SHH! Entering Confidential Arbitration: When User Terms and Conditions Defeat a Data Privacy Litigation
Arbitration agreements are increasingly common for manufacturers of consumer electronics equipment (you read all of those small print terms and conditions when you purchased your new smart phone, right?). A case this year underscored how companies can proactively use binding arbitration agreements to manage litigation risk. In re: Wyze Data Incident Litigation, Case No. C20-0282-JCC (W.D. Wa. 2020).
In Wyze, purchasers of internet-enabled security cameras filed a putative class action against the camera’s manufacturer. According to plaintiffs, once they powered up the cameras and downloaded a monitoring application to their smartphones, defendant’s application directed plaintiffs to establish a user account. Defendant collected plaintiffs’ personally identifiable information through this process. This included usernames, e-mail addresses, and WiFi network details. Defendant unintentionally exposed this repository of information to third parties in a December 2019 data breach. After multiple class actions were filed against defendant by various groups of purchasers, the cases were consolidated before a Washington federal court.
Defendant moved to compel arbitration of these claims and have the litigations dismissed. How so? Beginning in July 2018, defendant implemented a “clickwrap” arrangement describing its terms and conditions. When defendant first starting using this agreement in 2018, users had to click a box indicating that they agreed to defendant’s terms and conditions, available via a hyperlink, before continuing. However, defendant later modified the clickwrap process, making the link to its terms and conditions even more prominent and requiring established account holders to click the “Agree” box (meaning, in legalese, they indicated an affirmative assent to the terms and conditions)—before they could again access their cameras with their smartphones.
What was included in these terms and conditions? A strictly worded arbitration provision labeled “DISPUTE RESOLUTION AND ARBITRATION/WAIVER OF CLASS ACTION AND JURY TRIAL.” This provision provided that [defendant] and you agree to exclusively arbitrate all disputes and claims . . . THIS ARBITRATION IS MANDATORY AND NOT PERMISSIVE.” The provision also included a 30-day opt out period, whereby users who “do not wish to be bound by arbitration and class-action waiver provisions” could opt out by notifying defendant in writing within 30 days “of the date you first accept the Agreement.” Importantly in Wyze, not a single plaintiff had utilized this opt out provision before filing suit.
This failure on behalf of plaintiffs proved fatal to their data privacy class action against defendant. Federal courts in the Ninth Circuit have consistently upheld arbitration provisions contained in clickwrap agreements. This case was treated no differently. The court kicked plaintiffs’ claims into binding, confidential arbitration.
Also important to the court reaching this determination was that under Washington state law a consumer is legally precluded from arguing that a contract was unenforceable (yup, agreements to arbitrate are binding contracts) as long as the consumer was not deprived of the opportunity to read it. While plaintiff argued they did not assent to arbitration because they were not informed of the arbitration provision when they purchased their cameras (and learned only after the fact), the court didn’t find that fact relevant. This was because, the court reasoned, even if there was some lag in between when plaintiffs purchased their cameras and set up user accounts with defendant, there was still a manifestation of mutual intent between the parties whereby plaintiffs assented to arbitration.
So there you have it-while the defendant will still need to address plaintiffs’ claims in arbitration, it avoided the public scrutiny and cost of litigation. Watch for this issue to continue to pop up in other privacy class actions. One interesting permutation will be litigation under the California Consumer Privacy Act (“CCPA”) which came into effect this year. The CCPA provides for a private right of action and has been used as a hook for several class action lawsuits. However, courts have yet to address whether certain language in the CCPA makes certain class action waivers or arbitration agreements unenforceable. See Cal. Civ. Code § 1798.192 (“Any provision of a contract or agreement of any kind that purports to waive or limit in any way a consumer’s rights under this title, including, but not limited to, any right to a remedy or means of enforcement, shall be deemed contrary to public policy and shall be void and unenforceable.”). Stay tuned.