Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

In re Home Depot Inc., Customer Data Security Breach Litigation

United States Court of Appeals, Eleventh Circuit

July 25, 2019


          Appeals from the United States District Court for the Northern District of Georgia D.C. Docket No. 1:14-md-02583-TWT

          Before TJOFLAT, WILLIAM PRYOR, and GILMAN, [*] Circuit Judges.


         Following a data breach at Home Depot, the information for tens of millions of credit cards was stolen, and a class of banks who issued the cards sued Home Depot to recover their resulting losses. Home Depot eventually settled with the class. As part of the settlement, Home Depot agreed to pay the reasonable attorney's fees of Class Counsel. The agreement specified that the attorney's fees would be paid separate from and in addition to the class fund, but the parties left the amount of those fees undetermined.

         The District Court awarded Class Counsel $15.3 million in fees. It reached this award using the lodestar method, finding Class Counsel's hours to be reasonable and applying a multiplier of 1.3 to account for the risk the case presented. The Court also used the percentage method as a cross-check to ensure the amount of fees was reasonable.

         On appeal, Home Depot argues that the District Court abused its discretion by applying a multiplier and by compensating Class Counsel for certain time spent on the case-namely, the substantial time spent litigating about a private dispute-resolution process separate from the litigation. Home Depot also says that the District Court's order is not capable of meaningful review. For its part, Class Counsel brings a conditional cross-appeal taking issue with how the District Court conducted the percentage cross-check.

         The main issue underlying the appeal is whether the fee arrangement outlined in the settlement should be characterized as a constructive common fund or as a fee-shifting contract. We hold that this is a contractual fee-shifting case, and the constructive common-fund doctrine does not apply. Once we identify the proper legal framework, the parties' challenges are more easily resolved. We affirm the District Court's decision in all respects except one: it was an abuse of discretion to use a multiplier to account for risk in a fee-shifting case.


         Disputes over attorney's fees are fact-intensive inquiries. As such, a thorough review of the facts is necessary to decide this case.


         In 2014, Home Depot experienced a massive data breach. It started when hackers installed malware on Home Depot's self-checkout kiosks. The malware would siphon off the personal financial information of customers who paid at the kiosks using a credit or debit card. The hackers then made this information, including names, card numbers, expiration dates, and security codes, available for sale on a black-market website. Approximately fifty-six million cards were compromised. It did not take long for a large number of fraudulent transactions to occur using the stolen information.

         A flood of lawsuits followed. Consumers whose personal information was stolen and banks that issued the compromised cards filed over 50 class actions. The United States Judicial Panel on Multidistrict Litigation consolidated these cases in the Northern District of Georgia, where the District Court split the litigation into two tracks: one for the consumers and one for the banks. This appeal arises from the bank track.[1] The District Court appointed Class Counsel to manage the sprawling litigation and ordered Class Counsel to submit quarterly reports to the Court in camera showing the hours billed and expenses incurred.

         The banks filed a consolidated complaint accusing Home Depot of failing to secure its data. They brought claims for negligence and negligence per se on behalf of a national class, and for violations of state consumer-protection statutes on behalf of eight state-specific subclasses. They alleged that, as a result of the data breach, they were forced to cancel and reissue the compromised cards, investigate claims of fraudulent activity, and reimburse customers for fraudulent charges (among other things). The banks sought monetary damages for the cost of these responses, as well as declaratory and injunctive relief to force Home Depot to improve its security measures.

         Home Depot moved to dismiss the complaint on numerous grounds. In the interim, and at the urging of the District Court, the parties proceeded with preliminary discovery. After the District Court ruled on the motion to dismiss, denying it in part, Home Depot answered the complaint. Shortly afterwards, the District Court stayed further action in the case pending settlement negotiations.


         While the litigation unfolded, another process played out that is central to this appeal: the card-brand recovery process. The card brand recovery process is essentially a private dispute-resolution arrangement between Home Depot, the banks, and the card brands (e.g., Visa and Mastercard). It's separate from the litigation, and instead is based on contracts with merchants (like Home Depot) that outline the terms for accepting credit and debit cards as payment. The process is relevant to this appeal because Class Counsel took issue with events that occurred in the card-brand recovery process that affected the class action, and Home Depot argues that Class Counsel should not be compensated for the substantial time spent pursuing the matter.

         Here's how the card-brand recovery process works: The card brands, Visa and MasterCard, have contracts with the banks that issue their branded cards to customers. In turn, the banks have contracts with the merchants who accept the cards as payment.[2] These contracts include regulations for protecting payment-card data against the threat of a data breach. The contracts also establish procedures for merchants to reimburse the banks for losses in the event that card information is compromised in a data breach. As part of the procedure, the card brands investigate to determine if a breach occurred and the financial impact of the breach. The card brands then impose assessments on the merchant to reimburse the banks for their losses.

         That process is what happened in this case. Following the breach, Visa and Mastercard together assessed $120 million against Home Depot to be paid to banks.[3] Home Depot had the option to challenge the assessment and possibly pay a reduced amount. In fact, Mastercard could not recall when a merchant had ever paid the full amount. But instead of fighting the assessments, Home Depot offered to pay the full amount plus a premium.

         Home Depot did so in exchange for the banks releasing their claims against Home Depot. Normally, when a merchant pays these assessments, it does not include a release from liability. In Home Depot's view, if it was going to pay the assessments, it ought to be released from liability too. So Home Depot reached out to Visa, Mastercard, and some of the larger banks to negotiate a deal. These banks were putative class members, who represented up to 80% of the compromised payment cards.

         These parties worked out a deal in which Home Depot would pay the full amount of the assessment, plus about a 10% premium payable to the banks that released their claims against Home Depot. Visa and Mastercard then sent the release offers to some of the larger banks, who had been part of the negotiations with Home Depot. Some of these larger banks then forwarded the release offers to smaller banks that were affiliated with the card brands only through their relationship with the larger banks and had not been involved in the release negotiations. The release offers specifically referenced the ongoing multidistrict litigation ("MDL"), making clear that any banks who accepted the terms would release their claims in that litigation.

         Class Counsel objected. Home Depot had earlier moved the District Court for permission to reach out to putative class members to propose release offers. Because the District Court had not yet ruled on that motion, Class Counsel accused Home Depot of charging ahead without the Court's permission.[4] Class Counsel also complained that the release offers were misleading and coercive. Specifically, the offers did not say how much the banks would receive from the settlement or whether the banks would still receive their share of the assessments even if they did not agree to the settlement. Moreover, the offers were sent during the Thanksgiving holidays, and banks were given only a few days to respond. Class Counsel moved the District Court to vacate the releases, to send curative notices to class members, and to protect class members from misleading settlement attempts going forward.

         The District Court agreed that the release offers were misleading and coercive. But the Court refrained from ruling on Class Counsel's request for relief-vacating the releases, etc.-until it had more information. To that end, the Court allowed Class Counsel to pursue discovery relating to the release offers. The parties clashed repeatedly over the scope of the discovery, leading to a flurry of motions to compel and other discovery disputes. The Court never resolved whether to vacate the release offers; it stayed discovery pending settlement negotiations before the issue came to a head.

         Ultimately, but before Home Depot settled with the class, a significant number of banks accepted the releases, including most of the larger ones. These banks represented 70-80% of the compromised payment cards. In exchange for the releases, Home Depot paid these banks a total of $14.5 million (a premium on top of the $120 million in assessments).


         Returning to the litigation, after the District Court stayed discovery, the parties participated in three rounds of mediation, resulting in a preliminary settlement agreement that the parties presented to the District Court for approval.

         The settlement agreement defined the class as follows:

All banks, credit unions, financial institutions, and other entities in the United States . . . that issued Alerted-on Payment Cards.[5] Excluded from this class are entities that have released all of their claims against Home Depot, but not excluded from the class are independent sponsored entities whose claims were released in connection with [the release offers] made by Mastercard.

         As one would expect, the class definition excludes those banks that released their claims against Home Depot by accepting the release offers. However, "independent sponsored entities"-smaller banks who did not contract directly with the card brands-are not excluded from the class. They are not excluded because Class Counsel contests the validity of their releases, maintaining that these smaller banks were misled and coerced by the offers.

         In exchange for settling the case, Home Depot agreed to provide the following relief. First, Home Depot agreed to pay $25 million into a settlement fund. The fund would be used to pay any taxes due and to pay any service awards to class representatives that the District Court approved.[6] The remainder of the fund would be distributed to class members who had not released their claims. No money in the fund would revert to Home Depot. Second, Home Depot agreed to pay up to $2.25 million to some of the smaller banks (the "independent sponsored entities"). To be eligible, these banks must certify that they did not have sufficient time or information to appropriately consider the release offers-i.e., that they were misled and/or coerced. Home Depot did not create a fund for these payments; if less than $2.25 million was claimed, Home Depot would pay only the amount claimed.

         Finally, Home Depot agreed to adopt security measures to protect its data. These measures include developing a "risk exception" process to identify risks in its data security; designing safeguards to manage any risks identified; monitoring its service providers and vendors to ensure compliance with those safeguards; and implementing an industry recognized security control framework.

         On the matter of attorney's fees, the settlement agreement provided that Home Depot would pay the "reasonable attorneys' fees, costs and expenses" of Class Counsel.[7] But the agreement left the amount of fees undetermined. Pursuant to the agreement, Class Counsel would submit to the District Court a requested amount in fees and expenses, to which Home Depot was free to object. While each party reserved its right to appeal the District Court's decision on attorney's fees, the amount awarded-no matter how large or how small-would not affect the "finality or effectiveness" of the settlement. Notably, the agreement stated that Home Depot's payment of attorney's fees would be "separate from and in addition to" the settlement fund. In other words, payment would not come from the $25 million set aside for class members.

         The District Court approved the settlement agreement, noting that the issue of attorney's fees would be decided separately.


         After the terms of the settlement were approved, the dispute over attorney's fees began.

         Courts calculate attorney's fees using one of two methods: the percentage method or the lodestar method. Under the percentage method, courts award counsel a percentage of the class benefit. See Camden I Condo. Ass'n v. Dunkle, 946 F.2d 768, 774 (11th Cir. 1991). The class benefit generally includes any benefits resulting from the litigation that go to the class. Id. In this Circuit, courts typically award between 20-30%, known as the benchmark range. Id.

         Under the lodestar method, courts determine attorney's fees based on the product of the reasonable hours spent on the case and a reasonable hourly rate. Hensley v. Eckerhart, 461 U.S. 424, 433 (1983). The product is known as the lodestar. Sometimes courts apply to the lodestar a multiplier, also known as an enhancement or an upward adjustment, to reward counsel on top of their hourly rates. See 5 William B. Rubenstein, Newberg on Class Actions § 15:91, p. 353 (5th ed. 2015).

         Class Counsel advised the District Court that it had discretion to choose either the lodestar or the percentage method. Under either approach, Class Counsel requested $18 million in fees. In contrast, Home Depot argued that the District Court had to use the lodestar method, and based on its calculations, a reasonable fee would be about $5.6 million.

         After entertaining a hearing on the motion for attorney's fees and reviewing the parties' briefings, the District Court issued a five-page decision. Following Home Depot's recommendation, the District Court adopted the lodestar approach. The District Court accepted the lodestar proposed by Class Counsel-about $11.7 million-as "an appropriate measure of the time expended by the plaintiffs in this case." Next, it applied the same multiplier used in the consumer-track settlement, 1.3, to arrive at a reasonable fee of $15.3 million.

         Home Depot argued that Class Counsel was not entitled to a multiplier. Home Depot did not suggest that a multiplier was prohibited, only that it was not warranted. In Home Depot's view, Class Counsel did not achieve a great result, the case was not more complex than the consumer track, and Class Counsel did not face greater risks than counsel for the consumer class faced. But the District Court disagreed, finding that a multiplier of 1.3 was "appropriate and justified in light of the exceptional litigation risk that class counsel took in litigating this case."

         While the District Court agreed with Home Depot on using the lodestar method, it declined to adopt the lodestar proposed by Home Depot: about $5.6 million. It rejected the argument that Class Counsel's lodestar should be the same as the one used for counsel in the consumer track:

The Court accepts that the lawyers for the [banks] have expended more effort than the lawyers who represented consumers, that they had to expend more effort than did the consumer lawyers in arriving at a settlement, and that dealing with [banks] rather than consumers added difficulty to the process of litigating this case, such as finding adequate class representatives, and thus required more time and effort.

         The District Court also rejected the argument that Class Counsel should not be compensated for the time spent litigating about the card-brand recovery process, finding that the issues relating to the release offers "were appropriate for plaintiffs to address in this case."

         Finally, the District Court employed the percentage method as a cross-check on the lodestar. The parties agreed that the class benefit should include the $25 million settlement fund, the $2.25 million Home Depot agreed to pay to some smaller banks (the sponsored entities), and $710, 000 in expenses. The parties did not agree on two other potential inputs into the class benefit.

         Class Counsel thought the class benefit should include the $14.5 million premiums that Home Depot paid to banks in exchange for releases as part of the card-brand recovery process. Home Depot urged the District Court not to include the $14.5 million for three reasons. First, the premiums did not go to class members; they went to former putative class members who were no longer part of the class (because they accepted the premiums). Second, the premiums were not prompted by the litigation. And third, Class Counsel tried to stop the premiums, so they should not now receive compensation for them. The District Court sided with Class Counsel and included the premiums, finding that they were "substantially motivated by the pendency of this litigation."

         Class Counsel also asked the District Court to include the $18 million in requested fees in the class benefit. Home Depot objected to including a self-selected fee in the class benefit, pointing out that allowing Class Counsel to determine the size of the benefit by selecting the size of the fee is circular. Instead, Home Depot effectively made the same circular request, proposing that the District Court use the lodestar amount as the fees to include in the benefit. The District Court declined to follow either recommendation, and did not include any attorney's fees in the class benefit, because this was not a "true common fund analysis."

         Thus, adding the $25 million settlement fund, the $2.25 million that Home Depot agreed to pay to the sponsored entities, the $710, 000 in expenses, and the $14.5 million premiums, the class benefit equaled about $42.5 million.[8] As an attorney's fee of $15.3 million is slightly more than a third of the class benefit, the District Court concluded that the percentage cross-check supported the reasonableness of the fee award.

         In sum, the District Court ordered Home Depot to pay Class Counsel $15.3 million in fees. It reached this award using the lodestar method, under which it accepted the lodestar proposed by Class Counsel and applied a multiplier of 1.3 to account for risk. The Court also used a percentage cross-check, which, after including the $14.5 million premiums in the class benefit and excluding any attorney's fees, showed that the fee award was slightly more than a third of the class benefit, which the Court found to be reasonable.


         Home Depot appeals the award of attorney's fees, raising four issues for our consideration. First, whether it was an abuse of discretion for the District Court to apply a multiplier. Second, whether it was an abuse of discretion to compensate Class Counsel for time spent litigating about the card-brand recovery process. Third, whether it was an abuse of discretion to compensate Class Counsel for time spent soliciting class representatives. And fourth, whether the District Court's order fails to provide sufficient detail for meaningful appellate review.

         Class Counsel also brings a cross-appeal-conditioned on the outcome of Home Depot's appeal. Class Counsel asks us to reach their cross-appeal only if, in response to Home Depot's appeal, we reverse or modify the attorney's fee award and remand to the District Court for reconsideration. In that event, Class Counsel challenges the District Court's decision not to include attorney's fees in the class benefit when it conducted the percentage cross-check. Thus, if we remand the case, Class Counsel asks us to instruct the District Court to include attorney's fees in the class benefit when it performs the percentage method-either as a crosscheck or in the first instance.[9] Necessarily, then, we address the issues raised in Home Depot's appeal first.


         We review a district court's award of attorney's fees for abuse of discretion. Muransky v. Godiva Chocolatier, Inc., 922 F.3d 1175, 1194 (11th Cir. 2019). "An abuse of discretion occurs if the judge fails to apply the proper legal standard or to follow proper procedures in making the determination, or bases an award upon findings of fact that are clearly erroneous." ACLU of Ga. v. Barnes, 168 F.3d 423, 427 (11th Cir. 1999) (quotation omitted). "Under this standard, district courts have great latitude in setting fee awards in class action cases." Muransky, 922 F.3d at 1194.


         Before tackling the specific issues raised in Home Depot's appeal, we address a preliminary question on which much of the subsequent analysis turns: whether this is a common-fund or fee-shifting case. Different rules and principles govern common-fund cases and fee-shifting cases. Because this fee arrangement defies easy categorization, we start with some background on these concepts.


         In the American legal system, each party is traditionally responsible for its own attorney's fees. Hardt v. Reliance Standard Life Ins. Co., 560 U.S. 242, 253 (2010) ("Each litigant pays his own attorney's fees, win or lose, unless a statute or contract provides otherwise."); see also Alyeska Pipeline Serv. Co. v. Wilderness Soc'y, 421 U.S. 240, 247 (1975) ("In the United States, the prevailing litigant is ordinarily not entitled to collect a reasonable attorneys' fee from the loser."). This principle is known as the American Rule. Hardt, 560 U.S. at 253.

         There are three exceptions to the American Rule: (1) when a statute grants courts the authority to direct the losing party to pay attorney's fees; (2) when the parties agree in a contract that one party will pay attorney's fees; and (3) when a court orders one party to pay attorney's fees for acting in bad faith.[10]See Rubenstein, supra § 15:25, p. 59-60; see also Alyeska Pipeline, 421 U.S. at ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.