Law professor Eric Goldman, who's spoken out about the broken class action system in the past, has another ridiculous example, this time involving Heartland Payment Systems. You may recall Heartland as being the company that had the largest security breach ever (at the time), losing data on over 100 million credit cards. A class action lawsuit (of course) followed, and Heartland agreed to pay up to anyone who could show that they were a victim of fraud from the loss. The company didn't have cardholder addresses, so it spent $1.5 million to advertise the settlement, and estimated that over 80% of the potential class saw an ad at least 2.5 times. Either way, not too many claims came in. A total of 290 claims were made, but only 11 were found to be valid.
Heartland had to pay a maximum of $175 to those individuals. Assuming it did pay the maximum, that means the "victims" of the breach got a grand total of $1925 (perhaps less). According to the settlement agreement, Heartland was supposed to pay out at least $1 million to victims (and up to $2.4 million). If less than $1 million worth of victims were found, the rest would go to non-profit organizations focused on protecting consumer privacy rights. That leaves $998,075 for those non-profits.
So, let's summarize:
And, of course, Heartland also ended up paying its own lawyers a ton. In the end, this system involved Heartland paying many millions of dollars... to benefit a "class" of 11 people and giving them less than $2,000.
- Actual victims got: $1,925
- Heartland spent $1.5 million to find the people to give out that $1,925.
- Somewhere around $998,075 goes to non-profits
- The lawyers who brought the lawsuit? They got $606,192.50. For helping 11 people get less than $200 each.
02 May 2012
Dissecting a class action lawsuit
A column at TechDirt crunches the numbers:
I quibble with your last characterization of "Heartland paying many millions of dollars... to benefit a 'class' of 11 people and giving them less than $2,000." Heartland benefitted a class of 11, and had to give about 1 million dollars to non-profits. Hearland was also punished their total payout, cost of advertising, plus lawyer's fees for having bad practices that allowed 100 million credit card numbers to be exposed.
ReplyDeleteYeah, it would have been nice if there had been more direct payouts. It is unclear from that article whether damages per claimant were actually capped at $175 which would be extremely bad or if that was the maximum amount of damage incurred by any class member which just means that actual damages where thankfully low in this case.
So you can be unhappy with the lawyer's fees and low direct payouts but I bet that Heartland has taken big steps to prevent another massive leak.
Plus which, the class action lawsuit was successful, which should serve as a warning to other companies to ensure better security for customer data.
Delete"but I bet that Heartland has taken big steps to prevent another massive leak"
DeleteUnfortunately, no. None of the payment systems are taking additional steps to safeguard the information because it has been determined that paying these settlements is cheaper than fixing the problem.
Oops, I also see that it is not *your* characterization but the author of the original article's characterization.
ReplyDeleteHeartland seems to have negotiated a good deal in restricting the settlement class to those who could prove they were a fraud victim. I would have expected every person whose credit card data was exposed to be part of the settlement class and entitled to a small payout, while people with proof of fraud entitled to a larger payout.
ReplyDeleteLarge corporations are against class-action lawsuits because this is a weapon that can hurt them. If it turned out that Chase bank illegally charged consumers $20 over the course of a year due to a bad interest calculation on their credit card, without class-action lawsuit, their response would be "sorry, and if you don't like it, you're free to find another bank, but we're not giving you your money back". Not much incentive to be precise, is there?
ReplyDeleteClass-action lawsuits allow consumers to band together to make sure that large corporations can't quietly pick their pockets without reprisal.
I agree with NoPolitician. It is a shame that we don't have a better way to address corporate malfeasance, but at least there's something to keep them honest.
ReplyDeleteIronically, the cigarette class-action suits destroyed a lot of law firms. The cigarette lawyers made so much money for the firms that they didn't feel like sharing it with the partners who were only bringing in a few million.