One of my gripes with Anthem and Equifax data breach settlements is, consumers get the junk Summary Report when they need the Detailed Report to detect fraud on their accounts, name and social security number. Obviously, companies like Anthem and Equifax don't want consumers to see it because it proves fraud is occurring on the consumer.*
I've written Object Letters opposing the settlements that include this exact point. That bitch Judge Koh completely disregarded the objection in the Anthem Data Breach settlement. She approved the settlement without the requirement of Detailed Reports. She also approved the settlement without the choice of Early Warning. I hope that bitch gets hit by a bus and dies. She is no friend of the people in this country.
* One of the hurdles in moving an action forward in a class action is Article III standing. That basically says you have to be experiencing harm or harm is eminent (among other requirements). Obviously a documentation trail that details harm correlated to a breach is good for consumers and their action, and bad for businesses.
There's also a 2018 ruling from the 9th Circuit Court of Appeals that acknowledged someone is at future risk after a data breach. The Justices reasoned, "why steal the data if the thieves were not going to use it". Hat tip to the 9th Circuit for the ruling. The US Supreme Court upheld the Circuit Court's ruling.
I've been trying for 10 or 15 years to get the courts to apply that reasoning. In the early 2000's I watched as no judge exercised any common sense. Then, around 2005, I started writing them before the rulings and criticizing them after their [poor] rulings.
From Court Reopens 2012 Zappos Data Breach Litigation:
A class-action lawsuit against Zappos.com was reopened Thursday when the 9th U.S. Circuit Court of Appeals voted to overturn a previous lower-court dismissal.
The case, “Theresa Stevens, et al., v. Zappos.com Inc.,” stems from a 2012 data breach in which hackers accessed the Zappos servers and allegedly stole the names, addresses, passwords and credit and debit card information of more than 24 million of the site’s customers.
Zappos responded quickly to the incident at the time, notifying customers via email of the breach and recommending that they change their passwords on the e-commerce site.
However, numerous customer filed punitive actions against the company following the news, claiming that Zappos did not do enough to protect its customers’ privacy and that they were at risk of identity fraud.
The U.S. District Court in Reno, Nev., chose to dismiss the claims on the grounds that not all of the plaintiffs had Article III standing, which requires (a) proof of actual injury, (b) that the injury be traceable and (c) that the injury can be redressed by a favorable decision.
On March 8, the federal appeals court chose to overturn that decision, allowing all the plaintiffs to pursue their litigation against Zappos.
Judge Elaine E. Bucklo wrote in a summary opinion, “The panel held that plaintiffs sufficiently alleged an injury in fact … based on a substantial risk that the Zappos hackers will commit identity fraud or identity theft. The panel assessed plaintiffs’ standing as of the time the complaints were filed, not as of the present. The panel further held that plaintiffs sufficiently alleged that the risk of future harm they faced was ‘fairly traceable’ to the conduct being challenged; and the risk from the injury of identity theft was also redressable by relief that could be obtained through this litigation.”
Zappos was a really good case for consumers. Not only did it help establish Article III standing for data breaches, it also provided this gem for consumers: If there's no meeting of the minds, then there is no contract and it is unenforceable.
From How Zappos' User Agreement Failed In Court and Left Zappos Legally Naked:
According to the court, Zappos presented its "terms of use" as a browsewrap. You can see the implementation from this screenshot snippet above--look for the obscure link entitled "terms of use" on the left side. (As the court notes, if you printed out the home page of Zappos.com, this snippet would be on page 3 of the 4 page printout).
The court does not have kind words for Zappos' implementation:
we cannot conclude that Plaintiffs ever viewed, let alone manifested assent to, the Terms of Use. The Terms of Use is inconspicuous, buried in the middle to bottom of every Zappos.com webpage among many other links, and the website never directs a user to the Terms of Use. No reasonable user would have reason to click on the Terms of Use, even those users who have alleged that they clicked and relied on statements found in adjacent links, such as the site's “Privacy Policy.”
Later, the court reinforces how unimpressed it is with Zappos' browsewrap argument:
The arbitration provision found in the Zappos.com Terms of Use purportedly binds all users of the website by virtue of their browsing. However, the advent of the Internet has not changed the basic requirements of a contract, and there is no agreement where there is no acceptance, no meeting of the minds, and no manifestation of assent. A party cannot assent to terms of which it has no knowledge or constructive notice, and a highly inconspicuous hyperlink buried among a sea of links does not provide such notice. Because Plaintiffs did not assent to the terms, no contract exists, and they cannot be compelled to arbitrate.
Zappos Reserved the Right to Amend the Contract Whenever It Wanted
uncaptioned As you can see from the screenshot snippet on the right, Zappos' terms of use says "We reserve the right to change...these terms and conditions at any time." Zappos isn't the only website using language like this; it's ubiquitous on the Internet. Unfortunately, despite its widespread usage, this language is toxic to a contract.
The court takes this amendment power to its logical conclusion. If Zappos can change the terms at any time, then it can change the arbitration clause at any time. Thus, citing to a long list of cases, the court says that such unilateral power to change the arbitration clause makes the clause "illusory"--and thus unenforceable.
