I do my very best to make sure that our blog isn’t profusely littered with obscure legal theories and ongoing commentary about Supreme Court rulings.  I do so for the same reason that I try not to make legal jokes on here: most people don’t care, and the things lawyers find interesting/funny are groaningly groan-inducing in others.  (E.g., the basketball court on the top floor at the Supreme Court is called….wait for it….the “highest court in the land.”  I know.  I’m sorry.)

But there are some Supreme Court decisions that merit a closer look for our data privacy purposes, particularly when they impact privacy lawsuits.  Yesterday, we discussed the CCPA and the potential for a new private cause of action.  That right, as mentioned, would spur large numbers of lawsuits, and a fair number of those would be consolidated into class actions.  For simplicity’s sake, a class action is a lawsuit brought on behalf of a group of people with similar or identical claims for whom litigating individually would either be economically unfeasible or practically impossible (because, for instance, there are millions of plaintiffs.)

You can see how a class action in a data breach case might make sense: if all of the data subjects had their data stolen in the same breach, it is far easier to manage a case where proof of the breached company’s failures or negligence in a single, consolidated action, rather than in 500 individual lawsuits.  And, absent a finding of substantial theft of money (through pilfered credit card numbers, for instance), the amount of money at stake in a data breach for any given individual is fairly low – sometimes hovering between zero and ten dollars.  For these very reasons, most of the large data breach lawsuits in this country are class actions: my ten dollar damages may not be enough to justify a lawsuit, but when 500,000 other people join me, there’s a chance for a meaningful settlement.

Here’s where the actual highest courts in the land show up — courts, plural.  The US Supreme Court and various state supreme courts have taken an exceedingly wary view of class actions in recent years.  There’s a tension, to be sure, because courts are hesitant to make it difficult for litigants to have their day in court.  At the same time, supreme courts are responsible for ensuring that lower courts are not overburdened by endless (and endlessly complex) class actions.  These are huge cases (I’ve worked my fair share of them) that take up an enormous amount of time, for the judges and the lawyers alike.

Along those lines, the US Supreme Court (or, to lawyers, “SCOTUS”, like POTUS or FLOTUS, because lawyers have to make everything weird and awful) just this Tuesday announced that courts of appeal had no authority to allow for what is sometimes called “equitable tolling” for late-filed notices of appeal (the document that starts the appellate process).  Courts often have the freedom to allow cases to proceed, even if the filing deadline has passed, under their equitable powers, the ancient authority of courts to do justice when the rules are too stringent.

But it doesn’t always work that way.  In Nutraceutical Corp. v. Lambert, the class plaintiffs’ motion to have the case proceed (“certification”) was denied.  Instead of filing an appeal, the plaintiffs asked the court to reconsider its decision, which it declined to do.  They then filed an appeal.  When the defendants noted that the appeal should have been filed immediately after the denial of class certification, the trial court said that any failure to file wasn’t important, because the class had acted “diligently” in pursuing its rights.  In other words, the plaintiffs may have missed a deadline, but not because they were being dilatory or wasting time; they simply chose to file a motion for reconsideration rather than immediately appeal.  No big deal, right?

Big deal, says SCOTUS.  “The Rules [] express a clear intent to compel rigorous enforcement of Rule 23(f)’s deadline, even where good cause for equitable tolling might otherwise exist.”  The Federal Rules of Civil Procedure expressly make it harder to get tolling in class action cases, and the Supreme Court’s ruling in Nutraceutical Corp. makes it even less likely that lower courts will have discretion to make allowances for slight delays or procedural defects.  It isn’t just a federal issue, because state courts (yes, even including California) are doing the same kind of rollback on class actions.  And, lest you think that this is a Republican/Democrat thing, the ruling in Nutraceutical was unanimous, written by Justice Sotomayor.

So it goes for class actions in general, and therefore, for data privacy class actions in particular.  As we discussed, most of the larger data breach lawsuits are class actions, which means that the process of litigating a data breach claim is a very complicated one.  That may sound like good news for companies defending against breach class actions, but the longer-term takeaway is not quite so good.  The stringency of rules for consumer class actions produced a handful of extremely capable, extremely successful class action plaintiffs’ law firms, and there is every reason to expect a similarly developed data privacy plaintiffs’ bar.

The law is like that, creating equilibrium through trial and error (literally and figuratively).  For every action, there is an equal, although not necessarily directionally opposite, reaction.  Some scholars suggest that the Supreme Court does it intentionally, engaging in “compensating adjustments” to keep the law from moving too much in one direction or the other.  The important lesson is that, regardless of how the substantive law of data privacy develops, and irrespective of how strict procedural rules may be, litigating data privacy cases is never ideal, and the best way to win a data privacy class action is to never be sued in the first place.