In Attias v. CareFirst, Inc., 15-cv-00882-CRC (D.D.C. Mar. 28, 2023), the court’s application of TransUnion v. Ramirez, 141 S. Ct. 2190 (2021), reinforced that inclusion of uninjured class members in the class definition can defeat certification.  In CareFirst, Plaintiffs alleged that the data breach that CareFirst, Inc. (“CareFirst”), a health insurance company, suffered in 2014 exposed the plaintiffs to increased risk of fraud and identity theft.  Plaintiffs claimed they had to spend time and money on services such as credit and identity theft monitoring programs.  They sought to represent classes that included all CareFirst customers in certain states whose personal information was impacted by the breach, regardless of whether those customers incurred additional expenses as a result of the breach. 

            The court declined to certify the class, concluding that doing so would be inconsistent with TransUnion.  In applying TransUnion, the court explained that although the named plaintiffs had standing, the class, presently defined, would include a significant number of people who did not spend any time or money on mitigating services and thus did not suffer any Article III injury under TransUnion.  While recognizing that a modification to the class definition to limit its membership to “customers who spent time on protective measures because of the CareFirst breach” may be of some benefit in achieving certification, the court expressed skepticism over how such edification could overcome the practical difficulties associated with identifying class members who meet the definition.

              The CareFirst decision’s application of TransUnion emphasizes that including uninjured members in a class definition, or excluding them without a practical method of parsing them out, presents challenges for class certification.