Sung et al v. Schurman Fine Papers, No. 3:2017cv02760 - Document 59 (N.D. Cal. 2018)

Court Description: ORDER granting 46 Motion for Preliminary Approval of Class-Action Settlement. The deadlines are in the chart at the end of the order and include a date for the final approval hearing on May 31, 2018 (because the court had a conflict with the parties' date). (Beeler, Laurel) (Filed on 3/11/2018)
Download PDF
Sung et al v. Schurman Fine Papers Doc. 59 1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 NORTHERN DISTRICT OF CALIFORNIA 10 San Francisco Division United States District Court Northern District of California 11 IRENE SUNG, et al., Plaintiffs, 12 v. 13 14 SCHURMAN FINE PAPERS d/b/a SCHURMAN RETAIL GROUP, 15 Case No. 17-cv-02760-LB PRELIMINARY APPROVAL ORDER Re: ECF No. 46 Defendant. 16 17 INTRODUCTION This is a putative class action under Rule 23.1 The plaintiffs are current and former employees 18 19 (and their spouses and dependents) of Schurman Fine Papers d/b/a Schurman Retail Group 20 (“SRG”). They contend that a phishing attack on SRG in 2016 — and SRG’s lax security and poor 21 training — resulted in the theft of their W-2 data: names, addresses, compensation, and Social 22 Security Numbers.2 On behalf of national and state classes, they assert the following claims 23 arising out of the data breach of their personally identifying information (“PII”): (1) negligence 24 (on behalf of all classes); (2) unlawful business practices in violation of California’s Unfair 25 Competition Law (“UCL”), Cal. Bus. & Prof. Code § 17200 (on behalf of all classes); (3) unfair 26 27 28 1 First Amended Complaint (“FAC”) – ECF No. 28. Citations refer to material in the Electronic Case File (“ECF”); pinpoint citations are to the ECF-generated page numbers at the top of documents. 2 Id. at 2 (¶ 1). ORDER – No. 17-cv-02760-LB 1 business practices in violation of California’s UCL (on behalf of all classes); (4) breach of implied 2 contract (on behalf of the Nationwide Employee Class); (5) a violation of California’s Security 3 Breach Notification Law, Cal. Civ. Code § 1798.82 (on behalf of the California Employee Class); 4 and (6) a violation of North Carolina’s Security Breach Notification Law, N.C. Gen. Stat. §§ 75– 5 61, 75–65, et seq. (on behalf of the North Carolina Employee Class).3 The parties settled their case, and the plaintiffs filed an unopposed motion for preliminary 6 7 approval of the class-action settlement.4 The court grants the motion. 8 9 10 STATEMENT 1. Other Information About the Lawsuit to Date United States District Court Northern District of California 11 After the defendants filed a motion to dismiss, the plaintiffs filed the first amended class- 12 action complaint.5 The parties participated in informal discovery and then agreed to mediate their 13 case before the Honorable Edward A. Infante (Ret.), who has mediated a number of data-breach 14 cases.6 After a full-day mediation, the parties “ultimately reached an agreement on the essential 15 terms” of a settlement and signed a term sheet, and they finalized the settlement agreement over 16 the next months.7 17 18 2. Proposed Settlement The parties agreed to the following class definitions for settlement purposes only: 19 20 Settlement Employee Class: All persons who are or were employees of SRG or its affiliates (collectively “SRG”) and whose W-2 information was involved in the Data Incident. Settlement Third-Party Class: All individuals who were Qualifying Spouses or Qualifying Adult Dependents (as defined in the Settlement Agreement) of a Settlement Employee Class Member. 21 22 23 24 25 26 27 28 3 Id. at 17–24. 4 Mot. – ECF No. 46; Statement of Non-Opposition – ECF No. 50. 5 ECF Nos. 15, 28. 6 Mot. – ECF No. 46-1 at 6. 7 Id. ORDER – No. 17-cv-02760-LB 2 1 2 3 4 Unless expressly distinguished, “Settlement Class” or “Settlement Class Members” refers to both of the above-defined classes collectively. Excluded from the Settlement Class are any entity in which SRG has a controlling interest, is a parent or subsidiary, or which is controlled by SRG, as well as the officers, directors, affiliates, legal representatives, heirs, predecessors, successors, and assigns of SRG.8 In summary form, the Settlement Agreement9 is as follows: 5 2.1 Identity Theft Protection Services 6 SRG originally offered two years of credit monitoring to its employees through AllClear ID. 7 The Settlement Agreement provides extended credit monitoring through AllClear ID for all 8 Settlement Class Members, regardless of whether they previously enrolled in the credit 9 monitoring, through March 20, 2022.10 Unless they have timely opted out of the Settlement, Settlement Class Members who have already enrolled will have their coverage extended 11 United States District Court Northern District of California 10 automatically.11 Settlement Class Members who have not enrolled will have until July 13, 2018 12 (the “Election Deadline”) to submit an Election Form to enroll in the credit monitoring.12 13 2.2 Settlement Administration Account and Reimbursement of Economic Costs 14 SRG will fund a non-reversionary Settlement Administration Account of $325,000 for the 15 reimbursement of economic costs incurred by Settlement Class Members that are not reimbursable 16 under the original or additional AllClear Plans.13 Settlement Class Members may submit one or 17 more claims for reimbursement of such economic costs (including mileage reimbursement at the 18 current IRS rate) up to an aggregate total of $500 per Settlement Class Member.14 Settlement 19 Class Members may also submit a claim for time spent addressing the Data Incident at a rate of 20 $15 per hour for up to 10 hours, for a total of $150.15 The total reimbursable amount thus is $650. 21 22 23 8 Settlement Agreement – ECF No. 46-2 at 56 (¶¶ 1.28, 1.32, 1.33), 102. 9 Capitalized terms in this order have the definition given to them in the Settlement Agreement. 10 24 Settlement Agreement – ECF No. 46-2 at 58 (¶¶ 5.1.2–5.1.3). At the preliminary-approval hearing, the parties represented that the value of the credit monitoring exceeded $1.4 million. 25 11 Id. at 58 (¶¶ 5.1.1). 12 Id. at 54 (¶¶ 1.9). 13 Id. at 64 (¶ 5.2.4). 14 Id. at 60 (¶ 5.2). 26 27 28 15 Id. ORDER – No. 17-cv-02760-LB 3 1 Class Members must make their claims on the Reimbursement Form and Affirmation Form.16 In 2 the event that the value of the Claims exceeds or is less than the Settlement Consideration, the 3 Settlement Class Members will receive increased or decreased pro-rata distributions.17 4 2.3 Nonmonetary Relief 5 SRG agrees to implement and maintain the following data-security practices: a. The creation and implementation of an information security program containing policies, procedures, and technical controls regarding the handling of employee PII; b. Training and education by a qualified third party of SRG employees who handle PII; and c. Testing of SRG employees who handle PII and retraining as necessary.18 6 7 8 9 2.4 Attorney’s Fees and Costs 11 United States District Court Northern District of California 10 The plaintiffs’ counsel will petition the court for an award of reasonable attorney’s fees and 12 costs not to exceed $237,000; the fees will not reduce the Settlement Consideration available for 13 Settlement Class Members.19 SRG will not oppose the motion.20 14 2.5 Service Awards 15 The plaintiffs will petition for, and SRG will not oppose, service awards of $1,500 each (not to 16 exceed a total of $15,000); the awards will not reduce the Settlement Consideration available for 17 Settlement Class Members.21 18 2.6 Release 19 In return for the settlement relief, the Settlement Agreement has release provisions. SRG and 20 its affiliated entities (the “Released Parties”) will receive a release of claims arising out of or 21 related to: (1) the disclosure of the Settlement Class Members’ personal information; (2) SRG’s 22 maintenance of the Settlement Class Members’ personal information; (3) SRG’s policies, practices 23 24 25 26 27 28 16 Id. at 60 (¶ 5.2) and 112, 114 (Exs. C–D). 17 Id. at 61 (¶ 5.2.4). 18 Id. at 62 (¶¶ 5.3–5.3.3). At the preliminary-approval hearing, the parties represented that the value of the nonmonetary relief was substantial. 19 Id. at 72 (¶ 10.1). 20 Id. (¶ 10.2). 21 Id. (¶¶ 10.1–10.2). ORDER – No. 17-cv-02760-LB 4 1 or procedures relating to the maintenance, handling, and security of Employee personal 2 information, including the training relating to the same and responses to breach incidents; (4) 3 SRG’s provision of notice to Settlement Class Members following the Data Incident; (5) the Data 4 Incident, including SRG’s response thereto; and (6) any event, matter, dispute or thing that in 5 whole or in part, directly or indirectly, relates to or arises out of (1) through (5) above (the 6 “Released Claims”), provided that nothing in the Release is intended to, does or shall be deemed 7 to release any claims not arising out of, based upon, resulting from, or related to the Data 8 Incident.22 2.7 Administration 9 SRG will provide the Settlement Administrator (Rust Consulting23) with the address 10 United States District Court Northern District of California 11 information (including emails and addresses (to the extent reasonably available) for Settlement 12 Class Members. The administrator will verify or update the mailing addresses received through the 13 National Change of Address database or similar database and thereafter send each Class Member 14 by email and U.S. mail a copy of the Summary Notice and the Election, Reimbursement and 15 Affirmation Forms. The Summary Notice contains a description of the material terms of the 16 settlement including the class definitions, a description of the Settlement Consideration, claims 17 procedures, deadlines, procedures for exclusion, procedures for objections, and information about 18 the settlement website (where Settlement Class Members can access the Settlement Agreement, 19 the Long Form Notice (with answers to frequently asked questions), and other related documents 20 and information). 21 The Settlement Agreement describes these procedures in detail.24 The forms of Notice are 22 attached to the Settlement Agreement.25 The costs of administration are a flat fee of $35,000. 23 24 25 26 27 28 22 Id. at 70–72 (¶¶ 9.1–9.6). 23 See ECF No. 58. 24 Settlement Agreement – ECF No. 46-2 at 64–70 (¶¶ 7.1–8.10.2). 25 Id. at 91–110, Ex. A–B. ORDER – No. 17-cv-02760-LB 5 ANALYSIS 1 2 1. Jurisdiction The court has jurisdiction under the Class Action Fairness Act (“CAFA”), 28 U.S.C. § 3 4 1332(d)(2). 5 6 2. Conditional Certification of Settlement Classes The court reviews the propriety of class certification under Federal Rule of Civil Procedure 7 8 23(a) and (b). When parties enter into a settlement before the court certifies a class, the court 9 “must pay ‘undiluted, even heightened, attention’ to class certification requirements” because the court will not have the opportunity to adjust the class based on information revealed at trial. Staton 11 United States District Court Northern District of California 10 v. Boeing, 327 F.3d 938, 952–53 (9th Cir. 2003) (quoting Amchem Prods., Inc. v. Windsor, 521 12 U.S. 591, 620 (1997)); Hanlon v. Chrysler Corp., 150 F.3d 1011, 1019 (9th Cir. 1998). Class certification requires the following: (1) the class must be so numerous that joinder of all 13 14 members individually is “impracticable”; (2) there are questions of law or fact common to the 15 class; (3) the claims or defenses of the class representatives must be typical of the claims or 16 defenses of the class; and (4) the person representing the class must be able to fairly and 17 adequately protect the interests of all class members. Fed. R. Civ. P. 23(a); Staton, 327 F.3d at 953. 18 The court finds preliminarily (for settlement purposes only) that the proposed Settlement 19 Classes meet the Rule 23(a) requirements of numerosity, commonality, typicality, and adequacy. 20 First, there are approximately 2,700 in the Settlement Employee Class.26 The class is so 21 numerous that joinder of all members is impracticable. Second, there are questions of law and fact common to the class. The class members allege 22 23 identical claims under a breach-of-contract theory, and they allege identical UCL and negligence 24 claims. The lawsuit involves a single data breach, which raises the following common issues for 25 the Settlement Class Members: (a) whether SRG disclosed their PII; (b) whether it failed to protect 26 their PII with industry-standard protocols and technologies; (c) whether SRG had notice that it 27 28 26 Mot. – ECF No. 46-1 at 12. ORDER – No. 17-cv-02760-LB 6 1 was a target for hacking or phishing; and (d) whether SRG promised the Settlement Class 2 Members that it would protect their PII that they provided as a condition of their employment.27 Third, the claims of the representative parties are typical of the claims of the class. All 3 4 Settlement Employee Class Members allege that they provided PII to SRG as a condition of 5 employment, and they may have provided PII for their spouses or other dependents. All 6 representatives possess the same interest and suffer from the same injury. Betorina v. Randstad 7 U.S., L.P., No. 15-cv-0346-EMC, 2017 WL 1278758, *4 (N.D. Cal. April 6, 2017). Fourth, the representative parties will fairly and adequately protect the interests of the class. 8 9 They share the same interests as Settlement Class Members, there are no conflicts of interest, and 10 the named plaintiffs and counsel will vigorously prosecute the case. See Hanlon, 150 F.3d at 1020. The court also finds preliminarily (and for settlement purposes only) that questions of law or United States District Court Northern District of California 11 12 fact common to class members predominate over any questions affecting only individual 13 members, and a class action is superior to other available methods for fairly and efficiently 14 adjudicating the controversy. See Fed. R. Civ. P. 23(b)(3); Brown v. Hain Celestial Group, Inc., 15 No. 11-cv-03082-LB, 2014 WL 6483216, at *15–20 (N.D. Cal. Nov. 18, 2014). The court 16 identified the common factual and legal questions, above. There are no individual issues that 17 predominate over these common questions. All claims arise from one data breach, and liability can 18 be determined on a class-wide basis. See Betorina, 2017 WL 1278758, at *5. Given the class size, 19 and the prospect of individual, expensive trials, the class action is a superior method of 20 adjudication. The court finds too that certification of a nationwide class under California law is appropriate 21 22 under the facts of this case. See Ellsworth v. U.S. Bank, N.A., No. 3:12-cv-02506-LB, 2015 WL 23 12952698, *3 (N.D. Cal. Sept. 24, 2015). The court thus conditionally certifies the Settlement Classes for settlement purposes only and 24 25 for the purposes of giving the Classes notice of the settlement and conducting a final approval 26 hearing. 27 28 27 Id. at 12–13. ORDER – No. 17-cv-02760-LB 7 1 2 3. Preliminary Approval of Settlement The approval of a class-action settlement has two stages: (1) the preliminary approval, which 3 authorizes notice to the class; and (2) a final fairness hearing, where the court determines whether 4 the parties should be allowed to settle the class action on the agreed-upon terms. 5 Settlement is a strongly favored method for resolving disputes, particularly “where complex 6 class action litigation is concerned.” Class Plaintiffs v. City of Seattle, 955 F.2d 1268, 1276 (9th 7 Cir. 1992); see, e.g., In re Pac. Enters. Sec. Litig., 47 F.3d 373, 378 (9th Cir. 1995). A court may 8 approve a proposed class-action settlement only “after a hearing and on finding that it is fair, 9 reasonable, and adequate.” Fed. R. Civ. P. 23(e)(2). The court need not ask whether the proposed settlement is ideal or the best possible; it determines only whether the settlement is fair, free of 11 United States District Court Northern District of California 10 collusion, and consistent with the named plaintiffs’ fiduciary obligations to the class. See Hanlon, 12 150 F.3d at 1026–27 (9th Cir. 1998). In Hanlon, the Ninth Circuit identified factors relevant to 13 assessing a settlement proposal: (1) the strength of the plaintiff’s case; (2) the risk, expense, 14 complexity, and likely duration of further litigation; (3) the risk of maintaining class-action status 15 throughout trial; (4) the amount offered in settlement; (5) the extent of discovery completed and 16 the stage of the proceeding; (6) the experience and views of counsel; (7) the presence of a 17 government participant; and (8) the reaction of class members to the proposed settlement. Id. at 18 1026 (citation omitted). 19 “Where a settlement is the product of arms-length negotiations conducted by capable and 20 experienced counsel, the court begins its analysis with a presumption that the settlement is fair and 21 reasonable.” Garner v. State Farm Mut. Auto Ins. Co., 2010 WL 1687832, *13 (N.D. Cal. Apr. 22, 22 2010); see, e.g., Rodriguez v. West Publ’g Corp., 563 F.3d 948, 965 (9th Cir. 2009) (“We put a 23 good deal of stock in the product of an arms-length, non-collusive, negotiated resolution . . . .”); 24 Nat’l Rural Telecomm. Coop. v. DirecTV, Inc., 221 F.R.D. 523, 528 (C.D. Cal. 2004). 25 26 The court has evaluated the proposed settlement agreement for overall fairness under the Hanlon factors and concludes that preliminary approval is appropriate. 27 28 ORDER – No. 17-cv-02760-LB 8 First, the settlement is the product of serious, non-collusive, arm’s-length negotiations and was 1 2 reached after mediation with an experienced mediator and after extensive settlement discussions 3 involving sophisticated counsel for all parties. Second, the parties engaged in discovery regarding liability and damages. 5 Third, the settlement has no obvious deficiencies. There is no reversion. The settlement 6 provides real benefits to the class, including cash benefits and changed business practices that 7 benefit employees. Looking at the plaintiffs’ possible recoveries through litigation, it is unlikely 8 that they would receive a more favorable result. (The harm identified by the plaintiffs includes 9 harm resulting from monitoring accounts, dealing with fraudulent tax returns, delayed refunds (for 10 some), and decreased credit scores for two named plaintiffs due to unauthorized credit checks run 11 United States District Court Northern District of California 4 on their names.28) A related point about damages is that there are risks that attend data breach 12 litigation, including issues about standing (as SFG argued in its motion to dismiss).29 In sum, the court finds that viewed as a whole, the proposed settlement is sufficiently “fair, 13 14 adequate, and reasonable” such that preliminary approval of the settlement is warranted. See 15 Officers for Justice v. Civil Serv. Comm’n of the City and Cnty. of San Francisco, 688 F.2d 615, 16 625 (9th Cir. 1982). The court thus approves the settlement agreement preliminarily and authorizes 17 notice to the class. 18 The court will address the issue of attorney’s fees at the final fairness hearing. See Hanlon, 150 19 F.3d at 1029 (twenty-five percent is a benchmark in common fund cases); cf. Vizcaino v. Microsoft 20 Corp., 290 F.3d 1043, 1048 (9th Cir. 2002) (twenty-five percent benchmark, though a starting 21 point for analysis, may be inappropriate in some cases; fees must be supported by findings). 22 23 4. Appointment of Class Representative, Class Counsel, and Claims Administrator 24 The court appoints the plaintiffs Irene Sung, Kimberly Carboni, Annie Fulton, Cary Berger, 25 Emmalyne Owens, Ruth Phelps, Christine Willetts, Linda Graves, and Christine Nizibian as Class 26 27 28 28 Mot. – ECF No. 46-1 at 8. 29 Mot. – ECF No. 15. ORDER – No. 17-cv-02760-LB 9 1 Representatives for the Settlement Employee Class. The court appoints the plaintiff Melissa 2 Berger as Class Representative for the Settlement Third-Party Class. The court finds provisionally 3 that they have claims that are typical of members of the Settlement Classes generally and that they 4 are adequate representatives of the other members of the proposed Settlement Classes. 5 The court appoints Rosemary M. Rivas of Levi & Korsinsky, LLP and Gayle M. Blatt of 6 Casey Gerry Schenk Francavilla Blatt & Penfield LLP as Settlement Class Counsel and finds that 7 they have the appropriate qualifications, experience, and expertise in prosecuting class actions. 8 The court designates and approves Rust Consulting as the claims administrator. It will 9 10 United States District Court Northern District of California 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 administer the settlement subject to the oversight of the parties and this court, as described in the Settlement Agreement. 5. Class Notice The court approves the class notice and plan, including the Short Form and Long Form Notices and the Affirmation Form, Reimbursement Form, and Election Form.30 The court finds that the class notice provides the best notice practicable, satisfies the notice requirements of Rule 23, adequately advises Settlement Class Members of their rights under the settlement agreement, and meets the requirements of due process. The forms of notice fairly, plainly, accurately, and reasonably provides class members with all required information, including (among other things): (1) a summary of the lawsuit and claims asserted; (2) a clear definition of the classes; (3) a description of the material terms of the settlement; (4) a disclosure of the release of the claims should they remain class members; (5) an explanation of class members’ opt-out rights, a date by which they must opt out, and information about how to do so; (6) the date, time, and location of the final fairness hearing; and (7) the identity of class counsel and the provisions for attorney’s fees, costs, and class-representative service awards.31 See Fed. R. Civ. P. 23(c)(2)(B). The parties — by agreement — may revise the Notice forms in ways that are not material, such as for accuracy or formatting. 30 Settlement Agreement – ECF No. 46-2 at 91–117, Exs. A–E. 31 Notice – ECF No. 145-1 at 33–42. ORDER – No. 17-cv-02760-LB 10 1 7.2 Final Approval Hearing The Final Approval Hearing will be on May 31, 2018, at 9:30 a.m. at the United States 2 Courthouse for the Northern District of California, 450 Golden Gate Avenue, 15th Floor, 4 Courtroom C, San Francisco, CA 94102. At the hearing, the court will consider whether to: (1) 5 grant final certification of the Settlement Classes; (2) finally approve the Settlement Agreement 6 and the releases in it; (3) approve the service awards; and (4) award attorney’s fees and costs to 7 Class Counsel. The court may, for good cause, extend any of the deadlines in this order or 8 continue the final approval hearing without further notice to the Settlement Class members, except 9 that notice of any such extensions must be included on the Settlement Website. Settlement Class 10 Members should check the Settlement Website regularly for updates and further details regarding 11 United States District Court Northern District of California 3 extensions of these deadlines. Exclusions and Objections must meet the deadlines and follow the 12 requirements set forth in the approved Class Notice in order to be valid. 13 7.3 Requests for Exclusion From the Settlement 14 Class members may exclude themselves from the settlement by sending a written notice of that 15 intent to the designated post office box designated in the Notice. All requests for exclusion must 16 be postmarked by May 14, 2018. 17 7.4 Objections to the Settlement 18 Settlement Class Members may object to the settlement (so long as they do not timely opt out 19 of the Settlement Class) by sending written objections postmarked no later than May 14, 2018 to 20 the Clerk of Court, with the following information: (1) the case name and number (Sung v. 21 Schurman Fine Papers, No. 3:17-cv-02760-LB); (2) the Class Member’s name, current postal 22 address, current phone number and any email address; (3) a written statement of the grounds for 23 the objection, accompanied by any legal support for the objection and any evidence that the 24 objecting Settlement Class Member wants to introduce as evidence; (4) the identity of any counsel 25 representing the objector, including any former or current counsel who may claim entitlement to 26 compensation for any reason related to the objection to the Settlement or the Fee Application; (5) a 27 statement confirming whether the objector will appear and/or testify at the Final Approval Hearing 28 and the identification of any counsel representing the objector who intends to appear at the Final ORDER – No. 17-cv-02760-LB 12 1 Approval Hearing; (6) a list of any persons who will be called to testify at the Final Approval 2 Hearing; and (7) the objector’s signature signed under oath and penalty of perjury or, if legally 3 incapacitated, the signature of a duly authorized representative (along with documentation setting 4 forth the incapacitation and representation).33 Settlement Class Members who want to speak for or 5 against the proposed Settlement may speak at the Final Approval Hearing, if they have provide the 6 written notice of their intent to appear (together with the other information set forth earlier in this 7 paragraph) postmarked or filed by May 14, 2018 (45 days after the Notice of Class Action 8 Settlement is completed). The court can excuse a failure to comply with this requirement for good 9 cause. At the Final Approval Hearing, Settlement Class Counsel and counsel for SRG must be prepared to respond to objections filed by Settlement Class Members and to provide other 11 United States District Court Northern District of California 10 information, as necessary, bearing on whether the Settlement should be approved 12 7.5 Other Orders 13 Settlement Class Counsel and Defendant are authorized to take, without further court approval, 14 all necessary and appropriate steps to implement the Settlement Agreement including the approved 15 notice plan. CONCLUSION 16 17 The court approves the settlement preliminarily. This disposes of ECF No. 46. 18 IT IS SO ORDERED. 19 Dated: March 11, 2018 ______________________________________ LAUREL BEELER United States Magistrate Judge 20 21 22 23 24 25 26 27 28 33 Settlement Agreement – ECF No. 46-2 at 69–70 (¶ 8.10.1). ORDER – No. 17-cv-02760-LB 13