damages.

August 29, 2023 by Gerald L. Maatman, Jr.

Ohio Federal Court Grants Conditional Certification In Wage & Hour Collective Action Under The Sixth Circuit’s New “Strong Likelihood” Standard

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Kathryn Brown

Duane Morris Takeaways: In Gifford v. Northwood Healthcare Group LLC et al., No. 22-CV-04389 (S.D. Ohio Aug. 21, 2023), Judge Sarah D. Morrison of the U.S. District Court for the Southern District of Ohio granted plaintiff’s motion for conditional certification of a wage & hour collective action pursuant to 29 U.S.C. § 216(b) of the Fair Labor Standards Act (“FLSA”). Through sworn declarations and documentary evidence of defendants’ meal break policy, the Court found plaintiff showed a “strong likelihood” that she was similarly-situated to potential collective action members who may elect to join the lawsuit. The ruling adds to the body of case law applying the Sixth Circuit’s new standard for notice to potential opt-in plaintiffs in putative FLSA collective actions announced in Clark v. A&L Homecare and Training Center, LLC, 68 F.4th 1003 (6th Cir. 2023), and ought to be required reading for any employers involved in wage & hour litigation.

Case Background

On December 15, 2022, plaintiff filed a Complaint against Northwood Healthcare Group, LLC and Garden Healthcare Group, LLC, two entities operating healthcare facilities in Ohio. Plaintiff allegedly worked at two such facilities as a non-exempt Licensed Practical Nurse. The lawsuit targeted the defendants’ meal break practices. Plaintiff contended that due to staffing shortages and the demands of patient care, she did not receive a full, uninterrupted 30-minute (“bona fide”) meal break on a regular basis. As alleged in the Complaint, defendants automatically deducted 30 minutes of time from her hours worked even when she did not receive a bona fide meal break, resulting in unpaid overtime compensation. On behalf of herself and similarly situated other employees, Plaintiff brought claims asserting failure to pay overtime wages under the FLSA, failure to pay overtime wages under the Ohio Minimum Fair Wage Standards Act (“OMFWSA”), failure to keep accurate payroll records under the OMFWSA and failure to pay wages timely under the Ohio Prompt Pay Act.

On March 15, 2023, plaintiff filed a motion for conditional certification of a collective action. On May 15, 2023, defendants opposed the motion on the merits and urged the Court to delay ruling until the Sixth Circuit issued its opinion in Clark.

On May 19, 2023, the Sixth Circuit in Clark announced a more rigorous standard for authorizing notice of an FLSA lawsuit to other employees. Abandoning the prior standard of a “modest factual showing” of similarly situated status, the standard in Clark requires plaintiffs to establish a “strong likelihood” that they are similarly situated to potential other plaintiffs.

Days later, in her reply brief filed on May 23, 2023, plaintiff argued that the evidence she presented in her motion satisfied the new standard in Clark.

The Court’s Decision

The Court determined that the evidence provided in support of plaintiff’s motion satisfied the “substantial likelihood” standard announced in Clark.

Specifically, plaintiff provided her own sworn declaration and the sworn declarations of six individuals who had filed consents to join the lawsuit as opt-in plaintiffs. Together, plaintiff and the other declarants worked at six of the 14 facilities plaintiff sought to include in her lawsuit. The Court found the declarations told a consistent story of employees not receiving overtime pay for those occasions when patient care needs required employees to skip or cut short their designated 30 minutes for a meal break, even after employees complained to management about being undercompensated.

Plaintiff also submitted evidence of employee handbooks in effect at the six facilities at which the declarants had worked for the defendants. The Court found that the handbooks reflected nearly identical policies on overtime compensation and meal breaks. For example, the meal break policy in the various employee handbooks stated that employees who worked through their meal breaks would receive pay for their time, whether the work was authorized or not. Defendants argued that plaintiff’s evidence fell short of identifying a “companywide” policy. Defendants pointed out that the declarants had no personal knowledge of the meal break practices in effect at facilities operated by defendants at which they had not worked. The Court disagreed. It opined that plaintiff presented enough evidence of a unified theory of conduct by defendants, notwithstanding that the declarants did not represent former employees at all of the facilities the plaintiff sought to include in the lawsuit.

The Court concluded that the evidence “establishes to a certain degree of probability” that the plaintiff, the individuals who had already filed consents to become opt-in plaintiffs, and the other potential plaintiffs performed the same tasks, were subject to the same policies and were unified by a common theory underlying their causes of action. Id. at 8.

In so ruling, the Court authorized plaintiff to send notice to all current and former hourly, non-exempt direct care employees of defendants who had a meal break deduction applied to their hours worked in any workweek in which they were paid for at least 40 hours of work during a three-year lookback period and through the final disposition of the case.

Implications For Employers

The Court’s ruling in Gifford demonstrates that application of the Sixth Circuit’s “strong likelihood” standard is highly dependent on the evidence presented by a plaintiff. By contrast, under the prior standard, courts routinely granted plaintiffs’ motions to authorize notice to potential opt-in plaintiffs.

Employers with operations in Ohio, Tennessee, Michigan and/or Kentucky should keep a close watch on Gifford and other cases applying the Sixth Circuit’s new standard in FLSA litigation.

August 11, 2023August 11, 2023 by Gerald L. Maatman, Jr.

Class Certification Granted To Illinois Consumers Whose DNA Was Shared With Third Parties Without Their Consent

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Jeffrey R. Zohn

Duane Morris Takeaways: On August 3, 2023, Judge Elaine E. Bucklo of the U.S. District Court For The Northern District Of Illinois granted class certification for individuals located in Illinois who had their genetic test results disclosed to third parties by Defendant Sequencing, LLC (“Sequencing”) in Melvin v. Sequencing, LLC, Case No. 21-CV-2194 (N.D. Ill. Aug. 3, 2023). Plaintiff David Melvin moved for class certification under Rule 23 on the basis that Sequencing violated the rights of up to 1,550 people under the Illinois Genetic Information Privacy Act (“GIPA”). Sequencing opposed the motion by arguing that a ruling on class certification should be delayed or denied because Plaintiff is not an adequate class representative and that Plaintiff failed to establish the predominance and superiority requirements of Rule 23. Sequencing’s position was not well-taken as the Court granted the Motion in a succinct 11-page order that described aspects of Sequencing’s arguments as “unaccompanied by authority” and lacking “reasoned argument.” The ruling is required reading for any companies dealing with GIPA claims in class action litigation.

GIPA Background

The Illinois legislature enacted the GIPA, 410 ILCS 513, in order to enhance privacy protections by prohibiting the unauthorized disclosure and use of an individual’s genetic information. Relevant to Melvin, Section 15 of the GIPA provides that “genetic testing and information derived from genetic testing is confidential and privileged and may be released only to the individual tested and to persons specifically authorized . . . by that individual to receive the information.” Id. at *2. Section 30 of the GIPA provides that “[n]o person may disclose . . . the identity of any person upon whom a genetic test is performed or the results of a genetic test in a manner that permits identification of the subject of the test[.]” Id. Section 35 of the GIPA prohibits the dissemination of genetic information to an entity other than the one to which the subject provided it. Id.

Case History

In Melvin, Plaintiff sought to represent a class of Illinois consumers who sent their DNA to Sequencing only for Sequencing to disclose it to unknown third party developers without first obtaining those consumers’ consent.

During discovery, Sequencing described its process for collecting and analyzing its customers’ DNA. The customers either send Sequencing their DNA directly or upload the results of a DNA test taken by a third party, such as 23andMe or Ancestry.com. Sequencing uses that information to create a “DNA data file” containing “raw human DNA data” that can be used to assess the customers’ genetic code. Id. at 4. The customers can then purchase reports based on their own genetic code. Most of the reports that are available for purchase are provided by third party developers. As soon as a customer purchases a report, their personal and genetic information is automatically transmitted to the corresponding third party developer.

Plaintiff, who went through this entire process, claimed that Sequencing did not inform him that his genetic information would be shared and that he never consented to the disclosure of that information to anyone.

The Court’s Opinion

In granting Plaintiff’s motion for class certification, Judge Bucklo issued an 11-page order “plain[ly]” explaining “that a class action is the superior vehicle for pursuing the class claims asserted” by Plaintiff. Id. at 10. Since Sequencing did not meaningfully dispute or argue otherwise, the Court concluded that Plaintiff satisfied the numerosity, commonality, typicality, and adequacy of counsel requirements of Rule 23 of the Federal Rules of Civil Procedure.

Sequencing suggested that Plaintiff was not an adequate class representative because he had suffered no damages at all. The Court rejected this “bald statement,” which was “unaccompanied by authority or reasoned argument.” Id. at 9. It noted that Sequencing “offers no basis to believe that Plaintiff would not be entitled to the same statutory damages he claims on behalf of the class and subclass if he succeeds in establishing Defendant’s liability.” Id.

The Court was also unpersuaded by Sequencing’s argument to deny class certification based on Plaintiff’s failure to establish the predominance and superiority requirements of Rule 23. It reasoned that “no absent class members have filed individual GIPA claims against” Sequencing nor has Sequencing articulated a reason to believe that individual class members have an interest in pursuing and controlling separate GIPA actions. Id. at 10.

As a last ditch effort to oppose class certification, Sequencing argued that the Court should “probe behind the pleadings before coming to rest on the certification question.” Id. at 10-11. This argument was not well-taken by the Court. Judge Bucklo determined that “[P]laintiff’s motion does not rest on the pleadings alone but on the ample evidence he has developed in discovery. Moreover, [Sequencing] offers no hint of the evidence it expects to uncover that would cut against class treatment of Plaintiff’s claims.” Id.

Finding that none of Sequencing’s arguments had merit, the Court granted Plaintiff’s motion and certified the class.

Implications For Corporate Defendants

When opposing a motion for class certification, it is important to choose arguments carefully and selectively. In Melvin, Sequencing conceded that Plaintiff had satisfied most of the Rule 23 requirements while only half-haphazardly arguing that Plaintiff did not satisfy the remaining requirements. The Court did not take Sequencing’s overall position seriously, as it described Sequencing’s opposition as containing “bald statement[s]” “unaccompanied by authority or reasoned argument.”

August 1, 2023 by Gerald L. Maatman, Jr.

West Virginia Federal Court Finds Lack Of Involvement By Defendant In Alleged Class Action Solicitation Does Not Preclude Personal Jurisdiction Or Article III Standing

Gerald L. Maatman, Jr., Jennifer A. Riley, and Nick Baltaxe

Duane Morris Takeaways: On July 18, 2023, in Mey v. Levin, Papantonio, Rafferty, Proctor, Buchanan, O’Brien, Barr & Mougey, P.A., et al., Case No. 5:23-CV-46 (N.D. W. Va. July 18, 2023), the Court denied a motion to dismiss Plaintiff’s claims for alleged violations of the Telephone Consumer Protection Act (the “TCPA”). In doing so, the Court held that, despite the fact that Levin Law did not direct and was not involved in the alleged calls, the Court had personal jurisdiction over Levin Law, and Plaintiff had Article III standing to pursue the TCPA claims. In doing so, the Court found allegations concerning the law firm’s alleged agency relationship with a co-defendant sufficient to confer broad authority to adjudicate Plaintiff’s claims against Levin Law under the TCPA. Additionally, the Court concluded that Plaintiff had alleged sufficient facts to support a do-not-call claim under the TCPA by alleging that her cell phone was a residential phone on the National Do-Not-Call Registry.

Case Background

Plaintiff Diana Mey, a resident of West Virginia, initiated this lawsuit against two law firms, Levin Law and Principal Law Group, LLC, alleging that those defendants violated the TCPA by soliciting clients for a mass tort litigation related to toxic water exposure at Camp Lejeune. Mey, Doc. 33 at 1-2. Defendant Levin Law filed a motion to dismiss on numerous grounds, including that the Court lacked personal jurisdiction, that Plaintiff lacked Article III standing, that Plaintiff failed to plead direct or vicarious liability, and that Plaintiff failed to plead a violation of the TCPA. Id. The Court denied the motion. Id. Specifically, Levin Law argued that it was not directly involved in any of the phone calls, which were made by co-defendant MCM Services Group, LLC (“MCM”), and therefore could not be sued for violation of the TCPA. Id. at 8.

Initially, Levin Law, a Florida professional corporation with a principal place of business in Pensacola, Florida, argued that it did not have sufficient minimum contacts with West Virginia because it did not purposely direct the alleged tortious activity toward the state. Id. While the Court acknowledged that Levin Law was not directly involved in the telephone calls placed to Plaintiff, it held that Plaintiff had provided sufficient facts to find that the calls were made by an agent under Levin Law’s control. Id. at 12. Specifically, the Court noted that Plaintiff allegedly received a representation agreement from Principal Law, under which Levin Law would provide legal services to Plaintiff, and Principal Law would serve as Levin Law’s associate counsel. Id. The Court found that these allegations were sufficient to plausibly connect Levin Law to the alleged calls. In a final point regarding personal jurisdiction, the Court did not address whether it had personal jurisdiction over out-of-state class members noting that, to proceed with the case, it needed to find personal jurisdiction only over the named Plaintiff and Defendants. Id. at 13.

The Court then addressed Levin Law’s argument that Plaintiff did not have Article III standing. Specifically, Levin Law argued that the calls, which were initiated by MCM, were not traceable to any conduct by Levin Law, which was a necessary prong in establishing Article III standing. Id. The Court, however, noted that because the representation agreement identified Principal Law as Levin’s Law associate counsel, and Plaintiff received the agreement from Principal Law, the Court reasonably could infer that the calls were made by someone under Levin Law’s control. Id. at 14. As such, the Court found that Plaintiff had pled sufficient facts to trace the challenged conduct to the defendant and, as such, had asserted Article III standing.

The Court addressed Levin Law’s final arguments that Plaintiff failed to plead a theory of liability against it and, further, failed to state a do-not-call claim under the TCPA. First, the Court held that Plaintiff asserted sufficient factual allegations to show vicarious liability and to survive a Motion to Dismiss. Id. at 15. Second, the Court found no case law supporting dismissal of a TCPA claim on the basis that the defendant allegedly placed a call to a cell phone instead of a residential phone. Id. at 17. Specifically, the Court noted that Plaintiff had alleged that her cell phone was used for residential purposes and was placed on the National Do-Not-Call Registry, making the claim actionable under the TCPA. Id.

Key Takeaways

In this ruling, the Court made interesting findings that will extend to plaintiffs outside the TCPA context to survive attacks at the pleading stage of litigation. Specifically, the Court found both personal jurisdiction and Article III standing despite the fact that Levin Law did not purposefully direct the activity at issue. By doing so, the Court agreed with arguments that the conduct of an alleged agent was enough to establish both personal jurisdiction and Article III standing. Going forward, plaintiffs will have yet another way to support personal jurisdiction and Article III standing at the outset of the case even against defendants who they do not contend were directly involved in the conduct about which they complain. Additionally, while there is a split in authority as to whether the TCPA extends to wireless telephone numbers, the Court in this litigation had no issue finding that a cell phone could be a residential phone for purposes of the TCPA, potentially extending its reach and keeping it relevant as a potential source of claims against corporate defendants.

July 20, 2023July 21, 2023 by Brandon Spurlock

Tennessee Federal Court Dismisses Class Action Under the Video Privacy Protection Act Because Plaintiff Failed to Allege He Accessed Video Content

By Brandon Spurlock and Jennifer A. Riley

Duane Morris Takeaways: On July 18, 2023, in Salazar v. Paramount Global d/b/a 247Sports, No. 3:22-CV-00756 (M.D. Tenn. July 18, 2023), Judge Eli Richardson of the U.S. District Court for the Middle District of Tennessee dismissed a class action lawsuit against Paramount Global because the Plaintiff failed to state a claim under the Video Privacy Protection Act (“VPPA”) where Plaintiff’s allegation that his subscription to an online newsletter made him a “subscriber” under the statute was insufficient because he did not allege that he accessed audio visual content through the newsletter. The VPPA is a law from 1980’s stemming from the failed Supreme Court nomination of Robert Bork, which involved his video rental history being published during the nomination process. In the ensuing decades, companies are seeing an increase in class action lawsuits under the VPPA and other consumer privacy statutes where plaintiffs seek to levy heavy penalties against businesses with an online presence. This ruling illustrates that some federal courts will closely examine such statutes to ensure that a plaintiff adequately states a claim based on the underlying statutory definitions before allowing a class action to proceed.

Case Background

Plaintiff filed a putative class action against Defendant Paramount Global d/b/a 247Sports alleging a violation of the VPPA. Id. at 1. According to Defendant, 247Sports.com is an industry leader in content for college sports, delivering team-specific news through online news feeds, social platforms, daily newsletters, podcasts, text alerts and mobile apps. Id. at 2. Plaintiff alleged that Paramount installed a Facebook tracking pixel, which allows Facebook to collect the data on digital subscribers to 247Sports.com who also have a Facebook account. Id. at 3-4. So if a digital subscriber of 247Sports.com is logged-in to his or her Facebook account while watching video content on 247Sports.com, then 247Sports.com sends to Facebook (via the Facebook pixel) the video content name, its URL, and, most notably, the digital subscriber’s Facebook ID. Id. at 4. Plaintiff claimed that Paramount violated the VPPA when it installed the Facebook pixel, which caused the disclosure to Facebook of Plaintiff’s personally identifying information. Id. at 5. Paramount moved to dismiss for lack of subject-matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1), and for failure to state a claims for relief under Rule 12(b)(6).

The Court’s Decision That Plaintiff Had Standing Under The VPPA

First, Paramount argued that Plaintiff did not have standing because Plaintiff failed to adequately allege either a concrete injury in fact or the traceability of the injury to Paramount’s conduct, because the alleged disclosure of Plaintiff’s information to Facebook did not constitute a concrete injury. Id. at 9. Rejecting Paramount’s standing argument, the Court noted that the VPPA created a “right to privacy of one’s video-watching history, the deprivation of which – through wrongful disclosure, or statutory violation alone – constitutes an injury sufficient to confer Article III standing.” Id. at 11-12. In other words, the VPPA created a statutory right to have personally identifiable information remain private by prohibiting disclosure to third parties. Id. at 12. Thus, the Court ruled that Plaintiff’s allegation that his personally identifiable information was transmitted to Facebook in violation of the VPPA identified a concrete harm for standing purposes. Id. at 14.

Plaintiff Failed To State A Claim Under The VPPA

Paramount also asserted that Plaintiff had no claim under the VPPA because he was not a “consumer,” meaning “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” Id. at 17. Because Plaintiff was not a “consumer” within the meaning of the VPPA, Paramount argued he was not a “subscriber of goods or services from a video tape service provider,” and Plaintiff did not state a claim under the VPPA because the statute only protects individuals who are “consumers” under the statute. Id. at 18.

The Court noted that although the VPPA does not define “subscriber,” the dictionary definition indicates that “subscriber” is a person who “imparts money and/or personal information in order to receive a future and recurrent benefit.” Id. at 19. Further interpreting the statute, the Court reasoned that a consumer is only a “subscriber” under the statute when he or she subscribes to audio visual materials. Id. at 21. Completing the analysis, the Court reasoned that under the VPPA, because Plaintiff’s subscription to the newsletter was not sufficient to establish that the he had subscribed to audio visual materials, Plaintiff’s position was unavailing in claiming that his subscription to the newsletter renders him a “subscriber.” Id. at 22.

The Court, therefore, dismissed Plaintiff’s VPPA class action lawsuit because Plaintiff failed to allege that he actually accessed audio visual content, which necessarily meant that Plaintiff was not a subscriber under the VPPA. Id. at 22.

Implications For Businesses

This past year has seen an uptick in VPPA class action filings against businesses that operate websites offering online videos and using third-party tracking tools. These lawsuits represent an ongoing pattern of increased consumer privacy class litigation throughout the country exposing companies to significant risk across a wide array of industries. Corporate counsel should note this ruling is a positive indication that some courts will closely examine the plain language and legislative intent of a privacy statute to ensure that a plaintiff actually states a viable claim before allowing class litigation to proceed.

July 10, 2023July 20, 2023 by Gerald L. Maatman, Jr.

Ninth Circuit Finds Article III Standing Under The TCPA For Owner Of Registered Phone With Third-Party User

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Nick Baltaxe

Duane Morris Takeaways: On June 30, 2023, in Kristen Hall v. Smosh Dot Com, Inc., DBA Smosh, et al., No. 22-16216 (9th Cir. June 30, 2023), the Ninth Circuit reversed the district court’s dismissal for lack of Article III standing of a class action under the Telephone Consumer Protection Act (the “TCPA”) and remanded the claim for further proceedings. In doing so, the Ninth Circuit held that the owner and subscriber of a phone with a number listed on the Do-Not-Call Registry suffers an injury in fact when unsolicited telemarking calls or texts are sent to the number even if the communications are intended for or solicited by another individual or someone else is using the phone at the time the messages are transmitted. In so holding, the Ninth Circuit established that the receipt of unsolicited phone calls or text messages in violation of the TCPA is a “concrete injury in fact sufficient to confer Article III standing” even if the individual bringing the claim was not the phone’s primary user. As a result, the ruling is required reading for any corporate counsel dealing with TCPA class action litigation.

Case Background

Plaintiff Kristen Hall, a resident of Willis, Texas, was in possession of a cellular phone that was used primarily for residential purposes and, at times, provided to her 13-year old son to use in his free time. Hall, No. 22-16216, at 5-6. Plaintiff placed this number on the National Do-Not-Call Registry in order to avoid invasive and irritating solicitation calls and to protect her son from any potential threats. Id. Plaintiff alleged that she was the owner and subscriber of the cell phone at issue and that she listed its number on the Do-Not-Call Registry. Id. at 9.

On or around November 3, 2019, Defendants – who are digital content creators producing “sketch comedy” for an adolescent audience and selling merchandise that relates to their digital content – obtained the personal information for Plaintiff’s son and sent him at least five text messages between December 25, 2019, and June 29, 2020. Id. These texts specifically solicited business and offered discounts on products offered by Defendant Smosh Dot Com, Inc., which Plaintiff alleged was “irritating, exploitative, and invasive” and “precisely the type of communications she sought to avoid when she registered her number on the Do Not Call [R]egistry.” Id. Plaintiff’s First Amended Complaint alleged that Defendants violated § 227(c) of the Telephone Consumer Protection Act (“TCPA”) by sending text messages to numbers listed on the National Do-Not-Call Registry. Id.

Defendants moved to dismiss the First Amended Complaint for failure to state a claim and for lack of standing. They argued that Plaintiff lacked Article III standing because she failed to plead that she was the user of the phone or actually received any of the soliciting text messages from Defendants. Id. at 6-7. Specifically, Defendants argued that because she provided the phone to her son, Plaintiff was not the actual user of the phone or the actual recipient of the messages and, therefore, did not suffer an injury and was instead attempting to assert the legal right of a third party. Id. at 9-10. The district court granted the motion to dismiss on the basis that Plaintiff did not have Article III standing merely because she was the subscriber/owner of the phone while not addressing any of the merits issues. Id. at 7. Plaintiff appealed this ruling. Id.

The Ninth Circuit’s Ruling

The Ninth Circuit reversed the district court’s ruling.

It held that Plaintiff had Article III standing to bring the claims under the TCPA. The Ninth Circuit noted that it was well established that unsolicited telemarketing phone calls or text messages in violation of the TCPA is a concrete injury in fact that, itself, is enough to confer Article III standing. It cited to Van Patten v. Vertical Fitness Grp., LLC, 847 F.3d 1037, 1043 (holding that “[u]nsolicited telemarketing phone calls or text messages, by their nature, invade the privacy and disturb the solitude of their recipients). Id. at 8. Importantly, the Ninth Circuit made clear that the relevant question for Article III standing is whether Plaintiff suffered a cognizable injury. Id. at 12. The Ninth Circuit reasoned that because a violation of the TCPA is a “concrete injury,” and the Do-Not-Call provisions of the TCPA proscribe unsolicited calls and text messages to phone numbers on the Do-Not-Call Registry, Plaintiff’s allegations that she received unsolicited text messages on a number on the registry were sufficient to confer standing. Id.

To reach this holding, the Ninth Circuit found no precedent that the owner of a cell phone also must be the primary or customary user to be injured by unsolicited phone calls or text messages. Id. at 13. The Ninth Circuit reasoned that requiring a certain level of phone usage to be a prerequisite for standing would go against Congress’ intention of preventing individuals on the Do-Not-Call Registry from receiving unsolicited text messages. Id. The Ninth Circuit also opined that this holding would not prevent other users of the phone from bringing claims, as they may also suffer a concrete injury from an unwanted call or text message. Id.

Importantly, the Ninth Circuit did not address the merits of Plaintiff’s claim, and refused to discuss Defendants’ contention that Plaintiff’s son solicited the text messages by signing up for telecommunications through an online form. Id. Instead, the Ninth Circuit held that, even if Plaintiff’s son solicited the messages, therefore affecting the merits of her claim, Plaintiff still had standing to bring her own claim by the virtue of her status as the subscriber and owner of the phone. Id. at 14. The Ninth Circuit additionally did not address the question of whether a subscriber would have Article III standing to litigate a TCPA claim if he or she authorized a third-party user to provide consent to a telemarketer, leaving that question open for the district court to discuss on remand. Id. at 9.

Key Takeaways

The Ninth Circuit has now established that all that is required for Article III standing under the TCPA is the receipt of unsolicited text messages or phone calls to a number owned or subscribed to by an individual and found on the Do-Not-Call Registry, even if that individual is not the primary user of the phone.

This ruling curtails attacks on the pleadings by TCPA defendants, especially with the language included by the Ninth Circuit that standing is “not exclusive” and numerous subscribers/users can bring TCPA claims. However, with the Ninth Circuit leaving open the question of whether a subscriber would have standing if he or she authorized a third-party user to provide consent to receive telemarketing, companies defending TCPA claims still may have a path forward to attacking standing for subscribers of phones on the Do-Not-Call Registry with third-party users. Until then, companies should be cognizant that even if a phone user solicited communications by signing up for those communications, the phone subscriber will still have standing to bring a claim under the TCPA.

July 7, 2023 by Gerald L. Maatman, Jr.

Texas Federal Court Finds That The Final DOL 80/20 Rule Is Still In Play…At Least For Now

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Shaina Wolfe

Duane Morris Takeaways: On July 6, 2023, in Restaurant Law Center, et al. v. U.S. Department of Labor, No. 1:21-CV-1106 (W.D. Tex. July 5, 2023) (ECF No. 67), federal district judge Robert Pitman of the U.S. District Court for the Western District of Texas denied the Restaurant Groups’ motion for preliminary injunction as to the new “80/20 Rule” – after being reversed by the Fifth Circuit several months prior – and denied the Restaurant Groups’ motion for summary judgment and granted the Department of Labor’s (“DOL”) motion for summary judgment. Judge Pitman determined that the DOL’s decision to construct and enforce the Final Rule was a permissible construction of the Fair Labor Standards Act (“FLSA”) and is not arbitrary and capricious. ECF 67 at 28. The ruling is nowhere close to the end of this litigation and the service and hospitality industry should pay close attention to what comes next as the Restaurant Law Center will inevitably appeal the district court’s decisions to the Fifth Circuit and as the U.S. Supreme Court has decided to reconsider the authority of agencies during the next term. The next set of decisions will be part of a broader analysis of the rules regarding tip credit, and more generally, the DOL’s authority.

The Final Rule

In late 2021, the DOL revived and revised the 80/20 Rule by providing that employers can utilize the tip credit only so long as 80 percent or more of the work is tip-producing, and not more than 20 percent is “directly supporting work.” See 29 C.F.R. § 531.56. Under the Final Rule, no tip credit can be taken for any non-tipped work. “Tip-producing work” is defined as work the employee performs directly providing services to customers for which the employee receives tips (i.e., taking orders and serving food). “Directly supporting work” is defined as work that is performed by a tipped employee in preparation of or to otherwise assist tip-producing customer service work (i.e., rolling silverware and setting tables). Non-tipped work includes preparing food or cleaning the kitchen, dining room, or bathrooms.

The Final Rule also includes a new requirement that an employer cannot utilize the tip credit when an employee performs more than 30 consecutive minutes of “directly supporting work.” Directly supporting work done in intervals of less than 30 minutes scattered throughout the workday would not invalidate the tip credit, subject to the 80/20 Rule. However, employers must pay minimum wages for “directly supporting work” performed after the lapse of the first 30 continuous minutes.

Procedural Background

In December 2021, the Restaurant Law Center challenged the Final Rule in the U.S. District Court in the Western District of Texas, on the grounds that, among other things, it violated the Fair Labor Standards Act. Restaurant Law Center, No. 1:21-CV-1106 at 4. The Texas federal district court denied the preliminary injunction after finding that the Plaintiffs failed to show that they would suffer irreparable harm absent the preliminary injunction. Id.

On April 28, 2023, the Fifth Circuit reversed the Texas federal district court, finding that the Restaurant Groups “sufficiently showed irreparable harm in unrecoverable compliance costs . . . .” Rest. L. Ctr. v. U.S. DOL, 66 F.4th 593, 595 (5th Cir. 2023). Significantly, the Fifth Circuit noted that that compliance costs would likely be necessary to track the number of minutes worked on nontipped labor and that the new 30-minute rule would impose additional monitoring costs. Id. The Fifth Circuit remanded the case for further proceedings. Id. [Our previous blog post on that ruling is here.]

The Texas Federal District Court’s Decision on Summary Judgment

At the second go-around, the district court had two fully-briefed motions, including: (1) the Restaurant Groups’ motion for preliminary injunction; and (2) the parties’ cross-motions for summary judgment. The district court denied the Restaurant Groups’ motion for summary judgment and granted the DOL’s cross-motion for summary judgment after finding that, contrary to the Restaurant Groups’ assertions, the DOL’s decision to construct and implement the Final Rule was a permissible construction of the FLSA and is not arbitrary and capricious. Id. at 28. In addition, the Texas federal district court denied the Restaurant Groups’ motion for preliminary injunction after finding that the Restaurant Groups did not succeed, and were likely not to succeed, on the merits of the case, that the balance of equities did not tip in the Restaurant Groups’ favor, and that an injunction was not in the public interest. Id.

In determining the Final Rule’s validity, the district court used a two-step framework articulated in Chevron, USA, Inc. v. Natural Resources Def. Council, Inc., 467 U.S. 837 (1984). Id. at 8. Under Chevron, if a statute has a gap that needs to be filled, Congress gave the agency administering the rule, rather than courts, authority to resolve it. Id. The district court found that Chevron deference applied to the case because Congress “delegated authority to the agency generally to make rules carrying the force of law,” and that the Final Rule “was promulgated in the exercise of that authority.” Id. at 10.

The federal district court also analyzed the FLSA’s text, structure and purpose, and legislative history, and found that, contrary to the Restaurant Group’s assertions, the statute was ambiguous. Id. at 17. The district court explained that “Congress has crafted an ambiguous statute and tasked DOL with implementing the ambiguous provisions,” and the Court “must defer to the agency’s regulation so long as it is not arbitrary, capricious, or manifestly contrary to the statute.” Id. at 17. The district judge further found that the Final Rule “accomplishes” the purposes of the FLSA “by adopting a ‘functional test’ to determine when an employee may be considered engaged in a tipped occupation.” Id. at 19.

Significantly, the district court also considered whether the Major Questions Doctrine was triggered, as discussed in West Virginia v. EPA, 142 S. Ct. 2587 (2022). Id. at 24. The district court found that the Major Questions Doctrine was not triggered because an agency action was only considered to be of “vast economic significance” if it requires “billions of dollars in spending.’” Id. at 25. The district court found that the DOL “pointed out that the average annual cost of the Rule in this case is $183.6 million” and explained that this amount was “far less than the billions considered in the cited cases. Id. The district court further opined that the “DOL has been interpreting the tip credit provision of the FLSA, as well as its other provisions, for decades.” Id.

The Texas Federal District Court’s Decision on the Preliminary Injunction

In addition, as instructed by the Fifth Circuit, the district court reconsidered the Restaurant Groups’ Motion for Preliminary Injunction. At the outset, the district court noted that “[a]lthough a failure to show likelihood of success on the merits is grounds alone for denial of a preliminary injunction, the Court will address the two remaining Rule 65 factors pursuant to the Fifth Circuit’s mandate to ‘proceed expeditiously to consider the remaining prongs of the preliminary injunction analysis.’” Id. at 26 (citing Rest. L. Ctr., 66 F.4th at 600). Despite the Fifth Circuit’s finding that Restaurant Groups will suffer irreparable harm because their compliance costs are non-recoverable, Rest. L. Ctr, 66 F.4th at 595, in balancing the equities, the district court essentially found the opposite – – that the Restaurant Groups, again, failed to show irreparable harm from complying with the Final Rule. See id. at 26-27.

Significantly, the Fifth Circuit previously disagreed with the DOL’s assertion that “employers need not engage in ‘minute to minute’ tracking of an employee’s time in order to ensure that they qualify for the tip credit.” Rest. Law Ctr., 66 F.4th at 599 (“No explanation is given (nor can we imagine one) why an employer would not have to track employee minutes to comply with a rule premised on the exact number of consecutive minutes an employee works.”). Contrary to the Fifth Circuit, the district court agreed with the DOL and found that “restaurants must already monitor the amount of time employees spend on non-tipped labor under the 80/20 rule, and the new 30-minute rule does not impose a new form of monitoring.” ECF 67 at 26. In addition, the district court noted that it is not clear that the Rule imposes significantly greater costs than restaurants incurred under the preexisting guidance because the Restaurant Groups failed to “provide an estimate of this additional monitoring.” Id. In essence, contrary to the Fifth Circuit’s Order, the district court, again, “emphasized the weakness of [the Restaurant Groups’] evidence.” Rest. Law Ctr., 66 F.4th at 598 (“For instance, the court found [the Restaurant Groups] claimed ongoing costs “to be overstate[d]” because the rule does not require “the level of detailed monitoring of which [the Restaurant Groups] warn. . . [this point is] meritless”).

Further, the district court explained that eighteen months had passed since the parties filed their briefs on the preliminary injunction, and that the Rule took effect on December 28, 2021 and has remained in place. Id. Without citing to any evidentiary support, the district court noted that “[r]estaurants and DOL have complied with the Rule since that time.” Id. at 27.

Moreover, similar to the district’s court’s first order, which was reversed by the Fifth Circuit, the district court explained “that even if there are ongoing management costs, the most significant compliance costs associated with the Rule were familiarization and adjustment costs, which have now already been incurred, and that granting an emergency motion to rescind the Rule now cannot undo these costs, and may very well force restaurants to incur additional costs adjusting to the policy that takes its place.” Id. Ultimately, the district court found that the Restaurant Groups’ “compliance costs do not outweigh the substantial harm that DOL may endure from essentially starting from scratch on a rule that serves to codify long-standing guidance.” Id.

Thus, the district court found that even if Restaurant Groups showed a likelihood of success on the merits, “neither the balance of equities nor the public interest would support a nationwide preliminary injunction.” Id. at 28.

Implications For The Service & Hospitality Industry

The fight to end and/or limit the Department of Labor’s authority and promulgation of the tip credit rule is far from over. Although the Texas federal district court sent a clear indication that it did not agree with the Fifth Circuit’s decision, and that it would not disturb the Department of Labor’s authority, the service and hospitality industry should be watchful for what has yet to come. The Restaurant Law Center will undoubtedly appeal both of the Texas federal district court’s rulings, and the Fifth Circuit has already indicated that preventing enforcement of the Final Rule may be on the horizon. Moreover, the Supreme Court’s decision to reconsider the Chevron doctrine in Loper Bright Enterprises v. Gina Raimondo, Case No. 22-451 – which will be heard in the next term – to the extent that it narrows or eliminates federal courts’ deference to agencies’ decisions, could substantially impact the agenda the Department of Labor can pursue. The service and hospitality industry should stay tuned for the Fifth Circuit’s rulings in Restaurant Law Center and Supreme Court’s forthcoming ruling Loper Bright Enterprises.

June 8, 2023 by Gerald L. Maatman, Jr.

Illinois Federal Court Denies Class Certification In Chicago Water Department Race Discrimination Lawsuit

By Gerald L. Maatman, Jr. and Jennifer A. Riley

Duane Morris Takeaways: In Edmond, et al. v. City of Chicago, No. 17-CV-4858 (N.D. Ill. June 6, 2023), Judge Matthew F. Kennelly of the U.S. District Court for the Northern District of Illinois denied a motion for class certification filed by a group of current and former employees alleging workplace race discrimination in violation of state and federal law. The ruling highlights the viability of defense positions relative to Plaintiffs’ failure to meet the Rule 23 commonality requirement, which was instrumental to defeating their bid for class certification.

Case Background

Nine African-American workers currently or previously employed by the Chicago Department of Water brought a putative class action against the City of Chicago and several individuals employed by it in 2017, alleging race discrimination and a hostile work environment on behalf of a group of employees. Plaintiffs alleged the existence of an ongoing and pervasive “culture of racism” fostered by organizational leadership across five bureaus and various sub-bureaus, treatment plants, and construction sites. Id. at 4. The lawsuit was brought after the City’s Inspector General uncovered emails containing racist exchanges between Department commissioners and deputies, which resulted in resignations of two executives. Id.

Plaintiffs alleged that the hostile work environment included racially offensive language, threatening gestures, and disparate treatment of Black employees in violation of 42 U.S.C. §§ 1981 and 1983 and Illinois law, and filed a motion to certify a class that included all Black workers employed by the Water Department since 2011 and three sub-classes for individuals who had been eligible for overtime, those with disciplinary infractions, and those who had been denied promotions.

In 2018, the Court granted Defendants’ partial motion to dismiss. Plaintiffs then brought a motion to amend the complaint in order to drop the individuals from the suit, which was granted without prejudice. Subsequently, Plaintiffs filed a motion to certify the classes pursuant to Rule 23 of the Federal Rules of Civil Procedure.

The Court’s Decision

The City argued that because Plaintiffs were unable to establish a shared work environment in their hostile work environment claim due to the Department’s dispersed workforce, Plaintiffs failed to identify a common contention whose resolution would resolve class claims, as required under Rule 23(a)(2)’s commonality element. The Court agreed with this position. It opined that there was no “evidence of common areas shared by all Department employees or instances of harassment broadcast across the entire Department.” Id. at 10. The Court found that the experience of putative class members varied across the Department, with individual claims of discrimination ranging from verbal to visual conduct, while others alleged bias in duty assignments or disciplinary actions.

Plaintiffs additionally contended that a pervasive culture of discrimination permeated the Water Department. They cited statements made by members of the city administration and the Inspector General’s investigation, and posited that this was proof of a “de facto policy of racism” across the workplaces. Id. at 11. The Court was not convinced that this had a uniform impact on all the named Plaintiffs and putative class members to satisfy the commonality question, and it denied the motion for class certification based on Plaintiffs’ failure to meet this threshold under Rule 23(a).

Likewise, Judge Kennelly rejected Plaintiffs’ arguments for certification of each sub-class based on a pervasively racist culture. The Court concluded that disciplinary, overtime, and promotion decisions were made by individual supervisors based on their personal discretion and varied across the Department, and that Plaintiffs failed to show evidence that the same decision-makers were responsible for such actions. Id. at 23. The Court was not convinced by Plaintiffs’ expert witness’ use of statistical data to show a disparate impact, noting that similar evidence had not been sufficient to demonstrate commonality for purposes of class certification in Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338 (2011).

Implications For Employers

The Edmond ruling underscores the importance of maintaining and utilizing a well-organized workplace reporting structure and managerial discretion in employment matters in anticipating arguing the absence of Rule 23’s commonality requirement, as seen in the Wal-Mart decision. In dismissing all of Plaintiffs’ arguments after finding an absence of a work environment common to all putative class members and no top-down decision-making policy regarding wages and promotions, the Court signals its steady reliance on the well-established standards for these types of claims, providing a valuable reaffirmation to employers’ reliable defense strategies.

May 24, 2023 by Gerald L. Maatman, Jr.

A Stellar Review For The Duane Morris Class Action Review – 2023

By Gerald L. Maatman, Jr. and Jennifer A. Riley

Duane Morris Takeaway: In its review of the Duane Morris Class Action Review – 2023, EPLiC Magazine called it the “the Bible” on class action litigation and an essential desk reference for business executives, corporate counsel, and human resources professionals.

We are humbled and honored by the recent review of the first edition of the Duane Morris Class Action Review – 2023 by Employment Practices Liability Consultant Magazine (“EPLiC”) – the review is here.

EPLiC said that “The Review must-have resource for in-depth analysis of class actions in general and workplace litigation in particular.”

EPLiC continued that “The Duane Morris Class Action Review analyzes class action trends, decisions, and settlements in all areas impacting Corporate America. The Review also highlights key rulings on attorneys’ fee awards in class actions, motions granting and denying sanctions in class actions, and the top class action settlement in a myriad of substantive areas. Finally, the Review provides insight as to what companies and corporate counsel can expect to see in 2023 in terms of filings by the plaintiffs’ class action bar.”

So how was it done?

The answer is pretty simple – we live, eat, and breathe class action law 24/7/365.

Every day, morning and evening, we check the previous day’s filings of class action rulings relative to antitrust class actions, appeals in class actions, arbitration issues in class actions, Class Action Fairness Act issues in class actions, civil rights class actions, consumer fraud class actions, data breach class actions, EEOC-initiated litigation, employment discrimination class actions, Employee Retirement Income Security Act class actions, Fair Credit Reporting Act class actions, wage & hour class actions, labor class actions, privacy class actions, procedural issues in class actions, product liability & mass tort class actions, Racketeer Influenced and Corrupt Organization Act class actions, securities fraud class actions, settlement issues in class actions, state court class actions, Telephone Consumer Protection Act class actions, and Worker Adjustment and Retraining Act class actions. We conduct searches on a national basis, in federal courts and all 50 states. Then we read and analyze every ruling on Rule 23 certification motions and subsidiary issues throughout federal and state trial and appellate courts. The information is organized in our customized database, which is used to provide the Review’s one-of-a-kind analysis and commentary.

The result is a compendium of class action law unlike any other. Thanks for the kudos EPLiC – we sincerely appreciate it!

We look forward to providing the 2024 Review to all of our loyal readers in early January. In the meantime, look for our first-ever Mid-Year Update coming at the beginning of July!

May 15, 2023May 16, 2023 by Gerald L. Maatman, Jr.

Tennessee Becomes Eighth State To Enact Comprehensive Privacy Legislation

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Tyler Zmick

Duane Morris Takeaways: As efforts to enact comprehensive privacy protection continue to stall on the federal level, states have stepped up to create a patchwork quilt of protections for those doing business with consumers within their borders. Tennessee recently became the eighth state – following Indiana, California, Colorado, Connecticut, Iowa, Utah, and Virginia – to enact comprehensive privacy legislation. At least 15 other states have introduced similar bills during the current legislative session, and Montana’s comprehensive consumer privacy statute awaits the signature of its Governor. Companies doing business in Tennessee or with Tennessee consumers should take heed of the new law and review their policies and processes for compliance.

Tennessee Legislation

After receiving overwhelming support from both houses of the General Assembly, on May 11, 2023, Governor Bill Lee signed the Tennessee Information Protection Act into law. With this law, Tennessee became the eighth state to institute comprehensive consumer privacy legislation. The law is set to take effect on July 1, 2024.

The act applies to businesses that conduct business in Tennessee or produce products or services that are targeted to Tennessee residents and that: (1) control or possess the personal information of at least 175,000 consumers; or (2) control or process personal information of at least 25,000 consumers and derive more than 50% of their gross revenue from the sale of personal information. The law contains exemptions for certain types of entities, such as governmental entities, certain financial institutions, non-profit organizations, and higher education institutions. The law also exempts certain types of data, such as personal information regulated by the Family Educational Rights and Privacy Act, and protected health information under HIPAA.

Similar to other comprehensive state privacy laws, the Tennessee law grants Tennessee residents certain rights in their personal information. It allows for consumers to confirm whether a company is processing their personal information, to access their personal information, to correct inaccuracies in their personal information, to delete their personal information, to obtain copies of their personal information, and to opt out of future sales or targeted advertising.

The law allows a consumer to invoke his or her rights (and the rights of his or her children) at any time by submitting a request to a controller of the personal information specifying the rights that the consumer wishes to invoke, and it requires the respondent to comply with an authenticated request without undue delay but, in all cases, within 45 days.

The law imposes various requirements on persons and entities who “determine[] the purpose and means” of processing personal information. For example, it requires such persons and entities to limit the collection of personal information to what is adequate, relevant, and reasonably necessary in relation to the purposes for which the data is processed; to establish, implement, and maintain reasonable data security practices; and, if the controller processes or sells personal information for targeted advertising, to clearly and conspicuously disclose the processing, as well as the manner in which a consumer may exercise the right to opt out of the processing.

The Tennessee law does not provide for a private right of action and vests exclusive enforcement authority in the Tennessee attorney general. It allows a court to impose civil penalties of up to $7,500 per violation, and allows treble damages for willful or knowing violations. The law requires that, prior to initiating an action, the attorney general must provide a 60-day notice period during which the recipient may cure the noticed violation to avoid an enforcement action. The law also creates an affirmative defense under certain circumstances for a company that creates, maintains, and complies with a written privacy policy that reasonably conforms to documented policies, standards, and procedures designed to safeguard consumer privacy.

Implications for Businesses

Covered persons and entities who do business in Tennessee or who target Tennessee consumers should start reviewing their policies and developing processes to comply with the Tennessee law. Although the law is not set to take effect until July 1, 2024, the law adds another challenge to the already complex compliance landscape for companies seeking to operate on a nationwide basis.