Skip to main content

Home Depot Data Breach Litigation: Venue and Consolidation

Written by Kevin McGinty

Substantive litigation in the flood of lawsuits concerning the recent Home Depot data breach awaits a determination of where the cases will be heard.  Numerous overlapping lawsuits have been filed in courts throughout the United States asserting claims on behalf of consumers and financial institutions arising from the massive theft of credit card data that was confirmed by Home Depot in September.

Plaintiffs in the first such action to go on file, Solak v. The Home Depot, Inc., have filed a motion with the Judicial Panel on Multidistrict Litigation (“JPML”) to transfer eleven cases, currently pending in seven separate federal courts, to the Northern District of Georgia for coordinated pretrial proceedings.  The Northern District of Georgia, where Solak is currently pending, sits in Atlanta, where Home Depot has its corporate headquarters.

Unsurprisingly, Home Depot supports the request to transfer the data breach cases to Atlanta, as do most of the plaintiffs in the other pending actions.  Opposing transfer to Atlanta are plaintiffs in three actions who support transfer to a single court, but oppose venue in Atlanta, urging that the JPML instead transfer the cases to the Middle District of Florida (in Orlando).  The dissident plaintiffs, one of whom brought suit in Orlando, argue that the Middle District of Florida would provide an equally convenient location, with superior transportation access and greater judicial and administrative capacity to handle the associated litigation.  Potentially at stake for the competing plaintiffs’ groups is control over the litigation, as to which plaintiffs who first filed in the transferee court would have an initial advantage.  The JPML, however, is not limited to the venues proposed by the two plaintiffs’ groups, and could send the case to any federal court it deems appropriate based on location, expertise and capacity to handle the dispute.  Likewise, the ultimate designation of lead counsel will be driven by substantive considerations and not merely by the venue to which cases are transferred.  The JPML will conduct a hearing on the motion to transfer on December 4, 2014 in Charleston, SC, and thereafter issue an order indicating where the cases will be transferred.  Proceedings relative to motions to dismiss, class certification, discovery and settlement will all await the resolution of the transfer motion.

Also presently at issue is potential consolidation of pending lawsuits.  Transfer of related actions to a single court does not mean that the transferred cases are consolidated into a single lawsuit.  Cases involving distinct classes asserting non-overlapping theories of recovery can remain as separate actions, coordinated as to scheduling and common discovery issues, but separate for all other purposes (including, most significantly, class certification, dispositive motions, settlement and trial).

Currently pending is a motion by Home Depot seeking consolidation of Solak and First Choice Federal Credit Union v. The Home Depot Inc., a class action also brought in the Northern District of Georgia asserting claims on behalf of financial institutions that issued credit cards to consumers whose data was stolen by the hackers who broke into the Home Depot network.

Home Depot argues that consolidation is appropriate because both cases, while advancing different theories on behalf of distinct classes, address common factual issues as to Home Depot’s data security practices that arise from a single event or occurrence.  First Choice responds that the two cases should not be consolidated because they raise non-overlapping theories of recovery on behalf of unrelated classes – consumers in Solak, and financial institutions in First Choice – as to which Home Depot owes distinct legal duties.

Consolidation of pending cases would streamline the litigation and reduce the burden and expense to Home Depot of its defense even though the distinct legal claims of consumers and financial institutions would have to be addressed separately.  Home Depot’s consolidation motion is now pending and awaits decision by a Northern District of Georgia judge.

Subscribe To Viewpoints

Author

Cynthia J. Larose

Member / Co-Chair, Privacy & Cybersecurity Practice

Cynthia J. Larose is Chair of the firm's Privacy & Cybersecurity Practice, a Certified Information Privacy Professional-US (CIPP-US), and a Certified Information Privacy Professional-Europe (CIPP-E). She works with clients in various industries to develop comprehensive information security programs on the front end, and provides timely counsel when it becomes necessary to respond to a data breach.