Amy E. Keller

A password can be replaced within minutes. A Social Security number may follow its owner for life. Keller's privacy practice starts with that difference, and the Equifax record put it in numbers. A patch for the Apache Struts vulnerability that attackers used had been available since March 2017. The intrusion ran from May into July. Equifax discovered it on July 29 and announced it on September 7. By then the names, birth dates, addresses and Social Security numbers of roughly 147 million people had been taken from a company none of them had chosen to do business with.

The consumer cases were consolidated as MDL No. 2800 in the Northern District of Georgia before Chief Judge Thomas W. Thrash Jr. He appointed Keller, then a partner at DiCello Levitt & Casey in Chicago, co-lead counsel for the consumer plaintiffs alongside Kenneth Canfield and Norman Siegel. Keller had studied at the University of Michigan and the John Marshall Law School in Chicago; she now chairs DiCello Levitt's privacy, technology and cybersecurity practice and manages its Chicago office.

A Duty to Safeguard

Equifax moved to dismiss. It argued, among other things, that Georgia law imposed no duty on it to protect the information it held. On January 28, 2019, in an eighty-page opinion, Judge Thrash held that Equifax owed a duty of care to safeguard the personal and financial information in its custody, and that a rule to the contrary would let companies that profit from consumers' data ignore known security risks. The negligence and state consumer-protection claims went forward.

The settlement he approved on January 13, 2020 paid $380.5 million into a fund and allowed up to $125 million more for out-of-pocket losses. It bound Equifax to spend at least $1 billion on data security over five years and to meet security requirements that an independent assessor would verify and the court could enforce. More than fifteen million class members had filed claims by the previous December, 3.3 million of them for credit monitoring. Of a class of 147 million, 388 people objected; the court overruled every objection and found that many rested on false and misleading information. The Federal Trade Commission's parallel resolution, announced at a minimum of $575 million and up to $700 million with the states and the Consumer Financial Protection Bureau, keeps free identity-restoration help available to breach victims through January 2029, more than eleven years after the intrusion.

Pricing a Hidden Software Change

In December 2017, reports surfaced that Apple's iOS updates had been slowing older iPhones to keep aging batteries from shutting the phones down, and that Apple had not told owners. In the multidistrict litigation that followed before Judge Edward J. Davila in San Jose, Keller was named co-chair of law and briefing on the plaintiffs' executive committee, the position responsible for turning operating-system behavior, battery condition and purchase decisions into a legal theory common to tens of millions of devices.

On March 19, 2021, Judge Davila gave final approval to a settlement under which Apple paid a non-reversionary minimum of $310 million and up to $500 million depending on claims. More than 3.25 million owners filed. The court's damages analysis put the recovery at roughly $18 to $46 per phone, for a software decision no owner could see.

The Right to Reach the Merits

Between February and May 2020, ransomware attackers took donor, patient and student records from Blackbaud, a cloud-software company that serves nonprofits, universities and hospitals. Keller is co-lead counsel in the multidistrict litigation in South Carolina. On July 1, 2021, Judge J. Michelle Childs denied Blackbaud's motion to dismiss for lack of standing, holding that the plaintiffs had adequately traced their injuries to the breach. That August the court let claims under the California Consumer Privacy Act proceed, rejecting Blackbaud's argument that as a service provider it fell outside the statute.

That same month, after T-Mobile disclosed a breach reaching tens of millions of current and former customers, Keller told the Wall Street Journal and Wired what the case was about. "If the hackers' claims are true," she said, "it's shocking that one of T-Mobile's databases held sensitive information like dates of birth, driver's license numbers, Social Security numbers, and plaintext security PINs, going back to the 1990s." Negligence claims alone, she argued, had not made companies invest in security; statutes with statutory damages would. "Consumers are sick and tired of data breaches." She sits on the plaintiffs' executive committee in the T-Mobile litigation.

The connected car came next. In the multidistrict litigation over General Motors' OnStar Smart Driver program, plaintiffs allege that GM and OnStar collected drivers' acceleration, braking, speed and mileage and sold it to LexisNexis Risk Solutions and Verisk, which resold it to insurers who raised premiums. Keller is co-lead counsel on the OnStar track. On April 22, 2026, Judge Thrash, hearing this case too, allowed the Federal Wiretap Act and Stored Communications Act claims to proceed, along with unjust-enrichment claims and parts of the invasion-of-privacy, civil-conspiracy and Fair Credit Reporting Act claims. "Your car," Keller said, "should not be a tool for corporate surveillance." Her docket also includes a $35 million class settlement over allegedly defective Electrolux dryers. She is secretary of Public Justice and sits on the steering committee of the Sedona Conference's working group on data security and privacy liability.

One Hundred Thirty Points

In January 2022, Nydia Jenkins, a Florida resident, was pre-approved for an auto loan. When she went to complete it in early April she was denied. Equifax had reported her credit score as 130 points lower than it was. She financed the car elsewhere at about $2,352 more a year. Between March 17 and April 6, 2022, a coding error at Equifax had sent lenders wrong scores for millions of applicants, some off by twenty points or more, enough to move a borrower from approval to denial or into a higher rate. Equifax said it fixed the problem on April 6 and that only a small number of consumers had received different credit decisions.

The Fair Credit Reporting Act cases were consolidated as In re Equifax Fair Credit Reporting Act Litigation in the Northern District of Georgia before Judge Leigh Martin May, with Keller as co-lead counsel. On August 17, 2026, the court preliminarily approved a $100 million non-reversionary settlement that pays cash directly to about four million people whose scores were misreported during those three weeks. The final fairness hearing is set for January 22, 2027.

The 2017 breach and the 2022 error were different failures of the same company, and Keller's cases answered both the same way: a duty stated by a court, a fund that pays people directly, and a remedy that lasts as long as the risk. For data that cannot simply be reissued, the remedy has to remain useful after the headlines are gone.