In Re: Post Meds, Inc. Data Breach Litigation

Opinion

In Re: PostMeds, Inc. Data Breach Litigation Case No. 23-cv-05710-HSG

ORDER GRANTING PRELIMINARY APPROVAL OF CLASS ACTION Re: Dkt. No. 97

Pending before the Court is Plaintiffs’ unopposed motion for preliminary approval of class action settlement. See Dkt. No. 97 (“Mot.”). The Court held a hearing on the motion on October 24, 2024. For the reasons detailed below, the Court GRANTS the motion. A. Factual Allegations Defendant PostMeds, Inc. (“PostMeds”), a digital pharmacy that fulfills mail-order prescriptions, suffered a data breach that exposed its customers’ personally identifiable and protected health information, including names, dates of birth, Social Security numbers, diagnosis information, treatment information, prescription information, medical record numbers, and health insurance information. Mot. at 12. The breach affected approximately two million customers. Id. PostMeds notified affected customers about the breach in October 2023. Id. at 13–14. Plaintiffs assert that the data breach resulted from PostMeds’ failure to implement reasonable cyber-security measures. See Dkt. No. 82 (“Compl.”) at 3. Based on these allegations, Plaintiffs brought the above-captioned class action, asserting violations of California and Illinois consumer protection and privacy laws, as well as negligence, breach of implied contract, unjust enrichment/quasi B. Settlement Agreement Following informal discovery and with the assistance of private mediator Jill Sperber, the parties entered into a settlement agreement. See Dkt. No. 97, Ex. 1 (“Settlement Agreement” or “SA”). The key terms are as follows: Class Definition: The class is defined as “[a]ll U.S. residents who were sent notice that their Private Information was potentially compromised as a result of the Data Incident experienced by PostMeds, Inc. d/b/a TruePill (‘PostMeds’ or ‘Defendant’), on or about October 30, 2023.” SA § 44. The proposed class comprises approximately two million individuals. Mot. at 14. Settlement Benefits: PostMeds will establish a settlement fund of $7,500,000. SA § 48. Each class member may submit claims for up to $4,000 in compensation for out-of-pocket losses resulting from the data breach. Id. § 58. In addition to compensation for out-of-pocket losses, each class member may submit a claim for either (1) a cash payment from the settlement fund or (2) one year of data protection services from Financial Shield Services. Id. Cash payments from the settlement fund will be evenly distributed on a pro rata basis after all out-of-pocket loss claims, notice and administrative expenses, any service awards, and attorneys’ fees and expense awards are paid. Id. At the hearing on this motion, the parties informed the Court that individual claimants can expect to receive between $45 and $240 in cash payouts. Release: The class will release PostMeds from “any claims . . . and issues of any kind or nature, whether known or unknown, that each Settlement Class member has, had, or may ever have, now or in the future, known or unknown, arising out of or in any way related to the Data Incident whether or not those claims, demands, rights, actions, or causes of action have been pleaded or otherwise asserted, including any and all damages, losses, or consequences thereof.” Id. § 80. Class members also agree to waive their rights under Section 1542 of the California Civil Code. Id. § 82. Class Notice: A third-party settlement administrator will send class notices via email to all prospective class members with an identified email address. Id. § 67. Class members without an identified email address or members whose emails bounce back as “undeliverable” will receive maintain a public settlement website that will contain relevant documents, such as the complaint, claim form, and a copy of the notice as well as relevant dates, including the deadlines for class members to file claims and object. SA § 50. The emailed notice will include: the settlement benefits, instructions on how to opt out of the settlement, and the time and date of the final approval hearing. See Dkt. No. 97-1, Ex. B. Opt-Out Procedure: Class members who do not wish to join the settlement must submit a written request for exclusion to the settlement administrator by the designated “Opt-Out Deadline.” SA § 32, 69. Attorneys’ Fees and Costs: Plaintiffs’ counsel will seek attorneys’ fees from the settlement fund. These fees will not exceed one-third of the fund’s size or $2,500,000. SA § 83. In addition to attorneys’ fees, counsel will seek an award for reasonable costs and expenses, which will also be drawn from the settlement fund. Id. Service Award: Class representatives may seek service awards up to $1,500.1 If approved, these awards will be paid from the settlement fund. Id. § 84. Plaintiffs bear the burden of showing by a preponderance of the evidence that class certification is appropriate under Federal Rule of Civil Procedure 23. Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350–351 (2011). Class certification is a two-step process. First, the plaintiffs must establish that each of the four requirements of Rule 23(a) is met: numerosity, commonality, typicality, and adequacy of representation. Id. at 349. Second, the plaintiffs must establish that at least one of the bases for certification under Rule 23(b) is met. Where, as here, plaintiffs seek to certify a class under Rule 23(b)(3), they must show that “questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating 1 The Court approves the proposed class representatives: Richard Reed, Frankie Garcia, Michael Siegel, Linda Johnson, David MacDonald, Lasedrick Toles, John Rossi, Michael Thomas, Marissa Porter, Angela Morgan, Benjamin Fisher, Brittany Hallman, Russell Autry, Jacob Benjamin, Victoria Phillips, Christopher Williams, David Sauceda, James Lowery, Hal Evans, Charles Byrd, the controversy.” Fed. R. Civ. P. 23(b)(3). A. Rule 23(a) Certification The Court finds that all the requirements of Rule 23(a) are met: i. Numerosity Rule 23(a)(1) requires that the class be “so numerous that joinder of all members is impracticable.” Fed. R. Civ. P. 23(a)(1). The Court finds that numerosity is satisfied here because joinder of the estimated two million class members would be impracticable. See Mot. at 21. ii. Commonality Rule 23(a)(2) requires that “there are questions of law or fact common to the class.” Fed. R. Civ. P. 23(a)(2). A contention is sufficiently common where “it is capable of classwide resolution—which means that determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke.” Dukes, 564 U.S at 350. Commonality exists where “the circumstances of each particular class member vary but retain a common core of factual or legal issues with the rest of the class.” Parra v. Bashas’, Inc., 536 F.3d 975, 978–79 (9th Cir. 2008). “What matters to class certification . . . is not the raising of common ‘questions’—even in droves—but rather the capacity of a classwide proceeding to generate common answers apt to drive the resolution of the litigation.” Dukes, 564 U.S at 350 (internal citation omitted). Even a single common question is sufficient to meet this requirement. Id. at 359. Common questions of law and fact in this action include: whether Defendant had a legal duty to use reasonable security measures to protect class members’ personal information; whether Defendant breached its legal duty by failing to protect class members’ personal information; whether Defendant acted reasonably in securing class members’ personal information; whether Defendant failed to establish appropriate security safeguards and procedures to protect the confidentiality of class members’ personal information; and whether Defendant’s actions were willful or taken with reckless disregard for the security of class members’ personal information. See Compl. at 2–4. iii. Typicality Rule 23(a)(3) requires that “the claims or defenses of the representative parties are typical of the claims or defenses of the class.” Fed. R. Civ. P. 23(a)(3). “The test of typicality is whether other members have the same or similar injury, whether the action is based on conduct which is not unique to the named plaintiffs, and whether other class members have been injured by the same course of conduct.” Hanon v. Dataproducts Corp., 976 F.2d 497, 508 (9th Cir. 1992) (internal citation and quotations omitted). That said, under the “permissive standards” of Rule 23(a)(3), the claims “need not be substantially identical.” Castillo v. Bank of Am., NA, 980 F.3d 723, 729 (9th Cir. 2020) (internal citation and quotations omitted). The Plaintiffs’ claims are both factually and legally similar to those of the proposed class members. Plaintiffs allege that, like other class members, they were “injured through PostMeds’ singular pattern of misconduct.” Mot. at 30. Since Plaintiffs allege that this misconduct resulted in the security breach affecting both Plaintiffs and all class members, the typicality requirement is satisfied. iv. Adequacy of Representation Rule 23(a)(4) requires that the “representative parties will fairly and adequately represent the interests of the class.” Fed. R. Civ. P. 23(a)(4). The Court must address two legal questions: (1) whether the Plaintiffs and their counsel have any conflicts of interest with other class members, and (2) whether the Plaintiffs and their counsel will prosecute the action vigorously on behalf of the class. See In re Mego Fin. Corp. Sec. Litig., 213 F.3d 454, 462 (9th Cir. 2000). This inquiry “tend[s] to merge” with the commonality and typicality criteria. Gen. Tel. Co. of Sw. v. Falcon, 457 U.S. 147, 158 n.13 (1982). In part, these requirements determine whether “the named plaintiff’s claim and the class claims are so interrelated that the interests of the class members will be fairly and adequately protected in their absence.” Id. The Court is unaware of any actual conflicts of interest in this matter and no evidence in the record suggests that either Plaintiffs or Plaintiffs’ counsel have a conflict with other class members. Plaintiffs’ counsel has been appointed class counsel in numerous federal and state class have prosecuted this action vigorously on behalf of the class to date and will continue to do so. The adequacy of representation requirement is therefore satisfied. B. Rule 23(b)(3) Certification To certify a class, Plaintiffs must also satisfy the two requirements of Rule 23(b)(3). First, “questions of law or fact common to class members [must] predominate over any questions affecting only individual members.” Fed. R. Civ. P. 23(b)(3). And second, “a class action [must be] superior to other available methods for fairly and efficiently adjudicating the controversy.” Id. The Court finds that both requirements are met in this case. i. Predominance The “predominance inquiry tests whether proposed classes are sufficiently cohesive to warrant adjudication by representation.” Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442, 453 (2016) (internal citation and quotations omitted). The Supreme Court has defined an individualized question as one where “members of a proposed class will need to present evidence that varies from member to member.” Id. A common question, on the other hand, is one where “the same evidence will suffice for each member to make a prima facie showing [or] the issue is susceptible to generalized, class-wide proof.” Id. The Court concludes that, for purposes of settlement, common questions regarding PostMeds’ alleged misconduct and the resultant harm to Plaintiffs predominate over individualized issues. Plaintiffs allege that PostMeds’ “failure to implement adequate and reasonable cyber-security procedures and protocols” led to the data breach that compromised all class members’ personal information. Compl. at 3; Mot. at 14. According to Plaintiffs’ allegations, PostMeds’ security failures affected all class members in the same way through the same set of actions and decisions. ii. Superiority The superiority requirement tests whether “a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” Fed. R. Civ. P. 23(b)(3). The Court considers four non-exclusive factors: (1) the interest of each class member in individually litigation concerning the controversy already commenced by or against the class; (3) the desirability of concentrating the litigation of the claims in the particular forum; and (4) the difficulties likely to be encountered in the management of a class action. Id. Here, because common legal and factual questions predominate over individual ones and because the proposed class contains two million members, the Court finds that the judicial economy achieved through common adjudication makes class action a superior method for adjudicating the proposed class’s claims. C. Class Representative and Class Counsel Because the Court finds that Plaintiffs meet the commonality, typicality, and adequacy requirements of Rule 23(a), the Court appoints them as class representatives. When a court certifies a class, it must also appoint class counsel. Fed. R. Civ. P. 23(c)(1)(B). The interim co- lead class counsel have investigated and litigated this case throughout its existence and have submitted declarations detailing their expertise in representing plaintiffs in class action suits, especially data breach settlements. See Dkt. Nos. 97-2, 97-4. Accordingly, the Court appoints Gary M. Klinger of Milberg Coleman Bryson Phillips Grossman PLLC, James J. Pizzirusso of Hausfeld LLP, and Jill M. Manning of Pearson Warshaw, LLP as Co-Lead Class Counsel. See Fed. R. Civ. P. 23(g)(1)(A) (listing factors courts must consider when appointing class counsel). Finding that provisional class certification is appropriate, the Court considers whether it should preliminarily approve the parties’ class action settlement. A. Legal Standard Federal Rule of Civil Procedure 23(e) provides that “[t]he claims, issues, or defenses of a certified class—or a class proposed to be certified for purposes of settlement—may be settled . . . only with the court’s approval.” Fed. R. Civ. P. 23(e). “The purpose of Rule 23(e) is to protect the unnamed members of the class from unjust or unfair settlements affecting their rights.” In re Syncor ERISA Litig., 516 F.3d 1095, 1100 (9th Cir. 2008). Accordingly, before a district court approves a class action settlement, it must conclude that the settlement is “fundamentally fair, Where the parties reach a class action settlement prior to class certification, district courts apply “a higher standard of fairness and a more probing inquiry than may normally be required under Rule 23(e).” Dennis v. Kellogg Co., 697 F.3d 858, 864 (9th Cir. 2012) (internal citation and quotations omitted). Such settlement agreements “‘must withstand an even higher level of scrutiny for evidence of collusion or other conflicts of interest than is ordinarily required under Rule 23(e) before securing the court’s approval as fair.’” Roes, 1-2 v. SFBSC Mgmt., LLC, 944 F.3d 1035, 1049 (9th Cir. 2019) (quoting In re Bluetooth Headset Prods. Liab. Litig., 654 F.3d 935, 946 (9th Cir. 2011)). A more “exacting review is warranted to ensure that class representatives and their counsel do not secure a disproportionate benefit at the expense of the unnamed plaintiffs who class counsel had a duty to represent.” Id. (internal citations and quotations omitted). “The Court cannot . . . fully assess [the fairness] factors until after the final approval hearing; thus, a full fairness analysis is unnecessary at this stage.” Uschold v. NSMG Shared Servs., LLC, 333 F.R.D. 157, 169 (N.D. Cal. 2019) (internal citation and quotations omitted). “At the preliminary approval stage, the settlement need only be potentially fair.” Id. (internal citation and quotations omitted). Preliminary approval is appropriate if the proposed settlement: (1) appears to be the product of serious, informed, non-collusive negotiations; (2) does not grant improper preferential treatment to class representatives or other segments of the class; (3) falls within the range of possible approval; and (4) has no obvious deficiencies. See In re Tableware Antitrust Litig., 484 F. Supp. 2d 1078, 1079 (N.D. Cal. 2007). Courts lack the authority, however, to “delete, modify or substitute certain provisions. The settlement must stand or fall in its entirety.” Dennis, 697 F.3d at 868 (quotation omitted). B. Analysis i. Evidence of Conflicts and Signs of Collusion The first factor the Court considers is whether there is evidence of collusion or other conflicts of interest. See Roes, 944 F.3d at 1049. The Ninth Circuit has directed district courts to look for “subtle signs of collusion,” which include whether counsel will receive a disproportionate arrangement where defendant will not object to a certain fee request by class counsel),” and whether the parties agree to a reverter that returns unclaimed funds to the defendant. Id. The Settlement Agreement does not contain a clear sailing agreement or a reverter. Under the Settlement Agreement, class counsel may request up to $2,500,000 in attorneys’ fees, which is one-third of the total settlement fund. SA § 83. In addition, counsel may request reimbursement for reasonable costs and expenses. Id. Both the attorneys’ fees and costs are paid out of the settlement fund. Any attorneys’ fees or costs not awarded by the Court will revert to the settlement fund. Id. § 41. Since the settlement fund pays out (1) approved out-of-pocket claims, (2) notice and administration expenses, (3) attorneys’ fees and costs, and (4) service awards before distributing pro rata cash payments, the amount of attorneys’ fees that the Court awards will affect the class members’ cash payouts. SA § 58. When deciding to award attorneys’ fees and costs, the Court has discretion in a common fund case to choose either (1) the lodestar method or (2) the percentage-of-the-fund. Vizcaino v. Microsoft Corp., 290 F.3d 1043, 1047 (9th Cir. 2002). Under the percentage-of-recovery method, twenty-five percent of a common fund is the benchmark for an attorneys’ fees award. See, e.g., In re Bluetooth Headset, 654 F.3d at 942 (“[C]ourts typically calculate 25% of the fund as the ‘benchmark’ for a reasonable fee award, providing adequate explanation in the record of any ‘special circumstances’ justifying a departure.”). Under the Settlement Agreement, counsel may request 33% of the fund (or $2,500,000) in attorneys’ fees. Although this number exceeds the standard 25% figure, even if the Court were to award this amount, the majority of the settlement fund will remain for class members. See Lowery v. Rhapsody Int’l, Inc., 75 F.4th 985, 994 (9th Cir. 2023) (“Except in extraordinary cases, a fee award should not exceed the value that the litigation provided to the class.”); Roe v. Frito-Lay, Inc., No. 14-CV-00751-HSG, 2016 WL 4154850, at *9 (N.D. Cal. Aug. 5, 2016) (granting preliminary approval of a class action settlement where the agreement allowed counsel to seek attorneys’ fees up to one-third of the settlement). In any event, the Court is cognizant of its obligations to review class fee awards with particular rigor, and at the final approval stage will carefully scrutinize the circumstances and find any procedural inadequacies in the negotiating process or substantive inadequacies in the Settlement Agreement’s provisions that bar preliminary approval. ii. Preferential Treatment The Court next considers whether the Settlement Agreement provides preferential treatment to any class members. The Ninth Circuit has instructed that district courts must be “particularly vigilant” for signs that counsel have allowed the “self-interests” of “certain class members to infect negotiations.” In re Bluetooth Headset, 654 F.3d at 947. For that reason, courts in this district have consistently stated that preliminary approval of a class action settlement is inappropriate where the proposed agreement “improperly grants preferential treatment to class representatives.” In re Tableware Antitrust Litig., 484 F. Supp. 2d at 1079. The Settlement Agreement authorizes the 24 class representatives to seek service awards of up to $1,500 each. SA § 42. Service awards “are intended to compensate class representatives for work done on behalf of the class, to make up for financial or reputational risk undertaken in bringing the action, and, sometimes, to recognize their willingness to act as a private attorney general.” Rodriguez v. West Publ’g Corp., 563 F.3d 948, 958–959 (9th Cir. 2009). “The Ninth Circuit has emphasized that district courts must ‘scrutiniz[e] all incentive awards [and service awards] to determine whether they destroy the adequacy of the class representatives.’” In re Facebook Internet Tracking Litig., No. 5:12-MD-02314-EJD, 2022 WL 16902426, at *13 (N.D. Cal. Nov. 10, 2022) (quoting Radcliffe v. Experian Info. Sols., 715 F.3d 1157, 1163 (9th Cir. 2013)). In doing so, courts consider “the number of named plaintiffs receiving incentive payments, the proportion of the payments relative to the settlement amount, and the size of each payment.” Staton v. Boeing Co., 327 F.3d 938, 977 (9th Cir. 2003). The Court will ultimately determine whether each service award is appropriate in light of each class representative’s role and responsibilities. Because the proposed service awards are not per se unreasonable, the Court finds that this factor weighs in favor of preliminary approval. See Rodriguez, 563 F.3d at 958 (finding that “[i]ncentive awards are fairly typical in class action cases” and “are discretionary”) (emphasis omitted). iii. Settlement Within Range of Possible Approval The Court also generally considers whether the settlement is within the range of possible approval. To evaluate whether the settlement amount is adequate, “courts primarily consider plaintiffs’ expected recovery balanced against the value of the settlement offer.” In re Lenovo Adware Litig., No. 15-MD-02624-HSG, 2018 WL 6099948, at *8 (N.D. Cal. Nov. 21, 2018) (internal citation and quotations omitted). This balancing is uniquely difficult here because “there have been no data breach cases tried to verdict, and only a handful of cases have achieved class certification.” Mot. at 23. The Settlement Agreement provides for a $7,500,000 settlement fund. Plaintiffs estimate a “claims rate of approximately 2% to 5%, based on the realized claims rates of recent data breach class actions.” Mot. at 28. Plaintiffs’ counsel projects that individual class members opting for the pro rata cash payment will receive between $45 and $240. Alternatively, class members may select one year of Financial Shield Services coverage, which is valued at $180. “Balancing the class’s potential recovery against the amount offered in settlement is perhaps the most important factor to consider in preliminary approval.” Becker v. LISI, LLC, No. 21-CV-03295-JST, 2022 WL 19975411, at *3 (N.D. Cal. Sept. 1, 2022) (internal citations and quotation omitted). See In re Tableware Antitrust Litig., 484 F. Supp. 2d at 1080 (explaining that courts “consider plaintiffs’ expected recovery” to evaluate a settlement’s fairness and adequacy). Plaintiffs argue that this is a fair recovery because Plaintiffs’ recovery on the merits in future litigation “is far from certain” and “difficult to value.” Mot. at 22. According to Plaintiffs, the “typical measure of damages” in data breach cases is the “market value of personal information based on black market rates for the types of data involved.” Id. at 23. Under this market value theory, Plaintiffs estimate that the class’s full recovery could range between “approximately $4,000,000 and $50,000,000.” Id. But as Plaintiffs concede, “[a] denial or reversal of class certification . . . losing on summary judgment or at a jury trial . . . [or] revers[al] on appeal” would “effectively extinguish any hope of recovery by the Settlement Class.” Id. at 20. Since only “a handful of [data breach] cases have achieved class certification,” the risks and finds that the settlement benefits, given the scope of the case and its substantial accompanying risks, weigh in favor of granting preliminary approval. iv. Obvious Deficiencies The Court also considers whether there are obvious deficiencies in the Settlement Agreement. The Court finds no obvious deficiencies, and therefore finds that this factor weighs in favor of preliminary approval. The Court “must direct notice in a reasonable manner to all class members who would be bound by the proposal[.]” Fed. R. Civ. P. 23(e)(1)(B). The “best notice . . . practicable under the circumstances[ ] includ[es] individual notice to all [class] members who can be identified through reasonable effort.” Fed. R. Civ. P. 23(c)(2)(B). Under the Settlement Agreement, Defendants will provide the third-party settlement administrator, Epiq Class Action and Claims Solutions, Inc., a list of all settlement class members. SA § 67. The Settlement Administrator will email notice to all class members who have an email address. See Dkt. No. 97-1, Ex. B. Any class members that the Settlement Administrator is unable to reach via email will receive notice via first class mail. See Dkt. No. 97-1, Ex. E. A more extensive form of notice will be posted on the settlement website. SA § 27; Dkt. No. 97-1, Ex. C. These notice procedures must be completed within sixty days of this order. SA § 67. The Court finds that the proposed notice process is “reasonably calculated, under all the circumstances, to apprise all class members of the proposed settlement.” Roes, 944 F.3d at 1045 (internal citation and quotations omitted). With respect to the content of the notice itself, the notice must clearly and concisely state in plain, easily understood language: (i) the nature of the action; (ii) the definition of the class certified; (iii) the class claims, issues, or defenses; (iv) that a class member may enter an appearance through an attorney if the member so desires; 1 (vi) the time and manner for requesting exclusion; and 2 (vil) the binding effect of a class judgment on members[.] Fed. R. Civ. P. 23(c)(2)(B). 3 The Court finds that the content of the proposed notices provides sufficient information 4 about the case and thus conforms with due process requirements. 5 Vv. CONCLUSION 6 The Court GRANTS Plaintiffs’ motion for preliminary approval of class action settlement. 7 The parties ace DIRECTED to meet and confer and stipulate to a schedule of dates for each event 8 listed below, which shall be submitted to the Court within seven days of the date of this Order: 9 10 Event Date Deadline for Settlement Administrator to send email notice = 2 Deadline for Settlement Administrator to send mail notice to all non-email accessible Class Members 13 Filing deadline for attorneys’ fees and costs motion and requests for service awards 14 Deadline for Class Members to opt-out or object 15 to settlement = Deadline for Class Members to object to any motions Qa 16 for attorneys’ fees Filing deadline for final approval motion Po 17 Final fairness hearing and hearing on motions Po O 18 The parties are further DIRECTED to implement the proposed class notice plan consistent with 19 the terms of the Settlement Agreement and the instructions provided above. 20 21 ITISSO ORDERED. 22 Dated: 11/26/2024 23 AMaspyrend f Why HAYWOOD S. GILLIAM, JR. United States District Judge 25 26 27 28