Federal Court Compels Data Breach Lawsuit Against Fortnite Developer to Arbitration

A North Carolina federal court has ordered a data breach lawsuit that was filed against Epic Games, the developer of the popular video game Fortnite, to individual arbitration.  In Heidbreder v. Epic Games, Inc., No. 5:19-cv-00348 (E.D.N.C. February 3, 2020), a Missouri man accused Epic Games of failing to adequately secure customer financial and other data.  In his putative class action complaint, Heidbreder claimed this failure resulted in his debit card account information being accessed and used by hackers between November 2018 and January 2019.

In response to the case, Epic Games filed a motion to compel the dispute to individual arbitration based on the terms of the company’s March 2019 End User License Agreement (“EULA”).  The EULA contained an arbitration provision that, among other things, required any disputes with Epic Games be arbitrated in an individual capacity and delegated any questions of arbitrability to an arbitrator.

Heidbreder opposed arbitration by claiming he did not agree to the terms of the EULA.  According to Heidbreder, his minor child who lacked the capacity to enter into an agreement did so using his account.  In addition, Heidbreder argued the arbitration provision was unconscionable because it was being applied retroactively and the purported data breach was beyond its scope.

The federal court dismissed Heidbreder’s claim he did not agree to be bound by the EULA because his child “was acting as plaintiffs agent and had both actual and apparent authority to agree to the EULA and bind plaintiff.”  After that, the court said the language included in the arbitration provision clearly stated the question of scope was for an arbitrator to decide.

Finally, the federal court turned to Heidbreder’s unconscionability argument.  The court said:

Plaintiff contends that the EULA provisions at issue are unconscionable because defendant is attempting to apply the agreement retroactively against injuries that already accrued. Plaintiff’s injuries occurred between November 2018 and January 2019 whereas the EULA was presented and agreed to by plaintiff in March 2019. Plaintiff argues defendant knew about data breaches, failed to provide notice, then foisted a new EULA upon plaintiff in March 2019 to avoid liability, resulting in unfair surprise and lack of meaningful choice.

Plaintiff does not satisfy either the procedural or substantive unconscionability prongs. To start, arbitration agreements applied retroactively against claims that have already accrued are enforceable if the clause’s language is broad enough. See, e.g., Levin v. Alms & Assocs., Inc., 634 F .3d 260, 267- 68 (4th Cir. 2011). Whether this specific provision applies to pre-existing claims, as discussed above, is a question for the arbitrator. That said, the courts’ sanctioning of retroactive arbitration agreements is relevant as it undermines plaintiffs specific emphasis on retroactivity as a basis for unconscionability. See Pl.’s Resp. at 18.

Second, plaintiff greatly exaggerates the lack of notice and choice users were given with respect to the arbitration provision at issue here. Prior to March 2019, the parties were governed by a previous EULA, which plaintiff agreed to when he created his Epic Games account. The previous EULA stated in bold type: “Epic may issue an amended Agreement… at any time in its discretion by posting the amended Agreement… on its website or by providing you with digital access to amended versions … when you next access the Software.” Rein Decl., Ex. A, § 14. This constitutes reasonable notice that defendant could amend the EULA terms. More important, though, is that users had meaningful choice over the arbitration provision. Defendant provided users a 30-day window after accepting the EULA to opt-out of the arbitration provision. EULA§ 12.6. When presented with the new terms in March 2019, plaintiff could have exercised this opt-out right or, simply, stopped playing the game if he objected to arbitration.

For substantive unconscionability, the terms at issue- the arbitration agreement, delegation clause, and class-action waiver- are common terms in modern contracts that have recently been sanctioned by the courts and can hardly be considered substantively unconscionable. See Schein, 139 S. Ct. 524(2019) (rejecting a “wholly groundless” exception to a delegation clause), and Epic Sys. Corp. v. Lewis, 138 S. Ct. 161 2 (20 18) (holding that the National Labor Relations Act does not prohibit enforcement of a class arbitration waiver in employment contracts). Moreover, defendant’s arbitration provision contains other user-friendly terms, including the opt-out right, choice of venue, defendant pays arbitration costs, and defendant waives the right to seek fees and costs. EULA § 12. The arbitration, delegation, and class waiver provisions are neither procedurally nor substantively unconscionable.

Because Heidbreder’s child had both actual and apparent authority to bind him to the Epic Games EULA, the arbitration provision included in the EULA was valid, and questions regarding the scope of the arbitral agreement were delegated to an arbitrator, the North Carolina federal court granted the Fortnite developer’s motion to compel Heidbreder’s case to individual arbitration.

Photo by: Alex Haney on Unsplash