Attorney public/private partnerships receive a boost

Twelve years ago in County of Santa Clara v. Super. Ct. (2010) 50 Cal.4th 35, the California Supreme Court recognized that while a contingency-fee arrangement is impermissible in criminal prosecutions, such an arrangement may be appropriate in other circumstances, implicating civil and criminal liability. Soon after, pundits predicted the holding would permit private lawyers to join with public entities to prosecute other quasi civil and criminal actions.

The same year as the Supreme Court’s decision in Santa Clara, the Orange County District Attorney hired a private lawyer on contingency to file a claim under California’s unfair competition law seeking civil penalties against Toyota for its “sticky pedal” and “sudden acceleration” issues. Although it resulted in a $16 million settlement, that lawsuit raised similar questions about neutrality and control addressed by the Supreme Court in Santa Clara.

In a recent decision, the 4th District Court of Appeal considered these same questions after the City of San Diego hired private lawyers on contingency to file a claim under the Unfair Competition Law (UCL) against Experian for the company’s failure to comply with the Customer Records Act. The Court’s decision upheld the contingency-fee arrangement. And by doing so, the 4th District’s holding may encourage more public-private partnerships, particularly in litigation, such as data breach class actions, where jurisdictional and other legal obstacles may prevent consumers from obtaining compensation.

Case Analysis

In July 2010, a Vietnamese hacker named Hieu Minh Ngo defrauded Court Ventures, Inc. (CVI), convincing it to provide him with access to a database owned by a third party, U.S. Infosearch.com (USI). (Appellant’s Opening Brief at *12, State v. Experian Data Corp., 2021 WL 4061562 (Cal.App. 4th Dist. Aug. 20, 2021)). That hacker used a CVI-controlled web portal to obtain the personally identifiable information of over 400,000 California residents from the USI database. (People ex. rel. San Diego v. Experian Data Corp. 77 Cal.App.5th 1006, 1010 (2022)). While the hacker continued accessing and selling protected information, Experian purchased CVI, the web portal, and the existing data-services-and-customer contracts in March 2012. (Ibid.) Seven months later, Experian learned of Ngo’s fraudulent activity and terminated his access to the USI databases through CVI’s web portal. (Ibid.)

In 2018, the City of San Diego filed a claim against Experian, CVI, and USI, after a federal court dismissed the California plaintiffs’ claims against Experian because those plaintiffs were not Experian customers. (Patton v. Experian Data Corp. 2018 WL 6190349, *8 (C.D. Cal. Jan. 23, 2018)). The City’s lawsuit sought civil penalties and injunctive relief for the defendants’ failure to provide notice to victims of the Ngo hack in violation of the Civ. Code § 1798.82. (San Diego, supra, 77 Cal.App.5th at 1011.) The City hired the same private lawyers, who worked on the Patton litigation, on contingency. That contingency-fee agreement mirrored the agreement in Santa Clara. (Id. at p. 1013.)

Nearly three years after the City filed its Complaint, Experian moved to disqualify the private lawyers because the contingency-fee agreement violated: (1) the public prosecutor’s duty of neutrality and (2) the UCL’s plain language requiring civil penalties to be paid to the City. (Id. at p. 1011.) After the trial court denied Experian’s motion to disqualify the private lawyers, Experian appealed.

The 4th District affirmed the trial court’s decision. The court compared the Supreme Court’s decisions in Santa Clara and People ex rel. Clancy v. Super. Ct., 39 Cal.3d 740 (1985). In Clancy, the City of Corona hired a private lawyer to file a public nuisance action against an adult bookstore, and the City’s agreement with that lawyer halved his hourly rate if he lost the case or did not recover attorney’s fees from the bookstore owner. (Clancy, supra, 39 Cal.3d at p. 745.) The Supreme Court held Corona’s contingency-fee agreement with the private lawyer violated its duty of neutrality. (Id. at p. 750.) As the Supreme Court held in Santa Clara, the 4th District differentiated the action against Experian from the action against the bookstore owner in Clancy. San Diego’s UCL action did not (1) intend to put Experian out of business; (2) implicate Experian’s First Amendment rights, and (3) portend future criminal liability. (Id. at p. 1014.) According to the 4th District, the civil penalties sought did not threaten Experian’s constitutional interests or its ongoing business operations. (Ibid.) The 4th District also held that San Diego’s agreement with the private lawyers maintained “the heightened standard of neutrality” required in Santa Clara. (Id. at p. 1013.) Under the arrangement, the City had complete control over the litigation and required the City to be involved. (Ibid.) As to Experian’s argument that the contingency-fee agreement violated the UCL, the 4th District rejected this too by holding Experian presented no evidence or authority in support. (Id. at p. 1016.)

Implications of San Diego v. Experian

The 4th District’s opinion closely followed the Supreme Court’s decision in Santa Clara, so while the result is not groundbreaking, the holding leaves several important questions unanswered. First, the 4th District and the Santa Clara Court both emphasized the size of the corporate defendants as a reason the contingency-fee agreements did not violate the public official’s duty of neutrality. (See Santa Clara, supra, 50 Cal.4th at p. 58 (holding the governmental action “does not threaten the continued operation of an ongoing business”) and San Diego, supra, 77 Cal.App.5th at p. 1014 (holding San Diego’s UCL litigation also does not impact Experian’s “ongoing business operations.”) Therefore, the same contingency-fee agreement could be valid or invalid depending on whether a corporate defendant can defend itself or afford the civil penalty. That may raise constitutional concerns. And if this holding prompts more public-private partnerships, the relationship between private attorneys and elected officials could face scrutiny. A 2014 New York Times article found a correlation between large campaign contributions and contingency-fee agreements between private lawyers and states’ attorneys general. (See Eric Lipton, Lawyers Create Big Paydays by Coaxing Attorneys General to Sue, N.Y. TIMES (Dec. 18, 2014)).

More importantly, this decision may provide private lawyers with another avenue to seek redress for those affected by a data breach and who cannot overcome jurisdictional challenges associated with their lawsuit. Often, plaintiffs in data breach class actions face difficulties establishing a claim. For example, the misappropriation of personal information, without more, does not establish a cognizable injury. (See, e.g. Pruchnicki v. Envision Healthcare Corp. 845 Fed. Appx. 613, 614 (9th Cir. 2021) (holding that mere misappropriation of personal information does not establish compensable damages)). And the California representative in Patton v. Experian Data Corp. 2018 WL 6190349, *8 (C.D. Cal. Jan. 23, 2018) had his claim dismissed because he was not Experian’s customer. Soon after, the City and the same private lawyers in Patton sued Experian, arguing it had to disclose the data breach to those affected under the State’s data breach statutes, and its failure to do so violated the UCL. The 4th District affirming the agreement between San Diego and private lawyers may encourage more public-private partnerships seeking civil penalties under the UCL to protect consumers whose personal information has been exposed but who cannot obtain compensation as private litigants.