InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
2nd Circuit requires second look at “design and content” of online user agreement
On September 14, the U.S. Court of Appeals for the Second Circuit reversed a district court’s order denying a credit union’s motion to compel arbitration in a case involving the “unique question” of “whether and how to address incorporation by reference in web-based contracts under New York law.” The plaintiff claimed that the credit union wrongfully assessed and collected overdraft and insufficient funds fees on checking accounts that were not actually overdrawn. After the credit union moved to compel arbitration pursuant to a mandatory arbitration clause and class action waiver provision contained in the account agreement, the plaintiff argued that she was not bound by these provisions because they were not included in the original agreement and the credit union did not notify her when it added them to the agreement. According to the credit union, the plaintiff was on inquiry notice of the modified agreement because she separately agreed to an internet banking agreement that incorporated the modified account agreement by reference, and because the modified account agreement was published on the credit union’s website, which the plaintiff used for online banking. The district court disagreed, finding, among other things, that the hyperlink and language related to the account agreement appeared to be “buried” in the internet banking agreement.
On appeal, the 2nd Circuit held that the district court “erred in engaging in the inquiry notice analysis, which requires an examination of the ‘design and content’ of the webpage, without reviewing the actual screenshots of the web-based contract.” Recognizing that the internet banking agreement was a “clickwrap” or a “scrollwrap” agreement, the appellate court explained that it has “consistently upheld such agreements because the user has affirmatively assented to the terms of the agreement by clicking ‘I agree’ or similar language.” While the plaintiff did not dispute that she signed up for internet banking, this did not end the court’s analysis; according to the 2nd Circuit, when addressing questions concerning digital contract formation, “courts also evaluate visual evidence that demonstrates ‘whether a website user has actual or constructive notice of the conditions.’” The credit union did not provide evidence showing how the internet banking agreement was presented to users—thereby preventing the district court from assessing whether the relevant language and hyperlink were clear and conspicuous. The 2nd Circuit, therefore, instructed the district court to consider on remand the design and content of the internet banking agreement “as it was presented to users” to determine whether the plaintiff agreed to its terms, and to assess whether the account agreements are “clearly identified and available to the users” based on applicable precedents regarding inquiry notice of terms in web-based contracts.
11th Circuit says wasted time, distress can confer FDCPA standing
On September 7, the U.S. Court of Appeals for the Eleventh Circuit vacated the dismissal of an FDCPA action after determining that wasted time and emotional distress can be sufficiently concrete as to confer Article III standing. After the plaintiff fell behind on his monthly condo association payments, the association referred the matter to a law firm (collectively, “defendants”). The defendant law firm eventually filed a claim of lien against the plaintiff’s condo and threatened foreclosure if the plaintiff did not pay more than $10,000 in past-due fees, interest, late fees, attorney’s fees, and costs. The plaintiff sued for violations of the FDCPA and state law, claiming, among other things, that the debt collection letters and claim of lien overstated the amount due by including interest, late fees, and other charges not permitted under Florida law. He also alleged that the law firm violated the FDCPA by filing the claim of lien in the public record, thereby communicating with a third party about his debt without permission. These actions, the plaintiff contended, caused him emotional distress and cost him time, money, and effort when “trying to ‘determine, verify, and dispute the amounts being sought against him.’” The plaintiff eventually voluntarily dismissed the claims against the association, and the law firm moved to dismiss for lack of jurisdiction. The district court determined that the plaintiff lacked standing because the law firm’s actions did not cause him any concrete injury and dismissed the suit.
On appeal, the 11th Circuit disagreed after finding that the time the plaintiff spent trying to determine the correct amount of debt and the emotion distress he suffered during the process were adequate to satisfy constitutional standing requirements. “[Plaintiff] presented evidence that he suffered injuries—including an inaccurate claim of lien against his property; time spent trying to determine the correct amount of his debt, resolve the lien, and avoid the threatened foreclosure; and emotional distress manifesting in a loss of sleep—which are sufficiently tangible to confer Article III standing,” the appellate court wrote. The 11th Circuit explained that while the time and money spent on the FDCPA lawsuit itself could not give rise to a concrete injury for standing purposes, the time and money spent by the plaintiff defending against a legal action taken by a debt collector was “separable” from the costs of bringing the FDCPA suit. Moreover, the appellate court determined that the defendants refusing to release the lien against the plaintiff’s home unless he paid more than what was actually owed “was a tangible harm sufficient to give [plaintiff] standing for his claims that the defendants’ conduct in filing the lien and threatening to foreclose on it violated the FDCPA.”
2nd Circuit upholds public service loan relief settlement
On September 7, the U.S. Court of Appeals for the Second Circuit affirmed a class action settlement reached between a student loan servicer and borrowers who claimed the servicer failed to inform them of a loan forgiveness program for public service employees. As previously covered by InfoBytes, the settlement required the servicer—who denied any allegations of wrongful conduct and damages—to put in place enhancements to identify borrowers who may qualify for Public Service Loan Forgiveness (PSLF) and “distribute comprehensive and accurate information about how to qualify, which are meaningful business practice enhancements.” The servicer was also required to fund a $2.25 million non-profit program to provide counseling to borrowers at all stages of the repayment process. The settlement also approved service awards for the named plaintiffs. In affirming the settlement, the appellate court rejected arguments raised by objectors who claimed, among other things, that the cy pres award would not benefit the class and “that the settlement improperly released monetary claims.”
“The cy pres award funds Public Service Promise and thereby assists all class members in navigating PSLF and determining whether they have a viable individual monetary claim against [the servicer],” the panel wrote, acknowledging that other circuit courts have recognized that class members can indirectly benefit from defendants paying appropriate third parties. “[T]he reforms will also benefit the remaining class members who, for example, are no longer with [the servicer] or who no longer have student loans, by providing them accurate information about the PSLF and helping them determine whether they have viable individual claims for damages,” the 2nd Circuit said.
11th Circuit says plaintiff lacks standing in collection letter case
On September 8, the U.S. Court of Appeals for the Eleventh Circuit issued an en banc decision in Hunstein v. Preferred Collection & Management Services, dismissing the case after determining the plaintiff lacked standing to sue. The majority determined that “[b]ecause Hunstein has alleged only a legal infraction—a ‘bare procedural violation’—and not a concrete harm, we lack jurisdiction to consider his claim.” In April 2021, the 11th Circuit held that transmitting a consumer’s private data to a commercial mail vendor to generate debt collection letters violates Section 1692c(b) of the FDCPA because it is considered transmitting a consumer’s private data “in connection with the collection of any debt.” The decision revived claims that the debt collector’s use of a third-party mail vendor to write, print, and send requests for medical debt repayment violated privacy rights established in the FDCPA. The 11th Circuit last November, however, voted sua sponte to rehear the case en banc and vacated its earlier opinion. (Covered by InfoBytes here.)
The en banc decision relied heavily on the U.S. Supreme Court’s ruling in TransUnion v. Ramirez (covered by InfoBytes here), which clarified the type of concrete injury necessary to establish Article III standing and directed courts “to consider common-law torts as sources of information on whether a statutory violation had caused a concrete harm.” The majority pointed out that when making a common-law tort comparison, courts “do not look at tort elements in a vacuum” but rather “make the comparison between statutory causes of action and those arising under the common law with an eye toward evaluating commonalities between the harms.”
“What harm did this alleged violation cause?” the majority questioned in its opinion, finding that no tangible injury or loss was identified in the complaint. Rather, the plaintiff analogized to the tort of public disclosure. The majority found that this comparison was inapposite, because “the disclosure alleged here lacks the fundamental element of publicity.” Because there was no public disclosure, there was no invasion of privacy and therefore no cognizable harm.
Four judges dissented, arguing that the plaintiff had standing to sue. They opined that the court’s job is not to determine whether the plaintiff stated a viable common-law tort claim, but rather to “compare the ‘harm’ that Congress targeted in the FDCPA and ‘harm’ that the common law sought to address” and to determine whether those harms bear a sufficiently “close relationship.” The dissenting judges found that the plaintiff’s allegations that the delivery of “intensely private information” to the vendor is the “same sort of harm that common-law invasion-of-privacy torts—and in particular, public disclosure of private facts—aim to remedy.” The dissent also stressed that even if the disclosure alleged by the plaintiff is less extensive than the type of disclosure of private information typically at issue in a common law invasion of privacy claim, that is a question of the degree of harm and not a question of the kind of harm, and therefore should not be the basis for dismissal.
11th Circuit affirms denial of title company’s cyber fraud claim
On September 6, the U.S. Court of Appeals for the Eleventh Circuit upheld a district court’s decision to deny insurance coverage to a Florida title company under its Cyber Protection Insurance Policy after it was allegedly “fraudulently induced—by an unknown actor impersonating a mortgage lender—to wire funds to an incorrect account.” The insurance company denied coverage on the basis that the title company did not meet the policy’s requirements. The title company submitted a claim under the cybercrime endorsement of its insurance policy, which includes a deceptive transfer fraud insurance clause that grants coverage provided certain criteria are met, including that the loss resulted from intentionally misleading actions, was done by a person purporting to be an employee, customer, client or vendor, and the authenticity of the wire transfer instructions was verified according to the title company’s internal procedures. The insurance company denied coverage, claiming that: (i) the mortgage lender to whom the funds were intended was not an employee, customer, client or vendor of the title company; and (ii) that the title company failed to verify the transfer request according to its procedures. The district court granted summary judgment in favor of the insurance company, agreeing that coverage did not exist under the plain language of the policy.
On appeal, the 11th Circuit determined that the mortgage lender was not listed as an entity under the plain language of the policy. It further disagreed with the title company’s position that under Florida law, insurance coverage clauses must “be construed as broadly as possible to provide the greatest amount of coverage,” and that the deceptive transfer fraud clause should also include “persons and entities involved in the real estate transaction.” The appellate court noted that “[a]s attractive as that proposition may be, it is simply not what the clause provides,” adding that because the clause “limits coverage to misleading communications ‘sent by a person purporting to be an employee, customer, client or vendor’” it must interpret these terms according to their plain meaning and may not “alter[] the terms bargained to by parties to a contract.”
8th Circuit affirms decision in FDCPA case
On September 6, the U.S. Court of Appeals for the Eighth Circuit affirmed a district court’s order to grant a defendant’s motion for judgment on the pleadings in an FDCPA suit. According to the opinion, the defendant sent the plaintiff a debt collection letter identifying the plaintiff as the attorney for a consumer named in the letter. The consumer was not the plaintiff’s client, the consumer had never identified the plaintiff as her attorney to anyone, and the plaintiff had never identified himself as the consumer’s attorney. When the plaintiff was unable to recognize the consumer’s name, he engaged in an extensive search of his files and records to determine if he had ever represented the consumer, and “found nothing to indicate that she was a past or present client.” The plaintiff filed suit, asserting that the defendant violated § 1692c(b) of the FDCPA when it contacted him regarding the debt of a consumer whom he did not represent and without the consumer’s consent. The plaintiff alleged that he suffered injury as a result of the violation, because his search for the consumer’s records cost him “valuable time and resources that he could have spent working on matters for actual clients.” The district court ruled that the defendant’s letter violated § 1692c(b) but said that the plaintiff lacked standing to sue under the statute and entered judgment on the pleadings against the plaintiff.
On appeal, the 8th Circuit agreed with the district court that the defendant violated the FDCPA when it sent the letter to the attorney, but also agreed with other circuit courts that non-consumers cannot bring § 1692c(b) claims. The appellate court noted that “[b]ecause the purpose of § 1692c(b) is to protect consumers alone, we conclude that [the plaintiff] falls outside § 1692c(b)’s ‘zone of interests’ and thus cannot invoke the protection afforded by it.” The 8th Circuit rejected the plaintiff’s argument that the proper course of action was to remand the case back to state court, where it was originally filed, and affirmed that the decision “was a ruling on the merits of [the plaintiff’s] claim, not on the district court’s jurisdiction.”
3rd Circuit: Arbitration valid despite questions about loan assignment
On September 1, the U.S. Court of Appeals for the Third Circuit concluded that a district court erred in finding that it had the authority to adjudicate the question of arbitrability based on questions concerning the underlying legality of an assignment of a consumer’s loan. The plaintiff took out a personal loan, which included an arbitration clause in the underlying agreement that delegated questions of arbitrability to an arbitrator. The plaintiff’s charged-off debt was assigned to the defendant who filed a lawsuit to recover the unpaid balance but later dismissed the suit rather than litigating. The plaintiff later contended that the defendant reported his loan delinquency to credit agencies in “an unlawful attempt to collect the [l]oan,” and sued, claiming that because the defendant was not licensed in Pennsylvania during the time period at issue it was not lawfully permitted to purchase the debt. The defendant filed a motion to compel arbitration under the purchase agreement with the loan originator. Focusing on the validity of the assignment, the district court denied the defendant’s motion to compel arbitration.
On appeal, the 3rd Circuit concluded that the district court’s only responsibility was to determine whether the parties to the underlying loan “clearly and unmistakably” expressed an agreement to arbitrate the issue of arbitrability, and, if so, the district court was required to send questions about arbitrability to the arbitrator. The appellate court reasoned that even if the underlying assignment is invalidated later, it would not affect whether the initial agreement to arbitrate was valid. The appellate court vacated the district court’s order denying arbitration and remanded with instructions to grant the motion to stay and refer the matter to arbitration. A dissenting judge countered that the plaintiff never signed an arbitration agreement with the defendant, and that because the underlying assignment was invalid, the plaintiff never consented to arbitration with the assignee of the contract.
3rd Circuit vacates dismissal of data breach suit
On September 2, the U.S. Court of Appeals for the Third Circuit vacated the dismissal of a class action alleging that a defendant pharmaceutical research company’s negligence led to a data breach. According to the opinion, the plaintiff, who is a former employee of the defendant’s subsidiary, provided her sensitive personal and financial information in exchange for the defendant’s agreement, pursuant to the plaintiff’s employment agreement, to “take appropriate measures to protect the confidentiality and security” of this information. After plaintiff ended her employment with the company, a hacking group accessed the defendant’s servers through a phishing attack and stole sensitive information pertaining to current and former employees. In addition to exfiltrating the data, the hackers installed malware to encrypt the data stored on the defendant’s servers and held the decryption tools for ransom. The defendant informed current and former employees of the breach and encouraged them to take precautionary measures. To mitigate potential harm, the plaintiff took immediate action by conducting a review of her financial records and credit reports for unauthorized activity, among other things. As a result of the breach, the plaintiff alleged that she has sustained a variety of injuries—primarily the risk of identity theft and fraud—in addition to the investment of time and money to mitigate potential harm. The district court granted the defendant's motion to dismiss based on lack of Article III standing, concluding “that [the plaintiff's] risk of future harm was not imminent, but ‘speculative,’ because she had not yet experienced actual identity theft or fraud.”
On the appeal, the 3rd Circuit noted that the district court “erred in dismissing [the plaintiff’s] contract claims, which are raised in Counts III (breach of implied contract) and IV (breach of contract),” arising from her employment agreement. The appellate court wrote that the plaintiff “has alleged an injury stemming from the breach—the risk of identity theft or fraud—that is sufficiently imminent and concrete,” because the defendant “expressly contracted to ‘take appropriate measures to protect the confidentiality and security’ of plaintiff’s information in [the plaintiff’s] employment agreement.” The appellate court also noted that in an “increasingly digitalized world, an employer's duty to protect its employees’ sensitive information has significantly broadened.” The 3rd Circuit vacated the judgment on all counts and remanded the dispute to the district court for consideration of the merits of the claims.
11th Circuit says one-year statutory notice period cannot be varied
On August 26, the U.S. Court of Appeals for the Eleventh Circuit vacated and remanded a district court’s summary judgment in favor of a bank after determining that the plaintiff-appellants’ claim for statutory repayment is not time-barred. Plaintiffs (Venezuelan citizens residing in Venezuela) maintained personal and commercial bank accounts at a Florida branch of the bank. According to the plaintiffs, a bank employee changed the email account associated with the bank accounts to a new fraudulent email. Identity thieves were later able to bypass security measures on the account, gave correct answers to security questions, and sent documents with signatures that matched ones the bank had on file, resulting in roughly $850,000 being transferred out of one of the accounts. Plaintiffs contended they were locked out of their accounts and struggled to contact the bank for months without success. After eventually regaining access to their accounts, plaintiffs discovered the stolen money and sued for a variety of claims, including fraud, negligence, and breach of contract. They also claimed that the bank was required to refund them for the fraudulent wire transfers under Florida Statutes § 670.202. The bank argued, among other things, that the plaintiffs’ claims were time-barred because they failed to notify the bank about the alleged fraud within 30 days of receiving a bank statement. Plaintiffs responded that the Florida Statutes provide a one-year time period to notify a bank of an unauthorized wire transfer and stated that the time-period could not be modified by agreement. The district court entered summary judgment for the bank, concluding “that the one-year period was modifiable and that the parties had modified it.” The district court also determined that because the bank’s procedures were “commercially reasonable” and followed “in good faith” it was not liable to the plaintiffs to repay the wire transfers.
On appeal, the 11th Circuit held that the plaintiffs were still within their statutory one-year notification period when they notified the bank of the fraudulent wire transfers, and rejected the bank’s argument that it could shorten the notification period to 30 days. The 11th Circuit, in rejecting the bank’s argument determined that it cannot “shift the loss of an unauthorized order to the customer during the statutorily determined period,” adding that “if the one-year statutory notice period could be varied, then banks could insist that customers sign contracts that make the time to demand a refund of a fraudulent payment a day (or even less). That would impair the account holder’s right to a refund and defeat Florida’s intent that banks—not account holders— bear the risk of a fraudulent transfer for the first year following the transfer. And there’s no limiting principle in the text for how short banks could make the statutory refund period.” Pointing out that the bank was unable to identify a limiting principal at oral argument, the appellate court concluded that “if banks could modify the one-year period, there’s no principled way to draw the line as to how short of a refund period is too short.” On remand, the 11th Circuit also instructed the district court to review whether the bank’s security procedures are “commercially reasonable.”
District Court denies request to reverse summary judgment in FDIA suit
On August 29, the U.S. District Court for the Eastern District of Pennsylvania denied a consumer plaintiff’s request to reconsider its summary judgment order against him in a Federal Deposit Insurance Act (FDIA) suit. According to the opinion, the plaintiff accrued debt to a federally-insured, state-chartered bank, which had then assigned that debt to defendants, who were not state-chartered, federally-insured banks. The plaintiff’s debt included interest charges that had accrued at an annual rate between 24.99 percent and 25.99 percent, which the plaintiff argued could not be collected by defendants because the interest exceeded the six percent allowed under Pennsylvania's usury law. The court ruled in favor of the defendants, relying on a recently promulgated FDIC rule that determined that state usury laws are preempted by section 27 of the FDIA in cases where state usury law interferes with state-chartered, federally-insured banks' ability to make loans or when they interfere with a state-chartered, federally-insured bank’s assignee’s efforts to collect on those loans. The plaintiff requested the reconsideration of the district court's summary judgment decision and filed a notice of appeal to the U.S. Court of Appeals for the Third Circuit. In his motion for reconsideration, the plaintiff argued that the court’s previous summary judgment decision was “erroneous” because: (i) the 3rd Circuit held in In re: Community Bank of Northern Virginia that “the FDIA unambiguously excludes non-bank purchasers of debt from its coverage and that deference to the FDIC’s contrary interpretation would, therefore, be inappropriate”; (ii) the FDIC’s rule cannot apply to his debts because such an application would be impermissibly retroactive; and (iii) LIPL fits within the FDIC rule’s exception for “licensing or regulatory requirements.”
The court denied the plaintiff’s motion for reconsideration, holding that the plaintiff “failed to identify an appropriate basis for reconsideration,” as the consumer’s arguments are “either a new argument that could have been presented before judgment was entered or a reprisal of an argument that the Court addressed in its original decision.” The court further noted that it would be “inappropriate for the Court to grant a motion to reconsider under either of those circumstances.” The court went on to determine that the new arguments advanced by the plaintiff were unpersuasive in any event, finding that the 3rd Circuit had not held section 27 of the FDIA to be unambiguous in its meaning and that application of the FDIC’s rule did not create an impermissible retroactive effect.