In Re: THE HOME DEPOT INC., CUSTOMER DATA SECURITY BREACH LITIGATION.
HOME DEPOT, INC. (THE), THE HOME DEPOT U.S.A., INC., Defendants-Appellants Cross Appellees. NORTHEASTERN ENGINEERS FEDERAL CREDIT UNION, PITTSFIELD COOPERATIVE BANK, PHENIX-GIRARD BANK, KELSEY O'BRIEN, FIRST FINANCIAL CREDIT UNION, FIRST CHOICE FEDERAL CREDIT UNION, SOUTHERN CHAUTAUQUA FEDERAL CREDIT UNION, GARY LOWENTHAL, SARA SAFFRAN, BARBARA SAFFRAN, et al., Plaintiffs-Appellees Cross Appellants, HOWARD STERN, et al., Plaintiffs,
Appeals from the United States District Court for the
Northern District of Georgia D.C. Docket No.
TJOFLAT, WILLIAM PRYOR, and GILMAN, [*] Circuit Judges.
TJOFLAT, CIRCUIT JUDGE
a data breach at Home Depot, the information for tens of
millions of credit cards was stolen, and a class of banks who
issued the cards sued Home Depot to recover their resulting
losses. Home Depot eventually settled with the class. As part
of the settlement, Home Depot agreed to pay the reasonable
attorney's fees of Class Counsel. The agreement specified
that the attorney's fees would be paid separate from and
in addition to the class fund, but the parties left the
amount of those fees undetermined.
District Court awarded Class Counsel $15.3 million in fees.
It reached this award using the lodestar method, finding
Class Counsel's hours to be reasonable and applying a
multiplier of 1.3 to account for the risk the case presented.
The Court also used the percentage method as a cross-check to
ensure the amount of fees was reasonable.
appeal, Home Depot argues that the District Court abused its
discretion by applying a multiplier and by compensating Class
Counsel for certain time spent on the case-namely, the
substantial time spent litigating about a private
dispute-resolution process separate from the litigation. Home
Depot also says that the District Court's order is not
capable of meaningful review. For its part, Class Counsel
brings a conditional cross-appeal taking issue with how the
District Court conducted the percentage cross-check.
main issue underlying the appeal is whether the fee
arrangement outlined in the settlement should be
characterized as a constructive common fund or as a
fee-shifting contract. We hold that this is a contractual
fee-shifting case, and the constructive common-fund doctrine
does not apply. Once we identify the proper legal framework,
the parties' challenges are more easily resolved. We
affirm the District Court's decision in all respects
except one: it was an abuse of discretion to use a multiplier
to account for risk in a fee-shifting case.
over attorney's fees are fact-intensive inquiries. As
such, a thorough review of the facts is necessary to decide
2014, Home Depot experienced a massive data breach. It
started when hackers installed malware on Home Depot's
self-checkout kiosks. The malware would siphon off the
personal financial information of customers who paid at the
kiosks using a credit or debit card. The hackers then made
this information, including names, card numbers, expiration
dates, and security codes, available for sale on a
black-market website. Approximately fifty-six million cards
were compromised. It did not take long for a large number of
fraudulent transactions to occur using the stolen
of lawsuits followed. Consumers whose personal information
was stolen and banks that issued the compromised cards filed
over 50 class actions. The United States Judicial Panel on
Multidistrict Litigation consolidated these cases in the
Northern District of Georgia, where the District Court split
the litigation into two tracks: one for the consumers and one
for the banks. This appeal arises from the bank
track. The District Court appointed Class Counsel
to manage the sprawling litigation and ordered Class Counsel
to submit quarterly reports to the Court in camera
showing the hours billed and expenses incurred.
banks filed a consolidated complaint accusing Home Depot of
failing to secure its data. They brought claims for
negligence and negligence per se on behalf of a
national class, and for violations of state
consumer-protection statutes on behalf of eight
state-specific subclasses. They alleged that, as a result of
the data breach, they were forced to cancel and reissue the
compromised cards, investigate claims of fraudulent activity,
and reimburse customers for fraudulent charges (among other
things). The banks sought monetary damages for the cost of
these responses, as well as declaratory and injunctive relief
to force Home Depot to improve its security measures.
Depot moved to dismiss the complaint on numerous grounds. In
the interim, and at the urging of the District Court, the
parties proceeded with preliminary discovery. After the
District Court ruled on the motion to dismiss, denying it in
part, Home Depot answered the complaint. Shortly afterwards,
the District Court stayed further action in the case pending
the litigation unfolded, another process played out that is
central to this appeal: the card-brand recovery process. The
card brand recovery process is essentially a private
dispute-resolution arrangement between Home Depot, the banks,
and the card brands (e.g., Visa and Mastercard). It's
separate from the litigation, and instead is based on
contracts with merchants (like Home Depot) that outline the
terms for accepting credit and debit cards as payment. The
process is relevant to this appeal because Class Counsel took
issue with events that occurred in the card-brand recovery
process that affected the class action, and Home Depot argues
that Class Counsel should not be compensated for the
substantial time spent pursuing the matter.
how the card-brand recovery process works: The card brands,
Visa and MasterCard, have contracts with the banks that issue
their branded cards to customers. In turn, the banks have
contracts with the merchants who accept the cards as
payment. These contracts include regulations for
protecting payment-card data against the threat of a data
breach. The contracts also establish procedures for merchants
to reimburse the banks for losses in the event that card
information is compromised in a data breach. As part of the
procedure, the card brands investigate to determine if a
breach occurred and the financial impact of the breach. The
card brands then impose assessments on the merchant to
reimburse the banks for their losses.
process is what happened in this case. Following the breach,
Visa and Mastercard together assessed $120 million against
Home Depot to be paid to banks. Home Depot had the option to
challenge the assessment and possibly pay a reduced amount.
In fact, Mastercard could not recall when a merchant had ever
paid the full amount. But instead of fighting the
assessments, Home Depot offered to pay the full amount plus a
Depot did so in exchange for the banks releasing their claims
against Home Depot. Normally, when a merchant pays these
assessments, it does not include a release from liability. In
Home Depot's view, if it was going to pay the
assessments, it ought to be released from liability too. So
Home Depot reached out to Visa, Mastercard, and some of the
larger banks to negotiate a deal. These banks were putative
class members, who represented up to 80% of the compromised
parties worked out a deal in which Home Depot would pay the
full amount of the assessment, plus about a 10% premium
payable to the banks that released their claims against Home
Depot. Visa and Mastercard then sent the release offers to
some of the larger banks, who had been part of the
negotiations with Home Depot. Some of these larger banks then
forwarded the release offers to smaller banks that were
affiliated with the card brands only through their
relationship with the larger banks and had not been involved
in the release negotiations. The release offers specifically
referenced the ongoing multidistrict litigation
("MDL"), making clear that any banks who accepted
the terms would release their claims in that litigation.
Counsel objected. Home Depot had earlier moved the District
Court for permission to reach out to putative class members
to propose release offers. Because the District Court had not
yet ruled on that motion, Class Counsel accused Home Depot of
charging ahead without the Court's
permission. Class Counsel also complained that the
release offers were misleading and coercive. Specifically,
the offers did not say how much the banks would receive from
the settlement or whether the banks would still receive their
share of the assessments even if they did not agree to the
settlement. Moreover, the offers were sent during the
Thanksgiving holidays, and banks were given only a few days
to respond. Class Counsel moved the District Court to vacate
the releases, to send curative notices to class members, and
to protect class members from misleading settlement attempts
District Court agreed that the release offers were misleading
and coercive. But the Court refrained from ruling on Class
Counsel's request for relief-vacating the releases,
etc.-until it had more information. To that end, the Court
allowed Class Counsel to pursue discovery relating to the
release offers. The parties clashed repeatedly over the scope
of the discovery, leading to a flurry of motions to compel
and other discovery disputes. The Court never resolved
whether to vacate the release offers; it stayed discovery
pending settlement negotiations before the issue came to a
but before Home Depot settled with the class, a significant
number of banks accepted the releases, including most of the
larger ones. These banks represented 70-80% of the
compromised payment cards. In exchange for the releases, Home
Depot paid these banks a total of $14.5 million (a premium on
top of the $120 million in assessments).
to the litigation, after the District Court stayed discovery,
the parties participated in three rounds of mediation,
resulting in a preliminary settlement agreement that the
parties presented to the District Court for approval.
settlement agreement defined the class as follows:
All banks, credit unions, financial institutions, and other
entities in the United States . . . that issued Alerted-on
Payment Cards. Excluded from this class are entities that
have released all of their claims against Home Depot, but not
excluded from the class are independent sponsored entities
whose claims were released in connection with [the release
offers] made by Mastercard.
would expect, the class definition excludes those banks that
released their claims against Home Depot by accepting the
release offers. However, "independent sponsored
entities"-smaller banks who did not contract directly
with the card brands-are not excluded from the class. They
are not excluded because Class Counsel contests the validity
of their releases, maintaining that these smaller banks were
misled and coerced by the offers.
exchange for settling the case, Home Depot agreed to provide
the following relief. First, Home Depot agreed to pay $25
million into a settlement fund. The fund would be used to pay
any taxes due and to pay any service awards to class
representatives that the District Court
approved. The remainder of the fund would be
distributed to class members who had not released their
claims. No money in the fund would revert to Home Depot.
Second, Home Depot agreed to pay up to $2.25 million to some
of the smaller banks (the "independent sponsored
entities"). To be eligible, these banks must certify
that they did not have sufficient time or information to
appropriately consider the release offers-i.e., that they
were misled and/or coerced. Home Depot did not create a fund
for these payments; if less than $2.25 million was claimed,
Home Depot would pay only the amount claimed.
Home Depot agreed to adopt security measures to protect its
data. These measures include developing a "risk
exception" process to identify risks in its data
security; designing safeguards to manage any risks
identified; monitoring its service providers and vendors to
ensure compliance with those safeguards; and implementing an
industry recognized security control framework.
matter of attorney's fees, the settlement agreement
provided that Home Depot would pay the "reasonable
attorneys' fees, costs and expenses" of Class
Counsel. But the agreement left the amount of fees
undetermined. Pursuant to the agreement, Class Counsel would
submit to the District Court a requested amount in fees and
expenses, to which Home Depot was free to object. While each
party reserved its right to appeal the District Court's
decision on attorney's fees, the amount awarded-no matter
how large or how small-would not affect the "finality or
effectiveness" of the settlement. Notably, the agreement
stated that Home Depot's payment of attorney's fees
would be "separate from and in addition to" the
settlement fund. In other words, payment would not come from
the $25 million set aside for class members.
District Court approved the settlement agreement, noting that
the issue of attorney's fees would be decided separately.
the terms of the settlement were approved, the dispute over
attorney's fees began.
calculate attorney's fees using one of two methods: the
percentage method or the lodestar method. Under the
percentage method, courts award counsel a percentage of the
class benefit. See Camden I Condo. Ass'n v.
Dunkle, 946 F.2d 768, 774 (11th Cir. 1991). The class
benefit generally includes any benefits resulting from the
litigation that go to the class. Id. In this
Circuit, courts typically award between 20-30%, known as the
benchmark range. Id.
the lodestar method, courts determine attorney's fees
based on the product of the reasonable hours spent on the
case and a reasonable hourly rate. Hensley v.
Eckerhart, 461 U.S. 424, 433 (1983). The product is
known as the lodestar. Sometimes courts apply to the lodestar
a multiplier, also known as an enhancement or an upward
adjustment, to reward counsel on top of their hourly rates.
See 5 William B. Rubenstein, Newberg on Class
Actions § 15:91, p. 353 (5th ed. 2015).
Counsel advised the District Court that it had discretion to
choose either the lodestar or the percentage method. Under
either approach, Class Counsel requested $18 million in fees.
In contrast, Home Depot argued that the District Court had to
use the lodestar method, and based on its calculations, a
reasonable fee would be about $5.6 million.
entertaining a hearing on the motion for attorney's fees
and reviewing the parties' briefings, the District Court
issued a five-page decision. Following Home Depot's
recommendation, the District Court adopted the lodestar
approach. The District Court accepted the lodestar proposed
by Class Counsel-about $11.7 million-as "an appropriate
measure of the time expended by the plaintiffs in this
case." Next, it applied the same multiplier used in the
consumer-track settlement, 1.3, to arrive at a reasonable fee
of $15.3 million.
Depot argued that Class Counsel was not entitled to a
multiplier. Home Depot did not suggest that a multiplier was
prohibited, only that it was not warranted. In Home
Depot's view, Class Counsel did not achieve a great
result, the case was not more complex than the consumer
track, and Class Counsel did not face greater risks than
counsel for the consumer class faced. But the District Court
disagreed, finding that a multiplier of 1.3 was
"appropriate and justified in light of the exceptional
litigation risk that class counsel took in litigating this
the District Court agreed with Home Depot on using the
lodestar method, it declined to adopt the lodestar proposed
by Home Depot: about $5.6 million. It rejected the argument
that Class Counsel's lodestar should be the same as the
one used for counsel in the consumer track:
The Court accepts that the lawyers for the [banks] have
expended more effort than the lawyers who represented
consumers, that they had to expend more effort than did the
consumer lawyers in arriving at a settlement, and that
dealing with [banks] rather than consumers added difficulty
to the process of litigating this case, such as finding
adequate class representatives, and thus required more time
District Court also rejected the argument that Class Counsel
should not be compensated for the time spent litigating about
the card-brand recovery process, finding that the issues
relating to the release offers "were appropriate for
plaintiffs to address in this case."
the District Court employed the percentage method as a
cross-check on the lodestar. The parties agreed that the
class benefit should include the $25 million settlement fund,
the $2.25 million Home Depot agreed to pay to some smaller
banks (the sponsored entities), and $710, 000 in expenses.
The parties did not agree on two other potential inputs into
the class benefit.
Counsel thought the class benefit should include the $14.5
million premiums that Home Depot paid to banks in exchange
for releases as part of the card-brand recovery process. Home
Depot urged the District Court not to include the $14.5
million for three reasons. First, the premiums did not go to
class members; they went to former putative class members who
were no longer part of the class (because they accepted the
premiums). Second, the premiums were not prompted by the
litigation. And third, Class Counsel tried to stop the
premiums, so they should not now receive compensation for
them. The District Court sided with Class Counsel and
included the premiums, finding that they were
"substantially motivated by the pendency of this
Counsel also asked the District Court to include the $18
million in requested fees in the class benefit. Home Depot
objected to including a self-selected fee in the class
benefit, pointing out that allowing Class Counsel to
determine the size of the benefit by selecting the size of
the fee is circular. Instead, Home Depot effectively made the
same circular request, proposing that the District Court use
the lodestar amount as the fees to include in the benefit.
The District Court declined to follow either recommendation,
and did not include any attorney's fees in the class
benefit, because this was not a "true common fund
adding the $25 million settlement fund, the $2.25 million
that Home Depot agreed to pay to the sponsored entities, the
$710, 000 in expenses, and the $14.5 million premiums, the
class benefit equaled about $42.5 million. As an
attorney's fee of $15.3 million is slightly more than a
third of the class benefit, the District Court concluded that
the percentage cross-check supported the reasonableness of
the fee award.
the District Court ordered Home Depot to pay Class Counsel
$15.3 million in fees. It reached this award using the
lodestar method, under which it accepted the lodestar
proposed by Class Counsel and applied a multiplier of 1.3 to
account for risk. The Court also used a percentage
cross-check, which, after including the $14.5 million
premiums in the class benefit and excluding any
attorney's fees, showed that the fee award was slightly
more than a third of the class benefit, which the Court found
to be reasonable.
Depot appeals the award of attorney's fees, raising four
issues for our consideration. First, whether it was an abuse
of discretion for the District Court to apply a multiplier.
Second, whether it was an abuse of discretion to compensate
Class Counsel for time spent litigating about the card-brand
recovery process. Third, whether it was an abuse of
discretion to compensate Class Counsel for time spent
soliciting class representatives. And fourth, whether the
District Court's order fails to provide sufficient detail
for meaningful appellate review.
Counsel also brings a cross-appeal-conditioned on the outcome
of Home Depot's appeal. Class Counsel asks us to reach
their cross-appeal only if, in response to Home Depot's
appeal, we reverse or modify the attorney's fee award and
remand to the District Court for reconsideration. In that
event, Class Counsel challenges the District Court's
decision not to include attorney's fees in the class
benefit when it conducted the percentage cross-check. Thus,
if we remand the case, Class Counsel asks us to instruct the
District Court to include attorney's fees in the class
benefit when it performs the percentage method-either as a
crosscheck or in the first instance. Necessarily, then, we
address the issues raised in Home Depot's appeal first.
review a district court's award of attorney's fees
for abuse of discretion. Muransky v. Godiva Chocolatier,
Inc., 922 F.3d 1175, 1194 (11th Cir. 2019). "An
abuse of discretion occurs if the judge fails to apply the
proper legal standard or to follow proper procedures in
making the determination, or bases an award upon findings of
fact that are clearly erroneous." ACLU of Ga. v.
Barnes, 168 F.3d 423, 427 (11th Cir. 1999) (quotation
omitted). "Under this standard, district courts have
great latitude in setting fee awards in class action
cases." Muransky, 922 F.3d at 1194.
tackling the specific issues raised in Home Depot's
appeal, we address a preliminary question on which much of
the subsequent analysis turns: whether this is a common-fund
or fee-shifting case. Different rules and principles govern
common-fund cases and fee-shifting cases. Because this fee
arrangement defies easy categorization, we start with some
background on these concepts.
American legal system, each party is traditionally
responsible for its own attorney's fees. Hardt v.
Reliance Standard Life Ins. Co., 560 U.S. 242, 253
(2010) ("Each litigant pays his own attorney's fees,
win or lose, unless a statute or contract provides
otherwise."); see also Alyeska Pipeline Serv. Co. v.
Wilderness Soc'y, 421 U.S. 240, 247 (1975)
("In the United States, the prevailing litigant is
ordinarily not entitled to collect a reasonable
attorneys' fee from the loser."). This principle is
known as the American Rule. Hardt, 560 U.S. at 253.
are three exceptions to the American Rule: (1) when a statute
grants courts the authority to direct the losing party to pay
attorney's fees; (2) when the parties agree in a contract
that one party will pay attorney's fees; and (3) when a
court orders one party to pay attorney's fees for acting
in bad faith.See Rubenstein, supra
§ 15:25, p. 59-60; see also Alyeska Pipeline,
421 U.S. at ...