In re Wawa, Inc. Data Security Litigation v.

85 F.4th 712
Court of Appeals for the Third Circuit·Decided November 2, 2023·No. 22-1950·Published·Cited by 14 cases

Opinion

PRECEDENTIAL

UNITED STATES COURT OF APPEALS FOR THE THIRD CIRCUIT

No. 22-1950

IN RE WAWA, INC. DATA SECURITY LITIGATION

THEODORE H. FRANK,

Appellant

On Appeal from the United States District Court for the Eastern District of Pennsylvania (D.C. Civil No. 2:19-cv-06019)

District Judge: Honorable Gene E. K. Pratter

Argued March 30, 2023

Before: MATEY, FREEMAN, and FUENTES, Circuit Judges.

(Filed: November 2, 2023)

Theodore H. Frank Adam E. Schulman [ARGUED] Hamilton Lincoln Law Institute 1629 K Street, N.W. Suite 300 Washington, DC 20006 Counsel for Appellant

Donald E. Haviland, Jr. Haviland Hughes 201 South Maple Street Suite 110 Ambler, PA 19002

Gerard A. Dever Roberta D. Liebenberg Fine Kaplan & Black One South Broad Street Suite 2300 Philadelphia, PA 19107

Samantha E. Holbrook Benjamin F. Johns [ARGUED] Jonathan Shub Shub & Johns 200 Barr Harbor Drive Four Tower Bridge, Suite 400 West Conshohocken, PA 19428 Counsel for Plaintiffs-Appellees

Kristin M. Hadgis Gregory T. Parks [ARGUED] Morgan, Lewis & Bockius 2222 Market Street Philadelphia, PA 19103

Michael E. Kenneally Morgan, Lewis & Bockius 1111 Pennsylvania Avenue, N.W. Suite 800 North Washington, DC 20004 Counsel for Defendants-Appellees

Melissa Holyoak Office of Attorney General of Utah 350 North State Street Suite 230 Salt Lake City, UT 84114 Counsel for Amicus Appellant

OPINION OF THE COURT

MATEY, Circuit Judge.

Convenience is king at Wawa, Inc., where guests are invited to gas up, chow down, and swipe, tap, or click to pay before heading on their way. Throughout 2019, uninvited guests stopped by too. Hackers, who infiltrated Wawa’s payment systems and helped themselves to the credit and bank card data of some twenty-two million customers. Wawa announced the breach on December 19, 2019; by the next day,

attorneys had rounded up plaintiffs and filed the first of many class action suits seeking damages for the disclosures. A brisk nine months later, Wawa and plaintiffs’ class counsel shook hands on a settlement making $9 million in gift cards and some other compensation available to customers (of which $2.9 million was claimed) and giving $3.2 million to class counsel for fees and expenses (the “Settlement Agreement”). Objections arrived, prompting modifications to the proposal. But the changes are not enough to ensure class counsel receives only a reasonable fee award, and we clarify two considerations that loom large in that calculation: the ratio between the fee award and amount recovered by the class members, and side agreements between class counsel and the defendant. Because the District Court lacked the benefit of our fresh guidance, we will vacate the fee award and remand for further consideration.

I.

When Wawa announced that malware had been stealing payment information for nearly a year, litigation erupted overnight. Moving to order a ballooning docket, the District Court consolidated the multiplying lawsuits into one class action with three tracks: financial institutions, employees, and consumers. The resulting master complaint asserts claims against Wawa for negligence, negligence per se, breach of implied contract, unjust enrichment, and violations of multiple states’ consumer protection and data privacy laws. Our focus is the consumer track plaintiffs who reached a proposed settlement in September 2020 (the “Proposed Settlement Class”).

The Proposed Settlement Class includes around 22 million people 1 who used electronic payments (be it credit, debit, or something else) at a Wawa between March 4, 2019, and December 12, 2019. The Settlement Agreement provided three tiers of relief:

Tier 1 customers who attest that they spent at least some time monitoring their credit can get a $5 Wawa gift card. Total Tier 1 compensation is subject to a $6 million cap and a $1 million floor.

Tier 2 customers who saw a fraudulent charge that required some effort to sort out can receive a $15 Wawa gift card for their trouble. Total Tier 2 compensation is subject to a $2 million cap with no floor.

Tier 3 customers who show certain out-ofpocket losses caused by the breach can receive $500 (in currency, not Wawa gift cards). Total Tier 3 compensation is subject to a $1 million cap without a floor.

The Settlement Agreement also specified injunctive relief, including upgraded security and processing systems, which

class counsel and Wawa valued at about $35 million. For this work, class counsel sought a lump-sum award of $3.2 million, comprised of $3,040,060 in attorney’s fees, $45,940 in litigation expenses, some $100,000 in settlement administration fees, and $14,000 in class representative awards. The parties added those fees, expenses, and awards to the $9 million offered to the class to create what they call a “constructive common fund” of $12.2 million. App. 19–20, 22. That combination of attorney and class recovery into a single amount is at center stage in this appeal. 2

Class member Theodore H. Frank objected to the settlement and the request for attorney’s fees. Frank argued the constructive common fund was miscalculated and the settlement unfair because, stripped of the labels, class counsel would receive a disproportionate share of the amount Wawa would pay in gift cards or cash. And he pointed to other perks class counsel secured in the deal, including a “clear sailing” clause, under which Wawa agreed not to contest class counsel’s fee petition. 3 He also objected to the “fee reversion,”

a provision that returned any reductions in the fee award to Wawa, and not to the class. Frank urged a different approach: cap attorney’s fees at 25% of the actual claims made and paid, rather than funds and gift cards offered but never used.

Amendments followed Frank’s objections. A Second Amended Settlement clarified that the gift cards would not expire and granted automatic eligibility for Tier 1 gift cards to Wawa app users with valid email addresses. And a Third Amended Settlement eliminated the fee reversion so any reduction in fees awarded would be redistributed to Tier 1 and Tier 2 gift card holders. Finally, a claims administrator would email the 575,162 eligible Wawa app users, explaining that they will receive $5 electronic gift cards once the settlement is finalized. The administrator also plans to remind unused gift card holders to use their credit by sending an email nine months after distribution. These adjustments boosted the estimated redemption rate from about 0.035% (about 8,000 claims of the 22 million class members) to as much as 2.6% (around 564,000 claims). This brought the total projected distribution amount to $2,905,195, including $2,815,075 for Tier 1 (up from $33,720 before the amendment), $10,290 for Tier 2, and $79,830 for Tier 3.

Frank then withdrew his objection to the settlement. But he maintained his objection to the attorney’s fees because they

were still based on the constructive common fund, not the amounts paid to the class, a several million-dollar difference. He also pointed to the never-deleted clear sailing clause as evidence of collusion between class counsel and Wawa.

The District Court disagreed, endorsing the $12.2 million calculation for the constructive common fund and finding that class counsel’s requested $3,040,060 fee award— totaling just shy of 25% of that fund—was not unreasonable. Analyzing the fee award under the factors outlined in Gunter v. Ridgewood Energy Corp., 223 F.3d 190, 195 n.1 (3d Cir. 2000), the District Court found that class counsel’s blended $653 hourly rate was reasonable; the litigation was complex; there was a substantial risk of nonpayment (since class counsel worked on contingency); and the total payout fell below other data breach settlements. Cross-checking those conclusions, the District Court ran a lodestar analysis—resulting in an award of roughly $3.8 million. Class counsel’s requested fees of $3,040,060 is less than that number.

Free access — add to your briefcase to read the full text and ask questions with AI

In re Wawa, Inc. Data Security Litigation v., 85 F.4th 712 (3d Cir. 2023).

85 F.4th 712 (In re Wawa, Inc. Data Security Litigation v.) — published by Counsel Stack Legal Research, free access to 12M+ legal documents.

Related