In a meaningful development for corporate law professionals, the Fourth Circuit, on August 18, 2023, decertified nearly 20 million putative class action claims originating from a 2018 data breach involving Marriot Hotels. The decision reversed the district court’s certification, requiring the latter to determine from square one if all the supposed plaintiffs had, in effect, forfeited their rights by subscribing to class action waivers as part of their Starwood Preferred Guest Program (“SPG”) registration. This issue is of particular importance for businesses that deploy class action waivers in the context of consumer or data privacy matters.Reed Smith provides more detailed information on this topic.
The Fourth Circuit’s decision underlines the relevance of class action waivers, even in the face of substantial data breaches. The waivers, typically included in the terms and conditions encountered during enrollment in programs such as SPG, can potentially inoculate corporations against substantial class action litigation arising from data breaches. Employing these class action waivers properly can, therefore, serve as a significant legal strategy for companies managing large data volumes and associated vulnerabilities.
However, it is equally imperative for legal professionals to understand that the court’s requirement to verify each plaintiff’s waiver denotes that the effectiveness of class action waivers is still subject to individual scrutiny and legal interpretation. Legal teams should, therefore, also be prepared to prove that these waivers have been knowingly accepted by all parties involved, underlining due diligence in their implementation.
This ruling is likely to not only impact future cases of similar nature but will also offer a detailed outline for companies to insulate themselves against such potential class actions. The importance of such provisions is certainly heightened in a world increasingly reliant on data and technology.