Skip to content

Menu

LexBlog, Inc. logo
NetworkSub-MenuBrowse by SubjectBrowse by PublisherJoin the NetworkGet StartedSubscribeSupportContact
Search
Close

The Supreme Court Will Rule on Data Breach Class Arbitration Suit

By Jason C. Gavejian & Maya Atrakchi on June 6, 2018
Email this postTweet this postLike this postShare this post on LinkedIn

The U.S. Supreme Court recently granted a petition for review of a data breach lawsuit addressing the issue of whether parties can pursue a class arbitration when the language in the arbitration agreement does not explicitly allow for such, Lamps Plus, Inc. v. Varela , No. 17-988, certiorari granted April 30, 2018. The Court will have the opportunity to clarify its 2010 decision in Stolt-Nielsen v. AnimalFeeds International Corp., 559 U.S. 662 (2010) in which the Court ruled that parties cannot be forced into class arbitration, “unless there is contractual basis for concluding [they] agreed to do so”.

The petition for a writ of certiorari brought by Lamps Plus, a lighting retailer, presented the issue, “[w]hether the Federal Arbitration Act (FAA) forecloses a state-law interpretation of an arbitration agreement that would authorize class arbitration based solely on general language commonly used in arbitration agreements.” Lamps Plus argues that the 9th Circuit panel erred in ruling that the company must participate in a class arbitration of an employee’s claims when the employment agreement did not state that class arbitration was available. The employee’s claims arise from an incident of identity theft, as the result of a phishing attack, in which a third party impersonating a Lamps Plus employee convinced a fellow Lamps Plus colleague to send copies of W-2 forms for multiple Lamps Plus employees.

The employment agreement between the named plaintiff, Frank Varela, and his employer, Lamps Plus, included an arbitration clause, however it was silent on whether the clause also allowed for class arbitration. The 9th Circuit majority ruling stated that “perhaps the most reasonable” interpretation of that agreement allows for class arbitration. The circuit court analogized how Varela waiving his “right…to file a lawsuit or other civil action or proceeding” and “any right…to resolve employment disputes through trial by judge or jury,” clearly also includes waiving his right to class action lawsuits, even though the agreement does not explicitly state such.

In its petition to the Supreme Court, Lamps Plus emphasized that, “This court could not have been clearer that, in light of the fundamental differences between class and individual arbitration, the FAA prohibits exactly what the panel below did here: inferring ‘[a]n implicit agreement to authorize class action arbitration from the fact of the parties’ agreement to arbitrate,”.

Varela, on the other hand, relying on the 9th Circuit analysis, argued that the circuit court decision is consistent with the high court’s decision in Stolt-Nielsen, the FAA, and California contract law principles. “The decision creates no inter-circuit conflict and does not threaten to impose class arbitration wholesale on parties who did not agree to it. It offers only a reasonable interpretation of a single contract to determine the parties’ intent in light of background principles of state contract law,” Varela stated.

The Supreme Court will now clarify its decision in Stolt-Nielsen, and will settle an ongoing circuit split over whether, irrespective of state contract law, an agreement that does not explicitly include class arbitration can nonetheless authorize it. The Court’s decision will have major implications for employers, well beyond the data breach context. Regardless of how the Court ultimately rules, companies are advised to include unambiguous language in their employment agreements on whether class arbitration is available. For additional insight regarding class actions, including class arbitration and waivers, please visit the Class and Collective Action Update.

Photo of Jason C. Gavejian Jason C. Gavejian

Jason C. Gavejian is the office managing principal of the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. and a member of the firm’s Board of Directors. He is also a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy…

Jason C. Gavejian is the office managing principal of the Berkeley Heights, New Jersey, office of Jackson Lewis P.C. and a member of the firm’s Board of Directors. He is also a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy Professionals.

As a Certified Information Privacy Professional (CIPP/US), Jason focuses on the matrix of laws governing privacy, security, and management of data. Jason is co-editor of, and a regular contributor to, the firm’s Privacy blog.

Jason’s work in the area of privacy and data security includes counseling international, national, and regional companies on the vast array of privacy and security mandates, preventive measures, policies, procedures, and best practices. This includes, but is not limited to, the privacy and security requirements under state, federal, and international law (e.g., HIPAA/HITECH, GDPR, California Consumer Privacy Act (CCPA), FTC Act, ECPA, SCA, GLBA etc.). Jason helps companies in all industries to assess information risk and security as part of the development and implementation of comprehensive data security safeguards including written information security programs (WISP). Additionally, Jason assists companies in analyzing issues related to: electronic communications, social media, electronic signatures (ESIGN/UETA), monitoring and recording (GPS, video, audio, etc.), biometrics, and bring your own device (BYOD) and company owned personally enabled device (COPE) programs, including policies and procedures to address same. He regularly advises clients on compliance issues under the Telephone Consumer Protection Act (TCPA) and has represented clients in suits, including class actions, brought in various jurisdictions throughout the country under the TCPA.

Read more about Jason C. GavejianEmail
Show more Show less
  • Posted in:
    Privacy and Cybersecurity
  • Blog:
    Workplace Privacy, Data Management & Security Report
  • Organization:
    Jackson Lewis P.C.
  • Article: View Original Source

Call us at 1-800-913-0988 or email sales@lexblog.com.

Facebook LinkedIn Twitter RSS
The Library at LexBlog
  • About LexBlog
  • The Field We Built
  • Library at LexBlog
  • Our Beliefs
  • Our Team
  • Contact LexBlog
  • Disclaimer
  • Editorial Policy
  • Terms of Service
  • Get Started
  • Publishing Solutions
  • Compass
  • Submit a Request
  • Support Center
  • System Status
Copyright © 2026, LexBlog, Inc. All Rights Reserved.
Law blog design & platform by LexBlog LexBlog Logo