In re Transunion Derivative Stockholder Litigation, C.A. No. 2022-1103-LWW (Del. Ch. Oct. 1, 2024). The officers and directors of a Delaware corporation are required to ensure that a corporation operates lawfully. A corporation’s failure to comply with its legal obligations does not automatically translate into a breach of a fiduciary duty. Rather, to establish liability, the plaintiff must satisfy the high burden of demonstrating that the officers and directors caused the corporation to willfully violate the law, or in the alternative, that the officers and directors failed to establish controls to assess and address risk. In the event that these controls are in place, officers and directors will not bear liability for breach of a fiduciary duty as long as the officers and directors acted in good faith. As Vice Chancellor Lori Will explained, “[i]mperfect compliance is not bad faith.”
Case Background
Transunion was the subject of a multiyear investigation by the Consumer Financial Protection Bureau (CFPB) related to the corporation’s advertising and marketing practices. The regulatory agency initiated the investigation in 2015, resulting in the entry of a consent order identifying the corporation’s violations of the Consumer Financial Protection Act and the corrective action that it agreed to undertake to remedy the violations. Under the consent order, Transunion was required to submit compliance and redress plans for the agency’s review. The corporation first submitted its plans to the Audit and Compliance (A&C) Committee before forwarding the proposals to the CFPB. The Transunion board was made aware of the company’s efforts to comply with the consent order and its engagement with the government through its general counsel.
Based on its review of the redress plan, the CFPB provided Transunion with a determination of non-objection. However, with respect to the compliance plan, the agency neither required revisions nor provided a determination of non-objection. The Transunion board was informed of these developments. The board also received legal advice that the company was not required to take action in furtherance of a plan until it received a determination of non-objection.
In 2019, the CFPB issued a Potential Action and Request for Response letter, which set forth its preliminary findings that Transunion violated the consent order. The CFPB disagreed with Transunion that a determination of non-objection was necessary for the company to implement corrective action. Transunion responded to the letter by citing the actions taken to address the concerns in the consent order. However, the agency was not persuaded and the matter was referred by the agency for an enforcement action. The A&C Committee was informed of each of these developments.
Thereafter, the CFPB issued a number of civil investigative demands for information. In response, Transunion formed a Steering Committee consisting of legal, compliance, and business personnel as well as the Enterprise Risk Management Committee, which included Transunion’s executives and officers. The corporation developed a revised compliance plan that outlined the efforts undertaken to date, the rationale for its conduct, and the steps that it intended to implement. The A&C Committee endorsed the revised plan, but the CFPB elected to file suit against Transunion in federal court.
This lawsuit was filed by shareholders on behalf of the corporation against current and prior members of Transunion’s board of directors, in which the shareholder plaintiffs alleged that the directors breached their fiduciary duty to oversee the corporation’s compliance with federal law.
Analysis
Officers and directors possess a duty to ensure that a corporation conducts its business in a lawful manner. Delaware law presumes that officers and directors discharge this duty in good faith. The legal threshold for imposing liability on officers and directors based on failed oversight over a corporation is high: the plaintiff must demonstrate that the officers and directors acted in bad faith.
A claim against an officer or director who failed to maintain oversight over a corporation may take a variety of shapes and forms. Delaware courts frequently defer to the judgment of officers and directors when addressing risk. To establish an actionable claim against officers and directors, the plaintiff must demonstrate that a violation of the law was so obvious and material that disregarding the violation constitutes bad faith. Frequently, a claim for relief relies on one of the following theories: (1) the officers and directors purposely cause the corporation to break the law in pursuit of profit; (2) the officers and directors knowingly fail to implement a system to monitor the corporation’s level of compliance; or (3) when a system is in place, the officers and directors fail to monitor the system and make a good faith effort to address the risks.
In Transunion, the court rejected the plaintiff shareholders’ allegations that the defendant directors violated their fiduciary duty. The defendant directors obtained legal advice from an attorney with experience in CFPB enforcement actions. The corporation’s general counsel personally interacted with the CFPB. The defendant directors received frequent updates from multiple committees concerning efforts to remedy the purported legal violations and address the CFPB’s comments on the corporation’s remediation plans. Having established a mechanism to monitor compliance and a review of the proposed remedial actions, the court found that the defendant directors, at minimum, satisfied their duty of oversight in good faith. Although the CFPB filed suit related to Transunion’s compliance with the consent order, imperfect compliance, including a difference in opinion as to the requirements of the consent order, is not indicative of bad faith. Accordingly, the court dismissed the plaintiff shareholders’ complaint.
Takeaways
Officers and directors of a Delaware corporation can discharge their duty of corporate oversight through the creation of certain controls (e.g., an audit or compliance committee) and a good faith effort to address identified risks. The implementation of a control alone will not suffice. Officers and directors must also inquire of the findings of these systems and ensure that the corporation is adequately addressing risk. In this instance, imperfection does not necessarily give rise to liability. Rather, if the officers and directors satisfy this baseline threshold, the Delaware courts will not second-guess their actions in the absence of bad faith.