If your information was exposed in a data breach, a class action is a single lawsuit that a few people bring on behalf of everyone harmed by the same breach. A court must first approve the case as a class action. Its result then binds every person in the class who does not formally ask to be left out.
A breach notice may say that a company lost control of a person's name, Social Security number, account details or medical records. A news story or a second letter may then mention a lawsuit. A reader may want to know whether that lawsuit includes them, whether they have to do anything, and what protects them in the meantime.
This page walks through each of those questions. It explains how a class action works, which federal laws come up in breach cases, how a court decides whether a case can go forward for a whole group, and what a settlement means. It also covers the fraud alert and security freeze provisions of federal credit reporting law, which do not depend on whether any lawsuit exists.
What a Data Breach Class Action Is
A class action is a lawsuit in which one or more named plaintiffs sue on behalf of a larger group of people with similar claims arising from the same conduct. That group is called the class. A named plaintiff is a person who files the case in their own name and stands in for the rest of the group.
A data breach is unauthorized access to, or acquisition of, personal information held by a company or organization. The information might be names and addresses, Social Security numbers, financial account numbers or health records.
The two ideas come together when the named plaintiffs allege one thing in particular. They claim the company failed to protect personal information, and that this failure harmed everyone whose data was exposed. When members of a group share questions of law or fact, the case may be brought as one lawsuit instead of many separate ones, if the requirements of Federal Rule of Civil Procedure 23 are met.
That structure creates the most important difference from an individual lawsuit. In an individual case, the result affects only the people who sued. In a class action certified under Rule 23(b)(3), the judgment covers every class member who has not requested exclusion, which is what opting out means. To opt out means to formally ask to be excluded from the class. A person who stays in is generally bound by the outcome, whether or not they took part, and whether or not the outcome is good for them.
A class action is a way to decide shared legal questions in one place. Whether a breach led to a lawsuit, and whether that lawsuit can proceed for a class, depends on the facts and on the court.
Federal Laws That Apply to Data Breach Cases
Two federal statutes are described here. Whether either applies to a particular breach depends on its facts.
The Federal Trade Commission Act is one federal law in this area. Under 15 U.S.C. § 45(a)(1), "unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." The statute directs the Federal Trade Commission to prevent those practices. It does not reach some types of businesses, including banks, savings and loan institutions, federal credit unions and certain common carriers. Enforcement runs through the Commission. Under 15 U.S.C. § 45(b), when the Commission has reason to believe a company is using an unfair or deceptive act or practice and a proceeding would be in the interest of the public, it issues and serves a complaint with notice of a hearing; if, after the hearing, it is of the opinion that the act or practice is prohibited, it issues an order requiring the company to cease and desist.
The Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq., governs consumer reporting agencies, which are companies such as the nationwide credit bureaus that gather and sell information about consumers. It also governs the businesses that furnish information to those agencies and the businesses that use consumer reports. Congress found in 15 U.S.C. § 1681(a)(4) "a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy." A breach at a consumer reporting agency may raise questions under the FCRA. Whether any particular breach violates the FCRA depends on its facts.
State law adds another layer. State breach notification laws may require companies to notify affected people, and state law may add protections beyond federal law. These rules differ from state to state.
How a Court Certifies a Data Breach Class Action
A case filed as a class action is only a proposed class action at the start. To become an actual class action, it must be certified. Class certification is the court's order allowing the case to proceed on behalf of the whole group. In federal court, Federal Rule of Civil Procedure 23 governs that decision.
Rule 23(a) sets four threshold requirements:
- Numerosity: the class is so large that joining every member individually is impracticable.
- Commonality: questions of law or fact are common to the class.
- Typicality: the named plaintiffs' claims are typical of the class.
- Adequacy: the representative parties, meaning the named plaintiffs, will fairly and adequately protect the class's interests.
Rule 23(b) lists the types of class action that may be maintained once Rule 23(a) is satisfied. Rule 23(b)(3) requires the court to find that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.
Courts do not certify every proposed class. Under Rule 23(c)(1), the court must decide by order whether to certify, and an order that grants or denies certification may be altered or amended before final judgment. Whether any particular breach leads to a certified class depends on the facts, the claims and the court. For a general picture of how federal consumer cases move from filing onward, see how consumer lawsuits work.
Who Qualifies as a Class Member
The court's certification order sets the class definition, which is the description of who is in the class. An order that certifies a class must define the class and the class claims, issues, or defenses (Rule 23(c)(1)(B)).
For a Rule 23(b)(3) class, Rule 23(c)(2) requires notice to class members. The court must direct notice to class members that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort, and the notice may be by United States mail, electronic means, or other appropriate means. The notice must state, among other things, the definition of the class certified, that the court will exclude from the class any member who requests exclusion, the time and manner for requesting exclusion, and the binding effect of a class judgment on members.
A class member generally faces one choice:
- Staying in. A class member who does not opt out is bound by any judgment or settlement in the case.
- Opting out. A class member who requests exclusion is excluded from the class by the court (Rule 23(c)(2)(B)(v)), and the class judgment does not include that member.
The roles also differ. Named plaintiffs, also called class representatives, actively take part in the litigation. Absent class members are everyone else in the class, and they generally do not take part.
Many readers start with a simpler question: was my information in a breach at all? A person may learn this through a breach notification letter from the company, or through a court-approved class notice if a case is pending. Federal law also directs the FTC to set up a central page at IdentityTheft.gov that links to each nationwide credit bureau's page for freezes and fraud alerts. Being named in a breach notice does not by itself place anyone in a class. Membership turns on the court's definition. Whether a given person fits that definition, or receives anything, depends on the case.
How Data Breach Class Actions Are Resolved
A settlement is an agreement between the parties that resolves the case. A class settlement does not take effect just because the parties sign it. Under Rule 23(e), the claims of a certified class may be settled only with the court's approval.
Rule 23(e) sets the steps. The court must direct notice in a reasonable manner to all class members who would be bound by the proposal if giving notice is justified, and any class member may object to a proposal that requires court approval. If the proposal would bind class members, the court may approve it only after a hearing and only on finding that it is fair, reasonable, and adequate. If the class was previously certified under Rule 23(b)(3), the court may refuse to approve a settlement unless it gives class members who had an earlier opportunity to request exclusion a new opportunity to do so.
The question many readers carry into this section is what one person receives. This page states no typical amount, and none can be predicted. What an individual class member receives, if anything, depends on the terms of the settlement the court approves. In deciding whether to approve, Rule 23(e)(2) has the court consider, among other things, the relief provided for the class, including the method of distributing relief and processing class-member claims, and whether the proposal treats class members equitably relative to each other.
More about remedies under federal consumer statutes and their conditions is on the page about consumer lawsuits under federal law.
What Happens After a Breach: Steps a Consumer May Take
The provisions in this section do not depend on any class action. The FCRA provides two tools to control access to a consumer's credit file: the fraud alert and the security freeze.
A fraud alert is a note in a credit file that tells businesses to take steps to verify a consumer's identity before extending new credit. Under 15 U.S.C. § 1681c-1(a), a consumer, or someone acting for them, who asserts in good faith a suspicion of fraud or identity theft may ask a nationwide consumer reporting agency for an initial alert. The agency must first receive proof of the requester's identity. The alert lasts at least one year, unless the consumer asks to remove it earlier. That agency must refer the alert to the other nationwide agencies, and it must tell the consumer they may request a free copy of their file. The notice required under 15 U.S.C. § 1681c-1(i)(5) adds that an identity theft victim is entitled to an extended fraud alert lasting 7 years. The FTC's guidance on freezes and alerts says an extended alert is available to people who have experienced identity theft and have completed an FTC identity theft report at IdentityTheft.gov or filed a police report. It also describes an active duty alert for servicemembers.
A security freeze, also called a credit freeze, is a restriction that prohibits a consumer reporting agency from disclosing a frozen report to anyone requesting it. Under 15 U.S.C. § 1681c-1(i), placing and removing a freeze is free, and so is a temporary lift for a period the consumer chooses. The law sets these deadlines:
- Placing a freeze: within 1 business day of a request by toll-free telephone or secure electronic means, or 3 business days of a request by mail.
- Confirmation: within 5 business days after placing it.
- Removal or temporary lift: within 1 hour of a phone or electronic request, or 3 business days of a request by mail.
A freeze does not apply to every user of a report. The exceptions include existing creditors reviewing or collecting an account, certain government agencies, and anyone using the information for insurance underwriting or for employment, tenant or background screening. The CFPB's explanation of security freezes says a freeze does not affect credit scores, and that a consumer must contact each of the three nationwide credit reporting companies separately to freeze all three files. Where fraudulent accounts have already appeared, the page on identity theft and consumer law covers blocking and disputes.
If You'd Like a Consumer Rights Case Review
Data breach cases turn on details that a general explainer cannot weigh. This page does not cover the claim procedures of any particular settlement or the breach laws of individual states.
A reader may request a consumer rights case review through Federal Consumer Rights. Answers to related questions about federal consumer rights are collected in the consumer law FAQ.
