ATLANTA — A federal judge in Georgia on Feb. 24 granted preliminary approval of a $32.5 million settlement in a shareholder derivative lawsuit against several current and former officers and directors of Equifax Inc. over their handling of the credit-reporting agency’s massive 2017 data breach (In re Equifax Inc. Derivative Litigation, No. 18-317, N.D. Ga.).
PORTLAND, Ore. — Seven months after an Oregon federal judge preliminarily approved a $42 million settlement between Premera Blue Cross and a class of its insureds over a 2014 data breach, the judge on March 2 granted final approval, the same day that a fairness hearing was held (In Re: Premera Blue Cross Customer Data Security Breach Litigation, No. 3:15-md-02633, D. Ore.).
SAN FRANCISCO — In respective case management statements filed in California federal court on Feb. 27, Facebook Inc. and a putative class suing it over the Cambridge Analytica data-sharing incident blame each other for delays in the discovery process, arguing about such matters as search terms, depositions and the appropriate number of custodians (In re Facebook Inc., Consumer Privacy User Profile Litigation, No. 3:18-md-02843, N.D. Calif.).
SAN FRANCISCO — In a pair of notices filed in California federal court on Feb. 27, the plaintiffs in three consolidated suits brought under the Children’s Online Privacy Protection Act (COPPA) related to children’s game apps, announced that settlements had been reached between the plaintiffs, ViacomCBS Inc. and two companies involved in the games’ development (Amanda Rushing, et al. v. The Walt Disney Company, et al., No. 3:17-cv-04419, N.D. Calif.; Amanda Rushing, et al. v. ViacomCBS Inc., et al., No. 3:17-cv-04492, N.D. Calif.; Michael McDonald, et al. v. Kiloo ApS, et al., No. 3:17-cv-04344, N.D. Calif.).
LAS VEGAS — Days after MGM Resorts International confirmed that it had experienced a data breach months earlier, a California man filed a putative class action against the resort in Nevada federal court on Feb. 21, alleging negligence and unjust enrichment for MGM’s “failure to implement adequate and reasonable cyber-security procedures and protocols necessary to protect” customers’ personally identifiable information (PII) (John Smallman v. MGM Resorts International, No. 2:20-cv-00376, D. Nev.).
CHICAGO — A hospital worker failed to plead that the manufacturer of a medication-dispensing system that utilizes employees’ fingerprints for identification purposes collected or disclosed biometric data in violation of the Illinois Biometric Information Protection Act (BIPA), a Chicago federal judge ruled Feb. 24, granting the firm’s motion to dismiss the worker’s putative class claims (Corey Heard v. Becton, Dickinson & Co., No. 1:19-cv-04158, N.D. Ill., 2020 U.S. Dist. LEXIS 31249).
LOS ANGELES — Seven months after a California federal judge partly dismissed a well-known cryptocurrency investor’s negligence suit against AT&T Mobility LLC over phone hacking incidents that he says led to the theft of $24 million in digital currency, the same judge on Feb. 24 partly granted the cellular carrier’s renewed dismissal motion, while finding that some of the earlier pleading deficiencies had been cured (Michael Terpin v. AT&T Mobility LLC, et al., No. 2:18-cv-06975, C.D. Calif., 2020 U.S. Dist. LEXIS 31742).
ALBUQUERQUE, N.M. — A suite of educational services offered free-of-charge by Google LLC to schools comes with “a very real cost,” New Mexico alleges in a complaint filed Feb. 20 in New Mexico federal court, claiming that the tech giant has been collecting children’s personally identifiable information (PII) in violation of the Children’s Online Privacy Protection Act (COPPA), as well as state and common law (New Mexico, et al. v. Google LLC, No. 1:20-cv-00143, D. N.M.).
GREENBELT, Md. — A motion by Marriott International Inc. to dismiss 10 bellwether class claims in a multidistrict litigation against it over a massive data breach it experienced was largely unsuccessful, with a Maryland federal judge denying dismissal of nine of those claims on Feb. 21, finding that the plaintiffs adequately established jurisdiction and alleged their claims and injuries from the incident (In re: Marriott International Inc. Customer Data Security Breach Litigation, No. 8:19-md-02879, D. Md., 2020 U.S. Dist. LEXIS 30435).
PHILADELPHIA — A federal judge in Pennsylvania on Feb. 21 transferred a lawsuit accusing Equifax Inc. and its affiliates of violating the Fair Credit Reporting Act (FCRA) of illegally selling information to mortgage brokers who made phone calls to plaintiffs’ Florida home after they began refinancing the loan on a home they own in Delaware, finding that litigating the suit in the U.S. District Court for the Northern District of Georgia would enhance judicial efficiency (Harold Berk v. Equifax Inc., et al., No. 19-4629, E.D. Pa., 2020 U.S. Dist. LEXIS 29714).
ATLANTA — Reversing and remanding the denial of DIRECTV LLC’s motion to compel arbitration of a putative privacy class claim against it, an 11th Circuit U.S. Court of Appeals panel on Feb. 19 found that the scope of an arbitration provision within a plaintiff’s customer agreement covered a claim that the satellite television carrier violated federal law by sharing customer data with an expert witness in the course of litigating a Telephone Consumer Protection Act (TCPA) lawsuit (Sebastian Cordoba, et al. v. DIRECTV LLC, No. 18-14832, 11th Cir., 2020 U.S. App. LEXIS 5024).
SAN FRANCISCO — A Tesla Inc. customer did not sufficiently establish that a report about him that Experian Information Systems Inc. provided to the automaker was a “consumer report” that was used for an impermissible purpose under the Fair Credit Reporting Act (FCRA), a California federal judge ruled Feb. 19, granting the defendants’ motions to dismiss (Wayne Skiles v. Tesla Inc., et al., No. 3:17-cv-05434, N.D. Calif.).
PHOENIX — A settlement agreement in an Arizona federal class lawsuit over motel guest lists being voluntarily turned over to U.S. Immigration and Customs Enforcement (ICE) agents by Motel 6 Operating L.P. and G6 Hospitality LLC, doing business as Motel 6, that provides up to $10 million was granted final approval on Feb. 18 over protests by the Arizona attorney general who argued in a Feb. 6 amicus brief that the settlement provided the majority of the settlement funds to cy pres recipients (Jane V., et al. v. Motel 6 Operating L.P., et al., No. 18-242, D. Ariz.).
SAN FRANCISCO — Less than a week before a scheduled hearing in the Ninth Circuit U.S. Court of Appeals, two former drivers with Uber Technologies Inc. on Feb. 7 filed a notice of settlement, informing the appeals court that they had reached a confidential settlement with the ride share company over a 2014 database hacking incident (Sasha Antman, et al. v. Uber Technologies Inc. No. 18-16100, 9th Cir.).
GREENBELT, Md. — A Louisiana-based bank sufficiently alleged, under that state’s law, that Marriott International Inc.’s negligence in not adequately protecting its customers’ payment card data led to its being compromised, a Maryland judge overseeing the multidistrict litigation over Marriott’s data breach concluded Feb. 7, partly denying the hotel chain’s motion to dismiss (In re: Marriott International Inc. Customer Data Security Breach Litigation, No. 8:19-md-02879, D. Md., 2020 U.S. Dist. LEXIS 21502).
SAN JOSE, Calif. — Google LLC was hit with another class complaint alleging violation of the Illinois Biometric Information Privacy Act (BIPA) in California federal court on Feb. 6, with an Illinois man claiming that the tech giant has been using its “Google Photos” app to upload and store “millions of ‘face templates’” without users’ knowledge or consent (Brandon Molander v. Google LLC, No. 5:20-cv-00918, N.D. Calif.).
CHICAGO — Clearview AI Inc. was hit with a putative class complaint in Illinois federal court on Feb. 5, marking the third federal suit filed against the tech firm in two weeks over its creation of “a dystopian surveillance database” with the biometric identifiers of millions of people (Anthony Hall v. Clearview AI Inc., et al., No. 1:20-cv-00846, N.D. Ill.).
RALEIGH, N.C. — A Fortnite player who claims that his Epic Games Inc. account was breached and his data was stolen must submit his claims to individual arbitration, a federal judge in North Carolina ruled Feb. 3, staying the Missouri man’s putative class complaint (Michael Heidbreder v. Epic Games, Inc., No. 19-348, E.D. N.C., 2020 U.S. Dist. LEXIS 17878).
CINCINNATI — Six pharmacy chains on Jan. 22 filed a petition for a writ of mandamus in the Sixth Circuit U.S. Court of Appeals that seeks to block the opioid multidistrict litigation court from forcing them to disclose “transaction level” prescription order data (In Re: CVS Pharmacy, Inc., No. 20-3075, 6th Cir.).
PEORIA, Ill. — In a Jan. 31 dismissal motion, a supermarket chain tells an Illinois federal court that negligence, contractual and other class claims brought against it over a 2018-2019 data breach are inadequately pleaded and do not contain the necessary particularity per federal pleading guidelines (Noreen Perdue, et al. v. Hy-Vee Inc., No. 1:19-cv-01330, C.D. Ill.).