Whose Data Anyway? The Inconsistent and Prejudicial Application of Ascertainability in Data Privacy Class Actions

Data breaches are increasingly common. As the frequency of data breaches increases, so too does the frequency of data privacy class action suits. However, as plaintiffs overcome longstanding obstacles to class certification, new challenges are emerging. One issue poses a particular challenge for data privacy plaintiffs: the heightened ascertainability requirement. This requirement conditions certification for damages classes on plaintiffs’ ability to demonstrate an administratively feasible method of identifying class members. Typically, plaintiffs refer to defendants’ records in satisfying this requirement. However, when defendant records do not identify every class member, plaintiffs must resort to other strategies, like submitting affidavits. Courts have discretion in permitting the use of affidavits and are typically hesitant to permit affidavits when plaintiffs plead large damages. Unfortunately for data privacy litigants, the most commonly used federal laws for data privacy class actions typically award large statutory damages. The result is a situation where, if defendants have deficient records, data privacy litigants’ request for certification might be defeated by the very statute they use to get into court. Indeed, courts have already deployed ascertainability to kill data privacy class actions, and in doing so have used the doctrine capriciously and inconsistently. As the Supreme Court has shown little interest in resolving the ascertainability circuit split, the issue will likely persist.

This Note responds by recommending a two-pronged solution. To begin, this Note recommends that Congress pass legislation permitting data privacy suits and awarding nominal damages to data privacy litigants. Simultaneously, courts should use the aforementioned nominal damages to justify adopting the ascertainability jurisprudence seen in consumer classes, where plaintiffs can satisfy ascertainability with affidavits when defendant records are deficient and damages are small. In so doing, Congress and the courts will ensure defendant accountability, certification consistency, and will prevent plaintiffs from suffering due to defendants’ indolent recordkeeping.