Fourth Circuit Reverses Class Certification Of Data Breach Claims

The recent Fourth Circuit decision denying class certification in the long drawn-out Marriott data breach litigation underscores the enforceability of class action waiver provisions in customer contracts.

Background
In 2018, Marriott announced that hackers had accessed the guest reservation database of its Starwood hotel chain. The breach affected 133.7 million guest records, including members of the Starwood Preferred Guest Program (SPG Program). Putative class actions were filed around the country by plaintiffs who asserted myriad contract, tort, and statutory claims against Marriott for failing to adequately safeguard their personal information. These cases were consolidated into a multi-district litigation (MDL¹) proceeding in Maryland federal court.