Hunton Retail Law Resource

As reported on the Hunton Privacy & Information Security Law Blog, on March 8, 2018, the Ninth Circuit Court of Appeals (“Ninth Circuit”) reversed a decision from the United States District Court for the District of Nevada. The trial court found that one subclass of plaintiffs in In re Zappos.Com, Inc. Customer Data Security Breach Litigation had not sufficiently alleged injury in fact to establish Article III standing. The opinion focused on consumers who did not allege that any fraudulent charges had been made using their identities, despite hackers accessing their names, account numbers, passwords, email addresses, billing and shipping addresses, telephone numbers, and credit and debit card information in a 2012 data breach. 

On June 13, 2017, Judge Andrea R. Wood of the Northern District of Illinois dismissed with prejudice a putative consumer class action filed against Barnes & Noble. The case was first filed after Barnes & Noble’s September 2012 announcement that “skimmers” had tampered with PIN pad terminals in 63 of its stores and exposed payment card information. The court had previously dismissed the plaintiffs’ original complaint without prejudice for failure to establish Article III standing. After the Seventh Circuit’s decision in Remijas v. Neiman Marcus Group, the plaintiffs filed an almost identical amended complaint that alleged the same causes of action and virtually identical facts. Although the court found that the first amended complaint sufficiently alleged Article III standing, the plaintiffs nevertheless failed to plead a viable claim. The court therefore dismissed the first amended complaint under Rule 12(b)(6). 

On June 19, 2017, the United States Supreme Court announced important constitutional limitations on state courts’ ability to exercise specific jurisdiction over nonresidents’ claims against out-of-state defendants. The Court’s nearly unanimous decision in Bristol-Myers v. Superior Court, 582 U.S. (2017) has potentially far-reaching implications for companies facing claims brought by nonresident and resident plaintiffs in states in which those companies are neither incorporated nor maintain their principal place of business. In holding that mere joinder of nonresident plaintiffs’ claims with those of resident plaintiffs does not permit a state court to exercise specific jurisdiction over an out-of-state defendant, the Court’s decision is the latest in a trend of important personal jurisdiction decisions rendered by the high court in recent years which provide companies with significant constitutional protections in terms of where plaintiffs may force companies to litigate.

A year ago, the United States Supreme Court held in Spokeo, Inc. v. Robins that a plaintiff must do more than plead a mere statutory procedural violation to establish standing; to plead an injury in fact, a plaintiff also must allege a harm that is both “concrete” and “particularized.” Two recent decisions by the U.S. Court of Appeals for the Eleventh Circuit—one involving a rare written dissent from the denial of a petition for rehearing en banc—demonstrate the continuing difficulties courts are facing in determining what constitutes a concrete injury under Spokeo. They suggest that the Eleventh Circuit is most likely to find standing for violations of statutes that are intended to protect personal privacy or create a right to information, although judges do not always agree as to which statutes fall within these categories.

On May 2, 2017, the United States Court of Appeals for the Second Circuit issued a summary order affirming dismissal of a putative data breach class action against Michaels Stores, Inc. (“Michaels”). The plaintiff’s injury theories were as follows: (1) the plaintiff’s credit card information was stolen and twice used to attempt fraudulent purchases; (2) the risk of future identity fraud and (3) lost time and money resolving the attempted fraudulent charges and monitoring credit. The plaintiff, however, quickly cancelled her card after learning of the unauthorized charges and did not allege that she was held responsible for any of those charges.

The first blow to the recent expansive application of the New Jersey Truth-in-Consumer Contract, Warranty and Notice Act (“TCCWNA”) was struck by a federal court in California last month. In Candelario v. Rip Curl, Inc., the Central District of California granted a motion to dismiss a complaint alleging a TCCWNA violation of website terms and conditions because the plaintiff lacked Article III standing. The plaintiff has appealed the decision to the Ninth Circuit.

This past week, several consumer protection and regulatory actions made headlines:

Mars Petcare Settles With the FTC Over False Advertising Claims

Mars Petcare U.S., Inc., (“Mars Petcare”) has agreed to settle FTC allegations that the company falsely advertised its Eukanuba dog food.

The FTC’s complaint alleges that, in 2015, Mars Petcare claimed in TV, print and Internet ads that its dog food could increase a dog’s lifespan by 30 percent or more. This claim was allegedly based on a 10-year study of dogs who were fed Eukanuba. According to the FTC, the claim was false or unsubstantiated.

As reported on the Privacy & Information Security Law blog, on July 29, 2016, the FTC announced that it had issued an opinion and final order concluding that LabMD, Inc. (“LabMD”) violated the unfairness prong of Section 5 of the FTC Act by failing to maintain reasonable security practices to protect consumers’ sensitive personal information. The unanimous decision reverses a November 2015 administrative law judge’s initial decision that, as we previously reported, dismissed the FTC’s charges against LabMD for failing to show that LabMD’s allegedly unreasonable data security practices caused, or were likely to cause, substantial consumer injury.

On July 19, 2016, the United States Court of Appeals for the Seventh Circuit held in Cincinnati Ins. Co. v. H.D. Smith, LLC, No. 15-2825 that a general liability insurer’s duty to defend suits seeking damages “because of bodily injury” was triggered when the state of West Virginia sued a pharmaceutical distributor, alleging it had contributed to an epidemic of prescription drug abuse, causing the state to spend money to care for addicted citizens.

On June 28, 2016, in two related settlements, German auto-manufacturer, Volkswagen AG (“VW”), has agreed to pay $14.7 billion to resolve allegations that the company cheated diesel emissions tests for nearly 500,000 2.0 liter diesel vehicles sold over six years. One settlement partially resolves EPA allegations for alleged violations of the Clean Air Act’s federal emissions standard; the other partially resolves FTC claims that VW violated the FTC Act by deceptively and unfairly advertising its “clean diesel” vehicles. VW also will pay damages to 44 states, Washington, D.C., and Puerto Rico. The announced settlements do not resolve pending civil claims concerning VW’s 3.0 liter diesel vehicles, or potential criminal liability.

Information posted to social media accounts can be highly relevant in suits brought by individuals, but too often requesting parties ask for “any and all” content, rendering their requests overly burdensome and subject to objection. Especially now, with the December 2015 changes to the Federal Rules of Civil Procedure, courts are grappling with how social media discovery fits into this new world of proportional discovery. In the recent case of Rhone v. Schneider Nat’l Carriers, Inc., No. 4:15-cv-01096-NCC, 2016 WL 1594453, the court settled this question with a unique approach.

TCCWNA. The very acronym evokes head scratches and sighs of angst and frustration amongst many lawyers in the retail industry. You have probably heard about it. You may have even been warned about it. And you may currently be trying to figure out how best to minimize your risk and exposure this very moment. But what is it and why has virtually every retailer been hit with a TCCWNA class action demand letter or lawsuit in the past few months? And why are most retailers scrambling to update the terms and conditions of their websites?

As we previously reported, the Supreme Court’s decision in Spokeo v. Robins has been nearly universally lauded by defense counsel as a new bulwark against class actions alleging technical violations of federal statutes. It may be that. But Spokeo also poses a significant threat to defendants by defeating their ability to remove exactly the types of cases that defendants most want in federal court. The decision circumscribes the federal jurisdiction, with all its advantages, that defendants have enjoyed under Class Action Fairness Act (“CAFA”) for the past decade.

We previously reported on the proposed regulations initiated by the California Office of Environmental Health Hazard Assessment and its impact on retailers. Retailers should take steps to ensure that they are protected from Prop 65 claims, particularly with the proposed regulations in the pipeline. As with any regulatory requirements that impact businesses, often the best defense is a good offense -- forethought, assessment and implementation of a compliance program can minimize the costs, headaches, business disruption and negative publicity that may otherwise occur.

As reported on the Hunton Insurance Recovery Blog, data breach claims involving customer data can present an ever-increasing risk for many retailers and other companies. A recent case further supports efforts to recover the costs associated with such claims. Specifically, a panel of the Fourth Circuit confirmed that general liability policies can afford coverage for cyber-related liabilities, and ruled that an insurer had to pay attorneys’ fees to defend the policyholder in class action litigation in Travelers Indemnity Company v. Portal Healthcare Solutions, No. 14-1944. Syed Ahmad, a partner in the Hunton & Williams LLP insurance practice, was quoted in a Law360 article concerning the importance of this decision.

As we previously reported, the Prop 65 statute prohibits businesses from exposing people in California to any of the over 800 listed chemicals without first providing a “clear and reasonable” warning. Currently, California’s Office of Environmental Health Hazard Assessment is working to repeal existing Prop 65 warning regulations and adopt new requirements. However, the proposed regulations contain several problematic provisions regarding the content and method of transmission for required warnings. Retailers need to be aware of proposed provisions which clearly apportion responsibility for providing warnings throughout the chain of commerce. Though purportedly aimed at reducing retailers’ Prop 65 warning burden, if implemented as written, the provisions will actually increase retailers’ risks and allow manufacturers to insulate themselves from liability at retailers’ expense.

On March 29, 2016, the Federal Trade Commission (“FTC”) filed suit against Volkswagen Group of America (“VW”), which includes Volkswagen of America and Audi of America, for its “Clean Diesel” advertisements.

The complaint alleges VW’s “Clean Diesel” ads made various deceptive claims, including that its diesel technology produced “30% fewer emissions” and reduced “nitrogen-oxide emissions by 90%.” The FTC alleges that the vehicles with VW’s “Clean Diesel” technology were also equipped with a “defeat device” designed to calibrate the vehicle’s emission system to produce legally-compliant emissions during standard emissions testing.

For retailers operating in California, the state’s Safe Drinking Water and Toxic Enforcement Act of 1986 (“Prop 65”) is a constant and often costly headache. Among other requirements, Prop 65 prohibits businesses with ten or more employees, including those that ship products into California, from exposing people in California to any of the over 800 listed chemicals without first providing a “clear and reasonable” warning. The statute also contains a prohibition against discharging or releasing listed chemicals to “sources of drinking water” in the state, but those provisions are not discussed here. The list of over 800 chemicals is revised and updated annually.

Over the past two years, Hunton & Williams has been carefully monitoring the application of Daimler AG v. Bauman in trial and appellate courts throughout the country. The U.S. Supreme Court’s landmark Daimler decision articulated a standard that significantly limits the types of contacts sufficient to subject a defendant to general jurisdiction in a particular forum. Under that standard, a plaintiff must demonstrate that the defendant’s contacts with the forum are so continuous and systematic as to render it “essentially at home” there. In most instances, a company is “essentially at home” only in the state where it is incorporated and the state where it operates its principal place of business. Since the opinion was issued, the risk of a company becoming subject to general jurisdiction outside its home states has substantially decreased—a largely positive outcome for companies in the retail products industry that have traditionally been subject to “all purpose” general jurisdiction in each state where they conduct business.

There is general consensus that 3D printing has potentially revolutionary implications for industry and, along with it, for the law. Its consequences for consumers injured by 3D-printed products are potentially just as far-reaching.

Consider this fact pattern: A plumbing parts manufacturer makes CAD files available to plumbing stores so that they may 3D print replacement parts on demand and on-site in response to customer requests. A plumbing store sells such a 3D-printed part to a customer, but the part malfunctions, causing significant damage to the customer’s home.

In this fact pattern, the injured consumer may have recourse against the plumbing parts manufacturer and the plumbing store, although the manufacturer and store are likely to have agreements with indemnification and liability provisions.