Opinion
No. 14 C 3809
05-03-2017
ANNE DOLMAGE, individually and on behalf of all others similarly situated, Plaintiff, v. COMBINED INSURANCE COMPANY OF AMERICA, Defendant.
MEMORANDUM OPINION & ORDER
Anne Dolmage ("Plaintiff") filed this action against Combined Insurance Company of America ("Defendant") alleging breach of contract for failing to keep her personally identifiable information ("PII") private. Presently before the Court is Plaintiff's motion for class certification pursuant to Federal Rule of Civil Procedure 23. (R. 111, Mot.) For the reasons stated below, the motion is denied.
FACTS
In April 2011, Plaintiff applied for a life insurance policy underwritten by Defendant. (R. 119-1, Policy Docs. at 1-42.) At the time, Plaintiff was an Iowa resident and an employee of the department store Dillard's. (Id. at 24-25.) Defendant offered a variety of insurance products to Dillard's employees, including group and individual supplemental insurance policies underwritten by Defendant, group products underwritten by ACE American Insurance Company ("ACE"), and various medical, vision, and dental products underwritten by third parties. (R. 111, Mot. at 2.)
Plaintiff applied for her insurance policy by phone. (R. 119-1, Policy Docs. at 24-25.) After the phone application process was completed, Defendant mailed a package of fulfillment materials to Plaintiff. (Id. at 1, 24-25.) These documents included the insurance policy, explanations of benefits, sales materials, and a document labeled, "Our Privacy Pledge to You" (herein "Privacy Pledge"). (Id. at 5-40.) The Privacy Pledge details some of the safeguards Defendant has in place to secure private information, including restricting access to a limited number of people and ensuring that any third party given access to the information abides by the same strict privacy standards. (Id. at 38.) The Privacy Pledge is not specifically mentioned in the Insurance Policy Table of Contents; however, the fulfillment documents mailed to Plaintiff stated that "[a] copy of the application and any rider and endorsement follow page 17." (Id. at 5.) The Privacy Pledge is one of the documents following page 17. (See id. at 18-38.) The Privacy Pledge is generally sent out with fulfillment materials issued by Combined Insurance, (R. 119-2, Barg Dep. Tr. at 43; R. 111-7, Whalen Dep. Tr. at 8), and it was included in the materials sent to all Dillard's employees who purchased a Combined Insurance policy. (R. 111-20, Def.'s Resp. to Interrogs. ¶ 20.)
Defendant hired Robert Diorio, the principal operator of Enrolltek, to provide support services in connection with the insurance policies offered to Dillard's employees. (R. 111-1, Answer ¶¶ 12-13; R. 111-2, Barth Dep. Tr. at 42.) As part of this process, Defendant provided Diorio with the PII of Dillard's employees and their dependents. (R. 111-2, Barth Dep. Tr. at 42.) Diorio had some limited training on how to handle and secure private data, but the training was not provided by Defendant, nor did it include any formal certification. (R. 111-3, Diorio Dep. Tr. at 34-36.) Defendant was aware that Diorio would save the PII of newly enrolled members so that he could process the information. (Id. at 173-74.) Around February or March 2012, Diorio accessed the PII of certain insureds and their dependents, including Plaintiff. (R. 111-1, Answer ¶ 17.) Diorio then posted the information on the Enrolltek website. (Id.) Diorio also sent an email to employees of Defendant with hyperlinks for all the files contained on the website. (R. 111-5, Email.)
Unfortunately, Enrolltek's website was not adequately secured, meaning that the PII of Plaintiff and thousands of other Dillard's employees was readily available online from March 2012 to July 2013. (R. 111-10, Whalen Dep. Tr. at 11-12.) On July 8, 2013, a Dillard's employee happened to notice that his social security number and other personal information could be obtained through a basic internet search. (Id. at 63; R. 111-18, Email.) After learning of the issue, Defendant took steps to remove the information from the Enrolltek website and from several common internet search engines. (R. 111-10, Whalen Dep. Tr. at 8-14.) In a July 2013 letter, Defendant offered credit-monitoring services to Plaintiff and other insureds, (R. 111-1, Answer ¶ 23; R. 111-12, Letter.) Individuals were also offered free credit reports and identity theft insurance. (R. 111-12, Letter at 1-2.)
In 2013, Plaintiff and approximately 30 other Dillard employees had their tax refunds delayed, diverted, or stolen by identity thieves. (R. 119-11, Worley Dep. Tr. at 22.) After an internal investigation, Defendant sent out another letter to insureds in 2014 alerting them to the tax-fraud scheme and again offering them credit-monitoring services. (R. 111-13, Letter.) As of the time of briefing of the motion for class certification, Dillard's had received approximately 185 reports of false tax filings or attempted filings from its employees. (R. 119, Resp. at 14.)
PROCEDURAL HISTORY
In May 2014, Plaintiff filed this action on behalf of herself and a class of similarly situated individuals alleging a host of federal and state law claims stemming from the data breach. (R. 1, Compl.) After two rounds of motions to dismiss, various amended pleadings, and two substantive opinions from this Court, what remains of the case is a breach of contract claim premised on Defendant's alleged breach of the Privacy Policy. See Dolmage v. Combined Ins. Co. of Am., No. 14 C 3809, 2016 WL 754731 (N.D. Ill. Feb. 23, 2016); Dolmage v. Combined Ins. Co. of Am., No. 14 C 3809, 2015 WL 292947 (N.D. Ill. Jan. 21, 2015). The crux of Plaintiff's claim is that Defendant breached the Privacy Pledge when it failed to ensure that Enrolltek securely maintained the personal information of potential class members. Dolmage, 2016 WL 754731Id. at *4-6. Plaintiff claims that the Privacy Pledge was incorporated into the terms of the parties' insurance agreement, and that it is thus legally enforceable. Id. Defendant disagrees that the Privacy Pledge is part of the parties' agreement and believes that Plaintiff's claim also fails for lack of damages and other reasons. Id. at *4-10.
After the Court permitted the breach of contract claim to proceed, Defendant answered the complaint and asserted several affirmative defenses. (R. 60, Ans.) After several rounds of motions and amendments to the answer, the Court on May 24, 2016, struck three of Defendant's seven affirmative defenses. (R. 64-73.) On July 8, 2016, Defendant filed a motion seeking to amend its answer in order to assert an entirely new affirmative defense. (R. 76, Mot. to Suppl.) Specifically, Defendant alleged that Plaintiff had provided misinformation on her original insurance policy application, and therefore sought to raise the defense of fraud in the inducement, entitling it to rescind her policy. (Id.) The Court denied the motion as untimely and precluded Defendants' from raising fraud in the inducement as an affirmative defense. (R. 95, Order.) Following the close of discovery, Plaintiff filed her motion for class certification. (R. 111, Mot.) After voluminous briefing, the motion is now fully briefed. (R. 119, Resp.; R. 123, Reply; R. 127, Surreply; R. 132, Resp. to Surreply.)
LEGAL STANDARD
To obtain class certification under Rule 23, a plaintiff must satisfy each requirement of Rule 23(a)—numerosity, commonality, typicality, and adequacy of representation—and at least one subsection of Rule 23(b). See Bell v. PNC Bank, Nat'l Ass'n, 800 F.3d 360, 373 (7th Cir. 2015); Harper v. Sheriff of Cook Cty., 581 F.3d 511, 513 (7th Cir. 2009). Under Rule 23(b), a class may be certified if one of three circumstances is met: (1) prosecuting separate actions by individual class members would "create a risk of inconsistent judgments"; (2) "the party opposing the class has acted or refused to act on grounds that apply generally to the class, so that final injunctive relief or corresponding declaratory relief is appropriate respecting the class as a whole"; or (3) "the court finds that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy." FED. R. CIV. P. 23(b). Satisfaction of the Rule 23(a) and 23(b) requirements categorically entitles a plaintiff to pursue her claim as a class action. See Shady Grove Orthopedic Assocs., P.A. v. Allstate Ins., 559 U.S. 393, 398-99 (2009). District courts have broad discretion in determining whether certification is appropriate. Ervin v. OS Rest. Servs., Inc., 632 F.3d 971, 976 (7th Cir. 2011).
In considering a motion for class certification, the Court "may not simply assume the truth of the matters as asserted by the plaintiff." Messner v. Northshore Univ. HealthSystem, 669 F.3d 802, 811 (7th Cir. 2012). If there are material facts in dispute, "the court must 'receive evidence . . . and resolve the disputes before deciding whether to certify the class.'" Id. (citation omitted). In order to grant class certification under Rule 23, the Court must be "satisfied, after a rigorous analysis" that the Rule's requirements are met. Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350-51 (2011) (citation omitted). In conducting this analysis, "[m]erits questions may be considered to the extent—but only to the extent—that they are relevant to determining whether the Rule 23 prerequisites for class certification are satisfied." Amgen Inc. v. Conn. Ret. Plans & Tr. Funds, 133 S. Ct. 1184, 1195 (2013). "The party seeking certification bears the burden of proving that certification is proper by a preponderance of the evidence." Bell, 800 F.3d at 373.
ANALYSIS
Plaintiff seeks to certify the following class:
All current and former Dillard's, Inc., employees as well as their dependents who were covered at any time between March 2010 through March 2012, under a hospital indemnity or accident insurance policy underwritten by ACE American Insurance Company, and were covered by insurance underwritten by Combined Insurance at any point in time between April 2000 and August 2013.(R. 111, Mot. at 7.) Plaintiff argues that the proposed class satisfies all of the Rule 23(a) requirements as well as the requirements of Rule 23(b)(3). (Id. at 13.)
I. Rule 23(a) requirements
As stated, to obtain class certification under Rule 23, a plaintiff must satisfy each requirement of Rule 23(a)—numerosity, commonality, typicality, and adequacy of representation. See Bell, 800 F.3d at 373. The Court addresses each requirement below.
A. Numerosity
Rule 23(a)(1) permits class certification only when "the class is so numerous that joinder of all members is impracticable." FED. R. CIV. P. 23(a)(1). "Although there is no 'bright line' test for numerosity, a class of forty is generally sufficient[.]" McCabe v. Crawford & Co., 210 F.R.D. 631, 643 (N.D. Ill. 2002). Plaintiff has submitted evidence showing that there are more than 4,000 potential class members nationwide. (R. 111-4, Barth Dep. Tr. at 100.) Defendant does not dispute this number. Because there are more than 4,000 members of the proposed class, Plaintiff has met the numerosity requirement.
B. Commonality
Rule 23(a)(2) next requires plaintiffs to establish the existence of "questions of law or fact common to the class." FED. R. CIV. P. 23(a)(2). Commonality requires that class members "suffered the same injury," not "merely that they have all suffered a violation of the same provision of law." Wal-Mart, 564 U.S. at 350 (citation omitted). Ordinarily, "[w]here the same conduct or practice by the same defendant gives rise to the same kind of claims from all class members, there is a common question." Suchanek v Sturm Foods, Inc., 764 F.3d 750, 756 (7th Cir. 2014). However, "[w]hat matters to class certification . . . is not the raising of common 'questions' . . . but, rather the capacity of a classwide proceeding to generate common answers apt to drive the resolution of the litigation." Chi. Teachers Union, Local No. 1 v. Bd. of Educ. of City of Chi., 797 F.3d 426, 434 (7th Cir. 2015) (quoting Wal-Mart, 563 U.S. at 350). In other words, a common question exists where the "determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke." Mullins v. Direct Digital LLC, 795 F.3d 654, 673 (7th Cir. 2015) (quoting Wal-Mart, 564 U.S. at 350).
Plaintiff identifies various issues that she believes are common to all class members, specifically: whether Defendant's Privacy Pledge was part of the insurance agreements between Defendant and class members; whether Defendant violated the Privacy Pledge when Enrolltek posted class members' PII on the internet; and whether class members suffered harm by having their information available on the internet. (R. 111, Mot. at 14-16.) In a general sense, Plaintiff is correct that it was one single action—or inaction—by the Defendant that allegedly caused the class members' injury: the failure to protect their personal information, leading to its disclosure on an unsecured website. The Court agrees that this general issue is common to all class members, but the specific issues identified by Plaintiff pose much more difficulty.
1. Enforceability of the Privacy Pledge
Plaintiff believes that the enforceability of the Privacy Pledge is an issue common to all class members that can be decided on a class-wide basis. (R. 111, Mot. at 15.) Defendant argues against a finding of commonality because, in Defendant's view, there can be no class-wide determination of whether the Privacy Pledge is part of class members' insurance agreements. (R. 119, Resp. at 11-13.) Defendant points to the expert report of Charles Morgan, an attorney with extensive experience in the field of insurance compliance, to support its claim. (See R. 119-3, Morgan Report at 2-26.) Before considering Morgan's report, and the reports of the two proposed damages experts, the Court must consider the proper role of experts in connection with a motion for class certification.
As a general matter, the admissibility of expert testimony is governed by Federal Rule of Evidence 702 and Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993). Bielskis v. Louisville Ladder, Inc., 663 F.3d 887, 893 (7th Cir. 2011). These same rules govern admissibility of expert reports filed in connection with a motion to certify a class. Am. Honda Motor Co. v. Allen, 600 F.3d 813, 815-16 (7th Cir. 2010). Courts apply a three-step analysis when considering whether to admit expert testimony. See Ervin v. Johnson & Johnson, Inc., 492 F.3d 901, 904 (7th Cir. 2007). First, the witness must be qualified "as an expert by knowledge, skill, experience, training, or education." Daubert, 509 U.S. at 588 (quoting FED. R. EVID. 702). Second, "the expert's reasoning or methodology underlying the testimony must be scientifically reliable." Id. at 592-93. Third, the expert's testimony must be relevant; in other words, it must "assist the trier of fact to understand the evidence or to determine a fact in issue." Id.
Plaintiff and Defendant both argue against this Court's reliance on their adversary's experts. (R. 119, Resp. at 17-18; R. 123, Reply at 5-6; R. 132, Resp. to Surreply 1-8.) "[W]henever an expert's report or testimony is critical to a class certification decision, a district court must rule conclusively on a challenge to the expert's qualifications or opinions before ruling on class certification, without regard to whether the district court ultimately grants or denies that motion." Messner, 669 F.3d at 813 (citing Am. Honda, 600 F.3d at 815-16). The Court thus proceeds to the Daubert inquiry.
As for Morgan, the record shows that he has more than 30 years of experience in the areas of life insurance product design, risk management, and compliance. (R. 119-3, Morgan Report at 27-32.) He has been retained in many instances to serve as an expert witness and has authored several articles related to insurance agreements. (Id. at 28.) Additionally, he is a licensed attorney in Massachusetts, New Jersey, and Texas, and has a masters' degree in business administration from Pepperdine University. (Id. at 32.) Plaintiff does not challenge Morgan's qualifications, and the Court finds that he has the requisite experience and education to submit a report on matters concerning insurance contracts. However, Plaintiff questions whether the opinions he offers are reliable and useful to the trier of fact.
Morgan's opinion, in essence, is that the Privacy Policy cannot be considered part of the parties' insurance agreement given the way it was drafted and the fact that it was not filed with any state regulatory agency as part of the policy-approval process. (Id. at 24-25.) Morgan is no doubt knowledgeable in the field of insurance law, but many of his "opinions" are essentially legal conclusions, which are not the proper subject of expert testimony. United States v. Blount, 502 F.3d 674, 679-80 (7th Cir. 2007). Of course, "[a]n opinion is not objectionable just because it embraces an ultimate issue" to be decided in the case. FED. R. EVID. 704(a). But by the same token, expert testimony that contains legal conclusions is not permitted. Sommerfield v. City of Chi., 254 F.R.D. 317, 330 (N.D. Ill. 2008) ("[E]xpert testimony that contains a legal conclusion that determines the outcome of a case is inadmissible."); Apotex Corp. v. Merck & Co., Inc., No. 04 C 7312, 2006 WL 1155954, at *8 (N.D. Ill. Apr. 25, 2006) (excluding expert testimony that consisted of "plainly inadmissible legal conclusions"). As the U.S. Court of Appeals for the Seventh Circuit has explained, there is a "difference between stating a legal conclusion and providing concrete information against which to measure abstract legal concepts." Blount, 502 F.3d at 680. The former is prohibited; the latter is not. Id.
Morgan states in a variety of ways that, in his opinion, the Privacy Policy is not enforceable because it is not specifically incorporated by reference in the policy or clearly identified as an endorsement. (See R. 119-3, Morgan Report at 17-25.) This is a legal conclusion. Indeed, to support his conclusion he provides a survey of case law from various states. (Id. at 17-23.) "Argument about the meaning of . . . contracts . . . belongs in briefs, not in 'experts' reports,'" RLJCS Enters., Inc. v. Prof'l Benefit Tr. Multiple Emp'r Welfare Benefit Plan & Tr., 487 F.3d 494, 498 (7th Cir. 2007); see also Scottsdale Ins. Co. v. City of Waukegan, 689 F. Supp. 2d 1018, 1023 (N.D. Ill. 2010) (observing that experts "may not testify as to the legal implications of conduct"). Similarly, his opinion that the Privacy Pledge "cannot be, and is not, a part of the Insurance Contract, since it would have had to have been filed with the States in order to comply with State insurance law" is also a legal conclusion. (R. 119-3, Morgan Report at 25.) Indeed, the methodology he employed appears to have been simply to read various state insurance statutes and interpret their language. (Id. at 10-16.) The Court has not considered these inadmissible opinions in reaching its conclusions.
This is not to say that his entire report is inadmissible. The Court will consider Morgan's statements explaining whether the Privacy Pledge was filed with the relevant state authorities as part of the insurance compliance process, as well as his statements providing general background information about insurance compliance and drafting practices. (R. 119-3, Morgan Report at 18-22.) These opinions provide "concrete information against which to measure abstract legal concepts," which is a proper use of expert testimony. Blount, 502 F.3d at 680. With these clarifications, the Court turns back to the commonality inquiry.
As evidenced by Morgan's report, one of the key issues in this case is whether the Privacy Pledge was part of the contract between Defendant and the proposed class members and, if so, what duties it imposed on Defendant. But it is unclear how this issue could be resolved on a class-wide basis, because the proposed class covers individuals living in Iowa, Illinois, Florida, California, Texas, and nearly 25 other states. (R. 119, Resp. at 4 n.6; R. 119-3, Policy Filings at 66-70.) Neither party has pointed to any choice-of-law provision contained in the relevant contracts, and to the contrary, the language in the sample contracts that have been submitted suggests that the law of the state in which the insured resided at the time the contract was entered would govern. (See, e.g., R. 119-6, Policy Forms at 8 ("Any provision of this policy which, on its effective date, is in conflict with the laws of the state in which the Insured resides on that date is amended to conform with the minimum requirements of such laws.").) This outcome comports with choice-of-law principles that apply in this forum, which normally favor the "location of the insured risk." Jupiter Aluminum Corp. v. Home Ins. Co., 225 F.3d 868, 873 (7th Cir. 2000) (holding that under Illinois law, in the absence of an express choice-of-law provision in an insurance policy, various factors control which forum's laws apply, including the "location of the subject matter, the place of delivery of the contract, [and] the domicile of the insured or of the insurer" but "the location of the insured risk is given special emphasis" (citations omitted)). Given that the proposed class members reside in nearly 30 states throughout the country, the Court would have to apply multiple states' laws to determine whether the Privacy Pledge is enforceable.
Indeed, to highlight this fact, the Privacy Pledge has sections detailing specific rights enjoyed by Vermont and California residents based on the privacy laws of those states. (R. 119-1, Policy Documents at 38.)
Generally, when multiple state laws need to be applied to resolve class members' claims, certification is improper. See In re Bridgestone/Firestone, Inc., 288 F.3d 1012, 1018 (7th Cir. 2002). Nor can the Court simply assume that the forum state's law applies as a means of streamlining the resolution of class members' claims. Id. at 1016-18. In Bridgestone/Firestone, for example, the Seventh Circuit reversed a district court's certification of a class where it found that the court erred in concluding that the laws of Michigan and Tennessee would govern every sales transaction occurring nationwide, regardless of where the transaction took place. Id. The Seventh Circuit observed that "[s]tate consumer-protection laws vary considerably, and courts must respect these differences rather than apply one state's law to sales in other states with different rules." Id. at 1018. The court observed that "[n]o class action is proper unless all litigants are governed by the same legal rules. Otherwise the class cannot satisfy the commonality and superiority requirements of FED. R. CIV. P. 23(a), (b)(3)." Id. at 1015. The Seventh Circuit concluded that because class members' claims "must be adjudicated under the law of so many jurisdictions, a single nationwide class is not manageable." Id. at 1018.
Plaintiff seems to concede that many different states' laws would apply to resolve the enforceability issue, as she herself cites a smattering of case law from Texas, Florida, Iowa, and other states to support the legal principles contained in her briefs. (See, e.g., R. 123, Reply at 10-12.) She does not suggest any uniform way that the Court could resolve whether the Privacy Pledge constitutes an enforceable contract under the law of so many different states, and the Court can discern none. See Vill. of Bedford Park v. Expedia, Inc. (WA), 309 F.R.D. 442, 452 (N.D. Ill. 2015) ("[P]laintiffs have failed to demonstrate that the 154 different ordinances can be arranged into a modest number of subclasses with materially identical legal standards. Absent this showing, certifying this case as a class action would present significant manageability problems."). She suggests that Illinois contract law principles are "the standard ones of common law," but she does not provide a survey of the other states' laws for this Court to make a meaningful comparison. (R. 111, Mot. at 18 (citation omitted).) To the extent she is asking the Court to simply apply the law of Illinois because it is the forum state, or because its laws are representative of the majority of other states, the Seventh Circuit has expressly disavowed this tactic. See Bridgestone/Firestone, 288 F.3d at 1017-20; see also In re Rhone-Poulenc Rorer, Inc., 51 F.3d 1293, 1297 (7th Cir. 1995) (concluding that district court abused its discretion in certifying a nationwide class because it was improper for the court to try to overcome variations in states' laws by applying a "general common law"); In re Yasmin & Yaz (Drospirenone) Mktg., 275 F.R.D. 270, 276 (S.D. Ill. 2011) ("[I]n the class action context differences in state law cannot be swept away by electing to apply the law of a single state to all class members' claims.").
Indeed, in a footnote, Plaintiff cites to insurance statutes from 49 different states. (See R. 111, Mot. at 14 n.2.) She also argues that two states enforce insurance policy documents even if they are not filed with the state insurance regulator. (See R. 132, Surreply at 4.) Her failure to discuss the law of any other state suggests to this Court that they follow a different rule, which would further complicate the resolution of this issue.
Given the multiple state laws that would be applied in this case, the Court easily concludes that certification of a nationwide class would be improper. The need to determine the enforceability of the Privacy Pledge under a plethora of state laws weighs strongly against a finding of commonality.
2. Damages
Defendant also argues that the commonality requirement is not met because damages cannot be determined on a class-wide basis. (R. 119, Resp. at 6-11.) In support, Defendant relies on the report of Dr. Stephen Prowse, an expert in economics and statistical analysis. (See R. 119-9, Prowse Report at 60-80.) Plaintiff, in turn, seems to agree that individual damages determinations will be necessary, but in her view this is not fatal to her motion. She asserts that "[w]hen the jury finds in favor of the Class on its breach of contract claims, the Court can set up a process to determine the amount of damages incurred by each individual Class member." (R. 111, Mot. at 21.) She offers the report of Anthony D'Angelo, an expert on financial crimes and identity theft, to address the damages issue. (See R. 111-16, D'Angelo Report at 1-25.)
As a preliminary matter, the Court must consider whether the experts' reports satisfy Rule 702 and Daubert. See Ervin, 492 F.3d at 904. D'Angelo, Plaintiff's expert on damages, has a law degree from the University of Louisville and a masters' degree in security studies from the Naval Postgraduate School for Homeland Security and Defense. (R. 111-16, D'Angelo Report at 25.) He has more than 25 year experience working on financial crimes investigations, including working with the Federal Bureau of Investigation and the United States Department of Justice ("DOJ"). (Id. at 22-25.) The Court finds that he is qualified as an expert on the damages routinely incurred as a result of identity theft. His report is also reliably based on his own experiences and his review of various studies and literature detailing the damages that often result from identity theft. The Court has duly considered D'Angelo's report in reaching its decision.
Prowse, in turn, is experienced in assessing damages for securities, fraud, intellectual property, and breach of contract class action suits, and is well-versed in statistical analysis. (R. 119-9, Prowse Report at 60-90.) He holds a Ph.D. in economics from the University of California-Los Angeles and is a member of the American Economic Association, the American Finance Association, and similar professional organizations. (Id. at 60.) He has published many articles in the fields of finance and economics and has been retained in at least 16 other suits. (Id. at 81-90.) While he is not an expert in identity theft, per se, the Court finds that Prowse is qualified to offer an opinion about the viable methods of calculating damages in this case.
As Plaintiff points out, however, at times in his report Prowse offers impermissible legal opinions. For instance, Prowse comments about damages being an "essential element of a claim for breach of contract." (Id. at 66.) He also comments that "[i]n order for Plaintiff to establish the fact of damages on a classwide basis, it would require Plaintiff to establish that proof of the fact of damages for one proposed class member necessarily means that proof of the fact of damages is established for all other proposed class members." (Id.) These are essentially legal opinions that are outside the scope of Prowse's expertise and are not helpful to the trier of fact. The elements of a breach of contract claim and the requirements for class certification are matters of black letter law. See Clintec Nutrition Co. v. Baxa Corp., No. 94 C 7050, 1998 WL 560284, at *9 (N.D. Ill. Aug. 26, 1998) ("Legal conclusions are not admissible [as expert opinions] because they are not helpful to the trier of fact. . . . Witnesses are not supposed to compete with the court in instructing the jury."). Accordingly, the Court has disregarded these inadmissible comments.
Nevertheless, just as with the Morgan Report, the bulk of Prowse's report is admissible. The Court specifically credits Prowse's opinion that no viable methodology exists to generalize from Plaintiff's experiences to calculate damages on a class-wide basis. (Id. at 65-66, 77-78.) The Court also credits Prowse's opinions pertaining to his review of D'Angelo's report, which stresses the individual nature of the damages inquiry in cases of identity theft. (Id. at 66-77.)
Based on the reports of D'Angelo and Prowse, there can be little dispute that victims of data breaches and identity theft often suffer damages. For example, D'Angelo explained that individuals who had their PII available on the internet, including social security numbers, will likely have to be more vigilant forever regarding their credit information. (R. 111-16, D'Angelo Report at 16.) D'Angelo noted commonly incurred costs associated with identity theft, including paying for credit monitoring, paying for a bounced check, or placing a credit freeze on an account. (Id.) His report also details the time spent and emotional costs of dealing with identity theft. (Id. at 10; see also R. 119-9, DOJ Study, "Victims of Identity Theft, 2014.")
Nevertheless, the question before this Court is not whether class members actually suffered damages, but rather, whether their damages can be calculated on a class-wide basis. Notably, D'Angelo—Plaintiff's own expert—makes clear that identity theft is by its very nature a highly personalized crime, and that every victim experiences different damages. (R. 111-16, D'Angelo Report at 9-17.) During his deposition he acknowledged that the proper means of assessing damages in a case of identity theft is to consider the experience of each victim "with respect to their own credit and purchase history." (R. 119-9, D'Angelo Dep. Tr. at 174-75.) It is clear from D'Angelo's testimony that of the 4,000 plus proposed class members, some (like Plaintiff) may have become the victim of an actual theft of funds. (Id. at 157.) A subset of these individuals may have been able to resolve the problems quickly or obtain reimbursement from banks and other third parties. (Id. at 141, 168.) Others may have spent months trying to resolve the identity fraud with little or no success, to the point that they "encounter[ed] employment and relationship issues." (Id. at 168.) Other class member may have not had their information stolen by an identity thief but nevertheless incurred minor expenses monitoring their credit or taking other steps to protect themselves. (Id. at 139.) Another subset of class members may have had no out-of-pocket expenses at all, but suffered emotional distress worrying that they could become a victim of identity theft. (Id. at 169-70.) Still others may have suffered no distress or inconvenience whatsoever. (Id. at 180-82.) In short, Plaintiff's own damages expert makes clear that the types and amounts of damages suffered by class members will vary dramatically.
To the extent any of the experts have opined on whether class members will ultimately prevail in this case, the Court has disregarded such opinions as they are not appropriately considered at this stage. See Amgen, 133 S. Ct. at 1195.
Plaintiff seems to concede as much, but points to cases holding that "the need for individual proof [of damages] alone does not necessarily preclude class certification." Pella Corp. v. Saltzman, 606 F.3d 391, 394 (7th Cir. 2010). It may be true as a general matter that the need to make individual damages determinations does not always preclude class certification, but it presents a significant problem here, because damages are ordinarily an element of a breach of contract claim. Using Illinois law as an example—and putting to one side that the Court would need to look to look to the law of as many as 30 different states—to prevail on a breach of contract claim, "a plaintiff must show the existence of a valid and enforceable contract, performance of the contract by the plaintiff, breach of the contract by the defendant, and resulting injury to the plaintiff." Carlton at the Lake, Inc. v. Barber, 928 N.E.2d 1266, 1270 (Ill. App. Ct. 2010) (emphasis added). As outlined above, determining whether each class member suffered a "resulting injury" will require a highly individualized inquiry. This is not a case, then, where the Court can simply determine liability on a class-wide basis and leave the matter of damages for a later stage. Compare Butler v. Sears, Roebuck & Co., 727 F.3d 796, 800 (7th Cir. 2013) ("[A] class action limited to determining liability on a class-wide basis, with separate hearings to determine—if liability is established—the damages of individual class members, or homogeneous groups of class members, is permitted by Rule 23(c)(4) and will often be the sensible way to proceed."), with Block v. Abbott Labs., No. 99 C 7457, 2002 WL 485364, at *4 (N.D. Ill. Mar. 29, 2002) (finding commonality not satisfied in light of individualized inquiries required to determine causation, which was an essential element of class members' failure-to-warn claims).
For these reasons, the Court finds that the commonality requirement is not satisfied. This alone warrants denial of Plaintiff's motion, Bell, 800 F.3d at 373, but for the sake of completeness the Court considers the other requirements.
C. Typicality
Rule 23(a)(3) requires that "the claims or defenses of the representative parties are typical of the claims or defenses of the class." FED. R. CIV. P. 23(a)(3). Typicality is "closely related to the preceding question of commonality." Rosario v. Livaditis, 963 F.2d 1013, 1018 (7th Cir. 1992). A typical claim is one that "arises from the same event or practice or course of conduct that gives rise to the claims of other class members" and is "based on the same legal theory." Oshana v. Coca-Cola Co., 472 F.3d 506, 514 (7th Cir. 2006) (citation omitted). "Typical does not mean identical, and the typicality requirement is liberally construed." Gaspar v. Linvatec Corp., 167 F.R.D. 51, 57 (N.D. Ill. 1996). However, typicality requires "enough congruence between the named representative's claim and that of the unnamed members of the class to justify allowing the named party to litigate on behalf of the group." Spano v. Boeing Co., 633 F.3d 574, 586 (7th Cir. 2011). While "some factual variations may not defeat typicality, the requirement is meant to ensure that the named representative's claims have the same essential characteristics as the claims of the class at large." Oshana, 472 F.3d at 514 (citation and internal quotation marks omitted).
Plaintiff argues that she is typical of the class because she, like potential class members, is a Dillard's employee whose PII was made available on the internet due to Defendant's actions. (R. 111, Mot. at 11-12.). This is true as a general matter, but as explained above, different states' laws will govern her claim and those of class members living in states other than Iowa. Under these circumstances, it is difficult to conclude that Plaintiff's claim is "typical" of other class members. In re Fluidmaster, Inc., Water Connector Components Prod. Liab. Litig., No. 14-CV-5696, 2017 WL 1196990, at *48 (N.D. Ill. Mar. 31, 2017) (finding that plaintiff failed to establish "that any class representative's claim could be typical for a nationwide class that applies every state's consumer protection law"); Block, 2002 WL 485364, at *5 (finding typicality not satisfied for nationwide class involving multiple states' laws).
Additionally, as Defendant points out, Plaintiff is claiming actual damages as a result of the data breach, whereas the vast majority of class members never reported becoming a victim of identity theft. (See R. 119, Resp. at 25.) Issues pertaining to the theft of Plaintiff's data by third parties, particularly whether it was caused by the data breach and what damages she suffered as a result, are thus not "typical" of the claims of most class members. Suchanek, 764 F.3d at 758 ("A person whose claim is idiosyncratic or possibly unique is an unsuitable class representative."). Potential class members may have suffered some other type of injury, such as emotional strain or worry over the safety of their personal data, but proving such an injury would require different proof than that needed to prove out-of-pocket losses. See Block, 2002 WL 4853645, at *3 (plaintiff's claim is not "typical" if proof of her claim "would not necessarily prove all of the proposed class members' claims"). Again, the damages issue is a central one in this case given that breach of contract claims ordinarily require proof of injury as an essential element. See, e.g., Carlton at the Lake, 928 N.E.2d at 1270. For these reasons, the Court finds that Plaintiff's claim is not typical of the class.
This proportion is consistent with a DOJ study discussed by both Prowse and D'Angelo, which found that in 2014, only 14 percent of identity theft victims suffered actual out-of-pocket losses of $1 or more. (See R. 119-9, Prowse Report at 73 & n.28.)
It is worth noting that some states do not permit recovery of emotional distress damages for breach of contract. See, e.g., Parks v. Wells Fargo Home Mortgage, Inc., 398 F.3d 937, 941 (7th Cir. 2005) (observing that under Illinois law, "absent fraud or malice, contractual damages are measured ordinarily by the value of the promise; they do not, like tort damages, attempt to restore the party to the status quo ante."); Clark-Peterson Co. v. Indep. Ins. Assocs., Ltd., 514 N.W.2d 912, 916 (Iowa 1994) ("Plaintiffs also seek to recover for ordinary emotional distress, damages that are ordinarily unavailable in a breach-of-contract suit."). Class members living in states that adhere to that rule who suffered only emotional damages presumably would be unable to prevail on a breach of contract claim.
D. Adequacy of representation
The final requirement of Rule 23(a) is that "the representative parties will fairly and adequately protect the interests of the class." FED. R. CIV. P. 23(a)(4). "This adequate representation inquiry consists of two parts: (1) the adequacy of the named plaintiffs as representatives of the proposed class's myriad members, with their differing and separate interests, and (2) the adequacy of the proposed class counsel." Gomez v. St. Vincent Health, Inc., 649 F.3d 583, 592 (7th Cir. 2011). Essentially, Rule 23(a)(4) aims to ensure that there are no conflicts of interest between the named plaintiffs and the putative class members. In re Sw. Airlines Voucher Litig., 799 F.3d 701, 714-15 (7th Cir. 2015).
Defendant does not challenge the adequacy of Plaintiff's counsel, and upon review of the materials that have been submitted, the Court finds counsel to be fully competent to represent the class in this case. However, Defendant does challenge Plaintiff's ability to adequately represent absent class members based on an alleged misstatement she made about her driving record on her insurance application. (R. 119, Resp. at 18-19). This Court previously precluded Defendant from pursuing an affirmative defense on the ground of Plaintiff's alleged misrepresentation, and the Court finds no basis to conclude that this tangential issue puts Plaintiff's interests in direct conflict with those of the other class members. A mere "hypothetical" conflict is not enough to find the named plaintiff inadequate. Johnson v. Meriter Health Servs. Emp. Ret. Plan, 702 F.3d 364, 372 (7th Cir. 2012). Plaintiff was forthcoming about this issue during her deposition, and Defendant has not provided any evidence suggesting that she has engaged in wrongdoing in connection with this case. Instead, it appears that Plaintiff's interests are fully aligned with the members of the class, and the Court finds her to be an adequate class representative.
II. Rule 23(b) requirements
Plaintiff is seeking certification under Rule 23(b)(3), which permits certification where "questions of law and fact common to members of the class predominate over any questions affecting only individual members," and "a class action is superior to other available methods for fairly and efficiently adjudicating the controversy." FED. R. CIV. P. 23(b)(3). Although similar, predominance and commonality are not exactly the same requirement; the predominance requirement is "even more demanding." Comcast Corp. v. Behrend, 133 S. Ct. 1426, 1432 (2013). Broadly speaking, the predominance inquiry "trains on the legal or factual questions that qualify each class member's case as a genuine controversy" to establish whether a proposed class is "sufficiently cohesive to warrant adjudication by representation." Messner, 669 F.3d at 814 (citation omitted). In essence, class actions certified under Rule 23(b)(3) are meant to "cover cases in which a class action would achieve economies of time, effort, and expense, and promote uniformity of decision as to persons similarly situated, without sacrificing procedural fairness or bringing about other undesirable results." Amchem Prods., 521 U.S. at 615 (citation omitted).
Plaintiff argues that the common issues of contract formation and breach are class-wide issues that predominate in this case. (R. 111, Mot. at 17-21). Defendant counters that the individual issues overwhelm any common issues, considering that both enforceability of the contract and damages will need to be determined on an individual basis. (R. 119, Resp. at 6.) The Court agrees with Defendant. As explained above, this case will require individualized damages inquiries for each class member. In addition, the contract and insurance laws of multiple states will govern the merits of class members' claims. Certifying a class under these circumstances is not the superior method of adjudicating the claims and instead would be entirely unmanageable. See Mednick v. Precor, Inc., No. 14 C 3624, 2016 WL 3213400, at *8 (N.D. Ill. June 10, 2016) (denying class certification where plaintiff sought to "certify a multi-state class to pursue violations of the consumer fraud laws of 10 states"); Haley v. Kolbe & Kolbe Millwork Co., No. 14-CV-99-BBC, 2015 WL 9255571, at *11 (W.D. Wis. Dec. 18, 2015) ("Although courts can divide multi-state classes into state subclasses to address such choice of law issues, this would be unmanageable with 50 different state laws."); Doster Lighting, Inc. v. E-Conolight, LLC, No. 12-C-0023, 2015 WL 3776491, at *20-22 (E.D. Wis. June 17, 2015) (refusing to certify class where claims implicated the laws of multiple states and there was a need to conduct individualized damages determinations, because "such a class [has] too many individual issues, which overwhelm the common ones"); DuRocher v. Nat'l Collegiate Athletic Ass'n, No. 1:13-CV-01570-SEB, 2015 WL 1505675, at *11 (S.D. Ind. Mar. 31, 2015) (striking class allegations where multiple states' laws would apply to class members' claims, because "the differences (both major and nuanced) between the potentially 55 different jurisdictions pose a major impediment to class treatment"). Therefore, the Court finds that the predominance and superiority requirements are not satisfied. For these reasons, the motion for class certification is denied.
Defendant also points out that Plaintiff did not provide a "trial plan" along with her motion. (R. 119, Resp. at 20.) Courts have authority to require trial plans in class action cases to streamline their consideration of whether issues to be resolved at trial can be decided on a class-wide basis. See FED. R. CIV. P. 23, Advisory Committee Note, 2003 Amendments ("An increasing number of courts require a party requesting class certification to present a 'trial plan' that describes the issues likely to be presented at trial and tests whether they are susceptible of class-wide proof."). The Court does not find Plaintiff's failure to submit a trial plan fatal, but the lack of a tangible plan from Plaintiff outlining exactly how liability and damages could be decided on a class-wide basis at trial further undercuts her arguments that, the Rule 23 requirements are satisfied. See, e.g., Marshall v. H & R Block Tax Servs. Inc., 270 F.R.D. 400, 407 (S.D. Ill. 2010) (denying class certification in case requiring application of multiple states' laws and individualized damages determinations, where plaintiffs "proposed no subclasses, no discrete 'issue' certification, and no trial plan" for the court to determine whether class treatment of all or a portion of the issues raised in the case would be "manageable and superior"). --------
CONCLUSION
For the foregoing reasons, the Court DENIES Plaintiff's motion for class certification (R. 111). The parties are directed to exhaust all settlement possibilities in light of this opinion. The parties shall appear for a status hearing on June 20, 2017, at 9:45 a.m.
ENTERED: /s/ _________
Chief Judge Rubén Castillo
United States District Court Dated: May 3, 2017