In re CorrectCare Data Breach Litigation

Opinion

UNITED STATES DISTRICT COURT EASTERN DISTRICT OF KENTUCKY CENTRAL DIVISION (at Lexington)

) ) In re CorrectCare Data Breach Litigation ) Civil Action No. 5: 22-319-DCR ) ) ) ) MEMORANDUM OPINION ) AND ORDER )

*** *** *** *** Defendant CorrectCare Integrated Health, LLC (“CorrectCare”) is a third-party administrator that facilitates access to medical providers and manages medical claims payment for certain correctional facilities. It discovered in July 2022 that two of its file directories had been exposed on the public internet, thus disclosing the personal identifiable information (“PII”) and personal health information (“PHI”) of approximately 600,000 incarcerated individuals—the plaintiffs in this class action. Following successful negotiations, the parties reached a settlement that was preliminarily approved, and the following class was preliminarily certified: “All individuals whose Personal Information was compromised as a result of the Data Incident.” A final approval hearing was held on September 16, 2024. For the reasons explained below, the undersigned concludes that the settlement is fair, reasonable, and adequate. Accordingly, the objections received will be overruled, the settlement agreement will be approved, and the proposed incentive rewards and attorneys’ fees and costs will be approved. I. In December 2022, the lead plaintiff, Virginia Hiley, sued CorrectCare based on the data breach alleging claims of negligence, negligence per se, breach of implied contract,

breach of fiduciary duty, invasion of privacy, and unjust enrichment. A Consolidated Amended Complaint was filed in March 2023. This pleading consolidated the original action with similar actions pending in this Court and added various claims under state consumer privacy laws. [Record No. 37] The parties reached a settlement following successful mediation. The plaintiffs then filed an unopposed motion for preliminary approval of the class action settlement. [Record No. 84] The settlement provided for a non-reversionary $6,490,000 common fund with

payments to the members of the proposed settlement class, release of claims, class-notice procedures, settlement administration, attorneys’ fees, costs, and service awards. After reviewing the agreement at length, the Court denied the motion, without prejudice, because it was unclear whether sufficient funds would remain to pay class members seeking an alternative cash payment after class members seeking out-of-pocket damages were paid. [See Record No. 85, p. 14-15.] Three weeks later, the plaintiffs filed a renewed motion for

settlement approval, noting that the settlement agreement had been revised and limited total out-of-pocket losses to one-half of the settlement fund, ensuring that sufficient money would remain to pay class members seeking an alternative cash payment. [Record No. 86] Class notice was sent as directed. The time for objections has passed, with the Court receiving 15 filings that could be construed as objections. The undersigned has reviewed each of these filings which counsel for the plaintiffs addressed during the final approval hearing held on September 16, 2024. II. The Sixth Circuit recognizes that the law favors settlement of class action lawsuits. UAW v. General Motors Corp., 497 F.3d 615, 632 (6th Cir. 2007) (noting “the federal policy

favoring the settlement of class actions”). “The evaluation and approval of a class action settlement is committed to the sound discretion of the district court,” which “should approve a class action settlement if, following a hearing, the court determines that the settlement ‘is fair, reasonable, and adequate.” IUE-CWA v. General Motors Corp., 238 F.R.D. 583, 593-94 (E.D. Mich. 2006). The Court does not substitute its judgment for the parties and their counsel. Instead, its job is to ensure that the agreement is “not the product of fraud or overreaching by, or collusion between, the negotiating parties, and that the settlement taken as a whole, is fair,

reasonable and adequate to all concerned.” Id. at 594. Rule 23(e)(2) of the Federal Rules of Civil Procedure provides: If the proposal would bind class members, the court may approve it only after a hearing and only on finding that it is fair, reasonable, and adequate after considering whether: (A) the class representatives and class counsel have adequately represented the class; (B) the proposal was negotiated at arm’s length; (C) the relief provided for the class is adequate, taking into account: (i) the costs, risks, and delay of trial and appeal; (ii) the effectiveness of any proposed method of distributing relief to the class, including the method of processing claim-member claims; (iii) the terms of any proposed award of attorney’s fees, including time of payment; and (iv) any agreement required to be identified under Rule 23(e)(3).

The Sixth Circuit also has identified the following factors for consideration: the risk of fraud or collusion; the complexity, expense, and likely duration of the litigation; the amount of discovery engaged in by the parties; the likelihood of success on the merits; the opinions of class counsel and class representatives; the reaction of absent class members; and the public interest. Int’l Union, United Auto., Aerospace & Agricultural Implement Workers of America v. Gen. Motors Corp. (“UAW v. GMC”), 497 F.3d 615 (6th Cir. 2007). The Court considered these factors when deciding whether to grant preliminary

approval and determined, to the extent they could be evaluated at that time, that they weighed in favor of approval. [Record No. 85, pp. 13-14] And no facts have come to light that would change that analysis; therefore, the Court’s opinion remains the same. However, it must now consider the reaction of absent class members. A brief explanation of the notice program is appropriate before addressing this factor. The Amended Complaint alleges that the data breach involved the potential unauthorized access of PII of approximately 600,000 individuals who were housed at various

correctional institutions in four states (California, Georgia, Louisiana, and South Carolina). On May 20, 2024, CorrectCare provided the settlement administrator (“Kroll”) with data files containing 635,321 records for identified settlement class members. “Additional research identified the best possible associated physical address” for these individuals. [Record No. 99-1, p. 14] After de-duplicating the records, Kroll was left with 572,453 unique, identified class member records. Id.

Of the 572,453 records, Kroll identified a physical address for 391,449 class members, which included some correctional facilities. Kroll mailed postcard notices to those addresses on July 1, 2024. For those that were returned as undeliverable, Kroll promptly remailed notices “to any new address available through USPS information and by using an advanced address search.” A total of 23,215 were remailed after initially being returned as undeliverable. Counsel for the plaintiffs report that direct notice ultimately was provided to 61 percent of the class. Kroll then implemented a supplemental publication program targeted at class members and their “loved ones, families, and friends” who would be likely to share the information with them. It consisted of targeted online display advertisements in English and Spanish. Kroll

also utilized social media advertisements on Facebook, Instagram, and Youtube. On July 5, 2024, Kroll issued a press release over “PR Newswire’s US1, African American and National Hispanic Newslines.” The plaintiffs report that PR Newswire distributes to thousands of print and broadcast newsrooms nationwide, as well as websites, databases and online services. Approximately 304 mentions of the settlement resulted from the press release. Kroll also established a toll-free telephone number which allowed callers to hear an introductory message and have the option to learn more about the settlement in the form of recorded answers to

frequently asked questions and to request that a claim form be mailed to them. Notwithstanding the extensive notice program, the Court has received and reviewed 15 objections. Overwhelmingly, the objections complain that notice was insufficient or that the class member did not have sufficient time to file a claim. Class counsel correctly notes, however, that due process does not require actual notice to each party intended to be bound by the decision. Fidel v. Farley, 534 F.3d 508, 513 (6th Cir. 2008). Instead, “the court must

direct to class members the best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort.” Id. (quoting Fed. R. Civ. P. 23(c)(2)(B)). In advance of and during the September 16 hearing, class counsel explained that, despite diligent efforts, the settlement administrator simply was not able to determine a physical address for some class members. As a result, it undertook an extensive supplementary notice campaign which proved to be effective as indicated in the objections stating that the class members learned about the settlement through family members or by word of mouth. Ultimately, over 100,000 claims have been filed, which equals approximately 17 percent of the class—a very favorable claims rate for a data breach class action. See In re Wawa, Inc.

Data Security Litigation, 2024 WL 1557366, at *17 (noting that a claims rate of 2.56% “compares favorably to the claims rates in other data breach class actions”). See also In re Packaged Ice Antitrust Litigation, 322 F.R.D. 276, 291 (E.D. Mich. 2017) (observing that a high claims rate was an indication of the success of the notice program). A few objectors state that they learned about the settlement too late to file a claim. In response, class counsel indicated at the final approval hearing that these individuals will be given an extension in which to file claims. Additionally, there were a couple of substantive

objections to the settlement. One objector initially complained that the settlement was “too low” and then sought to withdraw the objection in exchange for a $30,000 payment.1 Another individual objects to certain class members being eligible for a California Additional Cash Payment. However, this additional payment is justified, as the California Consumer Privacy Act allows California consumers to seek statutory damages for unauthorized disclosure of personal information. See Cal. Civ. Code. § 1798.150.

Ultimately, the settlement constitutes a fair, reasonable, and adequate result. Following contentious mediation, plaintiffs’ counsel recovered a large sum for fewer class members than originally thought. The notice program was effective, going beyond what due process requires, as evidenced by the high volume of filed claims. The end result is payment of claims to over

1 Class counsel advised that this class member had been given the option to have his claim adjudicated or to opt out. 100,000 class members who were victims of the data breach and very likely would not have brought claims on their own. III.

The plaintiffs have filed a separate motion seeking approval of attorneys’ fees, expenses, and service awards. [Record No. 96] They seek class counsel attorneys’ fees in the amount of one-third of the settlement fund ($2,163,333.33), reimbursement of litigation expenses ($12,313.92), and an award to each of the five class representatives (i.e., a service award) of $2,500.00. The Sixth Circuit recognizes both the lodestar method and the percentage-of-the-fund method for calculating attorney fees. In re Amazon.com Fulfillment Ctr. FLSA Litig., 2024 WL

3361639, at *3 (W.D. Ky. July 10, 2024) (citing Gascho v. Glob. Fitness Holdings, LLC, 822 F.3d 269, 279 (6th Cir. 2016)). The Court has discretion to select the method it applies “but must articulate the reasons for adopting a particular methodology and the factors considered in arriving at the fee.” Id. The Court will apply the percentage method, as that approach “is generally preferred in common-fund cases.” See id. See also Rawlings v. Prudential-Bache Props., Inc., 9 F.3d 513, 516 (6th Cir. 1993). As counsel noted during the fairness hearing, the

lodestar method would be difficult to apply here because counsels’ work in the case remains incomplete. The Sixth Circuit has provided six factors that courts should consider under whichever method is applied to determine attorney fees: (1) the value of the benefit rendered to the plaintiff class; (2) the value of the services on an hourly basis; (3) whether the services were undertaken on a contingent fee basis; (4) society’s stake in rewarding attorneys who produce such benefits in order to maintain an incentive to others; (5) the complexity of the litigation; and (6) the professional skill and standing of counsel involved on both sides.

Moulton v. U.S. Steel Corp., 581 F.3d 344, 352 (6th Cir. 2016). However, the Court need not evaluate each factor in every case—particularly the value of the services on an hourly basis because time records are not being submitted. See id. As counsel notes, the benefit to the class members is of high value—$6,490,000 before to payment of attorneys’ fees. It is unlikely that many of the class members would have pursued claims individually, so without class counsel’s efforts, the bulk class members would have not been compensated for the breach. Class counsel took the case on a contingent basis, investing significant time and effort at the risk of recovering nothing. Further, as the plaintiffs note, lawsuits such as this provide a strong deterrent against lax data security practices. Accordingly, society has a significant interest in rewarding attorneys who prosecute these cases. As for the fifth factor, courts have acknowledged that data breach cases are particularly complex. See, e.g., In re Tik Tok, Inc. Consumer Privacy Litig., 617 F. Supp. 3d 904, 941 (N.D.

Ill. 2022); Gordon v. Chipotle Mexican Grill, Inc., 2019 WL 6972701, at *1 (D. Colo. Dec. 16, 2019). Finally, there is no dispute that class counsel is qualified and experienced in this type of litigation. And no objections to the requested fee of one-third of the settlement fund have been filed. See, e.g., In re Wright & Fillippis, LLC Data Security Breach Litig.,2024 WL 3083437 (E.D. Mich. Jun 20, 2024) (approving one-third of the settlement fund as class

counsels’ fee). Accordingly, the request for approval attorneys’ fees will be granted. Litigation expenses in the amount of $12,313.92 will be approved as well. The bulk of these expenses arise from the cost of mediation ($8,750). The remaining costs of court filings, pro hac vice fees, and attending court are reasonable. Further, because counsel advanced the expenses on a contingent basis with no guarantee of recovery, counsel had an incentive to incur only necessary expenses.

The plaintiffs seek approval of a $2,500 service award for each of the five named plaintiffs.2 In determining whether to approve such awards, courts within the Sixth Circuit consider: (1) the action taken by the Class Representatives to protect the interests of the Class Members and others and whether these actions resulted in a substantial benefit to Class Members; (2) whether the Class Representatives assumed substantial direct and indirect financial risk; and (3) the amount of time and effort spent by the Class Representatives in pursuing the litigation.

Ross v. Jack Rabbit Servs., LLC, 2016 WL 7320890, at *5 (W.D. Ky. Dec. 15, 2016). Counsel report that the named plaintiffs reached out to counsel, provided relevant information, and reviewed the Complaint and Court filings. These tasks took significant time, warranting compensation. Additionally, counsel notes that these plaintiffs exposed themselves to reputational harm by placing their names on the Complaint. Not only will the public know that their data has been breached, but it will be revealed that they were incarcerated. In view of these considerations, the relatively modest award of $2,500 is reasonable. See In re Novant Health, Inc., 2024 WL 3028443, at *13 (M.D.N.C. June 17, 2024) (concluding that a $2,500 service award for each of the 10 named plaintiffs in a data breach case was fair and reasonable). IV. Based on the foregoing analysis and discussion, it is hereby

2 The Class Action Settlement Agreement lists Virginia Hiley, Christopher Knight, Kyle Marks, and Marlena Yates as Class Representatives. Class counsel clarified during the final approval hearing that Anthony Oliver has been added to the list of Class Representatives, for a total of five. ORDERED as follows: 1. The plaintiffs’ motion for attorneys’ fees, expenses, and service awards [Record No. 96] is GRANTED. 2. For the reasons explained herein, the objections [Record No. 97, 98, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 111, 112, 113] are OVERRULED. 3. The plaintiffs’ motion for final approval of class action settlement [Record No. 99] is GRANTED. Dated: September 17, 2024. ASLO. Co y a9 im Danny C. Reeves, Chief Judge 4 War ti ay United States District Court “Se Eastern District of Kentucky

-10-