Photo of H. Scott Kelly

Scott is a consumer data and privacy specialist. He regularly defends against data breach lawsuits and class action claims asserted under federal and state consumer-protection statutes (FCRA, FDCPA, TCPA, UCC, UDAAP, RICO). Scott represents companies on an array of data privacy issues, including background screening, consumer reporting, data breaches, ransomware attacks, and related regulatory investigations by the Consumer Financial Protection Bureau (CFPB), Federal Trade Commission (FTC), and state attorneys general.

Plaintiffs who secure a preliminary injunction may now be able to recover attorney’s fees in the Eastern District of Virginia, due to the Fourth Circuit’s departure from its previous position that such plaintiffs are not “prevailing parties” for purposes of recovering attorney’s fees.

On June 12, Judge Hudson granted an emergency motion to stay arbitration proceedings, pending the court’s resolution of the issue of arbitrability in a case pending in the U.S. District Court for the Eastern District of Virginia, Richmond Division. See Sauer Brands, Inc. v. Polytrade Int’l, Inc., No. 3:23-cv-181-HEH, 2023 U.S. Dist. LEXIS 135786 (E.D. Va. June 12, 2023). As getting a case in or out of arbitration may be critical in pursuing a merits-based strategy or mitigating against excessive costs, this case provides several key considerations in structuring arbitration agreements and how to procedurally maneuver when one party proceeds to arbitration unilaterally over the other party’s objection.

The modern “Information Age” has been defined by rapidly increasing interconnectivity and dependence on the internet by consumers and businesses alike. One side effect of these technological advances has been the increasing frequency of cyberattacks and data breaches perpetrated by sophisticated cyber criminals using ever-evolving methods of infiltration. And, as can be expected, along with the increase in data breaches over the past few decades, we have seen the rise of data breach litigation, and in particular, consumer class action litigation against the companies who have been victimized by those data breaches. The Fourth Circuit has seen several high-profile data breach class actions. Such class actions often face difficult uphill battles in proving the necessary elements for class certification, particularly when it comes to defining a theory of harm that can be proven by common evidence across the class. Last month, Judge Gibney of the Richmond Division of the Eastern District of Virginia dismissed one such data breach class action case for a more basic problem: the named plaintiffs could not demonstrate they had suffered any concrete injury sufficient to establish Article III standing at all, let alone damages that could be proven classwide. Holmes v. Elephant Ins. Co., No. 3:22cv487, 2023 WL 4183380 (E.D. Va. June 26, 2023).