People of the State of California v. Experian Data Corp. et al.

CASE NAME: People of the State of California v. Experian Data Corp. et al.

TYPE OF CASE: Government Enforcement Action of Corporate Data Breach / Unfair Competition Law

COURT: San Diego County Superior Court, Orange County Superior Court

JUDGE(S): Judge Ronald L. Styn, Judge Linda S. Marks, Judge David B. Oberholtzer, Judge Donald F. Gaffney

DEFENSE LAWYERS: Jones Day, Richard J. Grabowski, John A. Vogt, Ryan D. Ball, Ashley E. Sarkozi, Matthew T. Billeci, Hannah Bensen

PLAINTIFF LAWYERS: Mara W. Elliot, Kevin King; Blood Hurst & O'Reardon LLP, Timothy G. Blood, Paula R. Brown, Jennifer MacPherson; The Coffman Law Firm, Richard L. Coffman, Sonya B. Coffman

International intrigue leading to the capture of a data thief and an issue of first impression in California courts regarding tolling of the statute of limitations both figured in the successful defense of data analytics and consumer credit reporting company Experian plc in a massive government enforcement case.

Three Jones Day partners -- Richard J. Grabowski, John A. Vogt and Ryan D. Ball -- were Experian's lead defense lawyers who came up with a winning strategy when the San Diego city attorney sued under California's unfair competition law seeking civil penalties of up to $2,500 for each of 2.4 million state residents who allegedly were not notified of a data hack. People v. Experian Data Corp. et al., 30-2019-01047183-CU-BT-CXC (O.C. Super. Ct., filed Jan. 29, 2019).

JOHN A. VOGT

"It was a ginormous number," said Grabowski. "But we showed that the government, when it sues, is a different kind of plaintiff and the statute of limitations rules apply differently."

The culprit in the case was a young Vietnamese hacker, Hieu Minh Ngo, who tricked an Experian subsidiary into giving him access to personal and financial data on more than 200 million Americans. He was eventually lured to Guam, where he was arrested by U.S. Secret Service agents and extradited to the U.S. "Experian cooperated in that," Grabowski said. "We were victims too."

Grabowski and colleagues contended that the San Diego authorities had waited too long to sue. "We found a U.S. Supreme Court case backing our claim that equitable tolling principles do not apply in UCL enforcement actions seeking civil penalties," said Ball, who drafted briefs containing the arguments that ultimately won the case.

The Supreme Court, in Gabelli v. SEC (2013), held that public policy requires that ordinary discovery rules extending the time to file don't apply when government investigators bring cases.

In discovery, Vogt conducted the key depositions that nailed the critical accrual date. "We established the claim was time-barred," Vogt said.

Even so, judges rejected Experian's demurrer and summary judgment motion, so the Jones Day team pushed its theory in in limine motion. A fourth judge in the case granted the motion and excluded civil penalties on time limitations grounds.

"This is new law," Grabowski said.

A spokesman for the San Diego city attorney emailed, "This matter is up on appeal, and this fight is far from over. In the meantime, no one should celebrate the fact consumers first lost their personal and financial information to criminals, and now face losing their right to speak through the courts. The statute of limitations did not run given that Experian had been promising for years that it was working to identify victims and would give them notice."

--John Roemer