An Arbitration Clause May Present A Defense To A Data Breach Class Action – But At What Cost?


By: Bill Cheney

A common defense strategy in response to data privacy and security class actions is to file a motion to compel arbitration.  The arbitration forum has a number of advantages, including efficiency, speed, lower costs, expertise, and confidentiality, which makes it an attractive alternative to class litigation.  The confidentiality that can be offered by arbitration is particularly attractive in data breach class actions, as the public nature of litigation and the often media attention given to same can interfere with a company’s efforts to repair its reputation and good will.  Moreover, with the Supreme Court’s decision in Lamps Plus, Inc. v. Varela, 139 S. Ct. 1407, 203 L.Ed.2d 636 (2019), which held that a parties’ agreement to class arbitration must be explicit and may not be inferred, there is more certainty that the arbitration will be on an individual basis and allow the parties to truly realize these benefits. 

Now, however, there is a new consequence to consider before filing a motion to compel arbitration in response to a data breach class action – mass arbitration.  On April 27, 2020, United States District Judge Richard D. Bennett dismissed a class action lawsuit filed in the District of Maryland against Chegg, Inc.  The lawsuit stemmed from a 2018 data breach experienced by Chegg, Inc. Chegg, Inc. subsequently filed a Motion to Compel Arbitration and Dismiss.  Judge Bennett found that there was “no triable issue” as to whether the arbitration provision in Chegg, Inc.’s Terms of Use, requiring individual arbitration, was agreed to, and dismissed all claims and ordered the parties to proceed to arbitration.

The result appeared to be a win for Chegg, Inc.  However, in less than a month, over 15,000 demands for arbitration were filed with the American Arbitration Association on behalf of those allegedly affected by the data breach.  In filing fees alone – the American Arbitration Association requires businesses to pay a nonrefundable fee of $300 once the consumer claimant meets the filing requirements – Chegg, Inc. will now have to incur over $4,500,000. 

Mass arbitration, like this, has been on the rise in the employment context, being instituted against employers such as Uber, Chipotle and DoorDash.  Moreover, several companies specialize in locating consumers and coordinating mass arbitration claim filings.  It is now a very real potential repercussion that must be accounted for in evaluating whether to proceed with a motion to compel arbitration in response to data privacy and security class actions. Otherwise, a perceived effective defense strategy may have dire consequences and put the plaintiffs in the driver’s seat.  

If you have questions or would like more information, please contact Bill Cheney at