Ann Marie Mortimer

Los Angeles

Litigation

Ann Marie Mortimer heads Hunton Andrews Kurth LLP's commercial litigation practice, is the founder and managing partner of the firm's Los Angeles office and serves on the executive committee.

Her special area of expertise is data security, and ever since the California Consumer Privacy Act took effect on Jan. 1, 2020, Mortimer has had a hand in shaping how the law has evolved. As an authority on the topic, she is set to present a November webinar updating CCPA enforcement challenges and other developments.

"If you look at data breaches, you see liability looking for damages," she said, referring to the CCPA's statutory penalty provisions. "Because the penalties are statutory, plaintiffs don't have to prove liability. At the same time, in early litigation, courts are holding litigants to the contours of the statute. The CCPA was not intended to be a catchall for privacy claims."

Mortimer won a Top Defense Verdict award for her 2021 win on behalf of Walmart Inc. in an early CCPA case. A claimant who found his personal identifying information for sale on the dark web represented some two million online customers alleging that hackers had breached Walmart's defenses and accessed their data. Gardiner v. Walmart Inc., 4:20-cv-04618 (N.D. Cal., filed July 10, 2020).

In dismissing all causes of action, a federal judge set a standard: leaked personal information does not necessarily entail financial injury, identity theft or other harm meriting a financial payout.

Similarly, last year, Mortimer again obtained dismissal for client Bath & Body Work Inc. in a class action targeting multiple prominent retailers. Hayden v. The Retail Equation et al., 8:20-cv-01203 (C.D. Cal., filed July 7, 2020).

The plaintiffs' theory was novel because the claimed CCPA violation did not involve a data breach. The claim was that retailers shared consumer data without consent with a loss prevention vendor, the lead defendant, which had developed a "risk score" model to combat fraudulent store returns.

Mortimer successfully argued that the CCPA does not contain a private right of action outside the data breach context and that the claims arose before the operative date of the statute. In the dismissal order, the court cited her Gardiner v. Walmart win.

"This was a creative attempt to expand the statute beyond what was intended to find a new breach scenario," Mortimer said. "I understand the motivation, but I was able to get my client out early in the litigation."

--John Roemer