MATTHEW BECKER, Case No. 21-cv-03295-JST
Plaintiff, ORDER DENYING SECOND MOTION v. FOR PRELIMINARY APPROVAL OF CLASS ACTION SETTLEMENT LISI, LLC, et al., Re: ECF No. 42 Defendants.
Before the Court is Plaintiff Matthew Becker’s second motion for preliminary approval of a class action settlement. ECF No. 42. The Court will deny the motion without prejudice. This putative class action arises out of the alleged failure of Defendants LISI, LLC and AmWins Group, Inc. to adequately secure and safeguard their customers’ personally identifiable information (“PII”). ECF No. 1. Plaintiff brings claims on behalf of all individuals whose PII was compromised as a result of the data breach Defendants announced in July 2020. A. Parties and Claims LISI partners with insurance carriers to market and distribute their products to insurance brokers and agencies. AmWins is LISI’s parent company. In July 2020, Becker, who had previously enrolled in a MetLife insurance plan, received a Notice of Data Breach from LISI. The notice indicated that an employee’s email account had been hacked, and that emails containing class members’ PII—including names, Social Security Numbers, dates of birth, and insurance information—had been forwarded from a LISI email account to an unauthorized third party. Becker alleges that Defendants took inadequate steps to protect class members’ PII, and theft. Among other harms, Becker asserts that fraudulent accounts were opened in his name using his Social Security number, and that he was required to purchase a credit and identity theft monitoring product that he would not otherwise have needed to purchase. Becker’s complaint asserts causes of action for (1) negligence, (2) breach of confidence, (3) injunctive and declaratory relief, and (4) violation of California’s Unfair Competition Law, Cal. Bus. & Prof. Code §§ 17200, et seq. B. Key Terms of Proposed Settlement The Settlement Agreement defines the Settlement Class as “all persons residing in the United States whose [PII] was compromised as a result of the Data Security Incident that was announced by Defendants in July 2020.” ECF No. 38-1 ¶¶ 1.35, 4.1. The class is comprised of approximately 500 individuals.1 Defendants agree to provide all class members with access to IDX’s Identity Protection Services for 24 months from the “Effective Date.”2 Id. ¶ 5.2. “This benefit will be provided with the Short Notice as a link with a redeemable code to be used directly with IDX.” Id. Though class members need not submit a claim to access Identity Protection Services, they must enroll by the
1 The exact size of the proposed class is unclear. The Settlement Agreement and notice state that the class is composed of 553 individuals. ECF No. 38-1 ¶ 1.37; id. at 46. Becker’s second motion for preliminary approval suggests that the class is composed of 491 individuals. ECF No. 42-3 (chart stating that 491 class members would be bound by the proposed settlement). For the purposes of this order, the Court assumes a class size of 500.
2 “Effective Date” is not defined in the Settlement Agreement, as the internal cross-reference in its definition is incorrect. ECF No. 38-11 ¶ 1.11 (defining “Effective Date” as “the first date by which all of the events and conditions specified in ¶ 1.12 herein have occurred and been met”); id. ¶ 1.12 (defining “Fee Application”).
The term “Effective Date” is also repeatedly used—without definition—in both the short and long notice. See, e.g., ECF No. 38-1 at 40 (explaining that all class members will be provided credit monitoring services “for a period of 24 months from the Effective Date of the Settlement”); id. at 43 (“[S]ervices will be provided for a period of 24 months from the Effective Date of the Settlement.”). For more information regarding the terms of the settlement, the notices direct class members to the Settlement Agreement, available on the settlement website. However, as noted “Election Deadline,” a term not defined in the Settlement Agreement.3 Id. Class members may also submit claims for out-of-pocket losses reasonably traceable to the data breach, including losses relating to fraud or identity theft; fees associated with lawyers, accountants, or credit repair services; costs associated with freezing or unfreezing credit and post- breach credit monitoring; and breach-related notary, fax, postage, copying, mileage, and long- distance telephone charges. Id. ¶ 5.3. Each class member seeking reimbursement for such out-of- pocket losses must submit receipts or other “not ‘self-prepared’” documentation. Id. Class members can also be reimbursed for up to three hours of time spent addressing issues related to the data breach, compensated at $25 per hour, provided they submit an attestation and brief description of the time associated with each action. While Defendants will not create a fund for payment of class members’ claims for reimbursement of out-of-pocket losses and lost time, Defendants will reimburse each claimant up to $1,500, up to an aggregate cap of $200,000. If the value of claims made exceeds this cap, each will be reduced on a pro rata basis. Id. If claims submitted total less than $200,000, Defendants will keep the difference. The Settlement Agreement also identifies “Non-Monetary Relief” in the form of improvements to Defendants’ cybersecurity practices. Id. ¶ 5.7. “In response to the event, following a password reset across the organization, [LISI] enacted multi-factor authentication and tightened policies and practices with regard to the creation of forwarding rules[,] . . . conducted a re-training of its employees[,] . . . instituted annual employee training[,] . . . [and] has also come under the governance of AmWINS Group, Inc.’s central security team, which has standardized anti-malware protections on all endpoints.”4 Id. 3 The Settlement Agreement states that, “[i]f a Settlement Class Member elects to receive . . . Identity Protection Services, he or she must make that election by the Election Deadline.” ECF No. 38-1 ¶ 5.3. Because the Settlement Agreement and notices indicate that all class members will receive this benefit, the Court understands the phrase “make that election” to mean that class members must enter the redeemable code on the IDX website prior to the Election Deadline. Neither notice explains that a class member who wishes to enroll in Identity Protection Services must do so by any deadline.
4 Despite the fact that the paragraph is titled “Non-Monetary Relief” and appears in a section titled “Settlement Consideration,” nothing in the text of the paragraph, the rest of the Settlement The Settlement Agreement provides that class members agree to release all claims “that result from, arise out of, are based upon, or relate to the [data breach], and conduct that was alleged or could have been alleged in [this action]. . . including [claims] . . . arising out of (1) the unauthorized access of [class members’] personally identifiable information . . .; (2) Defendants’ maintenance of [class members’] personally identifiable information; (3) Defendants’ information security policies or practices; (4) Defendants’ provision of notice to [class members] following the [data breach].” Id. ¶ 9.1. The Settlement Agreement includes a “clear sailing” provision: Defendants agree not to oppose any motion for attorney’s fees and costs of $75,000 or any motion for a service award of no more than $2,000 to Becker. Id. ¶¶ 10.3, 10.7. C. Procedural History Becker filed this action on May 4, 2021. ECF No. 1. After several stipulations to extend time to respond to the complaint, Becker filed a motion for preliminary approval of class action settlement on February 25, 2022. ECF No. 38. The Court denied the motion without prejudice. ECF No. 39. Becker filed this second unopposed motion for preliminary approval on October 28, 2022. ECF No. 42. The Court has jurisdiction pursuant to 28 U.S.C. § 1332. The Ninth Circuit maintains a “strong judicial policy” that favors the settlement of class actions. Class Plaintiffs v. City of Seattle, 955 F.2d 1268, 1276 (9th Cir. 1992). Rule 23 requires courts to employ a two-step process in evaluating a class action settlement. First, the parties must show “that the court will likely be able to . . . (i) approve the proposal under Rule 23(e)(2).” Fed. R. Civ. P. 23(e)(1)(B). In other words, a court must make a preliminary determination that the settlement “is fair, reasonable, and adequate” when considering the factors set out in Rule 23(e)(2). Fed. R. Civ. P. 23(e)(2). If no class has yet been certified, a court must make a preliminary finding that it “will likely be able to . . . (ii) certify the class for purposes of judgment “must direct notice in a reasonable manner to all class members who would be bound by the proposal.” Id. Second, courts must hold a hearing pursuant to Rule 23(e)(2) to make a final determination of whether the settlement is “fair, reasonable, and adequate.” Fed. R. Civ. P. 23(e)(2). The court’s task at the preliminary approval stage is to determine whether the settlement falls “within the range of possible approval.” In re Tableware Antitrust Litig., 484 F. Supp. 2d 1078, 1079 (N.D. Cal. 2007) (quoting Schwartz v. Dallas Cowboys Football Club, Ltd., 157 F. Supp. 2d 561, 570 n.12 (E.D. Pa. 2001)). Courts “must be particularly vigilant not only for explicit collusion, but also for more subtle signs that class counsel have allowed pursuit of their own self-interests and that of certain class members to infect the negotiations.” In re Bluetooth Headset Prods. Liab. Litig., 654 F.3d 935, 947 (9th Cir. 2011). Preliminary approval is appropriate if “the proposed settlement appears to be the product of serious, informed, non- collusive negotiations, has no obvious deficiencies, does not improperly grant preferential treatment to class representatives or segments of the class, and falls within the range of possible approval.” Tableware, 484 F. Supp. 2d at 1079 (quoting Schwartz, 157 F. Supp. 2d at 570 n.12). The proposed settlement need not be ideal, but it must be fair and free of collusion, consistent with counsel’s fiduciary obligations to the class. Hanlon v. Chrysler Corp., 150 F.3d 1011, 1027 (9th Cir. 1998), overruled on other grounds by Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338 (2011) (“Settlement is the offspring of compromise; the question we address is not whether the final product could be prettier, smarter or snazzier, but whether it is fair, adequate and free from collusion.”). To assess a settlement proposal, courts must balance a number of factors:
[T]he strength of the plaintiffs’ case; the risk, expense, complexity, and likely duration of further litigation; the risk of maintaining class action status throughout the trial; the amount offered in settlement; the extent of discovery completed and the stage of the proceedings; the experience and views of counsel; the presence of a governmental participant; and the reaction of the class members to the proposed settlement. Id. at 1026 (quoting Torrisi v. Tucson Elec. Power Co., 8 F.3d 1370, 1375 (9th Cir. 1993)). The proposed settlement must be “taken as a whole, rather than the individual component parts,” in the substitute certain provisions”; the settlement “must stand or fall in its entirety.” Id. (quoting Officers for Justice, 688 F.2d at 630). Becker’s second motion for preliminary approval addresses some, but not all, of the deficiencies identified by the Court in its prior order. In its prior order, the Court explained that Becker’s initial motion did not comply with certain sections of the Procedural Guidelines, and that “failure to address the issues discussed in the Guidelines is a proper ground for denying a motion for preliminary . . . approval.” ECF No. 41 at 8 (quoting Bakhtiar v. Info Res., Inc., No. 17-cv-04559-JST, 2020 WL 11421997, at *8 (N.D. Cal. Jan. 30, 2020)).5 Becker’s second motion does not comply with certain sections of the Guidelines. A. Section 1(c) The Guidelines require an explanation of “[t]he class recovery under the settlement (including details about and the value of injunctive relief), the potential class recovery if plaintiffs had fully prevailed on each of their claims, claim by claim, and a justification of the discount applied to the claims.” Guidelines § 1(c). Such information permits courts to determine whether a proposed settlement is reasonable. “Balancing the class’s potential recovery against the amount offered in settlement is ‘perhaps the most important factor to consider’ in preliminary approval.” Haralson v. U.S. Aviation Servs. Corp., 383 F. Supp. 3d 959, 970 (N.D. Cal. 2019) (quoting Cotter v. Lyft, Inc., 176 F. Supp. 3d 930, 935 (N.D. Cal. 2016)). “Plaintiffs seeking preliminary approval should show their work by explaining the relative value of their claims in significant detail.” Id. (quoting Eddings v. DS Servs. of Am., Inc., No. 15-cv-02576-VC, 2016 WL 3390477, at *1 (N.D. Cal. May 20, 2016)).
5 The Procedural Guidelines were updated on August 4, 2022. The Court’s prior order evaluated Becker’s first motion for preliminary approval under the prior version of the Procedural Guidelines, which were in effect at the time of the motion’s filing. Because Becker’s second motion was filed after August 4, 2022, the Court here evaluates Becker’s compliance with the current Procedural Guidelines, available at https://www.cand.uscourts.gov/forms/procedural- In its prior order, the Court instructed Becker that any future motion should state the maximum value of the class’s claims and explain the basis for this value. Becker’s second motion argues that such a calculation is not possible, and instead suggests that a market theory approach—which estimates the black-market value of class members’ stolen Social Security numbers—properly estimates the measure of damages at trial:
Plaintiff is unaware of any data breach cases that have proceeded to trial to provide illustration for the recovery that would be awarded if Plaintiff had fully prevailed on each of his claims on a class wide basis. While class wide data breach damage models remain largely untested, the typical measure of damages proffered has been a market value of PII based upon black market rates for the data points involved. . . . Under a market theory approach, Settlement Class Members may have been able to recovery [sic] $2[-]$25 per person for their Social Security numbers involved in the Data Security Incident. . . . At the highest amount of $25, Plaintiff would only have been able to recover $12,500 for the class as a whole. ECF No. 42 at 8-9 (citations omitted). Becker argues that, compared to the $12,500 maximum recovery calculated using the market theory approach, the proposed settlement offers clear benefits: Defendants have agreed to pay up to $200,000 in valid claims for out-of-pocket expenses and time lost, and all class members will be offered 24 months of IDX’s Identity Protection Services, which “provides more than $117,250.00 in [estimated retail] value to the Class for the free two years of coverage.” ECF No. 42 at 8. Becker argues that the “typical measure of damages” in data breach cases is the market value theory, citing two cases in which courts denied Daubert challenges to the use of dark web market values as a basis for damages models. ECF No. 42 at 9. But neither case suggests that dark web values provide the “typical measure” for damages in data breach cases, and Becker does not explain why this is the best measure of the value of his claims. Becker does not explain whether or how his proposed market theory approach accurately captures “the potential class recovery if plaintiffs had fully prevailed on each of their claims, claim by claim.” Guidelines § 1(c) (emphasis added). It is not clear how well the dark web value of class members’ Social Security numbers reflects the potential class recovery in this action. Becker’s complaint pleads claims for relief. Becker alleges that, as a result of Defendant’s conduct, class members faced:
ongoing, imminent, certainly impending threat of identity theft crimes, fraud and other misuse, resulting in monetary loss and economic harm; actual identity theft crimes, fraud, and other misuse, resulting in monetary loss and economic harm; loss of the value of their privacy and the confidentiality of the stolen PII; illegal sale of the compromised PII on the black market; mitigation expenses and time spent on credit monitoring, identity theft insurance, and credit freezes and unfreezes; reviewing bank statements, payment card statements, and credit report; expenses and time spent initiating fraud alerts; decreased credit scores and ratings; lost work time; lost value of the PII; lost benefit of their bargains and overcharges for services; and other economic and non-economic harm. ECF No. 1 ¶¶ 112, 122. The potential class recovery, if Becker had fully prevailed on his claims, would not seem to be measured by the market theory approach. Without information about the class’s potential recovery, the Court cannot evaluate whether the proposed settlement is reasonable. Any future motion should state “the potential class recovery if plaintiffs had fully prevailed on each of their claims, claim by claim, and a justification of the discount applied to the claims.” Guidelines § 1(c). Finally, the “Settlement Consideration” section of the Settlement Agreement discusses “Non-Monetary Relief” in the form of post-breach actions taken by Defendants. ECF No. 38-1 ¶ 5.7. If this is non-monetary relief to class members, any future motion must provide details about and estimate the value of such relief. B. Section 1(f) The Guidelines require that, where a settlement involves a claim form, the motion should state “an estimate of the expected claim rate in light of the experience of the selected claims administrator and/or counsel based on comparable settlements, the identity of the examples used for the estimate, and the reason for the selection of those examples.” Guidelines § 1(f). Becker’s second motion estimates a claims rate of 4%, in which case Defendants would pay up to $30,000 to 20 class members.6 ECF No. 42 at 10. An exhibit explains that proposed claims administrator Angeion Group reached this estimated claims rate by “sampl[ing] and compar[ing] 5 data breach cases Angeion Group has administered that [it] believe[s] to be instructive here” and provides a chart comparing the class size, number of claims, and claims rate in each of those cases. ECF No. 42-2 at 6. Neither the motion nor the exhibit discloses the identity of the examples used for the estimate or the reason for selection of those examples, as required by the Guidelines. C. Section 1(g) “[I]n light of Ninth Circuit case law disfavoring reversions,” the Guidelines require motions for preliminary approval to state “whether and under what circumstances money originally designated for class recovery will revert to any defendant, the expected and potential amount of any such reversion, and an explanation as to why a reversion is appropriate.” Guidelines § 1(g). Becker acknowledges that, like all claims-made settlements, “the Settlement Agreement allows Defendants to retain any unclaimed amounts, which is in essence a reversion.” ECF No. 38 at 22. At Becker’s estimated claims rate of 4%—which would result in Defendants paying out a maximum of $30,000 in claims—Defendants will keep at least $170,000 in funds they are willing to pay class members in consideration of their release of claims. Neither of Becker’s motions for preliminary approval explains why a reversionary settlement is appropriate in this case. Becker’s initial motion argued that “the circumstances of this matter coupled with the benefits in the proposed Settlement do not weigh against a reversion,” and that “[c]ompensating Settlement Class Members for their actual losses, which can be precisely calculated, is a fair form of compensation, as opposed to an equal distribution of a fund.” ECF No. 38 at 22. But the motion did not address why a reversionary claims-made settlement—as opposed to, for example, a settlement fund from which claims are paid, in which unpaid funds do not revert to Defendants—is appropriate in this particular case. Becker’s second motion for preliminary approval does not address this issue. Becker’s initial motion argued that “the provision of the additional 24 months of IDX Identity Protection Services is not subject to any cap,” which “adds to the overall value of the collusion.” ECF No. 38 at 22-23. Becker estimates that the provision of Identity Protection Services—for which all class members are automatically eligible—adds $117,250 in value to the class. ECF No. 42 at 8. Per the Settlement Agreement, “[t]his benefit will be provided with the Short Notice as a link with a redeemable code to be used directly with IDX.” ECF No. 38-1 ¶ 5.2. “If a Settlement Class Member elects to receive . . . Identity Protection Services, he or she must make that election by the Election Deadline.” Id. This language suggests that the redeemable codes expire or otherwise cannot be used after the Election Deadline. It is not clear whether this provision of the agreement is also reversionary.7 Any future motion for preliminary approval should clearly state “whether and under what circumstances money originally designated for class recovery will revert to any defendant, the expected and potential amount of any such reversion, and an explanation as to why a reversion is appropriate.” Guidelines § 1(g). The Court emphasizes that reversionary clauses “require ‘even greater scrutiny than is ordinarily demanded.’” Rollins v. Dignity Health, No. 13-CV-01450-JST, 2019 WL 8165915, at *8 (N.D. Cal. Oct. 28, 2019) (quoting In re Bluetooth, 654 F.3d at 949). D. Section 11 The Guidelines also require information about one or more prior, comparable settlements, namely “[t]he claims being released, the total settlement fund, the total number of class members, the total number of class members to whom notice was sent, the method(s) of notice, the number and percentage of claim forms submitted, the average recovery per class member or claimant, the amounts distributed to cy pres recipients, the administrative costs, the attorneys’ fees and costs, [and] the total exposure if the plaintiffs had prevailed on every claim.” Guidelines § 11(a). For settlements which entitle class members to non-monetary relief, counsel must additionally state “the number of class members availing themselves of such relief and the aggregate value redeemed by the class members and/or by any assignees or transferees of the class members’
7 If Defendants are paying a discounted bulk rate for credit monitoring services, regardless of how many class members enroll, the provision is not reversionary. If, however, Defendants are permitted to retain the value of any unredeemed codes after that date—that is, if Defendants do not interests.” Id. § 11(b). For settlements involving “injunctive and/or other non-monetary relief,” counsel must also “discuss the benefit conferred on the class.” Id. § 11(c). In its prior order, the Court noted that Becker’s first motion for preliminary approval provided some, but not all, of the information required concerning the past comparable settlements he identifies. Becker’s second motion attaches a chart of comparable data breach settlements that does not address all of the requirements of Section 11. ECF No. 42-3. The chart lists six data breach settlements and provides the total monetary settlement, number of class members, number of noticed class members, number of claims received, administrative costs, and “total exposure on market value theory” for each settlement.8 The chart additionally notes that one of the settlements included a distribution to a cy pres recipient. The chart does not identify the claims being released, the methods of notice, the average recovery per class member, or attorney’s fees and costs, nor does it identify whether class members in those settlements were entitled to non- monetary relief and, if so, how many class members availed themselves of such relief.9 Any future motion for preliminary approval should fully address the requirements of Section 11 of the Guidelines. From the information provided in Becker’s second motion for preliminary approval, the
8 While Becker offers no explanation for his calculation of “total exposure on market value theory” for each of these settlements, the amounts appear to have been calculated by multiplying the black-market value of a single Social Security number by the number of class members. See ECF No. 42-3 (calculating total exposure of $5,944,125 for class size of 237,765, based on estimated black-market value of $25). As discussed above, Becker does not adequately support an inference that this is an adequate measure of “total exposure if the plaintiffs had prevailed on every claim,” nor does Becker suggest that the plaintiffs in these cases measured exposure in this way.
9 Such details permit the Court to evaluate this settlement against past comparable settlements. See, e.g., Giroux v. Essex Prop. Tr., Inc., No. 16-cv-01722-HSG, 2018 WL 2463107, at *1-2 (N.D. Cal. June 1, 2018) (noting that, pursuant to settlement agreement, the defendant would establish a gross settlement fund of $350,000; the defendant would purchase an additional three years of credit monitoring and identity protection coverage; notice would be sent via email and U.S. mail; and the parties anticipated an average recovery of $70, excluding the value of identity protection services); Giroux v. Essex Prop. Tr., Inc., No. 16-cv-01722-HSG, 2019 WL 1207301, at *6 (N.D. Cal. Mar. 14, 2019) (granting $140,000 in attorney’s fees, $9,498.64 in costs, and 1 Court cannot make a preliminary determination that the proposed settlement is fair, reasonable, 2 and adequate, or that the settlement falls within the range of possible approval. The motion is 3 therefore denied. 4 Becker may submit a revised motion for preliminary approval within 90 days of this order.
6 Dated: May 25, 2023 JON S. TIGAR 8 nited States District Judge 9 10 11 12
© 15 16
= 17
Z 18 19 20 21 22 23 24 25 26 27 28