A Utah federal judge has refused to dismiss a proposed class action accusing Sundance Holdings Group LLC of unlawfully sharing its customers' private information with third parties. The decision, issued Monday by U.S. District Judge Robert J. Shelby, found that the federal rules governing class actions supersede Utah state law, which prohibits such claims.

The case, brought under the Utah Notice of Intent to Sell Nonpublic Personal Information Act (NISNPIA), centers on allegations that Sundance disclosed customers' private information from online purchases to advertisers, political organizations, and other third parties without proper notice or consent.

Federal Rule Preempts State Class Action Ban

Sundance argued that the lawsuit should be dismissed because the Utah statute prohibits class actions, which it claimed deprived the court of jurisdiction. Judge Shelby rejected this argument, finding that Rule 23 of the Federal Rules of Civil Procedure governs the case and overrides the state law.

“A federal district court is required to entertain a class action once a plaintiff makes the required showings under Rule 23(b),” Judge Shelby wrote, adding that any state statute imposing stricter limits on class actions conflicts directly with Rule 23.

The judge relied on the U.S. Supreme Court's 2010 decision in Shady Grove Orthopedic Associates PA v. Allstate Insurance Co., which held that federal courts must apply Rule 23 in cases where it conflicts with state class action restrictions. Under the two-step framework established in Shady Grove, Judge Shelby found that Rule 23 takes precedence and that Utah’s class action ban under Section 203(3) of NISNPIA does not alter the statute’s substantive rights or remedies.

Allegations of Unauthorized Data Sharing

The plaintiffs allege that Sundance failed to notify them or obtain their permission before sharing nonpublic personal information, including details of their online purchases, with data aggregators and other entities. The amended complaint claims these actions violated the Utah statute, which provides a remedy of $500 per violation.

Judge Shelby found the allegations sufficient to proceed, rejecting Sundance's assertion that the plaintiffs failed to adequately claim that their personal information was disclosed unlawfully.

"The first amended complaint allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged," the judge wrote.

Broader Implications for Class Actions

The decision could have significant implications for similar consumer protection lawsuits, particularly in states with laws restricting class actions. Judge Shelby acknowledged that class actions may increase litigation costs and risks for defendants but emphasized that procedural rules like Rule 23 are not intended to alter substantive rights.

The ruling ensures the plaintiffs can pursue their claims collectively, potentially increasing financial exposure for Sundance.

Sundance Data Disclosures Suit : Legal Representation

The plaintiffs are represented by Frank S. Hedin and Elliot O. Jackson of Hedin LLP, along with David W. Scofield of Peters Scofield. Sundance is represented by Elizabeth C. Rinehart of Venable LLP and Jordan K. Cameron of Cameron Ringwood LC. Neither party has commented on the ruling.