Whittum v. University Medical Center of Southern Nevada

• Court: District Court, D. Nevada
• Decided: April 17, 2023
• Docket: 2:21-cv-01777
• Status: Unknown

Opinion

1 2

3 UNITED STATES DISTRICT COURT

4 DISTRICT OF NEVADA

5 * * * 6 LEISA WHITTUM, et al., Case No. 2:21-cv-01777-MMD-EJY

7 Plaintiffs, ORDER v. 8 UNIVERSITY MEDICAL CENTER 9 OF SOUTHERN NEVADA,

10 Defendant.

11 12 I. SUMMARY 13 Plaintiffs Leisa Whittum, Nicole Kilburn, and Sara Sanguinetti (“Plaintiffs”)1 sued 14 Defendant University Medical Center of Southern Nevada (“UMC”) for injuries stemming 15 from a data breach of UMC’s systems in June 2021. (ECF Nos. 15 at 3, 59.) Before the 16 Court are Plaintiffs’ renewed motion to remand (ECF No. 61)2 under the local controversy 17 and interest of justice exceptions of the Class Action Fairness Act (“CAFA”), and motion 18 to compel (ECF No. 62).3 Plaintiffs filed the renewed motion after completion of limited 19 jurisdictional discovery for class citizenship. As further explained below, the Court finds 20 21 22

23 1Sara Sanguinetti was added as a Plaintiff after consolidation. (ECF No. 59.)

24 2In the last order, the Court granted class citizenship discovery because pertinent facts bearing on jurisdiction were disputed and additional citizenship discovery was 25 necessary to determine whether the CAFA exceptions applied. (ECF No. 52 at 9-10.) The Court also granted the parties leave to file renewed motions within 30 days of the 26 conclusion of jurisdictional discovery. (Id. at 10.) Plaintiffs subsequently filed their renewed motion to remand with exhibits. (ECF Nos. 61, 63, 64 (Sealed).) 27 3The parties filed responses and replies to the pending motions. (ECF Nos. 67, 70, 28 71.) 1 that remand is proper under both CAFA exceptions and will grant the renewed motion to 2 remand and deny the motion to compel.4 3 II. DISCUSSION 4 The Court rejects UMC’s arguments as to class size and standing because 5 Plaintiffs are relying on UMC’s own data to formulate their proposed class, and Plaintiffs 6 suffered concrete, separate injuries from the risk of future harm that are sufficient for 7 standing. The Court next grants remand under CAFA’s local controversy exception 8 because Plaintiffs have demonstrated that greater than two-thirds of proposed class 9 members are Nevada citizens. Alternatively, the Court finds that discretionary remand is 10 appropriate because more than one-third of proposed class members are Nevada 11 citizens, and the interests of justice warrant remand. Finally, the Court denies Plaintiffs’ 12 request for attorney’s fees and costs because Plaintiffs have not met the stringent 13 standard for attorney’s fees and have failed to comply with local rules. 14 A. Objections to Class Size & Standing 15 As a preliminary matter, UMC argues that remand is improper because Plaintiffs’ 16 proposed class size, based on the number of notices UMC sent and the addresses in 17 these notices, is “artificially inflate[d].” (ECF No. 67 at 7.) Specifically, UMC contends that 18 class size based on UMC notices is unreliable because (1) UMC was overinclusive and 19 provided notice to “dramatically more people than could have been impacted” by the 20 breach, and (2) some class members do not have standing because they are not data 21 breach victims, and their information was not accessed during the breach. (Id. at 4-9.) 22 The Court disagrees and finds that potential breach victims have standing, and the 23 proposed class size is appropriate for citizenship determinations.5 See Brinkley v.

24 4The Court adopts the background section from its previous order and will not repeat the information here. (ECF No. 52 at 2.) However, the Court notes that since the 25 issuance of the last order, the parties have completed jurisdictional discovery for class citizenship, and the Court has granted consolidation of this case and another case, 2:21- 26 cv-01779-JAD-EJY pertaining to UMC’s data breach. (ECF No. 59.)

27 5In their reply, Plaintiffs argue that the Court should “set aside UMC’s belated attempt to argue aspects of Article III jurisdiction” because UMC did not file a renewed 28 1 Monterey Fin. Servs., Inc., 873 F.3d 1118, 1121 (9th Cir. 2017) (explaining that to 2 determine class citizenship, the court must first determine the size of the class as a whole) 3 (citation omitted). 4 The Court is unpersuaded by UMC’s first argument. Plaintiffs’ proposed class size 5 is based on the total number of notices that UMC sent to victims or potential victims of 6 the breach, which is approximately 1.3 million. (ECF No. 61 at 8-9, 13.) To the extent this 7 figure is overinclusive, that defect is a result of UMC’s choices that it purposefully and 8 strategically made. (See ECF No. 67 at 9 (UMC explaining that “in the interest of providing 9 notice and opportunity to mitigate for any individuals that could have been impacted, UMC 10 proceeded with a strategy to purposefully provide notice and identity theft protection to 11 dramatically more people than could have been impacted”).) The Court finds it 12 unreasonable and unfair for UMC to now challenge class size when the class size was 13 based on data that UMC itself provided to Plaintiffs. Moreover, UMC offers no additional 14 information or clarification about the breakdown of the actual number of people UMC 15 should have informed about the breach. The Court therefore rejects UMC’s first argument 16 as to class size. 17 The Court is likewise unpersuaded by UMC’s second argument that the class size 18 is “inflated” because it includes individuals who were potentially impacted by the breach 19 but have suffered no injury because their information was not misused.6 (Id. at 4-7.) “To 20 have Article III standing to sue in federal court, plaintiffs must demonstrate, among other 21 things, that they suffered a concrete harm. No concrete harm, no standing.” TransUnion 22

motion to dismiss after jurisdictional discovery. (ECF No. 70 at 4.) The Court disagrees 23 and will consider UMC’s arguments because federal courts “are required sua sponte to examine jurisdictional issues such as standing.” See Bernhardt v. Cnty. of L.A., 279 F.3d 24 862, 868 (9th Cir. 2002) (citations omitted).

25 6In the FAC, Plaintiffs proposed a nationwide class, defined as “[a]ll persons whose Personal Data was procured or potentially procured by a third party as a result of the Data 26 Breach due to UMC’s failure to secure its internal systems of record.” (ECF No. 15 at 9.) Plaintiffs also proposed a Nevada class, defined as “[a]ll residents of the State of Nevada 27 whose Personal Data was procured or potentially procured by a third party as a result of the Data Breach due to UMC’s failure to secure its internal systems of record.” (Id. at 10.) 28 1 LLC v. Ramirez, 141 S. Ct. 2190, 2200 (2021). “[A] person exposed to a risk of future 2 harm may pursue forward-looking, injunctive relief to prevent the harm from occurring, at 3 least so long as the risk of harm is sufficiently imminent and substantial.” Id. at 2210 4 (citations omitted).7 However, “in a suit for damages, the mere risk of future harm, 5 standing alone, cannot qualify as a concrete harm [for standing]—at least unless the 6 exposure to the risk of future harm itself causes a separate concrete harm.” Id. at 2210- 7 11. Lower courts have found that the time and money spent mitigating and protecting 8 from future identity theft, along with the emotional distress the plaintiff suffers from “the 9 knowledge of the substantial risk of identify theft,” are sufficient, concrete injuries for 10 standing. See Ortiz v. Perkins & Co., Case No. 22-cv-03506-KAW, 2022 WL 16637993, 11 at *4 (N.D. Cal. Nov. 2, 2022) (citing Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 12 692-94 (7th Cir. 2015); Clemens v. ExecuPharm Inc., 48 F. 4th 146, 155-56 (3d Cir. 13 2022)); see also TransUnion, 141 S. Ct. at 2211 n.7 (stating that a “plaintiff’s knowledge 14 that he or she is exposed to a risk of future physical, monetary, or reputational harm could 15 cause its own current emotional or psychological harm”). 16 To start, Plaintiffs have demonstrated standing for monetary damages. Named 17 Plaintiff Whittum8 alleges that she spent a substantial amount of time trying to mitigate 18 the effects of the data breach, including “investigating her financial accounts for evidence 19 of fraud, and procuring her consumer disclosures from several credit reporting agencies” 20 to investigate for fraudulent activity. (ECF No. 15 at 5.) Whittum spent money enrolling in

21 7In TransUnion, the United States Supreme Court held that 6,332 class members lacked standing for the reasonable-procedures claim because TransUnion “did not 22 provide those plaintiffs’ credit information to any potential creditors” and the “mere presence of an inaccuracy in an internal credit file, if it is not disclosed to a third party, 23 causes no concrete harm.” 141 S. Ct. at 2209-10, 2214. This case is distinguishable from TransUnion because it is unclear whether class members’ personally identifiable 24 information was actually disclosed or disseminated to third parties, but the potential dissemination of Plaintiffs’ private information yielded separate, concrete injuries, as 25 discussed above. (See ECF Nos. 15 at 5-6, 67-1 at 2 (UMC’s notices warned that “[a]ffected information, potentially including yours, was compromised by a well-known 26 group of cybercriminals that seek to use the information for commercial gain”).)

27 8“In a class action, standing is satisfied if at least one named plaintiff meets the requirements.” Ollier v. Sweetwater Union High Sch. Dist., 768 F.3d 843, 865 (9th Cir. 28 2014) (citation omitted). 1 identity theft protection services and mailing documents to credit reporting agencies. (Id.) 2 She also suffered financial losses from having to wait to refinance her home due to the 3 security freezes on her credit reports. (Id. at 6.) Additionally, Whittum alleges that she 4 suffered stress, worry, anxiety, and hesitation from the feared risk of future fraud or theft. 5 (Id.) Because Plaintiffs undertook substantial mitigation and remedial measures to 6 prevent fraud, incurred out-of-pocket expenses, and suffered emotional distress from the 7 anticipation of fraud, the Court finds that Plaintiffs have alleged concrete, separate injuries 8 for standing from the risk of future harm. See Ortiz, 2022 WL 16637993, at *4; see also 9 TransUnion, 141 S. Ct. at 2204 (noting that “[i]f a defendant has caused physical or 10 monetary injury to the plaintiff, the plaintiff has suffered a concrete injury in fact under 11 Article III.”). 12 Plaintiffs have also demonstrated standing for injunctive relief. Named Plaintiff 13 Kilburn alleges that she has already received two notices of attempts to open credit cards 14 in her name after the data breach. (Id.) The compromised data from the breach also 15 includes highly sensitive demographic, clinical, and financial information, such as a 16 person’s social security number—the exact type of information that hackers and 17 cybercriminals use to commit fraud or identity theft. (ECF No. 67-1 at 2.) See Smallman 18 v. MGM Resorts Int’l, Case No. 2:20-cv-00376-GMN-EJY, 2022 WL 16636958, at *6 (D. 19 Nev. Nov. 2, 2022) (finding that the plaintiffs demonstrated substantial risk of future harm 20 because the “criminals perpetrated ransom attacks against them or attempted to sign into 21 their personal accounts” and the stolen information gave hackers the means to commit 22 future identity fraud or theft) (citations omitted); see also Greenstein v. Noblr Reciprocal 23 Exch., 585 F. Supp. 3d 1220, 1227 (N.D. Cal. 2022) (finding that disclosure of highly 24 sensitive personal information such as social security and credit card numbers 25 “increase[s] the risk of immediate future harm to the plaintiff”). Because Kilburn has 26 already received several fraud alerts and the stolen data provides hackers with the means 27 to commit fraud, the Court reasonably infers that the risk of harm is sufficiently imminent 28 and substantial for standing. See Galaria v. Nationwide Mut. Ins. Co., 663 F. App'x 384, 1 388 (6th Cir. 2016) (“Where a data breach targets personal information, a reasonable 2 inference can be drawn that the hackers will use the victims’ data for the fraudulent 3 purposes alleged in Plaintiffs’ complaints”). Because potential breach victims have 4 standing for monetary damages and injunctive relief, they may be included in the 5 proposed class and the class size is appropriate.9

6 B. Mandatory Remand Under CAFA’s Local Controversy Exception 28 U.S.C. § 1332(d)(4) 7 8 The parties’ primary dispute focuses on whether Plaintiffs have demonstrated that 9 more than two-thirds of class members are Nevada citizens under CAFA’s local 10 controversy exception. See 28 U.S.C. § 1332(d)(4)(A). Plaintiffs argue that remand is 11 mandatory because calculations from UMC’s dataset show that over 90 percent of the 12 breach notifications were sent to Nevada addresses. (ECF No. 61 at 3, 8.) UMC counters 13 that (1) the listing addresses on the notices are not indicative of citizenship, and (2) over 14 500,000 of the addresses “cannot be relied upon to convey any information regarding 15 citizenship” because they were returned as undeliverable, pertained to minors, or have 16 out-of-state addresses. (ECF Nos. 67 at 11, 67-3 at 4.) The Court disagrees and finds 17 that Plaintiffs have satisfied the citizenship requirement. 18 The burden of proof for establishing the applicability of an exception to CAFA 19 jurisdiction rests on the party seeking remand, which is often the plaintiff. See Serrano v. 20 180 Connect, Inc., 478 F.3d 1018, 1024 (9th Cir. 2007). However, the burden on a plaintiff 21 “should not be exceptionally difficult to bear.” Mondragon v. Capital One Auto Fin., 736 22 F.3d 880, 886 (9th Cir. 2013). Where there are disputed facts, the district court must make 23 factual findings for jurisdiction under a preponderance of the evidence standard before

24 9In the response, UMC also argues that there is a “lack of any evidence of any negative consequence” since there are “presently no known instances of any individuals 25 that experienced any loss or diminution of any interest based upon any unauthorized access to UMC data.” (ECF No. 67 at 10.) To the extent UMC is trying to allege that there 26 are no injuries from the breach, this conclusory assertion is highly disputed and premature since Plaintiffs allege that they have suffered emotional distress, incurred out-of-pocket 27 expenses, received notifications of fraud attempts, and spent time and energy mitigating and protecting against future fraud. (ECF No. 15 at 5-6.) 28 1 granting remand. See id. at 883-84 (citation omitted). While a “jurisdictional finding of fact 2 should be based on more than guesswork[,]” district courts are generally “permitted to 3 make reasonable inferences from facts in evidence.” Id. at 884, 886 (citation omitted). 4 Under CAFA’s local controversy exception, a district court must decline to exercise 5 jurisdiction: 6 (i) over a class action in which— (I) greater than two-thirds of the members of all proposed plaintiff classes 7 in the aggregate are citizens of the State in which the action was originally filed; 8 (II) at least 1 defendant is a defendant— (aa) from whom significant relief is sought by members of the plaintiff 9 class; 10 (bb) whose alleged conduct forms a significant basis for the claims asserted by the proposed plaintiff class; and 11 (cc) who is a citizen of the State in which the action was originally filed; and 12 (III) principal injuries resulting from the alleged conduct or any related 13 conduct of each defendant were incurred in the State in which the action was originally filed; and 14 (ii) during the 3-year period preceding the filing of that class action, no other class action has been filed asserting the same or similar factual allegations against any 15 of the defendants on behalf of the same or other persons[.] 16 See 28 U.S.C. § 1332(d)(4)(A). As explained below, the Court finds that Plaintiffs have 17 satisfied this exception. 18 The Court is unpersuaded by UMC’s first argument and finds that the addresses 19 in UMC’s notices are indicative of class citizenship.10 As a threshold matter, the Ninth 20 Circuit has explicitly held that the residences on the notices provide, at a minimum, some 21 evidence of class members’ domiciles.11 See Adams v. W. Marine Prods., Inc., 958 F.3d 22 1216, 1221 (9th Cir. 2020) (citation omitted). Other evidence in the record further supports 23 that the notice addresses establish domicile. See King v. Great Am. Chicken Corp., Inc., 24 903 F.3d 875, 878-79 (9th Cir. 2018) (explaining that “a district court should consider the

25 10The Court notes that it has already addressed this argument in its prior order. (ECF No. 52 at 9.) Nonetheless, the Court will address the issue, again, since UMC is 26 trying to revive the argument.

27 11A person’s domicile is their “permanent home” where (1) they reside, (2) with the intention to remain or return. See Adams, 958 F.3d at 1221 (citation omitted). 28 1 entire record to determine whether evidence of residence can properly establish 2 citizenship”) (quotation marks and citations omitted). To start, the addresses are fairly 3 recent, particularly in relation to the time of removal and the date of the breach. See 4 Adams, 958 F.3d at 1221 (“Citizenship is determined as of the date the case became 5 removable”) (quotation marks and citation omitted). The data breach occurred on June 6 14, 2021, UMC began notifying victims and potential victims in August 2021, and the case 7 was removed from state court in September 2021, so the separation between these 8 events was a mere matter of months. (ECF Nos. 1, 15 at 3-4, 67-1 at 2.) 9 Next, UMC admits that it used a third-party vendor to mail the notices and 10 standardize and validate the addresses “using USPS Coding Accuracy Support System 11 and National Change of Address Validation.” (ECF No. 63-5 at 5-6.) Notably, UMC admits 12 that only 236,43512 out of 1.3 million notices13 were returned as undeliverable—which is 13 only 18 percent of the total mailings. (ECF Nos. 67 at 11, 67-3 at 4.) This low percentage 14 of undeliverable notices suggests that UMC’s validation system was effective, and the 15 notice addresses were overall accurate. Because a person’s domicile, once established, 16 continues in that state and UMC has failed to rebut this presumption, the Court finds that 17 the notice addresses are indicative of class citizenship and may be used to determine the 18 percentage of class members who are Nevada citizens. See id. (explaining that a plaintiff 19 “may rely on the presumption of continuing domicile, which provides that, once 20 established, a person's state of domicile continues unless rebutted with sufficient 21 evidence of change”) (citation omitted); see also Mondragon, 736 F.3d at 886. 22 The Court is likewise unpersuaded by UMC’s second argument. After jurisdictional 23 discovery, Plaintiffs calculated that approximately 90 percent of all completed mailings 24 were sent to persons in Nevada—a figure that significantly surpasses the two-thirds 25

12There appears to be a typo in the response, where UMC claims that 206,435 26 notices were returned as undeliverable. (ECF No. 67 at 11.) This figure is based on Keith Slade’s declaration, where Slade states that 236,435 notices were returned as 27 undeliverable. (ECF No. 67-3 at 4.)

28 13UMC does not dispute this total figure provided by Plaintiffs. (ECF No. 67.) 1 threshold for CAFA’s local controversy exception. (ECF No. 61 at 3, 8, 17, 19.) See 28 2 U.S.C. § 1332(d)(4). UMC disputes the accuracy of this figure and argues that over 3 500,000 of these addresses are unreliable for citizenship. (ECF No. 67 at 11.) As support, 4 UMC included a declaration from Keith Slade,14 the hospital’s privacy officer, who claimed 5 that 218,013 UMC notices pertained to mailings to minors, 236,435 notices were returned 6 as undeliverable, and 120,687 notices used out-of-state addresses.15 (ECF No. 67-3 at 7 4.) Notably, Slade does not allege that there is any overlap or duplication between these 8 figures or categories. (Id. at 2-4.) 9 Even if over 500,000 addresses are unreliable or from outside of Nevada, which 10 amounts to 44 percent16 of all addresses, approximately 56 percent of addresses would 11 still be Nevada addresses—a figure that remains substantial and is fairly close to the two- 12 thirds threshold for mandatory remand. However, the Court is unpersuaded by UMC’s 13 argument that 218,013 notices are unreliable because they concerned mailings to minors 14 “for whom no data is presented (or potentially available) regarding citizenship of parents 15 or guardians.” (ECF No. 67 at 11.) The Court is permitted to make inferences from the 16

14In their reply, Plaintiffs argue that the Court should disregard Slade’s declaration 17 because he (1) failed to explain his qualifications or establish he has personal knowledge of the facts he attested to, (2) failed to explain his methodologies, and (3) failed to 18 authenticate the documents he relied on in making his conclusions. (ECF No. 70 at 6-10.) The Court rejects Plaintiffs’ arguments because Slade can testify as a lay witness since 19 the information in his declaration does not require scientific or technical expertise and is based on his personal knowledge as UMC’s privacy officer. See Fed. R. Evid. 701, 702. 20 The Court will also infer Slade’s personal knowledge from his position as a privacy officer at UMC. See Barthelemy v. Air Lines Pilots Ass'n, 897 F.2d 999, 1018 (9th Cir. 1990). 21 Finally, the amendments to Fed. R. Civ. P. 56 have eliminated the unequivocal requirement that summary judgment evidence must be authenticated. See Romero v. 22 Nev. Dep’t of Corr., 673 F. App'x 641, 644 (9th Cir. 2016). The Court will therefore consider Slade’s declaration. 23

15The Court makes its evidentiary findings based on the current record before the 24 Court. Because Slade does not allege any overlap or duplication between the figures, the Court will consider the figures as separate, independent categories for citizenship 25 calculations.

26 16This figure is derived from the approximately 1,304,594 total individuals that UMC mailed data breach notification letters to. (ECF No. 61 at 7.) In the response and 27 declaration, UMC and Slade do not dispute this total figure and do not provide an alternative total figure for the Court. (ECF Nos. 67, 67-3.) 28 1 record, and it is reasonable to infer that most minors would live with their parents or 2 guardians at the listed Nevada addresses. See Mondragon, 736 F.3d at 886. Moreover, 3 UMC failed to present any evidence to rebut the continuing domicile presumption to show 4 that the minors’ domiciles in Nevada have changed. See Adams, 958 F.3d at 1221 5 (citation omitted). Accordingly, the Court finds that the 218,013 notices to minors should 6 be considered for citizenship. When considered, only 27 percent of addresses are 7 unreliable or from out-of-state, and 73 percent of addresses were mailed to individuals in 8 Nevada—which exceeds the two-thirds threshold for mandatory remand.17 9 Additionally, it is reasonable to infer that the majority of breach and potential 10 breach victims are Nevada citizens, since UMC is a local Las Vegas hospital that services 11 the greater Las Vegas community. (ECF Nos. 15 at 3, 61 at 3, 14.) See Mondragon, 736 12 F.3d at 886. Accordingly, Plaintiffs have satisfied their burden for mandatory remand, 13 which is not exceptionally hard to bear, by demonstrating that more than two-thirds of 14 class members are Nevada citizens. See Adams, 958 F.3d at 1221 (citation omitted). 15 They have also satisfied the other local controversy elements because UMC is located in 16 Nevada, UMC’s alleged failure to secure their internal systems serves as a significant 17 basis for Plaintiffs’ claims, Plaintiffs’ principal injuries resulted from a data breach in 18 Nevada, and there are no identical or similar class actions filed before this lawsuit. Thus, 19 the Court grants mandatory remand under CAFA’s local controversy exception. See 28 20 U.S.C. § 1332(d)(4). 21 C. Discretionary Remand Under CAFA’s Interest of Justice Exception 28 U.S.C. § 1332(d)(3)18 22 23 Alternatively, Plaintiffs argue that even if the local controversy threshold is not met, 24 the Court should exercise its discretionary authority to remand under CAFA’s interest of 25

17These figures are derived from the approximately 1,304,594 total individuals that 26 UMC mailed data breach notification letters to. (ECF No. 61 at 7.)

27 18Because Plaintiffs have proffered sufficient evidence for remand under 28 U.S.C. § 1332(d)(3) and 28 U.S.C. § 1332(d)(4), the Court will deny Plaintiffs’ motion to compel 28 UMC to amend its answer to Request For Admission No. 2. (ECF No. 62.) 1 justice exception since UMC admitted that greater than one-third of the data breach 2 notices were mailed to Nevada addresses. (ECF Nos. 61 at 10, 14-15, 63-3 at 3.) See 28 3 U.S.C. § 1332(d)(3). The Court agrees. 4 Under CAFA’s interest of justice exception, a district court may, in the interests of 5 justice and looking at the totality of the circumstances, decline to exercise jurisdiction 6 under paragraph (2) over a class action: 7 [I]n which greater than one-third but less than two-thirds of the members of all proposed plaintiff classes in the aggregate and the primary defendants are citizens of the 8 State in which the action was originally filed based on consideration of— (A) whether the claims asserted involve matters of national or interstate interest; 9 (B) whether the claims asserted will be governed by laws of the State in which the 10 action was originally filed or by the laws of other States; (C) whether the class action has been pleaded in a manner that seeks to avoid 11 Federal jurisdiction; (D) whether the action was brought in a forum with a distinct nexus with the class 12 members, the alleged harm, or the defendants; (E) whether the number of citizens of the State in which the action was originally 13 filed in all proposed plaintiff classes in the aggregate is substantially larger than 14 the number of citizens from any other State, and the citizenship of the other members of the proposed class is dispersed among a substantial number of 15 States; and (F) whether, during the 3-year period preceding the filing of that class action, 1 or 16 more other class actions asserting the same or similar claims on behalf of the same or other persons have been filed. 17 18 See 28 U.S.C. § 1332(d)(3). As explained below, the Court finds that Plaintiffs have 19 satisfied this exception. 20 As an initial matter, UMC conceded that more than one-third of the data breach 21 mailings were sent to Nevada addresses, so the citizenship threshold for discretionary 22 remand has been satisfied. (ECF Nos. 61 at 10, 14-15, 63-3 at 3.) The Court finds that 23 the other 28 U.S.C. § 1332(d)(3) factors overwhelmingly weigh in favor of remand. First, 24 the asserted claims implicate matters of state interest since the case involves a significant 25 data breach at a local Las Vegas hospital that serves the local Las Vegas community. 26 (ECF Nos. 15 at 3, 61 at 3, 14.) Congress specifically provided exceptions to CAFA “to 27 allow truly intrastate class actions to be heard in state court.” Adams, 958 F.3d at 1220 28 (citation omitted). Second, Plaintiffs are only asserting common law and Nevada statutory 1 claims in their first amended complaint (“FAC”). (ECF No. 15.) Plaintiffs correctly note that 2 other than a hypothetical portion of Plaintiff’s negligence claims, the asserted claims “will 3 be governed exclusively by the laws of Nevada.” (ECF Nos. 14 at 13, 61 at 15.) Third, the 4 class action was pleaded in a manner that avoids federal question jurisdiction because 5 the FAC does not include any federal claims. In fact, the Court previously found that there 6 was no independent federal question jurisdiction because Plaintiffs’ state-law claims did 7 not implicate significant federal issues and were not completely preempted by federal law. 8 (ECF No. 52 at 3.) 9 Fourth, the case was filed in Nevada—a forum with a significant nexus to the class 10 members, the alleged harm, and the defendant—because UMC is located in Nevada, the 11 UMC breach occurred in Nevada, and Nevada citizens were disproportionately impacted 12 by the breach. Fifth, although some class members are dispersed throughout the country, 13 Plaintiffs’ calculations (over 90 percent of class members are Nevada citizens), UMC’s 14 own admissions (more than one-third of the mailings were sent to Nevada addresses), 15 and the Court’s calculations (at least 73 percent of class members are Nevada citizens 16 after omitting addresses that are unreliable or out-of-state) clearly show that the number 17 of Nevada citizens in the proposed class is substantially greater than citizens from other 18 states. Finally, there are no identical or similar class actions filed before this lawsuit. 19 Accordingly, the 28 U.S.C. § 1332(d)(3) factors clearly support remand under the interests 20 of justice exception because Nevada state courts have a stronger interest in adjudicating 21 this uniquely local matter. See Benko v. Quality Loan Serv. Corp., 789 F.3d 1111, 1119 22 (9th Cir. 2015) (citation omitted) (noting that CAFA exceptions are “intended to respond 23 to concerns that class actions with a truly local focus should not be moved to federal court 24 under this legislation because state courts have a strong interest in adjudicating such 25 disputes”) (citation omitted). Thus, Plaintiffs’ motion is also granted under CAFA’s interest 26 of justice exception. See 28 U.S.C. § 1332(d)(3). 27 /// 28 /// 1 D. Request for Attorney’s Fees & Costs 2 Finally, the Court denies Plaintiffs’ request for attorney’s fees and costs. (ECF No. 3 || 61 at 16.) Plaintiffs have not met the stringent standard for attorney's fees because they 4 || are not challenging the Court’s jurisdiction under CAFA, but instead, arguing that 5 || exceptions to CAFA applies. (ECF Nos. 14 at 10, 61 at 5.) See Martin v. Franklin Capital 6 || Corp., 546 U.S. 132, 141 (2005) (“Absent unusual circumstances, courts may award 7 || attorney's fees under § 1447(c) only where the removing party lacked an objectively 8 || reasonable basis for seeking removal.”). Denial is also appropriate because Plaintiffs 9 || failed to comply with LR 54-14 by not filing a separate motion for attorney’s fees. 10 || Ill. CONCLUSION 11 The Court notes that the parties made several arguments and cited to several 12 || cases not discussed above. The Court has reviewed these arguments and cases and 13 || determines that they do not warrant discussion as they do not affect the outcome of the 14 || issues before the Court. 15 Itis therefore ordered that Plaintiffs’ renewed motion to remand to state court (ECF 16 || No. 61) is granted. 17 It is further ordered that Plaintiffs’ motion to compel (ECF No. 62) is denied. 18 It is further ordered that Plaintiffs’ request for attorney's fees and costs (ECF No. 19 || 61 at 16) is denied. 20 It is further ordered that this case is remanded to the Eighth Judicial District Court 21 || of Clark County. 22 The Clerk of Court is directed to close this case. 23 DATED THIS 17" Day of April 2023. 24 aA 25 ASQ 26 CHIEF UNITED STATES DISTRICT JUDGE 27 28 13