Class Representative vs. Class Member

Which role fits you — and what each one pays

If you’ve been affected by a data breach, your first inclination may be to contact an attorney. You should — but you should also familiarize yourself with, and discuss with that attorney, the difference between a class representative and a class member. Here are a few things to think about.

Virtually all data breach cases exist as class actions, so at least one person must serve as the representative of the class. But each data breach case is likely to affect tens of thousands or even millions of people, so most people do not need to serve as a class representative. If you want to serve as one, you must be among the first people to call an attorney about the data breach.

Class Representative

Class representatives are important because a class action cannot exist without one — someone must represent the class by being willing to put their name on the lawsuit, work with attorneys to litigate the case, and potentially even sit for a deposition. These individuals will spend more time on the case: they must at least be interviewed by their attorney, hand over documents or other information about how they’ve been harmed by the data breach, and they will have to sign off on the settlement when it is ultimately negotiated. In some rare cases, class representatives may have to sit for a deposition where they would be required to answer questions under oath. In short, a class representative is a class member who is named on the complaint as filing the lawsuit. That person, or persons, stands in the shoes of the entire class as someone claiming to have similar injuries as the others stemming from the same alleged misdeeds. Their name is in the public record, and they are paid for that.

The amount of time a class representative must spend on the case varies, as does the number of class representatives — some cases have only one; some have a dozen or more. Importantly, though, if you serve as a class representative, you may be entitled to significantly more money at the end of the case. Putting your name on the lawsuit and spending additional time may ultimately be rewarded through what is called a service award or an incentive award. These range in data breach cases from $500 to $5,000, but they usually fall somewhere in the middle of that range. Often, the amount is lower when there are more class representatives. Though this is not nearly the type of money you would get from a personal injury case, such as when you suffer injuries in a car accident, it is far more than what you are likely to receive as a standard class member.

Class Member

Like all consumer privacy class actions, the payout per person is quite low in a data breach case. This is because there is such a large number of people affected. If the payout per person were much higher, a company could be forced into bankruptcy after a data breach. Imagine a mid-sized company announcing a breach of the personal information of 50,000 people and having to pay each person $1,000 — that would be $50,000,000, and this hypothetical represents a rather small data breach. Moreover, the market for data breach settlements assumes the commonly felt harms are quite low. Although a reasonable person might feel betrayed by a company that failed to stop a cyberattack — or failed to invest in reasonable safeguards to at least try hard enough — those same individuals often have a hard time showing a tangible financial injury. Indeed, courts in some states have no problem throwing these cases out because the judges may think people have not suffered a real enough injury. After all, how do you place a financial number on the simple privacy harm of having your Social Security number taken by a cybergang? And does it matter that similar cybergangs already stole your Social Security number from other companies?

Nevertheless, the market for data breach settlements usually calls for settlement benefits that will pay the people affected around $50 each. Those settlements will often say that class members can be reimbursed for thousands of dollars, but those class members must show evidence that they actually paid out or lost thousands of dollars in real money from their bank accounts. That proof is exceedingly rare, as banks usually reimburse fraudulent charges. What data breach victims who are standard class members are usually left with is some additional free credit monitoring and a small cash payment. If you do not serve as a class representative, you will have to settle for this smaller amount. Maybe you’ll get lucky and the amount will be higher, but cash payments even in the hundreds of dollars are rare.

The Bottom Line: It’s a Race

If you’re willing to put your name out there, you might be better off calling a lawyer as soon as you hear about a data breach that affected your information. The only way to serve as a class representative is to be faster than the other class members — whoever files these cases first usually gets more control over the case. It is, for all intents and purposes, a race. If twenty people file a case and you’re number twenty, you’re probably not going to get the chance to serve as a class representative unless you have already suffered identity theft or fraud in some documented way.