Guy v. Convergent Outsourcing Inc

Opinion

1 2 3 4

5 6 7 UNITED STATES DISTRICT COURT 8 WESTERN DISTRICT OF WASHINGTON AT SEATTLE 9 10 LEO GUY, et al., CASE NO. C22-1558 MJP 11 Plaintiffs, ORDER ON MOTION FOR PRELIMINARY APPROVAL OF 12 v. CLASS ACTION SETTLEMENT 13 CONVERGENT OUTSOURCING, INC., 14 Defendant. 15 16 17 This matter comes before the Court on Plaintiffs’ Unopposed Motion for Preliminary 18 Approval of Class Action Settlement. (Dkt. No. 55.) Having reviewed the Motion and all 19 supporting materials, the Court GRANTS the Motion’s request to certify a settlement class, and 20 DENIES without prejudice the Motion’s request for preliminary approval of the settlement. 21 BACKGROUND 22 This case concerns a data breach that occurred on June 17, 2022, when a third-party 23 exfiltrated highly sensitive personally identifiable information (PII) from Defendant Convergent 24 1 Outsourcing, Inc.’s computer system. (Consolidated Amended Complaint (CAC) ¶¶ 3, 46, 49 2 (Dkt. No. 31).) Plaintiffs filed suit individually and on behalf of the 640,906 individuals who 3 were similarly notified by Convergent that their PII was exposed in the data breach. (Id. ¶¶ 48- 4 49.) Plaintiffs allege that Convergent failed to protect their PII and follow minimum industry

5 standards. (See id. ¶¶ 45, 54, 58-63, 78, 81-85.) The Court granted in part and denied in part 6 Convergent’s motion to dismiss, allowing some of Plaintiffs’ state common law and statutory 7 claims to proceed. (Dkt. No. 45.) 8 Plaintiffs now seek preliminary approval of a settlement reached between the Parties as to 9 those claims that survived Defendant’s motion to dismiss. The Parties settled the claims for 10 $2,450,000 and Plaintiffs propose the Court certify a settlement class of approximately 640,906 11 individuals, and enter preliminary approval of the settlement on behalf the class. (Mot. at 3-4 12 (Dkt. No. 55).) The proposed Settlement Class includes: 13 All persons residing in the United States to whom Defendant Convergent Outsourcing, Inc. sent notification that their personal information may have been compromised by 14 unauthorized third parties as a result of the data security incident discovered by Convergent on or about June 17, 2022. 15 (Settlement Agreement ¶ 3.1 (Ex. B. to the Declaration of Gary M. Klinger) (Dkt. No. 56-2).) 16 The Settlement allows for Settlement Class Members to file one of three different types 17 claims for payment out of the settlement fund. (Settlement Agreement ¶¶ 4.2.) A class member 18 may seek up to $1,500 for “ordinary” out-of-pocket expenses related to the data breach or up to 19 $10,000 for “extraordinary” out-of-pocket expenses. (Settlement Agreement ¶¶ 4.21, 4.2.3.) As a 20 third option, Class members may elect to file a claim for an alternative pro rata share of the 21 settlement fund. (Settlement Agreement ¶ 4.2.4.) If the total dollar value of the claims exceeds 22 the amount remaining in the settlement fund necessary to cover the attorneys’ fees and costs, 23 class representative’s service award, and administrative costs, then the payment amount for 24 1 claims “shall be reduced pro rata” among those who submit claims for ordinary or extraordinary 2 losses, and those who seek the alternative pro rata share will receive nothing. (Settlement 3 Agreement ¶ 4.4.) 4 The Settlement requires all members of the proposed Settlement Class who do not

5 exclude themselves to release: 6 any and all claims, demands, actions or causes of action with respect to the Data Incident, whether known or unknown, that have been asserted in the Litigation, or that could have 7 been asserted, that arise out of or relate to the causes of action, allegations, practices, or conduct at issue in the Litigation related to Convergent or the Data Incident. 8 (Settlement Agreement ¶ 2.29.) 9 Plaintiffs’ counsel state that they will seek an award of reasonable attorneys’ fees and 10 costs. (See Mot. at 6.) But counsel has not specified the amount of costs and fees or even the 11 percentage of the common fund they seek. This information is similarly absent from the 12 proposed class notices. (See Dkt. No. 56-2 at 37-55.) Plaintiffs’ counsel have indicated that they 13 will request an award of $1,500 to each of the seven named plaintiffs for their services as the 14 settlement class’s named representatives. But they propose to file their motion asking for the 15 service award, attorneys’ fees, and costs just fourteen days before the deadline for Settlement 16 Class members to opt out of the settlement. (Klinger Decl. ¶ 40.) 17 ANALYSIS 18 The Court first examines certification of the Settlement Class before analyzing the 19 propriety of preliminary approval of the settlement. While the Court certifies the Settlement 20 Class, it finds two important flaws in the settlement preventing preliminary approval. 21 A. Preliminary Certification of Settlement Class 22 The Court finds the certification of the proposed Settlement Class is appropriate because 23 Plaintiffs have shown that it meets all of the requirements of Rules 23(a) and 23(b)(3). 24 1 1. Numerosity 2 The Court is satisfied that the Settlement Class is so numerous that joinder of all 3 members is impractical. See Fed. R. Civ. P. 23(a)(1). Plaintiffs’ Complaint and Motion identify 4 at least 640,906 individuals who were allegedly impacted by the data breach at issue. (Mot. at 4;

5 CAC ¶ 49.) This satisfies Rule 23(a)(1)’s numerosity requirement. 6 2. Commonality and Predominance 7 The Court finds that there are common issues of law and fact in satisfaction of Rule 8 23(a)(2)’s commonality requirement and that these common issues predominate over individual 9 ones as required by Rule 23(b)(3). The Court considers commonality and predominance together 10 given their overlapping nature. See, e.g., Valentino v. Carter–Wallace, Inc., 97 F.3d 1227, 1234 11 (9th Cir. 1996) (“Implicit in the satisfaction of the predominance test is the notion that the 12 adjudication of common issues will help achieve judicial economy.”) 13 To show commonality, Rule 23(a)(2) requires the plaintiff to demonstrate that there are 14 “questions of law or fact common to the class.” “Commonality requires the plaintiff to

15 demonstrate that the class members have suffered the same injury.” Wal-Mart Stores, Inc. v. 16 Dukes, 564 U.S. 338, 349–50 (2011) (citation and quotation omitted). To satisfy commonality, 17 the claims must depend on a common contention “that is capable of classwide resolution.” Id. at 18 350. As to predominance, the Court “tests whether proposed classes are sufficiently cohesive to 19 warrant adjudication by representation.” Amchem Products, Inc. v. Windsor, 521 U.S. 591, 623 20 (1997). “This calls upon courts to give careful scrutiny to the relation between common and 21 individual questions in a case.” Tyson Foods, 577 U.S. at 453. “An individual question is one 22 where members of a proposed class will need to present evidence that varies from member to 23 member, while a common question is one where the same evidence will suffice for each member

24 1 to make a prima facie showing [or] the issue is susceptible to generalized, class-wide proof.” Id. 2 (citation and quotation omitted). “The Rule 23(b)(3) predominance inquiry asks the court to 3 make a global determination of whether common questions prevail over individualized ones.” 4 Torres v. Mercer Canyons Inc., 835 F.3d 1125, 1134 (9th Cir. 2016). “Considering whether

5 questions of law or fact common to class members predominate begins, of course, with the 6 elements of the underlying cause of action.” Erica P. John Fund, Inc. v. Halliburton Co., 563 7 U.S. 804, 809 (2011) (internal quotation marks omitted). 8 Plaintiffs have satisfied both predominance and commonality. They identify a class of 9 individuals whose personal information was compromised in the same data breach affecting each 10 plaintiff. They allege the data breach occurred due to Convergent’s failure to safeguard their PII 11 consistent with industry standards. (See CAC ¶ 185.) This presents common issues, including 12 whether and what duty Convergent owed Plaintiffs and the Settlement Class to keep their PII 13 safe, whether Convergent breached that duty, and whether Convergent unreasonably delayed in 14 notifying Plaintiffs and the Settlement Class of the data breach. Resolving these legal issues

15 appears possible through classwide proof and the Court finds that common issues predominate 16 over any apparent individual ones. And while damages might vary among class members, the 17 right to recovery could be determined on a classwide basis. The Court finds both commonality 18 and predominance satisfied. 19 3. Typicality 20 The Court finds Plaintiffs’ claims are typical of absent class members as required by Rule 21 23(a)(3). 22 “The test of typicality ‘is whether other members have the same or similar injury, 23 whether the action is based on conduct which is not unique to the named plaintiffs, and whether

24 1 other class members have been injured by the same course of conduct.’” Hanon v. Dataprods. 2 Corp., 976 F.2d 497, 508 (9th Cir. 1992) (citation omitted). “Typicality refers to the nature of the 3 claim or defense of the class representative, and not to the specific facts from which it arose or 4 the relief sought.” Id. (internal citation and quotation marks omitted). The requirement is

5 permissive, such that “representative claims are ‘typical’ if they are reasonably coextensive with 6 those of absent class members; they need not be substantially identical.” Just Film, Inc. v. 7 Buono, 847 F.3d 1108, 1116 (9th Cir. 2017) (quoting Parsons v. Ryan, 754 F.3d 657, 685 (9th 8 Cir. 2014)). “The purpose of the typicality requirement is to assure that the interest of the named 9 representative aligns with the interests of the class.” Hanon, 976 F.2d at 508. 10 Plaintiffs here allege their personal information was compromised in the same data 11 breach that affected the other class members. (See CAC ¶ 49.) The claims they pursue appear 12 typical of the Settlement Class’s because the claims and injuries arise out of a common course of 13 conduct. This satisfies typicality. See Hanon, 976 F.2d at 508. 14 4. Adequacy

15 Rule 23(a) also requires that “‘the representative parties will fairly and adequately protect 16 the interests of the class.’” Hanlon v. Chrysler Corp., 150 F.3d 1011, 1020 (9th Cir. 1998) 17 (quoting Fed. R. Civ. P. 23(a)(4)), overruled on other grounds by Wal-Mart, 564 U.S. 338. 18 Adequacy of representation requires that “[f]irst, the named representatives must appear able to 19 prosecute the action vigorously through qualified counsel, and second, the representatives must 20 not have antagonistic or conflicting interests with the unnamed members of the class.” Lerwill v. 21 Inflight Motion Pictures, Inc., 582 F.2d 507, 512 (9th Cir. 1978). As to class counsel, the Court 22 must also assess the following requirements of Rule 23(g): 23 (i) the work counsel has done in identifying or investigating potential claims in the action; 24 1 (ii) counsel’s experience in handling class actions, other complex litigation, and the types of claims asserted in the action; 2 (iii) counsel’s knowledge of the applicable law; and (iv) the resources that counsel will commit to representing the class. 3 Fed. R. Civ. P. 23(g)(1)(A). The Court may also consider “any other matter pertinent to 4 counsel’s ability to fairly and adequately represent the interests of the class.” Fed. R. Civ. P. 5 23(g)(1)(B). And class counsel must “fairly and adequately represent the interests of the class.” 6 Fed. R. Civ. P. 23(g)(4). 7 The Court finds that Plaintiffs to be adequate class representatives and that class counsel 8 is similarly adequate. See Fed. R. Civ. P. 23(a)(4). While Plaintiffs have not provided 9 declarations, their counsel represent that Plaintiffs and counsel “vigorously and aggressively 10 gathered information that was available regarding Convergent and the Data Incident.” (Klinger 11 Decl. ¶ 28.) Counsel represents that each Plaintiff has been “vital in litigating this matter, 12 including providing important information about the impact of the Data Breach to proposed 13 Settlement Class Counsel” and that “Plaintiffs have been personally involved in the case and 14 support the Settlement.” (Id. ¶ 41.) The Court is also unaware of any conflict between Plaintiffs 15 and the proposed Settlement Class or any antagonistic interest between them. As such, the Court 16 finds the named Plaintiffs to be adequate representatives. Similarly, the Court finds that Plaintiffs 17 have retained counsel who have vigorously litigated this action, are experienced in bringing class 18 action data breach cases, and have the resources necessary to litigate this case. See Fed. R. Civ. 19 P. 23(g)(1). 20 5. Superiority 21 “In determining superiority, courts must consider the four factors of Rule 23(b)(3).” 22 Zinser v. Accufix Rsch. Inst., Inc., 253 F.3d 1180, 1190 (9th Cir.), as amended on denial of 23 reh’g, 273 F.3d 1266 (9th Cir. 2001). The four factors are: 24 1 (A) the class members’ interests in individually controlling the prosecution or defense of separate actions; 2 (B) the extent and nature of any litigation concerning the controversy already begun by or against class members; 3 (C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and 4 (D) the likely difficulties in managing a class action.

5 Fed. R. Civ. P. 23(b)(3)(A)-(D). 6 The Court finds superiority satisfied. Coordinating this litigation as a settlement class 7 action remains desirable given the relatively small individual amounts likely at issue, the limited 8 interest each class member likely has in directing the litigation, and the desirability in having one 9 court resolve this legal and factual issue for all class members. And the Courts no evidence of 10 any difficulties in managing the case as a class action for settlement purposes. 11 6. Approval of Settlement Class and Class Counsel 12 Having found all of the Rule 23(a) and Rule 23(b)(3) factors satisfied, the Court 13 GRANTS the Motion as to the proposed Settlement Class. The Court CERTIFIES the following 14 as the Settlement Class: 15 All persons residing in the United States to whom Defendant Convergent Outsourcing, Inc. sent notification that their personal information may have been compromised by 16 unauthorized third parties as a result of the data security incident discovered by Convergent on or about June 17, 2022. 17 (Settlement Agreement ¶ 3.1.) And the Court APPOINTS Jean S. Martin of Morgan & Morgan; 18 Gary M. Klinger of Milberg Coleman Bryson Phillips Grossman, PLLC; Gary E. Mason of 19 Mason LLP; and Cecily C. Jordan of Tousley Brain Stephens PLLC as Settlement Class 20 Counsel. 21 B. Preliminary Approval Not Appropriate 22 Although the Court certifies the Settlement Class, it finds that preliminary approval of the 23 settlement requires further consideration and action from the Parties. The Court identifies two 24 1 concerns: (1) the scope of the release; and (2) the lack of disclosure of Plaintiffs’ request for 2 attorneys’ fees and costs. For these reasons, the Court DENIES in part the Motion for 3 Preliminary Approval without prejudice. 4 1. Legal Standard

5 A proposed class action may not be settled on a classwide basis without court approval. 6 Fed. R. Civ. P. 23(e). Before approving a settlement, the Court must determine whether to order 7 notice of the proposed settlement to the class. Fed. R. Civ. P. 23(e)(1). This requires the parties 8 to “provide the Court with information sufficient to enable it to determine whether to give notice 9 of the proposal to the class.” Fed. R. Civ. P. 23(e)(1)(A). Notice must be given if the parties 10 show that “the court will likely be able to: (i) approve the proposal under Rule 23(e)(2); and (ii) 11 certify the class for purposes of judgment on the proposal.” Fed. R. Civ. P. 23(e)(1)(B). 12 Under Rule 23(e)(2), the Court must determine whether the proposed settlement taken as 13 a whole is “fair, adequate, and reasonable.” Fed. R. Civ. P. 23(e)(2); Hanlon v. Chrysler Corp., 14 150 F.3d 1011, 1026 (9th Cir. 1988), overruled on other grounds by Wal-Mart Stores, Inc. v.

15 Dukes, 564 U.S. 338 (2011). “[S]ettlements that occur before class certification are subject to a 16 high procedural standard.” Kim v. Allison, 8 F.4th 1170, 1178 (9th Cir. 2021) (quotation 17 omitted). “The district court must act as a fiduciary, protecting the interests of absent class 18 members by scrutinizing the settlement's fairness in light of well-established factors.” Id. To 19 assess whether a proposed settlement comports with Rule 23(e)(2), the Court considers: “(1) the 20 strength of the plaintiff's case; (2) the risk, expense, complexity, and likely duration of further 21 litigation; (3) the risk of maintaining class action status throughout the trial; (4) the amount 22 offered in settlement; (5) the extent of discovery completed and the stage of the proceedings; (6) 23 the experience and views of counsel; (7) the presence of a governmental participant; and (8) the

24 1 reaction of the class members of the proposed settlement.” Kim, 8 F.4th at 1178 (quotation and 2 citation omitted). And when settlement happens before class certification, approval is contingent 3 not only on a thorough assessment of these eight factors, but also a finding that the settlement “is 4 not[ ] the product of collusion among the negotiating parties.” In re Bluetooth Headset Prod.

5 Liab. Litig., 654 F.3d 935, 946-47 (9th Cir. 2011) (quotation and citation omitted). 6 2. Problems with Scope of Release 7 The Court finds that the scope of the release in the settlement is overbroad as drafted. 8 “[C]ourts have rejected preliminary approval when the proposed settlement contained 9 obvious substantive defects such as . . . overly broad releases of liability.” Newberg and 10 Rubenstein on Class Actions § 13:15 (6th ed. 2023 update) (collecting cases). “A proposed 11 settlement agreement is overly broad when it fails to limit the claims released to those based on 12 the facts alleged in the complaint.” Morgan v. United States Soccer Fed’n, No. 13 219CV01717RGKAGR, 2022 WL 16859651, at *3 (C.D. Cal. Aug. 11, 2022). This flows from 14 the Ninth Circuit’s explanation that “[a] settlement agreement may preclude a party from

15 bringing a related claim in the future even though the claim was not presented and might not 16 have been presentable in the class action, but only where the released claim is based on the 17 identical factual predicate as that underlying the claims in the settled class action.” Hesse v. 18 Sprint Corp., 598 F.3d 581, 590 (9th Cir. 2010) (citation and quotation omitted). 19 Here, the release contains ambiguous language that potentially covers claims that exceed 20 the core facts at issue in this action. The release reasonably covers “claims, demands, actions or 21 causes of action with respect to the Data Incident, whether known or unknown, that have been 22 asserted in the Litigation, or that could have been asserted[.]” ((Settlement Agreement ¶ 2.29.) 23 But the release also includes any “claims, demands, actions, or causes of action with respect to

24 1 the Data Incident . . . that arise out of or relate to the causes of action, allegations, practices, or 2 conduct at issue in the Litigation related to Convergent or the Data Incident.” The phrasing after 3 the ellipsis can reasonably be read to expand the scope of release to prevent any claims against 4 Convergent based on facts that do not relate to the claims at issue. The Complaint itself includes

5 allegations generally about Convergent’s business practices as a third-party consumer debt 6 collector across many different industries. (See, e.g., Consolidated Amended Complaint ¶ 1.) 7 One can plausibly read the inclusion of “practice, or conduct at issue in the Litigation related to 8 Convergent” to reach any of Convergent’s debt-collection related practices generally, even if 9 untethered to the data breach at issue. The Court appreciates that release includes limiting 10 language that any claims would need to be “with respect to the Data Incident[.]” But precisely 11 what is or is not “with respect to the Data Incident” is vague and could be argued expansively in 12 the context of post-ellipsis phrasing. If the release excluded the reference to “related to 13 Convergent or the Data Incident,” the ambiguity would no longer trouble the Court. But as 14 phrased, the Court finds that the release is overbroad. This prevents preliminary approval.

15 3. Notice Re: Attorneys’ Fees and Costs 16 The Court also finds that preliminary approval cannot be granted in the absence of an 17 express statement from Plaintiffs identifying the attorneys’ fees and costs that counsel will seek 18 from the settlement fund. The Court understands that any attorneys’ fees or costs require final 19 Court approval before being awarded. But the omission of this information from the Motion and 20 the proposed class notices adversely impacts the rights of the individuals within the Settlement 21 Class. Without knowing how much of the settlement fund might be requested, members of the 22 Settlement Class cannot fully understand or appreciate whether the proposed settlement is fair or 23 reasonable. There are approximately 640,906 individuals in the class who might seek either

24 1 ordinary, extraordinary, or pro rata shares from the $2.45 million settlement fund. (Mot. at 3-4.) 2 Those seeking a pro rata share may receive nothing if the common fund is exhausted by paying 3 the attorneys’ fees, costs, service awards, claims administrator, and both the ordinary and 4 extraordinary expense claims. (Settlement Agreement § 4.4.) And the amount that counsel seeks

5 from the settlement fund may also limit the amount of recovery for ordinary and extraordinary 6 claimants. The amount of attorneys’ fees and costs is therefore material to understanding the 7 fairness of the settlement. And while counsel proposes to submit their request for attorneys’ fees 8 and costs fourteen days before the class exclusion deadline, that does not assuage the Court’s 9 concerns. (See Klinger Decl. ¶ 40.) Information about fees and costs must be in the initial notice 10 to give class members sufficient time to understand and act on their right to opt out or challenge 11 the settlement. Excluding this information from the notice serves no valid purpose and would 12 hinder Settlement Class Members’ ability to understand the terms of the settlement and their 13 interests going forward towards final approval. 14 4. Additional Preliminary Approval Considerations

15 The Court has not addressed the other factors that impact preliminary approval. See Kim, 16 8 F.4th at 1178. The Court finds that analysis premature, given its concerns about the scope of 17 the release and the lack of information about attorneys’ fees and costs. The Court will assess 18 these factors should Plaintiffs renew their motion for preliminary approval. The Court will also 19 examine the adequacy of the claims administrator and the notice plan upon that submission. 20 CONCLUSION 21 The Court finds that Plaintiffs have satisfied all of the requirements for approval of the 22 proposed Settlement Class. The Court therefore GRANTS the Motion as to this request and 23 CERTIFIES the following Settlement Class:

24 1 All persons residing in the United States to whom Defendant Convergent Outsourcing, Inc. sent notification that their personal information may have been compromised by 2 unauthorized third parties as a result of the data security incident discovered by Convergent on or about June 17, 2022. 3 The Court also APPOINTS Jean S. Martin of Morgan & Morgan; Gary M. Klinger of Milberg 4 Coleman Bryson Phillips Grossman, PLLC; Gary E. Mason of Mason LLP; and Cecily C. Jordan 5 of Tousley Brain Stephens PLLC as Settlement Class Counsel. 6 But given the Court’s concerns about the Settlement Agreement, the Court DENIES the 7 Motion’s request for preliminary approval. The Court’s denial is without prejudice. The Court 8 will consider a renewed motion for preliminary approval that addresses the Court’s concerns. 9 The clerk is ordered to provide copies of this order to all counsel. 10 Dated December 19, 2023. A 11 12 Marsha J. Pechman 13 United States Senior District Judge 14 15 16 17 18 19 20 21 22 23 24