IN RE PHILADELPHIA INQUIRER DATA SECURITY LITIGATION

CourtDistrict Court, E.D. Pennsylvania
DecidedOctober 25, 2024
Docket2:24-cv-02106
StatusUnknown

This text of IN RE PHILADELPHIA INQUIRER DATA SECURITY LITIGATION (IN RE PHILADELPHIA INQUIRER DATA SECURITY LITIGATION) is published on Counsel Stack Legal Research, covering District Court, E.D. Pennsylvania primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
IN RE PHILADELPHIA INQUIRER DATA SECURITY LITIGATION, (E.D. Pa. 2024).

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA

CIVIL ACTION

IN RE PHILADELPHIA INQUIRER DATA SECURITY LITIGATION NO. 24-2106-KSM

MEMORANDUM

Marston, J. October 25, 2024

This is a putative class action brought by Plaintiffs Ivery Sheree Mosley, Steven Hassell, and Christopher Devine. (See Doc. No. 16.) Plaintiffs allege that Defendant, The Philadelphia Inquirer, failed to adequately safeguard sensitive personal information entrusted to it, despite acknowledging the risk of a data breach. (Id.) Presently before the Court is Plaintiffs’ renewed motion for preliminary approval of the class action settlement and revised settlement agreement, notices, and claim form. (Doc. Nos. 26, 26-2, 26-3, 26-4, 26-5.) For the reasons below, the motion is granted, and the Court will schedule a final approval hearing. I. BACKGROUND

Beginning in May 2023, several class actions were filed in this Court on behalf of consumers whose information was stolen following a third party cyberattack against Defendant. (See, e.g., Doc. No. 1, Mosley v. The Philadelphia Inquirer, PBC, Civil Action No.; Doc. No. 1- 1, Hassell v. The Philadelphia Inquirer LLC, Civil Action No. 2:24-cv-02499-KSM; Doc. No. 1- 1, Devine v. The Philadelphia Inquirer LLC, Civil Action No. 2:24-cv-02503-KSM.) On July 23, 2024, this Court consolidated these class actions under the new case name “In re Philadelphia Inquirer Data Security Litigation.” (Doc. No. 15.) On July 31, 2024, Plaintiffs filed a consolidated complaint asserting claims for negligence, negligence per se, invasion of privacy, unjust enrichment, and violations of state consumer protection and privacy statutes. (Doc. No. 16.) Plaintiffs alleged that they entrusted Defendant with their sensitive personal information, such as names, addresses, social security numbers, account passwords, and financial information.

(See id. at ¶¶ 1–7.) But, they allege, Defendant failed to implement adequate security practices to protect Plaintiffs’ information from cybercriminals and failed to provide timely notice of the data breach. (Id. at ¶¶ 8–14.) Plaintiffs argued that they entrusted Defendant with their information with the reasonable expectation that Defendant would comply with its obligations to keep the information confidential and secure from unauthorized access, pursuant to state consumer protection and privacy laws. (Id. at ¶¶ 26–31.) On July 8, 2024, following mediation with an experienced mediator, Bennett G. Picker, Esquire of Stradley Ronon Stevens & Young LLP, the parties agreed to a settlement in principle, and on August 22, 2024, Plaintiffs filed an initial unopposed motion for preliminary approval of the class action settlement. (Doc. No. 17; Doc. No. 17-1 at 11.) On September 25, 2024, the

Court held a hearing on the motion, and on October 4, 2024, at the Court’s direction, the parties filed the renewed motion and revised settlement agreement, short-form notice, long-form notice, and claim form currently before the Court. (Doc. Nos. 26, 26-2, 26-3, 26-4, 26-5.) II. Preliminary Certification of the Class for Settlement Purposes

A. Legal Standard

The Court may certify class actions for the sole purpose of settlement. In re CertainTeed Corp. Roofing Shingle Prods. Liab. Litig., 269 F.R.D. 468, 476 (E.D. Pa. 2010) (citing In re GMC Pick-Up Truck Fuel Tank Prods. Liab. Litig., 55 F.3d 768, 786 (3d Cir. 1995)). In these situations, the court provisionally certifies the class, but reserves “[f]inal certification” until it “rules on whether the final settlement agreement is to be approved.” Id. When a court certifies a class for settlement, “it must first find that the class satisfies all the requirements of Rule 23,” and in particular Rule 23(a) and 23(b). In re Cmty. Bank of N. Va.,

418 F.3d 277, 300 (3d Cir. 2005). Under Rule 23(a), a class action is allowable only if: (1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law or fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class. Fed. R. Civ. P. 23(a); see also Reyes v. Netdeposit, LLC, 802 F.3d 469, 482 (3d Cir. 2015) (“All potential classes must initially satisfy four prerequisites to be certified: (1) numerosity, (2) commonality, (3) typicality, and (4) adequacy of representation.”). Additionally, the class must be currently and readily ascertainable based on objective criteria. Marcus v. BMW of N. Am. LLC, 687 F.3d 583, 593 (3d Cir. 2012). If the Rule 23(a) and ascertainability conditions are met, then a case may proceed as a class action if one of the conditions of Rule 23(b) is also satisfied. Here, Plaintiffs seek certification for a class under Rule 23(b)(3), which requires that “the court find[] that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” Fed. R. Civ. P. 23(b)(3); see also Reyes, 802 F.3d at 482 (explaining that a plaintiff must demonstrate “predominance and superiority” for certification under Rule 23(b)(3)). B. Analysis Plaintiffs propose a class of “approximately 25,549 natural persons whose Private Information was potentially compromised in the Data Incident.” (Doc. No. 17-1 at 11; Doc. No. 26-2 at ¶ 1.40.) This class is ascertainable and meets all six requirements of Rules 23(a) and

23(b). We will address each in turn. 1. Ascertainability The plaintiff has the burden of showing, by a preponderance of the evidence, that “(1) the class is ‘defined with reference to objective criteria’; and (2) there is ‘a reliable and administratively feasible mechanism for determining whether putative class members fall within the class definition.’” Byrd v. Aaron’s Inc., 784 F.3d 154, 163 (3d Cir. 2015) (citing Carrera v. Bayer Corp., 727 F.3d 300, 306 (3d Cir. 2013)). The class here is ascertainable because the parties will determine the exact number and identities of individuals whose data could have been compromised using Defendant’s records. (Doc. No. 17-1 at 26.) 2. Rule 23(a) Requirements

In addition to being ascertainable, the putative class must also satisfy the requirements of Rule 23(a): “(1) numerosity, (2) commonality, (3) typicality, and (4) adequacy of representation.” Reyes, 802 F.3d at 482. Numerosity

While “[t]here is no magic number of class members needed for a suit to proceed as a class action,” the Third Circuit has held that “numerosity is generally satisfied if there are more than 40 class members.” In re Nat’l Football League Players Concussion Inj. Litig., 821 F.3d 410, 426 (3d Cir. 2016). Here, the proposed class is sufficiently numerous because it consists of over 25,000 people. (Doc. No. 17-1 at 26–27.) The Court is satisfied that this is enough people to render joinder impracticable. Fed. R. Civ. P.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Mullane v. Central Hanover Bank & Trust Co.
339 U.S. 306 (Supreme Court, 1950)
Amchem Products, Inc. v. Windsor
521 U.S. 591 (Supreme Court, 1997)
In Re Pet Food Products Liability Litigation
629 F.3d 333 (Third Circuit, 2010)
Dewey v. Volkswagen Aktiengesellschaft
681 F.3d 170 (Third Circuit, 2012)
Marcus v. BMW of North America, LLC
687 F.3d 583 (Third Circuit, 2012)
In Re Baby Products Antitrust Litigation
708 F.3d 163 (Third Circuit, 2013)
John Rodriguez v. Natl City Bank
726 F.3d 372 (Third Circuit, 2013)
Gabriel Carrera v. Bayer Corp
727 F.3d 300 (Third Circuit, 2013)
United States v. Richardson
521 F.3d 149 (Second Circuit, 2008)
Reibstein v. RITE AID CORPORATION
761 F. Supp. 2d 241 (E.D. Pennsylvania, 2011)
Crystal Byrd v. Aaron's Inc
784 F.3d 154 (Third Circuit, 2015)
Reynaldo Reyes v. Netdeposit
802 F.3d 469 (Third Circuit, 2015)
In Re: Google Inc. Cookie Plac v.
934 F.3d 316 (Third Circuit, 2019)
Sullivan v. DB Investments, Inc.
667 F.3d 273 (Third Circuit, 2011)

Cite This Page — Counsel Stack

Bluebook (online)
IN RE PHILADELPHIA INQUIRER DATA SECURITY LITIGATION, Counsel Stack Legal Research, https://law.counselstack.com/opinion/in-re-philadelphia-inquirer-data-security-litigation-paed-2024.