IN RE WAWA, INC. DATA SECURITY LITIGATION

CourtDistrict Court, E.D. Pennsylvania
DecidedApril 9, 2024
Docket2:19-cv-06019
StatusUnknown

This text of IN RE WAWA, INC. DATA SECURITY LITIGATION (IN RE WAWA, INC. DATA SECURITY LITIGATION) is published on Counsel Stack Legal Research, covering District Court, E.D. Pennsylvania primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
IN RE WAWA, INC. DATA SECURITY LITIGATION, (E.D. Pa. 2024).

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA

: CIVIL ACTION : : IN RE WAWA, INC. : This document applies to the DATA SECURITY LITIGATION : Consumer Track. : : : No. 19-6019 : and all related cases.

MEMORANDUM PRATTER, J. APRIL 9, 2024 A good lawyer wears many hats. The multifaceted nature of lawyering is so fundamental that it occupies the opening passages of the Model Rules of Professional Conduct: As a representative of clients, a lawyer performs various functions. As advisor, a lawyer provides a client with an informed understanding of the client’s legal rights and obligations and explains their practical implications. As advocate, a lawyer zealously asserts the client’s position under the rules of the adversary system. As negotiator, a lawyer seeks a result advantageous to the client but consistent with requirements of honest dealings with others. As an evaluator, a lawyer acts by examining a client’s legal affairs and reporting about them to the client or to others.

Model Rules of Prof. Conduct Preamble (Am. Bar Ass’n 2023). A panel of the Third Circuit Court of Appeals has instructed the Court to re-examine its award of attorneys’ fees in this class action settlement to determine whether the lawyers too readily removed one of these hats during the negotiation process, namely that of the so-called zealous advocate. In re-examining the fee award, the Court is also mindful that the lawyer as negotiator ought not blindly battle with their opponents’ every request under the banner of “zealous advocacy.” To arrive at an agreement, and to bring that agreement to fruition, zealous advocacy gives way to the “requirements of honest dealings with others,” including a measure of cooperation with the lawyers sitting across the negotiating table.1 The ability to cooperate when appropriate is a lawyerly asset. BACKGROUND After a December 2019 data breach at Wawa, multiple lawsuits were filed against the convenience store chain, which the Court consolidated into one action with three tracks: financial

institutions, employees, and consumers. In September 2020, the consumer plaintiffs negotiated a preliminary settlement agreement with Wawa. Retired United States Magistrate Judge Diane Welsh mediated these negotiations. The Court granted preliminary approval of the settlement in July 2021, pending a fairness hearing, which was held in January 2022. The Court granted final approval of the consumer track class action settlement in April 2022. As part of its final approval, the Court approved an attorneys’ fee award of $3.2 million over the objections of one class member, Theodore Frank. In November 2023, a panel of the Third Circuit Court of Appeals vacated this fee award and remanded so the Court could re-consider its reasonableness through the lens of two considerations: (1) whether the funds made available to the

class or the amount actually claimed by the class is the best measure of reasonableness under the circumstances of this case and (2) whether unargued appellate suspicion of putative “side agreements” renders the fee award unreasonable. After holding two post-remand hearings and reviewing counsel’s detailed sworn declarations regarding the negotiation process, the Court finds that the originally awarded fee is indeed reasonable and does not deserve being considered the result of any “side agreements.”

1 See generally Carol L. Zeiner, Getting Deals Done: Enhancing Negotiation Theory and Practice Through a Therapeutic Jurisprudence/Comprehensive Law Mindset, 21 Harv. Negot. L. Rev. 279 (2016); Carrie Menkel-Meadow, “Toward Another View of Legal Negotiation: The Structure of Problem Solving,” 31 UCLA L. Rev. 754 (1984). I. The First Final Approval Process The Proposed Settlement Class includes: “All residents of the United States who used a credit or debit card at a Wawa location at any time during the Period of the Data Security Incident of March 4, 2019 through December 12, 2019.” The class includes about 22 million people, only

six of whom opted out of the class.2 Among the class members, the Settlement Agreement provides for three tiers of relief. • Tier I – $5 Wawa Gift Card.3 This is available to customers who used a debit or credit card to make a purchase at Wawa between March 4, 2019 and December 12, 2019 and who attest that they spent at least some time monitoring their credit card. Total Tier I compensation is subject to a $6 million cap and a $1 million floor. • Tier II – $15 Wawa Gift Card. This is available to customers who used a payment card at Wawa during the relevant time period, had a subsequent fraudulent charge on their card, and spent at least some time addressing the fraudulent transaction or otherwise monitoring their account. Total Tier II compensation is subject to a $2 million cap and no floor. • Tier III – Cash payments up to $500. This is available to customers who can demonstrate certain expenditures or other out-of-pocket losses resulting from the data breach. Total Tier III compensation is subject to a $1 million cap and no floor.

Third Amended Settlement Agreement ¶ 36, Doc. No. 301-1.

The Settlement Agreement also includes injunctive relief provisions, which the parties valued at approximately $35 million. According to counsel for Wawa, “[t]he injunctive relief was discussed early and often in the negotiations. It was heavily negotiated and detailed.” Decl. of

2 As the Court fully explained when it first granted final approval of the class action settlement, the settlement notice program was fulsome and legally adequate. See In re Wawa, Inc. Data Security Litigation, No. 19-6019, 2022 WL 1173179, at *2 (E.D. Pa. Apr. 20, 2022). The appellate court did not instruct the Court to re-examine the notice procedures in this case, and the Court does not re-describe them here. 3 Gift cards will be fully transferable and usable toward the purchase of any item sold in a Wawa convenience store (except tobacco products), including fuel, if payment is completed inside the store. Pursuant to a December 21, 2021 stipulation agreed to by the parties after Court interaction, the gift cards will not expire. Gregory Parks ¶ 15, Doc. No. 427. These negotiated provisions require Wawa to: (1) encrypt payment card information at point of sale terminals in Wawa stores; (2) implement Europay, Mastercard, and Visa security procedures at point of sale terminals; (3) maintain written policies regarding information security; (4) retain, on an annual basis, a qualified security assessor; (5) conduct yearly penetration testing and remediate vulnerabilities thereby discovered; and (6) issue

a compliance report evidencing Wawa’s compliance with these requirements. Third Amended Settlement Agreement ¶ 40, Doc. No. 301-1; Decl. of Richard Dorough ¶ 3, Doc. No. 428-1. These measures exceed both the regulatory requirements applicable to Wawa and its contractual obligations with its payment processor. Decl. of Gregory Parks on Injunctive Relief ¶ 4, Doc. No. 274. The appellate court panel’s discussion of the settlement did not include material references to these equitable elements of the settlement. These actions may have been taken by Wawa in the absence of a court order: objector’s counsel notes that, as early as February 2020, Wawa told members of the media that it was already implementing some of what would later become the Court’s injunctive relief. Decl. of Adam

Schulman ¶¶ 12-13, Doc. No. 429. In fact, Wawa’s Board approved expenditures of $25 million in the wake of the data breach to address security concerns. Id. ¶ 65. Nonetheless, this litigation converted Wawa’s voluntary remedial measures into measures required by order of the Court. In fact, “[i]f it were not for the Consumer Track Action[,] . . . Wawa would not have agreed to having these measures be compelled as injunctive relief.” Decl.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Boeing Co. v. Van Gemert
444 U.S. 472 (Supreme Court, 1980)
In Re Bluetooth Headset Products Liability
654 F.3d 935 (Ninth Circuit, 2011)
In Re Baby Products Antitrust Litigation
708 F.3d 163 (Third Circuit, 2013)
In Re Safety Components, Inc. Securities Litigation
166 F. Supp. 2d 72 (D. New Jersey, 2001)
Reibstein v. RITE AID CORPORATION
761 F. Supp. 2d 241 (E.D. Pennsylvania, 2011)
Gunter v. Ridgewood Energy Corp.
223 F.3d 190 (Third Circuit, 2000)
Amber Gascho v. Global Fitness Holdings, LLC
822 F.3d 269 (Sixth Circuit, 2016)
Jim Sciaroni v. Target Corporation
847 F.3d 608 (Eighth Circuit, 2017)
Jim Sciaroni v. Target Corporation
892 F.3d 968 (Eighth Circuit, 2018)
Robert Briseno v. Conagra Foods, Inc.
998 F.3d 1014 (Ninth Circuit, 2021)
Altnor v. Preferred Freezer Services, Inc.
197 F. Supp. 3d 746 (E.D. Pennsylvania, 2016)
Medical Mutual of Ohio v. SmithKline Beecham Corp.
291 F.R.D. 93 (E.D. Pennsylvania, 2013)
In re Wawa, Inc. Data Security Litigation v.
85 F.4th 712 (Third Circuit, 2023)

Cite This Page — Counsel Stack

Bluebook (online)
IN RE WAWA, INC. DATA SECURITY LITIGATION, Counsel Stack Legal Research, https://law.counselstack.com/opinion/in-re-wawa-inc-data-security-litigation-paed-2024.