Opinion
CASE NO. C08-797RAJ.
March 2, 2009
ORDER
I. INTRODUCTION
This matter comes before the court on the motion (Dkt. # 23) of Plaintiff Brenda Stoots Ewing for preliminary approval of a settlement with Defendant Administrative Systems, Inc. ("ASI"), including preliminary certification of a settlement class. ASI does not oppose the motion. For the reasons stated below, the court requires additional information from the parties before resolving the motion. The court directs the clerk to RENOTE the motion for March 27, 2009.
II. BACKGROUND
This action springs from the December 2007 theft of a laptop computer belonging to ASI (the "ASI data breach"). The laptop contained approximately 550,000 people's personal information, including their names, birthdates, addresses, and social security numbers. Ms. Ewing was one of those people.
In February 2008, before this litigation began, ASI mailed notices of the breach to all affected persons. It created a telephone center to address concerns from people whom the breach affected. ASI offered some of them one year of free credit monitoring. The parties provide no information about what ASI learned about the impact of the data breach from the telephone center or how many people received the prelitigation offer.
Ms. Ewing sued in May 2008, seeking to represent a class of all 550,000 people whose information was stolen. The parties have reached a settlement in which ASI will pay $1.5 million plus miscellaneous expenses of up to $25,000 and class members will release ASI from further liability. The court must now determine whether to preliminarily approve the settlement.
III. ANALYSIS
The parties' agreement to settle this matter is not itself a sufficient basis for approving the settlement. The settlement would require the court to certify a class and dispose of the claims of its members. The court has an independent obligation to protect class members. Silber v. Mabon, 957 F.2d 697, 701 (9th Cir. 1992). Even for a class certified solely for purposes of settlement, the court must ensure that the class and its proposed representative meet the requirements of Fed.R.Civ.P. 23. Staton v. Boeing Co., 327 F.3d 938, 952 (9th Cir. 2003). In addition, the court must ensure that the settlement is "fair, reasonable, and adequate." Fed.R.Civ.P. 23(e)(2).
In this case, the parties have not provided a sufficient basis for the court to assess whether the settlement is fair, reasonable and adequate. The court arrives at this conclusion after examining the structure of the proposed settlement.
First, although ASI will pay $1.5 million to settle this action, it is plain at the threshold that much of that sum will not reach class members. Ms. Ewing's counsel reserves the right to seek up to 30% of the fund for attorney fees and costs, or $450,000 in this case. Settlement Agreement ("SA") ¶ 8.1.
Second, the settlement appropriately recognizes the substantial cost of notifying more than half a million class members about the settlement and processing their claims. The parties have elected to use an independent claims administrator to notify class members, handle their claims, and distribute settlement funds. E.g., SA ¶¶ 1.11, 1.12. All administration costs will be deducted from the settlement fund. SA ¶ 2.8. Although the parties provide no estimate of likely administration costs, the initial allocation to the administrator is $400,000. SA ¶ 1.28. The agreement permits the administrator to take more money from the settlement fund if costs exceed $400,000 (SA ¶ 2.8), but is silent as to whether money will be re-allocated to class members if expenses are less.
The court thus evaluates the settlement under the assumption that only $650,000 ($1.5 million less $450,000 for counsel and $400,000 for administration) will be available for distribution to class members. The court's assumption may be in error, but it will be up to the parties to demonstrate as much when they respond to this order.
The settlement distributes money to class members in a three-tiered system that casts further doubt on how much money will go to class members. One tier is a "Basic Monitoring Benefit" ("BMB") consisting of either one year of credit monitoring from a service that ASI has pre-selected, or reimbursement of up to $50 for already-purchased credit monitoring. SA ¶¶ 1.6, 2.2(b). The parties have allocated 75% of the net settlement fund to the BMB, or $487,500. In the event that class members do not exhaust 75% of the settlement fund for the BMB, the remainder of the allocation reverts to ASI. SA ¶ 2.2(g). The second tier is an "Augmented Monitoring Benefit" ("AMB") consisting of up to two years of extended credit monitoring for people whose first-tier credit monitoring shows unauthorized credit inquiries. SA ¶¶ 1.4, 2.3. The parties allocated 15% of the net settlement fund ($97,500) to the AMB, and as with the BMB, any portion of that allocation that is unused reverts to ASI. SA ¶ 2.3(d). The third tier consists of reimbursements to persons who were victims of identity theft. SA ¶¶ 1.22, 2.4. The remaining 10% of the net settlement fund ($65,000) is allocated to this tier, and any unused portion will be returned to ASI. SA ¶ 2.4(c).
One other wrinkle is important to the court's assessment of the three-tiered system. Persons who received ASI's prelitigation offer for credit monitoring, regardless of whether they accepted the offer, are ineligible for the BMB. This limitation is not apparent from the settlement agreement itself, but is contained in the parties' proposed notice to class members. Class Notice (Dkt. # 23-2, Ex. B) at 2 (parts 7 8).
The three-tiered system and the partial exclusion for people who received ASI's prelitigation offer raise questions about the benefit class members will actually receive. The difficulty is that the parties have shared no information regarding what benefits class members are likely to need or request. For example, the settlement recognizes that identity theft is a potentially serious consequence of the ASI data breach. ASI's total liability for identity theft, however, is $65,000, or just under 12 cents per class member. The court recognizes that it is extraordinarily unlikely that every person that the ASI data breach affected experienced or will experience identity theft. Nonetheless, some potential class members no doubt have been or will be the victims, and the parties likely have information that would allow them to make an educated guess about that number. ASI has dealt with potential class members through the telephone center it created, and no doubt has substantial knowledge about the impact of the data breach and what compensation is most needed. If, for example, 1000 of the 550,000 affected persons (or 0.18% of the putative class) have been or will be victims of identity theft, then only $65 will be available to compensate each member. The court's experience with identity theft victims suggests that this sum would be inadequate.
Similar concerns surround the other tiers of the settlement offer. The court has no idea how many class members are likely to accept the BMB, or how many are excluded because they received the pre-litigation offer. Depending on those numbers, the settlement's allocation of $487,500 might be appropriate, it might be insufficient, or it might be excessive. If a substantial portion of the putative class received the prelitigation offer, the BMB might be all but illusory. The court can only guess. The parties, however, no doubt have information that would permit at least a substantially more educated guess than the court can hazard on the record before it. An estimate is critical, especially when the settlement is structured to return undistributed amounts at each tier to ASI rather than class members. If, for example, the AMB turns out to be in relatively low demand, but identity theft occurs relatively more frequently, the unused AMB allocation will belong to ASI, not to identity theft victims.
The settlement's provisions for identity theft victims raise another question. Once class members receive notice of the settlement, the settlement gives them only 45 days to opt out. The settlement recognizes, however, that identity theft may occur well after the notice date, and for that reason permits class members up to 18 months from the notice date to report identity theft. SA ¶ 2.4(b). Given the limited fund available for identity theft victims, the settlement places persons whose identities are stolen after class notice in a predicament: they may have serious damages, but no settlement funds available, and no ability to seek recourse in court. This scenario may be unlikely, or it may be quite likely. Without information from the parties on the incidence of identity theft resulting from the ASI data breach, the court has no way of making an informed judgment.
On this record, the court lacks sufficient information to determine if the settlement is fair, adequate, and reasonable. On one end of the spectrum, if the number of persons actually harmed by the ASI breach is relatively low, the settlement may provide reasonable compensation, or even complete compensation, to class members. On the other end, if the number of persons who experience identity theft is high, and the number of persons who seek credit monitoring is low, the settlement may provide little to no compensation to class members who have suffered serious harm, and allow ASI to extinguish its liability for a tiny payment to class members and a tidy sum for class counsel and the claims administrator. Until the parties provide more information, the court cannot determine where on the spectrum this settlement is likely to fall.
For these reasons, the parties must either separately or jointly submit a brief that provides the information the court needs to assess the fairness of the settlement. In particular, the parties must provide information about what ASI has learned so far about potential class members. Have they sought credit monitoring in substantial numbers? Have they experienced unauthorized credit inquiries, or outright identity theft? If so, how often? How much expense has been incurred by identity theft victims who have already contacted ASI? How many people received the ASI pre-litigation offer? How many accepted it? Is there any reason to expect that class counsel will seek substantially less than 30% of the settlement fund? Will claims administration cost less than $400,000? The parties must provide this information and any other information that would help the court assess the settlement. The court will set a deadline of March 27 for receipt of this information, but the parties may request a reasonable continuance if additional time would help them address the court's concerns.
IV. CONCLUSION
For the reasons stated above, the court RENOTES Plaintiffs' unopposed motion for preliminary approval (Dkt. # 23) for March 27, 2009. By that date, the parties (jointly or individually) must submit a supplemental brief in accordance with the court's instructions above