Emerging Trends in New York Class Action Litigation

Standing

The authority of federal courts is limited under the US Constitution to the resolution of “Cases” and “Controversies”. To ensure that a lawsuit falls under the constitutional requirement and that the court has jurisdiction to hear the dispute, the Supreme Court established the rule that a plaintiff must have a personal stake in the case – what courts call “standing”. A plaintiff must meet three requirements to establish standing: (i) an injury, (ii) likely caused by the defendant, and (iii) that the injury can be addressed with judicial relief.

Most challenges to standing focus on the first prong where courts require that the injury suffered by the plaintiff be concrete and personal. To determine whether the injury is concrete, courts look to the harms historically recognised by American courts. The most well-recognised harms are physical or monetary. If a defendant physically injured a plaintiff or caused the plaintiff to lose money, the plaintiff suffered a concrete harm and has standing. There are other, less tangible harms that courts consider concrete. These intangible harms include violations of rights specified by the Constitution, such as a violation of free speech. Reputational harm and disclosure of private information are also intangible harms recognised by American courts as concrete harms.

In class actions, a class plaintiff has the burden of establishing standing and must maintain standing throughout the litigation. Additionally, every class member must have standing in order to recover individual damages. During the early stages of the case, however, the plaintiff may establish standing through allegations in the complaint and a class definition that describes a concrete and personal injury for each class member. As the case proceeds, the plaintiff will have to provide more evidence to establish standing. At the class certification stage, the plaintiff does not have to provide evidence of standing for every class member. Instead, the class plaintiff must provide sufficient evidence to demonstrate standing for itself and define the class such that anyone within it has standing. The obligation to prove standing for each class member extends to class action settlements. Since a class action settlement must be approved by a court, the court needs jurisdiction over the matter. A court only has jurisdiction if each class member under the class definition has standing.

Recent cases in New York emphasise that plaintiffs must establish a concrete injury even when suing based on the violation of a statute that provides for private enforcement. Plaintiffs may not plead a mere statutory or procedural violation of the law. They must plead an injury resulting from that violation. The harm resulting from the statutory violation must bear a “close relationship,” but need not be identical to a harm historically recognised in American courts as forming the basis for standing to bring a lawsuit. Moreover, the class must be defined such that every member has a concrete injury stemming from the statutory violation.

Challenges to standing are raised in almost every class action. For many types of class cases, standing is readily established because the claim describes a monetary loss. For instance, in price fixing or false advertising cases, the plaintiff establishes standing by showing that they would not have paid the same amount for the product in the absence of the defendant’s conduct. More difficult standing issues in class actions arise in cases involving intangible harms stemming from statutory violations such as claims based on unsolicited text advertisements that do not provide a means to unsubscribe.

Data privacy

Privacy and data breach class action litigation has soared in the past year. In 2023, privacy and data breach class actions saw a 154% increase. And a recent decision by the Second Circuit may open the door for even more privacy and data breach filings in federal court. In Bohnak v Marsh & McLennan Companies, Inc.,79 F.4th 276 (2d Cir. 2023), the plaintiff brought a proposed class action alleging that she and all class members had been harmed by her former employer when an unauthorised third party accessed employee names and social security numbers through a targeted data breach. The plaintiff alleged that Marsh & McLennan had failed to adequately protect employee’s personal information. The defendant challenged the plaintiff’s standing, arguing that Bohnak had not alleged a concrete injury stemming from the data breach or any resulting damages. The court held that the exposure of the personal information to the unauthorised users was akin to public disclosure of private facts, a historically recognised harm. In addition, the plaintiff had alleged harm from the future risk of exposure of her personal information because she incurred out-of-pocket expenses associated with monitoring identify theft.

This decision expanded the scope of concrete harm in data breach cases. Generally, a plaintiff does not have a case or controversy merely because there is a risk of harm. Here, the court recognised a harm in mere exposure to an unauthorised third-party despite no allegations of misuse. In addition, the court found she had standing to bring a claim based on the risk of misuse because Bohnak alleged costs associated with monitoring the use of her personal information. This decision may have consequences for companies experiencing data breaches in 2024.

Prior to this decision, a New York state court, in a case of first impression (one involving a question never before determined in the governing jurisdiction), held that a plaintiff had no standing to bring a claim based on the unauthorised access of her medical records. Greco v Syracuse ASC, LLC, 193 N.Y.S.3d 511 (2023). The plaintiff filed a class action seeking damages against an outpatient surgical centre that experienced a cyber-attack. Like Bohnak, the complaint alleged that the plaintiff paid for identity theft protection and other mitigation costs. The court, however, found the risk of future misuse too conjectural given that the alleged data breach only involved medical information without disclosure of dates of birth, credit card numbers, or social security numbers. While the information disclosed in the cases was not identical, the federal court had recognised a harm in the mere disclosure of private information to an unauthorised third-party, a harm the New York state court dismissed.

Recently Madison Square Garden (MSG) challenged a class action filed against it for its use of facial recognition technology. Gross v Madison Square Garden Ent. Corp., No. 23CV3380LAKJLC, 2024 WL 103235, (S.D.N.Y. Jan. 9, 2024). MSG owns or operates several entertainment venues in New York City, including Madison Square Garden and Radio City Musical Hall. The lawsuit claimed that the company collects, uses, and stores facial recognition technology at its venues, including a database of persons banned from its venues.

The New York City Biometrics Law prohibits the sale, lease, trade, or sharing of biometric identifier information for anything of value. The plaintiffs allege that MSG applies a facial recognition system to all customers who try to enter its venues and shares the biometric data with a third party to identify and ban lawyers who have active legal actions against it. The complaint alleged this system acted as a litigation deterrence policy. The issue addressed by the court was whether MSG exchanged plaintiffs’ biometric data for something of value or was otherwise profiting from an exchange of biometric data. The court accepted the plaintiff’s argument that the significant litigation expense that MSG saves by sharing the biometric data and banning certain lawyers constituted a benefit or profit. After surviving the motion to dismiss, the case is ongoing.

The cases described above illustrate that some courts recognise an individual’s right to protection of their biometric and personal information. While there is not unanimity on whether plaintiffs have standing to sue for damages based on the unauthorised exposure of such information, it is possible that any company that sells private information or has a database of private information breached by unauthorised users must be aware of its exposure to litigation.

Telephone Consumer Protection Act

New York courts have also recently had occasion to address standing for claims under the Telephone Consumer Protection Act (TCPA). The TCPA prohibits unsolicited advertisements through telephone or fax with three exceptions. Such an advertisement is allowed if (i) the sender has an established business relationship with the recipient, (ii) the phone or fax number was obtained through specific means implying consent, or (iii) the advertisement contains a detailed opt-out notice on the first page.

In previous cases challenging standing for violations of the TCPA, courts of appeals have held that allegations describing the nuisance and invasion of privacy from unsolicited robocalls, faxes, or text messages suffice as an injury-in-fact. In passing the TCPA, Congress specifically intended to prevent the nuisance and invasion of privacy resulting from unsolicited advertisements. Moreover, courts recognised that this harm has a close relationship to the longstanding, traditional claims for “invasion of privacy, intrusion upon seclusion, and nuisance.” Gorss Motels, Inc. v Lands’ End, Inc., No. 20-589-CV, 2021 WL 1915998 (2d Cir. May 13, 2021).

In addition to the historically recognised intangible harms, plaintiffs may allege a concrete harm by virtue of their fax machine or telephone line being occupied and/or because of wasted paper and ink. Although this harm may be of negligible cost, it describes an economic cost that courts consider tangible.

In a recent Eastern District of New York case, the defendant raised questions as to standing of class members suing for a violation of the TCPA. The plaintiffs in Urgent One Med. Care, PC v Co-Options, Inc., No. 21-CV-4180(JS)(SIL), 2022 WL 4596754 (E.D.N.Y. Sept. 30, 2022) alleged that the defendant sent unsolicited fax messages to paediatricians and other practitioners advertising a commercially available product, hoping the recipients would obtain and offer free samples to their patients. The defendant did not challenge the named plaintiff’s standing, but instead challenged the standing of absent class members. It argued that any potential class member who received an unsolicited fax through online services did not suffer a concrete harm because they had not wasted paper or ink. The court rejected the defendant’s argument because at this stage of the case, it was enough that the plaintiff had alleged that each class member suffered a concrete injury in the form of time, paper, and ink or toner consumed as a result of the unsolicited faxes.

As new and different technology is used for unsolicited advertisements, courts will have to consider whether plaintiffs have standing to sue for violations of the TCPA, looking to whether the plaintiffs suffered a traditionally recognised harm or any economic cost, no matter how small.

Automatic renewals

While the subscription model is not new, its use has proliferated over the past decade. Moving beyond print media, subscriptions or automatic renewals became the norm for streaming services, food delivery, dieting programmes, dating services, and countless other goods and services. With the increased use of automatic renewals, consumers were surprised to find charges when they had not realised they had signed up for a subscription. Recently, state governments have stepped in to prevent these surprise charges.

In 2009, California passed an automatic renewal law applicable to the sale of goods and services which came into effect in December 2010. The law required companies to obtain affirmative consent from consumers by clearly and conspicuously disclosing “automatic renewal offer terms”. California also required companies to provide customers with an easy means of cancelling the contract and a reminder prior to the start of the automatic renewal period. Other states, including Colorado, Florida, Georgia, Hawaii, Illinois, Louisiana, New Mexico, North Carolina, Oregon, Vermont, Virginia, and the District of Columbia followed suit. New York enacted a similar version in 2021. Recent updates to California and New York’s laws have strengthened this protection for consumers.

Neither New York nor California specifically provides a right to private enforcement of their automatic renewal laws. Nonetheless, plaintiffs have brought numerous class actions under California’s law. In particular, plaintiffs claim harm based on a theory of deceptive practice under the state’s consumer protection laws resulting from the violation of the automatic renewal statute. California state courts have recognised this indirect right of action under the automatic renewal law as long as the plaintiff sufficiently alleges a related economic injury. Mayron v Google LLC, 269 Cal. Rptr. 3d 86 (Cal. App. 6th Dist. 2020). Recently, plaintiffs have attempted to bring class actions under other state laws, including New York. In a recent case against the dieting app, Noom, the judge dismissed the claims brought under the laws of New York, Ohio, Texas, Alabama, and the District of Columbia. Nonetheless, in approving the settlement of USD56 million, the court approved a class definition that covered all purchasers in the United States, not just California residents. Nichols v Noom, Inc., No. 20-CV-3677 (KHP), 2022 WL 2705354 (S.D.N.Y. July 12, 2022).

Enforcement of automatic renewal laws is a relatively new area of law. It remains to be seen whether courts will recognise the private right of action in states beyond California or if states will amend laws to allow such private rights of action. As more states enact laws or strengthen existing provisions, class actions based on these laws may become more common in New York.