Joseph M. McLaughlin and Yafit Cohn
Joseph M. McLaughlin and Yafit Cohn ()

A cardinal precept of Delaware law is that directors, rather than shareholders, manage the business and affairs of the corporation. In the context of shareholder requests that the company pursue litigation, the decision whether to pursue litigation on behalf of the company generally resides with the board as an exercise of business judgment. A shareholder lacks standing to bring suit on the company’s behalf unless the shareholder (i) has demanded that the directors pursue the corporate claim and the demand is wrongfully refused; or (ii) purports to initiate litigation on behalf of the company and alleges with particularity why pre-suit demand is excused as futile.

The typical shareholder derivative claim seeks to assert state law claims. In re The Home Depot, Inc. Shareholder Derivative Litigation, a recent decision from the U.S. District Court for the Northern District of Georgia that applied Delaware law, weighed in on a recurring question regarding the demand requirement on which courts have differed: whether pre-suit demand is required for claims alleging a violation of Section 14(a) of the Securities Exchange Act of 1934 (Exchange Act).1Home Depot is the latest in a series of shareholder derivative actions arising from high-profile data breaches to be dismissed in recent years, with the court holding that Delaware’s demand requirement applies equally to Section 14(a) claims.

The Demand Requirement

Section 14(a) of the Exchange Act, in conjunction with Rule 14a-9 promulgated thereunder, provide that a proxy statement may not contain “any statement which, at the time and in light of the circumstances under which it is made, is false or misleading with respect to any material fact,” nor may it omit “to state any material fact necessary in order to make the statements therein not false or misleading.” A fact or statement is material if “there is a substantial likelihood that a reasonable shareholder would consider it important in deciding how to vote.”2 A claim alleging a violation of Section 14(a) may be brought either directly or derivatively.

Federal courts have long grappled with whether proxy disclosure claims under Section 14(a) are subject to the demand requirement in derivative actions, reaching conflicting conclusions. In In re Westinghouse Securities Litigation, for example, the Western District of Pennsylvania opined that where a plaintiff alleges a willful violation of the federal securities laws, “business judgment analysis is inapplicable,” since the preparation of allegedly false and misleading proxy statements is not a business decision.3

As the court explained, “the duty to make full and fair disclosure is independent of the duty to exercise reasonable care and prudence in the management of corporate affairs, and the decision whether or not to violate securities laws, unlike the decision whether to pursue litigation on behalf of the corporation, is not one reserved exclusively to directors.” The Westinghouse court further reasoned that, because derivative actions are the only private remedy for Section 14(a) violations, applying the business judgment rule to a Section 14(a) claim “would be tantamount to denying a type of enforcement that is essential to the accomplishment of the goals of” Section 14(a).

In Vides v. Amelio, the Southern District of New York came to a similar conclusion.4Vides explained that the purpose of a pre-suit demand in derivative actions is “to obtain the business judgment of the board on whether the litigation is in the best interests of the corporation and its shareholders.” According to Vides, that purpose has little bearing on a Section 14(a) claim, as a determination of “‘whether shareholders have, under the circumstances, been provided with appropriate information upon which an informed choice on a matter of fundamental corporate importance may be made, is not a decision concerning the management of business and affairs of the enterprise of the kind the business judgment rule is intended to protect.’” Rather, the decision regarding whether to include certain information in a proxy statement is a legal one, dependent on materiality.

Finally, as in Westinghouse, the court determined that the goals of Section 14(a) would be frustrated if director defendants were permitted to effect a dismissal of a derivative action based on the board’s judgment that its compliance with Section 14(a) was not in the best interests of the corporation. Accordingly, Vides concluded that “under Delaware law and federal policy, there is no need for prior demand upon the board of directors with respect to [a] claim of misstatements and omissions in the proxy statement.”

The Vides approach has been rejected by several courts. In a subsequent Southern District of New York decision, St. Clair Shores General Employees Retirement System v. Eibeler, for example, the court stated that it is “not persuaded that Section 14(a) claims should be treated as a special species of derivative claim not subject to the demand requirement and business judgment rule.”5 While acknowledging that a director’s decision regarding information to be included in a proxy statement “is not entirely protected by the business judgment rule” since it involves a question of materiality, the court held that a board’s decision regarding whether the corporation should pursue derivative litigation as a result of disclosure violations is still entitled to business judgment protection.

Similarly, in Bader v. Blankfein, the Eastern District of New York explained that, in deciding that there is no business judgment involved in determining whether to include certain information in a proxy statement, the Vides court overlooked the critical fact that, “when alerted to a materially false statement in a corporate proxy statement,” “directors must still use their business judgment in deciding what course of action to take”—including whether to pursue litigation.6

‘Home Depot’

Home Depot arose out of the 2014 breach of Home Depot’s payment card data systems that resulted in the theft of 56 million customers’ financial data and was estimated to cost the company nearly $10 billion. As is standard in recent data breach derivative actions, plaintiffs in the Home Depot action alleged, among other things, that the defendants—officers and directors of the company when the breach occurred—”breached their duty of loyalty to Home Depot because [they] failed to institute internal controls sufficient to oversee the risks that Home Depot faced in the event of a breach.”

With regard to this quintessential claim, the court found that demand was not futile, since the plaintiffs “failed to show beyond a reasonable doubt that a majority of the Board faced substantial liability because it consciously failed to act in the face of a known duty to act.” Rather, according to the court, plaintiffs acknowledged that the board took action to remedy the company’s security weaknesses, their allegations amounting to a claim that the board’s plan “was not good enough.” Applying the standard articulated for claims of failure of board oversight in In re Caremark Inc. Derivative Litigation, 698 A.2d 959 (Del. Ct. Ch. 1996), under which a violation of the duty of loyalty can be found only if plaintiffs can demonstrate that the directors utterly failed to undertake their responsibilities or disregarded clear red flags, the court dismissed the plaintiffs’ duty of loyalty claim.

More interestingly, the plaintiffs also alleged that the director defendants violated Exchange Act Section 14(a) in their proxy statements for 2014 and 2015. Specifically, the plaintiffs claimed that the defendants “failed to disclose in their 2014 Proxy Statement that Home Depot had known, specific threats to its data security.” The plaintiffs further maintained that “neither the 2014 nor the 2015 Proxy Statements disclosed that the Audit Committee’s charter was not amended” to reflect that, following the dissolution of the Infrastructure Committee in 2012, the Audit Committee was responsible for data security oversight.

The court addressed the threshold question whether the plaintiffs’ federal Section 14(a) claim was subject to the demand requirement under Delaware law. While acknowledging that “the Eleventh Circuit has not yet weighed in on the issue,” the Home Depot court explained that, since “the business judgment rule is the foundation for the demand requirement, most courts have held that Vides was mistaken and that the demand requirement applies equally to Section 14(a) claims.” The court concurred, holding that Section 14(a) derivative claims are subject to the demand requirement.

Since the plaintiffs sued without making pre-suit demand on Home Depot’s board, the court then addressed whether demand was futile under the test articulated by the Delaware Supreme Court in Aronson v. Lewis, 473 A.2d 805 (1984). Under Aronson, demand is excused “if the complaint provides particularized factual allegations that raise a reasonable doubt that the directors are disinterested and independent.” This is often demonstrated by showing “that a majority of the directors faced a substantial likelihood of liability on the underlying claims.” (Emphasis in original.) According to the Home Depot court, however, the plaintiffs failed to make this showing.

First, the court held that the failure to disclose that the Audit Committee charter had not been amended was not material, since the board still believed and acted as though the committee had oversight over the company’s data security during the time period in question. Second, with regard to the company’s alleged omission regarding data security threats, the court explained that the plaintiffs failed to identify the specific statements in the 2014 proxy statement that were “rendered false or misleading as a result of the omission,” thus failing to demonstrate, as is required for a Section 14(a) claim, that the board had a duty to disclose the information.

While finding that the court could dismiss the plaintiffs’ Section 14(a) claim for that reason alone, the court added that the plaintiffs also failed to “plead with particularity how the omissions caused the loss complained of”; specifically, the plaintiffs did not make any statements “showing that the security breaches to the company would not have occurred but for the Defendants being reelected to the Board.” In fact, the data breach had already begun prior to the director election. Having found that demand was not futile, the court dismissed the derivative action.

Significance of ‘Home Depot’

Though Home Depot does not break new ground in holding that derivative Section 14(a) claims are not exempt from the demand requirement under Delaware law, it expresses and follows the majority view that Vides was erroneous. Perhaps more importantly, Home Depot appears to foreclose an innovative avenue attempted by shareholders to withstand a motion to dismiss a derivative suit filed after a data breach at the company.

The decision suggests that in jurisdictions that have found pre-suit demand to be required for Section 14(a) claims, shareholders seeking to sue corporate boards in connection with a data breach—who, in recent years, have been largely unsuccessful in surviving motions to dismiss with regard to duty of loyalty claims—cannot circumvent the demand requirement by couching their allegations as violations of Section 14(a).

Endnotes:

1. 2016 WL 6995676 (N.D. Ga. Nov. 30, 2016).

2. Virginia Bankshares v. Sandberg, 501 U.S. 1083, 1084 (1991).

3. 832 F.Supp. 989, 998 (W.D. Pa. 1993).

4. 265 F.Supp.2d 273 (S.D.N.Y. 2003).

5. 2006 WL 2849783, at *4 (S.D.N.Y. Oct. 4, 2006).

6. 2008 WL 5274442 (E.D.N.Y. Dec. 19, 2008), aff’d 356 Fed. Appx. 471 (2d Cir. Dec. 14, 2009).

A cardinal precept of Delaware law is that directors, rather than shareholders, manage the business and affairs of the corporation. In the context of shareholder requests that the company pursue litigation, the decision whether to pursue litigation on behalf of the company generally resides with the board as an exercise of business judgment. A shareholder lacks standing to bring suit on the company’s behalf unless the shareholder (i) has demanded that the directors pursue the corporate claim and the demand is wrongfully refused; or (ii) purports to initiate litigation on behalf of the company and alleges with particularity why pre-suit demand is excused as futile.

The typical shareholder derivative claim seeks to assert state law claims. In re The Home Depot, Inc. Shareholder Derivative Litigation, a recent decision from the U.S. District Court for the Northern District of Georgia that applied Delaware law, weighed in on a recurring question regarding the demand requirement on which courts have differed: whether pre-suit demand is required for claims alleging a violation of Section 14(a) of the Securities Exchange Act of 1934 (Exchange Act).1 Home Depot is the latest in a series of shareholder derivative actions arising from high-profile data breaches to be dismissed in recent years, with the court holding that Delaware’s demand requirement applies equally to Section 14(a) claims.

The Demand Requirement

Section 14(a) of the Exchange Act, in conjunction with Rule 14a-9 promulgated thereunder, provide that a proxy statement may not contain “any statement which, at the time and in light of the circumstances under which it is made, is false or misleading with respect to any material fact,” nor may it omit “to state any material fact necessary in order to make the statements therein not false or misleading.” A fact or statement is material if “there is a substantial likelihood that a reasonable shareholder would consider it important in deciding how to vote.”2 A claim alleging a violation of Section 14(a) may be brought either directly or derivatively.

Federal courts have long grappled with whether proxy disclosure claims under Section 14(a) are subject to the demand requirement in derivative actions, reaching conflicting conclusions. In In re Westinghouse Securities Litigation, for example, the Western District of Pennsylvania opined that where a plaintiff alleges a willful violation of the federal securities laws, “business judgment analysis is inapplicable,” since the preparation of allegedly false and misleading proxy statements is not a business decision.3

As the court explained, “the duty to make full and fair disclosure is independent of the duty to exercise reasonable care and prudence in the management of corporate affairs, and the decision whether or not to violate securities laws, unlike the decision whether to pursue litigation on behalf of the corporation, is not one reserved exclusively to directors.” The Westinghouse court further reasoned that, because derivative actions are the only private remedy for Section 14(a) violations, applying the business judgment rule to a Section 14(a) claim “would be tantamount to denying a type of enforcement that is essential to the accomplishment of the goals of” Section 14(a).

In Vides v. Amelio, the Southern District of New York came to a similar conclusion.4Vides explained that the purpose of a pre-suit demand in derivative actions is “to obtain the business judgment of the board on whether the litigation is in the best interests of the corporation and its shareholders.” According to Vides, that purpose has little bearing on a Section 14(a) claim, as a determination of “‘whether shareholders have, under the circumstances, been provided with appropriate information upon which an informed choice on a matter of fundamental corporate importance may be made, is not a decision concerning the management of business and affairs of the enterprise of the kind the business judgment rule is intended to protect.’” Rather, the decision regarding whether to include certain information in a proxy statement is a legal one, dependent on materiality.

Finally, as in Westinghouse, the court determined that the goals of Section 14(a) would be frustrated if director defendants were permitted to effect a dismissal of a derivative action based on the board’s judgment that its compliance with Section 14(a) was not in the best interests of the corporation. Accordingly, Vides concluded that “under Delaware law and federal policy, there is no need for prior demand upon the board of directors with respect to [a] claim of misstatements and omissions in the proxy statement.”

The Vides approach has been rejected by several courts. In a subsequent Southern District of New York decision, St. Clair Shores General Employees Retirement System v. Eibeler, for example, the court stated that it is “not persuaded that Section 14(a) claims should be treated as a special species of derivative claim not subject to the demand requirement and business judgment rule.”5 While acknowledging that a director’s decision regarding information to be included in a proxy statement “is not entirely protected by the business judgment rule” since it involves a question of materiality, the court held that a board’s decision regarding whether the corporation should pursue derivative litigation as a result of disclosure violations is still entitled to business judgment protection.

Similarly, in Bader v. Blankfein, the Eastern District of New York explained that, in deciding that there is no business judgment involved in determining whether to include certain information in a proxy statement, the Vides court overlooked the critical fact that, “when alerted to a materially false statement in a corporate proxy statement,” “directors must still use their business judgment in deciding what course of action to take”—including whether to pursue litigation.6

Home Depot

Home Depot arose out of the 2014 breach of Home Depot ‘s payment card data systems that resulted in the theft of 56 million customers’ financial data and was estimated to cost the company nearly $10 billion. As is standard in recent data breach derivative actions, plaintiffs in the Home Depot action alleged, among other things, that the defendants—officers and directors of the company when the breach occurred—”breached their duty of loyalty to Home Depot because [they] failed to institute internal controls sufficient to oversee the risks that Home Depot faced in the event of a breach.”

With regard to this quintessential claim, the court found that demand was not futile, since the plaintiffs “failed to show beyond a reasonable doubt that a majority of the Board faced substantial liability because it consciously failed to act in the face of a known duty to act.” Rather, according to the court, plaintiffs acknowledged that the board took action to remedy the company’s security weaknesses, their allegations amounting to a claim that the board’s plan “was not good enough.” Applying the standard articulated for claims of failure of board oversight in In re Caremark Inc. Derivative Litigation, 698 A.2d 959 (Del. Ct. Ch. 1996), under which a violation of the duty of loyalty can be found only if plaintiffs can demonstrate that the directors utterly failed to undertake their responsibilities or disregarded clear red flags, the court dismissed the plaintiffs’ duty of loyalty claim.

More interestingly, the plaintiffs also alleged that the director defendants violated Exchange Act Section 14(a) in their proxy statements for 2014 and 2015. Specifically, the plaintiffs claimed that the defendants “failed to disclose in their 2014 Proxy Statement that Home Depot had known, specific threats to its data security.” The plaintiffs further maintained that “neither the 2014 nor the 2015 Proxy Statements disclosed that the Audit Committee’s charter was not amended” to reflect that, following the dissolution of the Infrastructure Committee in 2012, the Audit Committee was responsible for data security oversight.

The court addressed the threshold question whether the plaintiffs’ federal Section 14(a) claim was subject to the demand requirement under Delaware law. While acknowledging that “the Eleventh Circuit has not yet weighed in on the issue,” the Home Depot court explained that, since “the business judgment rule is the foundation for the demand requirement, most courts have held that Vides was mistaken and that the demand requirement applies equally to Section 14(a) claims.” The court concurred, holding that Section 14(a) derivative claims are subject to the demand requirement.

Since the plaintiffs sued without making pre-suit demand on Home Depot ‘s board, the court then addressed whether demand was futile under the test articulated by the Delaware Supreme Court in Aronson v. Lewis , 473 A.2d 805 ( 1984 ) . Under Aronson, demand is excused “if the complaint provides particularized factual allegations that raise a reasonable doubt that the directors are disinterested and independent.” This is often demonstrated by showing “that a majority of the directors faced a substantial likelihood of liability on the underlying claims.” (Emphasis in original.) According to the Home Depot court, however, the plaintiffs failed to make this showing.

First, the court held that the failure to disclose that the Audit Committee charter had not been amended was not material, since the board still believed and acted as though the committee had oversight over the company’s data security during the time period in question. Second, with regard to the company’s alleged omission regarding data security threats, the court explained that the plaintiffs failed to identify the specific statements in the 2014 proxy statement that were “rendered false or misleading as a result of the omission,” thus failing to demonstrate, as is required for a Section 14(a) claim, that the board had a duty to disclose the information.

While finding that the court could dismiss the plaintiffs’ Section 14(a) claim for that reason alone, the court added that the plaintiffs also failed to “plead with particularity how the omissions caused the loss complained of”; specifically, the plaintiffs did not make any statements “showing that the security breaches to the company would not have occurred but for the Defendants being reelected to the Board.” In fact, the data breach had already begun prior to the director election. Having found that demand was not futile, the court dismissed the derivative action.

Significance of ‘ Home Depot

Though Home Depot does not break new ground in holding that derivative Section 14(a) claims are not exempt from the demand requirement under Delaware law, it expresses and follows the majority view that Vides was erroneous. Perhaps more importantly, Home Depot appears to foreclose an innovative avenue attempted by shareholders to withstand a motion to dismiss a derivative suit filed after a data breach at the company.

The decision suggests that in jurisdictions that have found pre-suit demand to be required for Section 14(a) claims, shareholders seeking to sue corporate boards in connection with a data breach—who, in recent years, have been largely unsuccessful in surviving motions to dismiss with regard to duty of loyalty claims—cannot circumvent the demand requirement by couching their allegations as violations of Section 14(a).

Endnotes:

1. 2016 WL 6995676 (N.D. Ga. Nov. 30, 2016).

2. Virginia Bankshares v. Sandberg , 501 U.S. 1083, 1084 ( 1991 ) .

3. 832 F.Supp. 989, 998 (W.D. Pa. 1993).

4. 265 F.Supp.2d 273 (S.D.N.Y. 2003).

5. 2006 WL 2849783, at *4 (S.D.N.Y. Oct. 4, 2006).

6. 2008 WL 5274442 (E.D.N.Y. Dec. 19, 2008), aff’d 356 Fed. Appx. 471 ( 2d Cir. Dec. 14, 2009 ) .