Marlene Green-Cooper, et al. v. Brinker International, Inc.

Tampa, Florida consumer law lawyers represented Plaintiffs who sued Defendant for negligently failing to protect their credit card information from hackers.



Brinker International, Inc. ("Brinker”), the owner of Chili's

restaurants, faced a cyber-attack in which customers' credit and

debit cards were compromised. Chili's customers have brought a

class action because their information was accessed (and in some

cases used) and disseminated by cybercriminals.



Plaintiff sought to have the District Court d to certify two classes under Federal Rules of Civil Procedure 23(a) and

23(b)(3),5 seeking both injunctive and monetary relief: 1) a nationwide class (or alternatively a statewide class) for negligence and 2)

a California statewide class for California consumer protection

claims based on its unfair business practices state laws. They were

defined as follows:

1. All persons residing in the United States who

made a credit or debit card purchase at any affected Chili's location during the period of the

Data Breach (the "Nationwide Class”).

2. All persons residing in California who made a

credit or debit card purchase at any affected Chili's

location during the period of the Data Breach (the

"California Statewide Class”).

The District Court then certified the nationwide class for the

negligence claim as follows:

All persons residing in the United States who made a

credit or debit card purchase at any affected Chili's location during the period of the Data Breach (March

and April 2018) who: (1) had their data accessed by

cybercriminals and, (2) incurred reasonable expenses

or time spent in mitigation of the consequences of the

Data Breach (the "Nationwide Class”).

The District Court also certified a separate California class under

the state unfair competition laws:

All persons residing in California who made a credit

or debit card purchase at any affected Chili's location

during the period of the Data Breach (March and

April 2018) who: (1) had their data accessed by cybercriminals and, (2) incurred reasonable expenses or

time spent in mitigation of the consequences of the

Data Breach (the "California Statewide Class”).

We then permitted Brinker to appeal these class certifications pursuant to Federal Rule of Civil Procedure 23(f).

In our analysis of a damages methodology based on averages, the focus is on “whether the sample at issue could have been

used to establish liability in an individual action.” Tyson Foods,

Inc. v. Bouaphakeo, 577 U.S. 442, 458, 136 S. Ct. 1036, 1048 (2016).

In this case, each Chili’s customer fitting within the class definitions

experienced a similar injury of a compromised card combined with

some effort to mitigate the harm caused by the compromise. So,

the damages methodology is not “enlarg[ing] the class members’

substantive rights” by giving class members an award for an injury

they could not otherwise prove in an individual action. Id. (internal

alterations, quotation marks, and citation omitted). Through the

District Court’s rigorous analysis, it found that at the class certification stage the damages model was sufficient, and it would be a

“matter for the jury” to decide actual damages at trial. Id. at 459,

136 S. Ct. at 1049. Any individual inquiry into particularized damages resulting from the data breach, such as damages recoverable

due to uncompensated loss caused by compromised personal information, does not predominate over the three categories of common damages inquiries analyzed by the plaintiffs’ expert. We do

not think, therefore, that the District Court’s determination on this

point was an abuse of discretion, so we do not disturb it here.

VACATED IN PART AND REMANDED