In re Marriott Int'l, Inc. Customer Data Sec. Breach Litig.

Full title: IN RE MARRIOTT INTERNATIONAL, INC., CUSTOMER DATA SECURITY BREACH…

Court: United States District Court, District of Maryland

Date published: May 3, 2022

MDL 19-md-2879 (D. Md. May. 3, 2022)

Opinion

MDL 19-md-2879

05-03-2022

IN RE MARRIOTT INTERNATIONAL, INC., CUSTOMER DATA SECURITY BREACH LITIGATION CONSUMER ACTIONS

PAUL W. GRIMM, UNITED STATES DISTRICT JUDGE

MEMORANDUM OPINION

PAUL W. GRIMM, UNITED STATES DISTRICT JUDGE

This case involves consolidated class action claims filed by consumers against Marriott and Accenture related to a data breach of the Marriott-owned Starwood Hotels and Resorts, Inc.¹It is part of the Multidistrict Litigation ("MDL") pending before me concerning the data breach. Consumer Plaintiffs ("Plaintiffs") and Marriott and Accenture ("Defendants") selected ten "bellwether" claims to test the sufficiency of the pleadings, which include tort, contract, and statutory claims under the laws of various states.² Following the resolution of Defendants' motions to dismiss, nine bellwether claims remain. Plaintiffs now move to certify classes for monetary damages, liability issues, and injunctive relief under Federal Rules of Civil Procedure 23(b)(3), 23(c)(4), and 23(b)(2), respectively.³ For the reasons discussed below, Plaintiffs' motion is GRANTED IN PART, and DENIED IN PART.⁴

1 Plaintiffs named as defendants Marriott International, Inc., Starwood Hotels and Resorts Worldwide, LLC, and Accenture LLP. Second Amended Consolidated Complaint ("Compl."), ECF Nos. 413 (sealed), 537 (redacted) at ¶¶ 12-14. In this memorandum, I will refer to Marriott and Starwood as one entity and use the brand names interchangeably as Marriott acquired Starwood in 2016. Marriott buys Starwood, becoming world's largest hotel chain, CNBC (Sept. 23, 2016), https://www.cnbc.com/2016/09/23/marriott-buys-starwood-becomihg-worlds-largesthotel-chain.html. Marriott and Accenture are referred to collectively as "Defendants."

2 See ECF No. 368 (selection of bellwether claims). Each party selected five claims, consisting of a cause of action and a jurisdiction from the Second Amended Consolidated Complaint, brought by the named plaintiffs from the relevant jurisdiction. Id.

3 The motion has been fully briefed. See Pls.' Mot. for Class Cert. ("Pls.' Mot."), ECF Nos. 858 (redacted), 859/863/865 (sealed); Defs.' Opp'n, ECF Nos. 885 (sealed), 888 (redacted); Pls.' Reply, ECF Nos. 905 (sealed), 910 (redacted). (All references in this opinion are to these documents. As previously ordered, the parties will be submitting documents to the Court with updated redactions pursuant to the Special Master's resolution of the parties' confidentiality designation disputes. See ECF No. 1009. Those updates, however, do not affect this opinion.) In addition to the written briefing, a hearing was held on April 20, 2022. Because it was critical to Plaintiffs' motion for class certification, the Court resolved Defendants' motion to exclude the opinions of Plaintiffs' expert Dr. Jeffrey Prince, Ph.D., colloquially known as a Daubert motion, in a simultaneously issued companion opinion to this one. Plaintiffs filed two Daubert motions of their own, seeking to exclude the opinions of Defendants' experts, Kevin Poindexter and Tom Snyder. As neither of those two experts' opinions were critical to deciding the class certification motion, I DENY those motions WITHOUT PREJUDICE. To understand why I need not fully consider those Daubert motions now, see the "Standard of Review" discussion in the companion Daubert opinion.

4 At this time, I would like to thank my chambers' two spring semester judicial interns, Alan . Harrison and Michelle Lim, for their able assistance in preparing this opinion.

FACTUAL BACKGROUND

On November 30, 2018, Marriott announced that it was the target of one of the largest data breaches in history. Pls.' Tab 18.⁵ The breach took place in its Starwood guest reservation database. Id. Marriott International acquired Starwood Hotels and Resorts in September 2016. When guests make a reservation to stay at a Marriott property, they must provide personal information including name, address, email address, phone number, and payment card information. Pls.' Tab 19. In some instances, Marriott also collects passport information, room preferences, travel destinations, and other personal information. Id. Both Marriott and Starwood had privacy statements, dated May 18, 2018 and October 5, 2014 respectively, concerning their collection and use of this personal information and touting their ability to protect the security of this sensitive information. Pls.' Tab .50.

5 For all Plaintiffs' exhibits, see ECF Nos. 859 (sealed) and 863 (sealed) and their attachments.

Investigations into the data breach indicated that for over four years, from July 2014 to September 2018, hackers had access to Starwood's guest information database-the "New" Data Storage ("NDS") database. Pls.' Tabs 18-19. In other words, the data breach was ongoing before and after Marriott's acquisition of Starwood. During the data breach, the hackers exported customers' personally identifiable information ("PII"). Pls.' Tab 19. Marriott discovered the breach on September 8, 2018 when Accenture-a consulting company Starwood contracted to provide data security services, see Tab 48-reported an anomaly pertaining to the NDS database. Pls.' Tab 18. In total, the breach impacted approximately 133.7 million guest records associated with the United States, including an estimated 47.7 million records associated with the bellwether states. Defs.' Ex. 12.⁶

6 For all Defendants' exhibits, see ECF No. 885 (sealed) and its attachments.

Plaintiffs are consumers who provided their PII to Marriott to stay at a Starwood property or use Starwood's services before the data breach. Plaintiffs allege that Marriott and Accenture are liable for the data breach under theories of tort, contract, and breach of statutory duties.⁷ The gravamen of these allegations is that Marriott and Accenture failed to take reasonable steps to protect Plaintiffs' personal information against the foreseeable risk of a cyberattack and, in the case of Marriott, contrary to its express privacy statements and statutory duties.

7 The contract and statutory theories are applicable only to Marriott, not Accenture.

Pending is Plaintiffs' motion to certify thirteen damages classes and subclasses under Rule 23(b)(3), various liability issues under Rule 23(c)(4)', and a class for injunctive or declaratory relief under Rule 23(b)(2).

LEGAL STANDARD

Federal Rule of Civil Procedure 23 contains the requirements for class certification. A class action must first meet the prerequisites of Rule 23(a):

(a) Prerequisites. One or more members of a class may sue or be sued as representative parties on behalf of all members only if:

(1) the class is so numerous that joinder of all members is impracticable;

(2) there are questions of law or fact common to the class;

(3) the claims or defenses of the. representative parties are typical of the claims or defenses of the class; and

(4) the representative parties will fairly and adequately protect the interests of the class.

Fed. R. Civ. P. 23(a); see also Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 349 (2011); EQT Prod. Co. v. Adair, 764 F.3d 347, 357 (4th Cir. 2014). These prerequisites are commonly referred to as "numerosity, commonality, typicality, and adequacy of representation." Id.

In addition to meeting the requirements of Rule 23(a), a class action must fit one of the categories in Rule 23(b). As relevant here, Rule 23(b)(2) provides that a class action may be maintained if "the party opposing the class has acted or refused to act on grounds that apply generally to the class, so that final injunctive relief or corresponding declaratory relief is appropriate respecting the class as a whole." Fed.R.Civ.P. 23(b)(2). In addition, Rule 23(b)(3) provides that a class action may be maintained if "the court finds that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy." Fed.R.Civ.P. 23(b)(3). Factors relevant to the "predominance", and "superiority" requirements include:

(A) the class members' interests in individually controlling the prosecution or defense of separate actions;

(B) the extent and nature of any litigation concerning the controversy already begun by or against class members;

(C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and

(D) the likely difficulties in managing a class action.

Id.; see also Thorn v. Jefferson-Pilot Life Ins. Co., 445 F.3d 311, 319 (4th Cir. 2006).

Federal Rule of Civil Procedure 23(c)(4) states that, "[w]hen appropriate, an action may be brought or maintained as a class action with respect to particular issues." Fed.R.Civ.P. 23(c)(4). A class action for particular issues under Rule 23(c)(4) must then meet the requirements of Rule 23(a) and the criteria for one of the types of class actions in Rule 23(b). See Gunnells v. Healthplan Servs., Inc., 348 F.3d 417, 439 (4th Cir. 2003).

In addition to the explicit requirements listed in Rule 23, the Fourth Circuit has recognized that Rule 23 "contains an implicit threshold requirement that the members of a proposed class be 'readily identifiable.'" EQT Prod. Co., 164 F.3d at 358. This is commonly referred to as the "ascertainability" requirement. See id.

Rule 23 '"does not set forth a mere pleading standard.'" Comcast Corp. v. Behrend, 569 U.S. 27, 33 (2013) (quoting Wal-Mart, 564 U.S. at 350). Instead, "aparty must...' be prepared to prove that there are in fact sufficiently numerous parties, common questions of law or fact,' typicality of claims or defenses, and adequacy of representation, as required by Rule 23(a)." Id. (quoting Wal-Mart, 564 U.S. at 350). Likewise, "[t]he party must also satisfy through evidentiary proof at least one of the provisions of Rule 23(b)." Id. "It is the plaintiffs' burden to demonstrate compliance with Rule 23, but the district court has an independent obligation to perform a 'rigorous analysis' to ensure that all of the prerequisites have been satisfied." EQT Prod. Co., 764 F.3d at 358 (citing Wal-Mart, 564 U.S. at 350.) "Frequently that 'rigorous analysis' will entail some overlap with the merits of the plaintiffs underlying claim." Wal-Mart, 564 U.S. at 350. "Although Rule 23 does not give district courts a 'license to engage in free-ranging merits inquiries at the certification stage,' a court should consider merits questions to the extent 'that they are relevant to determining whether the Rule 23 prerequisites for class certification are satisfied.'" EQT Prod. Co., 764 F.3d at 357-58 (quoting Amgen Inc. v. Conn. Ret. Plans & Tr. Funds, 568 U.S. 455, 466 (2013)).

DISCUSSION

Plaintiffs move to certify classes for monetary damages under Rule 23(b)(3), for liability issues under Rule 23(c)(4), and for injunctive or declaratory relief under Rule 23(b)(2). Before addressing the requirements for these specific class action types, I will address standing and the explicit, as well as implicit, Rule 23(a) prerequisites that are applicable to all class action types.

I. Standing

In class actions, "the standing inquiry focuses on the class representatives." 2 W. Rubenstein, Newberg on Class Actions § 2:3 (5th ed. 2021). For a class representative, or named plaintiff, to establish standing, he or she must have (1) "suffered an 'injury in fact' that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical," (2) "fairly traceable to the challenged action of the defendant," and (3) "likely...[to] be redressed by a favorable decision." Bishop v. Bartlett, 575 F.3d 419, 423 (4th Cir. 2009)); see also Lujan v. Defs. of Wildlife, . 504 U.S. 555, 560-61 (1992) (same)/ Each of the elements of standing "must be supported in the same way as any other matter on which the plaintiff bears the burden of proof, i.e., with the manner and degree of evidence required at the successive stages of the litigation." Overbey v. Mayor of Baltimore, 930 F.3d 215, 227 (4th Cir. 2019) (quoting Lujan, 504 U.S. at 561). For example, "[a]t the pleading stage, general factual allegations of injury resulting from the defendant's conduct may suffice," but at the summary judgment stage, plaintiffs "must 'set forth' by affidavit or other evidence 'specific facts'" supporting standing. Lujan, 504 U.S. at 561.

The applicable evidentiary burden to apply to standing at the class certification stage has sparked some disagreement between courts. See Earl v. Boeing, 339 F.R.D. 391, 411-12 (E.D. Tex. 2021) (comparing Brooklyn Ctr. for Indep. of the Disabled v. Bloomberg, 290 F.R.D. 409, 414 (S.D.N.Y. 2012) (adopting pleading standard) with Gomez v. Trump, No. 20-CV-1419, 2020 WL 3429786, at *6 n.7 (D.D.C. June 23, 2020) (adopting heightened standard)). Nevertheless, for a number of reasons, I am persuaded that the pleading-stage burden applies until summary judgment. Lujan laid out only three general phases of litigation-pleading, summary judgment, and trial, see 504 U.S. at 561, and Rule 23 "does not-and cannot-add an additional step to the litigatory life cycle." Earl, 339 F.R.D. at 412 (citing Neale v. Volvo Cars of N. Am., LLC, 794 F.3d 353, 360 (3d Cir. 2015); Mahon v. Ticor Title Ins. Co., 683 F.3d 59, 64 (2d Cir. 2012)). Given that a plaintiff "remains several 'successive stages' away from resolving a given dispute" at the class certification stage, no shift in the burden should occur just yet. Earl, 339 F.R.D. at 412 (citations omitted). This position makes particular sense in a case such as this one where merits discovery will continue post-certification. Accordingly, my prior standing analysis still applies. See In re Marriott Int 'I, Inc., Customer Data Sec. Breach Litig., 440 F.Supp.3d 447, 456-67 (D. Md. 2020); Marriott, No. 19-md-2879, 2020 WL 6290670, at *4-5 (D. Md. Oct. 27, 2020). Undoubtedly, Defendants will raise further challenges to the class representatives' standing in this litigation, but those challenges will have to wait until the summary judgment stage.

Defendants do raise an argument related to absent class members' standing, however, that I must address now. Defendants argue that the inclusion of absent class members who lack standing in Plaintiffs' proposed class definitions makes class certification improper. See Defs.' Opp'n at 29-30. Last year, the Supreme Court declared, "Every class member must have Article III standing in order to recover individual damages." TransUnion LLC v. Ramirez, 141 S.Ct. 2190, 2208 (2021). However, the Court declined to address "whether every class member must demonstrate standing before a court certifies a class." Id. at n.4. (emphasis added). As the Supreme Court noted, the Eleventh Circuit has directly addressed this question and declined to require that district courts "ensure that the class definition does not include any individuals who do not have standing before certifying a class." Cordoba v. DIRECTV, LLC, 942 F.3d 1259, 1276 (11th Cir. 2019) (emphasis added). The Fourth Circuit has also declined to create such a requirement. See Krakauer v. Dish Network L.L.C., 925 F.3d 643, 657-58 (4th Cir. 2019) (affirming class certification when satisfied that the class did not include "a large number of uninjured persons," meaning the inclusion of a small number of uninjured persons who lack standing would have been reconcilable with granting class certification.); ⁸ but see Branch v. Gov't Emps. Ins. Co., 323 F.R.D. 539, 551 (E.D. Va. 2018) (applying out-of-circuit standard that "no class may be certified that contains members lacking Article III standing") (citations omitted). Thus, Plaintiffs need not demonstrate that every class member has standing at the class certification stage.

8 The First and Seventh Circuits have also taken this approach. See In re Nexium Antitrust Litig., 777 F.3d 9, 25 (1st Cir. 2015) ("We think that a certified class may include a de minimis number of potentially uninjured parties."); Kleen Prods, v. Int'l Paper Co., 831 F.3d 919, 927 (7th Cir. 2016), ("[I]f the [district] court thought that no class can be certified until proof exists that every member has been harmed, it was wrong.") (citation omitted).

Nevertheless, Plaintiffs must show that differences between class members as to standing-i.e., the inclusion of uninjured individuals alongside injured ones in the class-are not so significant that the class runs afoul of Rule 23. Courts often address this issue of "uninjured class members" in the context of Rule 23(b)(3)'s predominance requirement. Krakauer, 925 F.3d at 657 (citing In re Asacol Antitrust Litig., 907 F.3d 42, 51-53 (1st Cir. 2018); Kleen Prods, v. Int'l Paper Co., 831 F.3d 919 (7th Cir. 2016); In re Rail Freight Fuel Surcharge Antitrust Litig., 725 F.3d 244 (D.C. Cir. 2013)); see also Henderson v. Corelogic, Nat'l Background Data, LLC, No. 12-CV-97, 2016 WL 4611570, at *3 (E.D. Va. Sept. 2, 2016).⁹ As explained earlier, a court can only certify a class if "questions of law or fact common to class members predominate over any questions affecting only individual members." Fed.R.Civ.P. 23(b)(3). In other words, a class must be "sufficiently cohesive to warrant adjudication by representation." Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442, 453 (2016) (quoting Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 623 (1997). As implied in Krakauer, the presence of "a large number of uninjured persons" in a proposed class would undermine predominance. 925 F.3d at 657.

9 At least one court in this circuit has addressed the issue of uninjured class members through the lens of ascertainability instead of predominance, see Krakauer v. Dish Network L.L.C., 311 F.R.D. . 384 (M.D. N.C. 2015), but I will follow the predominance approach.

Here, the proposed classes that do not limit membership to those who bore the economic burden for a hotel stay would surely include a large number of uninjured persons under the overpayment theory. Individuals do not experience any overpayment injury when they are reimbursed by another individual or entity for a hotel stay. They do not suffer any economic loss. The proposed classes likely include many such individuals. As Defendants note, multiple bellwether plaintiffs traveled for work and were reimbursed by their employers for work travel, meaning that they did not bear the economic burden for work-related hotel stays. Defs.' Opp'n at 30. In addition to employer reimbursement, Defendants also indicate that some plaintiffs received reimbursement when booking hotel stays for others, such as family members. Id. While the bellwether plaintiffs pursuing the overpayment theory also paid for stays for which they did bear the economic burden of the overpayment, see Defs.' Exs. 40, 44, 48, 51-54, and thus are injured individuals as to those stays, we can draw some conclusions from the stays for which they did not bear the economic burden. Id.

Considering the information gathered from the bellwether plaintiffs, it is a near certainty that the proposed class definitions include many individuals who solely traveled to Starwood hotels for work and, therefore, have no hotel stays for which they were not reimbursed. The proposed class definitions may also include a number of individuals who only paid for Starwood hotel stays for which they were reimbursed by a family member. Given the size of the proposed classes, the number of uninjured class members could be in the thousands. As a result, sizeable portions of the various classes have differing legal arguments as to standing, undoing the cohesiveness of the classes and preventing common questions of law from predominating.¹⁰

10 Defining putative class members as those "who bore the economic burden" for a hotel stay raises some concerns regarding ascertainability. However, one could sort through the factual circumstances of reimbursement in a way that is consistent with predominance. See Section II.a. below.

Essentially, this predominance analysis shows that the aforementioned proposed classes are overbroad on the issue of standing. See Earl, 339 F.R.D. at 415 ("[U]sing Rule 23's predominance requirement to evaluate a putative class for overbreadth on the issue of standing makes sense from a functional perspective.") An overbreadth problem, however, "can and often should be solved by refining the class definition[s] rather than by flatly denying class certification on that basis." Messner v. Northshore Univ. Health Sys., 669 F.3d 802, 825 (7th Cir. 2012); see also 7A Charles Alan Wright, Arthur R. Miller, and Mary Kay Kane, Federal Practice and Procedure § 1760 (4th ed. 2021) ("[A court] has discretion to limit or redefine class[es] in an appropriate manner to bring the action within Rule 23.") Accordingly, I find that the class definitions related to the overpayment theory should be narrowed to prevent this overbreadth on the issue of standing. See In re Brinker Data Incident Litig., No. 18-CV-686, 2021 WL 1405508, at *6 (M.D. Fla. Apr. 14, 2021) (narrowing class definition to prevent the class definition from being overbroad and to prevent predominance issues regarding standing). All classes proceeding under the overpayment theory shall only include persons who bore the economic burden for hotel room(s). This change will exclude those individuals who are uninjured under the overpayment theory from being class members.¹¹

11 The Court will lay out the new class definitions, accounting for all alterations discussed, at the conclusion of the opinion.

In addition to this refinement, the Court will also limit the classes proceeding under the overpayment theory to individuals who made reservations at Starwood properties during the four-and-a-half-year period (2014-2018) in which hackers had access to Plaintiffs' PII. See Pls.' Tabs 18-19. Logically, an individual could only suffer an overpayment injury under Plaintiffs' overpayment damages model during that period. As Plaintiffs' own expert, Dr. Prince, cabined his model in this way, see Expert Class Cert. Rep. of Jeffrey T. Prince, Ph.D. ("Prince Initial Rep."), EC'F No. 859-4 (sealed) at ¶ 104; Deposition of Jeffrey T. Prince ("Prince Dep. 1"), ECF No. 891-2 (sealed) at 14:5-10, this change merely corrects an oversight by Plaintiffs' Counsel when writing the proposed class definitions related to the overpayment theory.

II. Rule 23(a) Prerequisites

a. Ascertainability

In addition to the factors explicitly listed in Rule 23(a) and (b), the Fourth Circuit has "repeatedly recognized that Rule 23 contains an implicit threshold requirement that the members of a proposed class be 'readily identifiable.'" EQT Prod. Co., 764 F.3d at 358 (quoting Hammond v. Powell, 462 F.2d 1053, 1055 (4th Cir. 1972)). Courts within the Fourth Circuit and in other circuits sometimes refer to this concept as the "ascertainability" requirement. Id.; see also Soutter v. Equifax Info. Servs., LLC, 307 F.R.D. 183, 196 (E.D. Va. 2015). In the Fourth Circuit, this requirement has two components. First, "[a] class cannot be certified unless a court can readily identify the class members in reference to objective criteria." EQT Prod. Co., 764 F.3d at 358 (4th Cir. 2014) (emphasis added). Second, there must be an "administratively feasible [way] for the court to determine whether a particular individual is a [class] member." Krakauer, 925 F.3d at 658 (quoting EQT Prod. Co., 764 F.3d at 358) (emphasis added).¹²

12 Circuit courts are split on the issue of administrative feasibility. The First and Third Circuits have incorporated administrative feasibility into a heightened ascertainability requirement. See Nexium Antitrust Litig., 777 F.3d at 19; Byrd v. Aaron's Inc., 784 F.3d 154, 163 (3d Cir. 2015). The Second, Fifth, Sixth, Seventh, Eighth, Ninth, and Eleventh Circuits have rejected an administrative feasibility prerequisite for class certification as a component of ascertainability or otherwise. See In re Petrobras Sec, 862 F.3d 250, 267 (2d Cir. 2017); Seeligson v. Devon Energy Prod. Co., 761 Fed.Appx. 329, 334 (5th Cir. 2019); Rikos v. Procter & Gamble Co., 799 F.3d 497, 525 (6th Cir. 2015); Mullins v. Direct Dig, LLC, 795 F.3d 654, 662 (7th Cir. 2015); Sandusky Wellness Ctr., LLC v. Medtox Set, Inc., 821 F.3d 992, 995-96 (8th Cir. 2016); Briseno v. ConAgra Foods Inc., 844 F.3d 1121, 1123-24 (9th Cir. 2017); Cherry v. Dometic Corp., 986 F.3d 1296, 1302 (11th Cir. 2021). While the Fourth Circuit requires administrative feasibility as a component of ascertainability, see EQT Prod. Co., 764 F.3d at 358-59, it has not directly addressed the circuit split that has developed. See Krakauer, 925 F.3d at 658; Peters v. Aetna Inc., 2 F.4th 199, 241-4-3 (4th Cir. 2021).

Plaintiffs have satisfied the objective criteria component. Neither the originally proposed class definitions nor the court-modified class definitions rely on subjective terms. Whether one resides in a state, is an SPG member, and so on, are not matters of belief or states of mind, but objective facts. Defendants do not contest ascertainability on objective criteria grounds. See Defs.' Opp'n at 46-49.

Unlike the objective criteria component, the parties strongly contest the administrative feasibility of identifying class members. Id.; Pls.' Reply at 24-26. When analyzing the task of identifying class members, the Fourth Circuit has stated, "[P]laintiffs need not be able to, identify every class member at the time of certification[, ]" but '"[i]f class members are impossible to identify without extensive and individualized fact-finding or 'mini-trials,' then a class action is inappropriate.'" EQTProd. Co., 764 F.3d at 358 (quoting Marcus v. BMW of N. Am., LLC, 687 F.3d 583, 593 (3d Cir. 2012)). District courts within the Fourth Circuit have interpreted the meaning of "extensive and individualized fact-finding or 'mini-trials'" in this context differently. In the eyes of one court, "[f]he individualized fact-finding giving rise to mini-trials that defeat ascertainability are those requiring determinations on the merits-not an administrative review to determine whether an objective element of a class definition is met." Soutter, 307 F.R.D. at 197 (citing In re Vitamin C Antitrust Litig., 279 F.R.D. 90, 116 (E.D.N.Y. 2012)) (emphasis added). Another court took a conflicting approach, finding that an exceptionally complicated administrative review of company records constituted the kind of individualized fact-finding that defeated ascertainability. See Spotswood v. Hertz Corp., No. 16-1200, 2019 WL 498822, at *6-8 (D. Md. Feb. 7, 2019) (emphasis added).

It is unnecessary to resolve these different approaches here. Even if this Court adopts the stricter approach and accepts that an exceptionally complicated administrative review constitutes an impermissible "mini-trial," the case law "does not suggest that no level of inquiry as to the identity of class members can ever be undertaken." Byrdv. Aaron's Inc., 784 F.3d 154, 171 (3d Cir. 2015). "If that were the case, no Rule 23(b)(3) class could ever be certified." Id. Even the Third Circuit, which originated the heightened ascertainability requirement, has stated: "[T]he size of a potential class and the need to review individual files to identify its members are not reasons to deny class certification." Id. (quoting Young v. Nationwide Mut. Ins. Co., 693 F.3d 532, 539-40 (6th Cir. 2012) (collecting cases)).

Bearing this case law in mind, the question becomes whether the administrative review required here constitutes an impermissible "mini-trial." To answer that question, this Court must engage in a fact-specific analysis. See In re Delta/AirTran Baggage Fee Antitrust Litig., 317 F.R.D. 675 (N.D.Ga. 2016) ("[T]he [ascertainability] inquiry is so fact-specific that judicial decisions setting forth the broad legal principles described above offer little meaningful guidance in applying them, particularly with respect to the administrative feasibility requirement.")¹³

13 While the Eleventh Circuit no longer requires the administratively feasible component of ascertainability, see Cherry, 986 F.3d at 1304, it did at the time Delta/Air Tran was decided. That the court grappled with administrative feasibility as required by the Fourth Circuit makes the case particularly relevant.

Taking account of the facts in this case, I conclude that Plaintiffs have satisfied the ascertainability requirement. Plaintiffs assert that the proposed classes are ascertainable because Marriott's NDS database contains the names and contact information for virtually all class members, and the parties can use that database to identify class members. See Pls.' Mot. at 25. "[B]ecause each class is defined generally as people who, because they gave their [PII] to Starwood and it wound up in Starwood's NDS database, had that information compromised as a result of the announced Data Breach," as Plaintiffs put it, an individual's very presence in the database indicates their membership in the class. See Id. Of course, that membership is subject to verification, but the NDS database is a strong starting point from which to identify class members.¹⁴ Acknowledging that records may be incomplete for some, individuals in the NDS database, Plaintiffs also propose filling in any gaps, or outdated information, with Marriott's current customer data. See Pls.' Reply at 25.

14 It is worth noting that Marriott actually has this data, distinguishing it from cases where ascertainability was complicated by data being hypothetical or being held by third parties who had not yet agreed to cooperate. See Williams v. Big Picture Loans, LLC, 339 F.R.D. 46, 55-56 (E.D. Va. 2021).

Defendants' first objection to Plaintiffs' approach is that the NDS data is too unreliable to identify class members. See Defs.' Mot. at 47-48. However, "[i]n general, courts do not look favorably upon the argument that records a defendant treats as accurate for business purposes are not accurate enough to define a class." Soutter, 307 F.R.D. at 197-98. As Plaintiffs note, Defendants' argument is particularly unavailing here because they used the NDS database to notify the proposed class members of the data breach. See Pls.' Mot. at 25 (citing Marriott Amend. Ans. to Compl., ECF No. 620 at ¶ 199); Pls.' Reply at 24. Defendants certainly viewed the database as reliable enough for that notification process. That said, the bellwether discovery process has revealed that some reservation "rows" in the database lack the full complement of up-to-date information needed to verify class members' identity. See Defs.' Mot. at 47-48 (citing Defs.' Ex. 38; Ex. 41). For example, some rows do not include information about a guest's state of residence, . or if reservations do include that information, it may be outdated. Id. But any gaps can be resolved by cross-referencing reservations made by the same guest within the NDS database and, if necessary, with Marriott's current customer data. If all else fails, the database contains enough contact information, i.e., email addresses and phone numbers, that one could easily verify, the objective fact of where a class member lives. At the class certification hearing, Plaintiffs also asserted that address finding services could help locate class members.

Defendants' second objection to Plaintiffs' approach is that there is no way to identify those who bore the economic burden for a hotel stay, i.e., those who did not receive reimbursement, without falling into an impermissible "mini-trial." See Id. at 48-49. The Court's decision to narrow the proposed classes pertaining to the overpayment theory to include only those who bore the economic burden surely raises the salience of this concern. Defendants' objection, though, is faulty. First, Defendants imply that individualized review (which the Court agrees is certainly required here) will defeat administrative feasibility. See Id. As explained previously, however, "the need to review individual files to identify [class] members [is] not [a] reason[] to deny class certification." Byrd, 784 F.3d at 171. Second, Defendants assume that "self-certification" through affidavits is the only source from which the parties can identify those who bore the economic burden. While self-certification may be part of the identification process, it will not be self-certification standing alone. Any affidavits can and will be cross checked against the NDS database, which can confirm whether a reservation was made, the dates of that reservation, the payment card used, etc. In the event that the NDS database lacked corroborating information, Plaintiffs also could use class members' own records such as receipts and bank and credit card statements as an informational supplement.¹⁵ Such records would be particularly helpful for confirming that individuals did not receive reimbursement for hotel stays. See Delta/AirTran, 317 F.R.D. at 692 ("To the extent class members retained receipts or credit card statements documenting payment... these objective records can be used to permit self-identification of class members in a reliable manner.").

15 At the class certification hearing, Plaintiffs suggested that such records could be useful.

Because the NDS database and these other records exist, Plaintiffs can use affidavits to . help ascertain the class. See City Select Auto Sales Inc. v. BMW Bank of N. Am. Inc., 867 F.3d 434, 441 (3d Cir. 2017) (quoting Byrd, 784 F.3d at 170-71 ("Affidavits from potential class members, standing alone, without 'records to identify class members or a method to weed out unreliable affidavits,' will not constitute a reliable and administratively feasible means of determining class membership," however, "affidavits, in combination with records or other reliable and administratively feasible means, can meet the ascertainability standard.")). As in Delta/AirTran, the Court is "cognizant of the concerns raised by self-identification." 317 F.R.D. at 692. However, "where the charge at issue is so small that it is unlikely to induce fraudulent claims," as here, and when "class members can obtain objective records with relative ease that would confirm their membership in the class," as here, "those concerns are minimized." Id.

Defendants' concern regarding their due process rights is misplaced at this stage of the litigation. Their ability "to challenge the proof used to demonstrate class membership," Carrera v. Bayer Corp., 727 F.3d 300, 307 (3d Cir. 2013); is not implicated by this ascertainability finding. "The due process question is not whether the identity of class members can be ascertained with perfect accuracy at the certification stage but whether the defendant will receive a fair opportunity to present its defenses when putative class members actually come forward." Williams v. Big Picture Loans, LLC, 339 F.R.D. 46, 56 (E.D. Va. 2021) (quoting Mullins v. Direct Dig., LLC, 795 F.3d 654, 670 (7th Cir. 2015)).

While the potential class sizes here are large and review of individual files will be required, Plaintiffs have adequately shown-at this stage in the proceedings-that any review in this case is administratively feasible and not the kind of administrative review that would preclude ascertainability.¹⁶ Identifying class members will no doubt be time consuming, but that fact does not defeat ascertainability.

16 As discussed, in the companion Daubert opinion, Defendants objected to producing the NDS database for individuals other than the bellwether plaintiffs, so Plaintiffs were given relatively limited information with which to address Defendants' representations related to administrative feasibility.

The Court will carefully monitor any developments related to the NDS database and other methods of class member identification to ensure continued administrative feasibility. Cf. Delta/Air Tran, 317 F.R.D. at 692 ("As the process for submitting and confirming class members' claims is further developed, the Court (and no doubt Defendants) will remain vigilant that the process be structured in a manner to eliminate as much of the uncertainty as possible."); Earl, 339 F.R.D. at 423 ("The Court concludes that Plaintiffs satisfy the ascertainability requirement. Of course, Plaintiffs are not finished with this element-as the litigation progresses, the Court will scrutinize this ascertainability.") The Court can limit or modify class definitions "to provide the, necessary precision" on the ascertainability requirement. Earl, 339 F.R.D. at 423 (quoting In re Monumental Life Ins., 365 F.3d 408, 414 (5th Cir. 2004)). Further, "if an ascertainability issue eventually becomes 'truly insoluble, the [C]ourt may decertify the class at a later stage of the litigation.'" Id. at 422-23 (quoting Mullins, 795 F.3d at 664).¹⁷

17 The Court notes that its references (here and elsewhere in the Memorandum Opinion) to the ability to amend its class certification order, or even decertify the classes, should not be construed as conditional certification. The 2003 amendments to Rule 23 deleted the provision that explicitly enabled courts to conditionally certify class actions. Fed.R.Civ.P. 23 Advisory Committee Note (2003). Courts disagree as to whether conditional certification is still permissible, see 2 Newberg § 4:80 (citations omitted), but, in any case, the Court is not relying on conditional certification here. It is merely referring to its "authority to 'modify[ ] its certification if it becomes clear, as the case develops, that the class action vehicle is in fact inappropriate.'" Id. (quoting In re New Motor Vehicles Canadian Export Antitrust Litig., 522 F.3d 6, 26 n.27 (1st Cir. 2008)). It is well established that courts retain this authority even if conditional certification is no longer permitted. See Id. Rule 23(c)(1)(C) explicitly states, "An order that grants or denies class certification may be altered or amended before final judgment." Fed.R.Civ.P. 23(c)(1)(C).

b. Numerosity

Rule 23(a)'s numerosity requirement is that the class must be "so numerous that joinder of all members is impracticable." Fed.R.Civ.P. 23(a)(1). "Though' [n]o specified number is needed to maintain a class action,' . .. '[a]s a general guideline, ... a class that encompasses fewer than 20 members will likely not be certified . . . while a class of 40 or more members raises a presumption of impracticability of joinder based on numbers alone.'" In re Zetia (Ezetimibe) Antitrust Litig, 7 F.4th 227, 234 (4th Cir. 2021) (quoting Cypress v. Newport News Gen. & Nonsectarian Hosp. Ass'n, 375 F.2d 648, 653 (4th Cir. 1967); 1 Newberg § 3:12). Plaintiffs need not establish the precise number of class members at the certification stage to satisfy the numerosity requirement so long as they provide "a reasonable estimate of the number of class members." Harris v. Rainey, 299 F.R.D. 486, 489 (W.D. Va. 2014) (quoting Wiseman v. First Citizens Bank & Tr. Co., 212 F.R.D. 482, 486 (W.D. N.C. 2003).

Here, Plaintiffs assert-and Defendants do not contest-that each of the proposed classes contains "no less than tens of thousands of class members." Pls.' Mot. at 20. This assertion is a reasonable estimate in this case. As Plaintiffs note, when Marriott discovered the data breach- one of the largest in history-the company itself estimated that the breach affected hundreds of millions of guest records. Id. After de-duplication efforts, Marriott updated its estimate, stating that the data breach affected approximately 133.7 million guest records associated with the United States. Defs.' Ex. 12. Of those records, 47.7 million may be associated with the bellwether states.¹⁸ Id. Even if "significant duplication remains," id, and the final class definitions exclude certain individuals, one can reasonably expect that the proposed classes will consist of tens of thousands of members.¹⁹ These class sizes far surpass the presumption of impracticability of joinder based on numbers alone.²⁰ Plaintiffs' reasonable estimate satisfies the numerosity requirement.

18 Specifically, Marriott provided the following estimate of associated guest records by state:,

19 As Marriott only produced transactional data from the NDS database for named Plaintiffs, it would have been exceedingly difficult for Plaintiffs to offer a more precise figure. See ECF No. 751.

20 Given that these class sizes are far outside the "gray area" cases consisting of classes between twenty and forty members, the Court need not engage in the factor-by-factor analysis required for such cases. Cf. Zetia (Ezetimibe) Antitrust Litig., 7 F.4th at 234-36.

c. Commonality

Rule 23 (a)'s commonality requirement is that "there are questions of law or fact common to the class." Fed.R.Civ.P. 23(a)(2). The Supreme Court has explained that under this requirement, "[w]hat matters to class certification ... is not the raising of common 'questions'- even in droves-but rather, the capacity of a class-wide proceeding to generate common answers." Wal-Mart, 564 U.S. at 350. "A single common question will suffice, . . . but it must be of such a nature that its determination 'will resolve an issue that is central to the validity of each one of the claims in one stroke.'" EQT Prod. Co., 764 F.3d at 360 (quoting Wal-Mart, 564 U.S. at 350). "Where the injuries complained of by named plaintiffs allegedly result from the same unlawful pattern, practice, or policy of the defendants, the commonality requirement is usually satisfied." Parker v. Asbestos Processing, LLC, No. 1 l-CV-01800, 2015 WL 127930, at *7 (D.S.C. Jan 8. 2015) (citing Marisol A. v. Giuliani, 126 F.3d 372, 376-77 (2d Cir. 1997) ("[Commonality satisfied...where injuries...were alleged to have arisen 'from a unitary course of conduct by a single system'")); see also In re TD Bank, N.A. Debit Card Overdraft Fee Litig., 325 F.R.D. 136, 153 (2018) (noting uniformity, "both in definition and implementation," of policy at issue).

Plaintiffs pose multiple questions that are common to the various classes, that would generate common answers, and the resolution of which are central to the validity of the various claims. Common questions of fact include whether Defendants knew about their data security vulnerabilities, what Defendants did or did not do to address those vulnerabilities, and whether the hacker(s) exploited those vulnerabilities to exfiltrate customers' PII. Pls.' Mot. at 21. These questions of fact, and their answers, are common because every class member was subject to the same Marriott and Accenture policies and practices related to data security. Defendants' decisions (or implementation of decisions) regarding multifactor authentication, account access, account monitoring, and encryption applied company-wide and did not vary by individual guest. See Pls.' . Mot. at 9-17 (citations omitted). Nor did these decisions vary hotel by hotel; rather Defendants operated one data security system with centralized leadership. See Pls.' Mot. at 8-9; Defs.' Opp'n at 3. This uniform course of conduct contrasts sharply with the more dispersed course of conduct (i.e., allowing discretion by local supervisors to make individualized' determinations as to employment matters) that the Supreme Court rejected as insufficiently common in Wal-Mart. 564 U.S. at 355-60. Instead, Marriott and Accenture's course of conduct is more of a piece with the corporate overdraft fee policy that supported finding commonality in TD Bank, 325 F.R.D. at 152, or (perhaps even more on the nose) the corporate data security policies and practices that supported finding commonality in Brinker, 2021 WL 1405508, at *1, *8.

The common answers to the common questions of fact discussed above will ultimately generate yet more common answers to common questions of law-i.e., whether Defendants failed to adequately protect customers' PII such that they breached a duty or contract or violated a state consumer protection statute. Pls.' Mot. at 21. These are central issues, i.e., key elements, for the various claims in this lawsuit. Plaintiffs have successfully demonstrated that they satisfy the commonality requirement.

Defendants raise several concerns regarding individualized inquiries that one might apply in assessing the commonality requirement, but Defendants declined to contest commonality directly. Instead, they chose to discuss their concerns regarding individualized inquiries in the • context of the related, yet "far more demanding," Rule 23(b)(3) predominance requirement. See Amchem Prods., 521 U.S. at 624. Accordingly, the Court will address those concerns in its predominance analysis. But as for the commonality requirement of Rule 23(a), Plaintiffs have met their burden.

d. Typicality

Rule 23 (a)'s typicality requirement is that "the claims or defenses of the representative parties are typical of the claims or defenses of the class." Fed.R.Civ.P. 23(a)(3). "The essence of the typicality requirement is captured by the notion that 'as goes the claim of the named plaintiff. so go the claims of the class.'" Deiter v. Microsoft Corp., 436 F.3d 461, 466 (4th Cir. 2006) (quoting Broussard v. Meineke Disc. Muffler Shops, Inc., 155 F.3d 331, 340 (4th Cir. 1998) (quoting Sprague v. Gen. Motors Corp., 133 F.3d 388, 399 (6th Cir. 1998) (internal quotation marks omitted))). "Although a representative's claims and the claims of other members of the class need not be 'perfectly identical or perfectly aligned, '. . .the representative's pursuit of his own interests 'must simultaneously tend to advance the interests of the absent class members.'" Ealy v. Pinkerton Gov't Servs., Inc., 514 Fed.Appx. 299, 304-05 (4th Cir. 2013) (quoting Deiter, 436 F.3d at 467). "Factual differences do not necessarily render a claim atypical, but the claims must be' based on the same course of conduct and legal theory." Gresser v. Wells Fargo Bank, N.A., No. 12-987, 2014 WL 1320092, at *2 (D. Md. Mar. 31, 2014) (citing Minter v. Wells Fargo Bank, N.A., 279 F.R.D. 320, 325 (D. Md. 2012); Hewlett v. Premier Salons Int'l, Inc., 185 F.R.D. 211, 217 (D. Md. 1997)).

To conduct the typicality analysis, the Court must compare the named plaintiffs' claims or defenses with those of absent class members. Ealy, 514 Fed.Appx. at 405; Deiter, 436 F.3d at 407. The way in which the class representatives will advance their negligence, ²¹ breach of contract, and consumer protection claims is typical of the various classes.²² See Pls.' Mot. at 22 (outlining how the class representatives are advancing the same legal arguments with regards to the same course of conduct as absent class members). The reasons that the class representatives' claims are typical are very similar to the reasons that Plaintiffs satisfied commonality, and "[c]ourts have recognized that the commonality and typicality requirements...tend to merge. Spotswood, 2019 WL 498822, at *11 (citing Gen. Tel. Co. of the Sw. v. Falcon, 457 U.S, 147, 157 n.13 (1982)). In short, the class representatives and the absent members are similarly situated legally and factually because Marriott and Accenture pursued the same course of conduct as to all class members.

21 Plaintiffs' negligence claims include negligence per se claims. See Pls.' Mot. at 4-5.

22 While the elements for these claims vary somewhat by state, they are broadly similar. See Bellwether Class Certification Claims and Defenses Chart, ECF No. 982.

Defendants do not argue that the class representatives are atypical because of differences in their claims. They instead attack Plaintiffs' compliance with typicality by arguing that the class representatives are subject to unique defenses. See Defs.' Opp'n at 39-41, 59. Unique defenses defeat typicality when "they threaten to dominate the litigation, particularly when they go to the ability to prove a defendant's liability to the named plaintiffs." Gresser, 2014 WL 1320092, at *3 (citing Wu v. MAMSI Life & Health Ins. Co., 269 F.R.D. 554, 563 (D. Md. 2010); Ostrof v. State Farm Mut. Auto. Ins. Co., 200 F.R.D. 521, 529 (D. Md. 2001)).

First, Defendants argue that the class representatives' claims and defenses are not typical of the class because their contractual relationships with Marriott differ from other class members. See Defs.' Opp'n at 39-40. Specifically, each of the class representatives was a Starwood Preferred Guest ("SPG") member and, accordingly, the SPG Program Terms & Conditions contract is applicable to the class representatives. Defs.' Opp'n at 36-37 (citing Exs. 25-39)²³ The SPG Program Terms & Conditions-and the legal issues surrounding that document-would not apply to non-SPG members. Despite this significant difference in the contractual relationship, Plaintiffs have included non-SPG members in their proposed negligence and consumer protection classes. See Pls.'Mot. at4-6.²⁴

23 It appears Defendants used several incorrect exhibit numbers when citing the class representatives' depositions in their Opposition. Here, the Court has cited the correct exhibit numbers based on Defendants' reference to the depositions.

24 Plaintiffs' proposed definitions for the contract classes would only include SPG members. See Pls.' Mot. at 6-7.

Plaintiffs argue that such contractual differences do not affect their negligence claims. See Pls.' Reply at 3. Presumably, they apply the same logic to their consumer protection claims as well, although they do not explicitly say so. Nevertheless, that the SPG Terms & Conditions apply to all the named Plaintiffs, but not to a significant, number of absent class members raises serious typicality concerns.²⁵ As Defendants outline in the Bellwether Class Certification Claims and Defenses Chart, they will raise affirmative defenses stemming from provisions in the SPG Terms & Conditions and the Website Terms of Use, which are directly referenced by the SPG Terms & Conditions. See ECF No. 982; see also Defs.' Opp'n at 36-37. For example, Marriott will argue that SPG members have released Marriott from liability for its conduct and that SPG members have waived their ability to bring a class action at all. Id. These affirmative defenses will be relevant in the negligence and consumer protection context, not just the contract context. In fact, these affirmative defenses directly relate to whether Plaintiffs can use the class action device to establish liability as to their negligence and consumer protection claims. See In re Titanium Dioxide Antitrust Litig., 962 F.Supp.2d 840, 862 (D. Md. 2013) (finding lack of typicality when some class members were "subject to contractual provisions that expressly foreclose their ability to proceed in this case" and others were not).

25 This fact raises concerns related to adequacy of representation as well that the Court will address later.

Accordingly, the negligence and consumer protection classes, as currently defined, do not satisfy the typicality requirement. Nevertheless, the Court will amend the class definitions to address this typicality problem. See 7A Federal Practice and Procedure § 1760 ("[A court] has discretion to limit or redefine class [es] in an appropriate manner to bring the action within Rule 23."); see also Titanium Dioxide, 962 F.Supp.2d at 863 (redefining class because of typicality, commonality, and predominance concerns related to differences in contractual relationships). All classes are redefined to only include SPG members and so the affirmative defenses allegedly applicable to the representative parties are typical of the class.²⁶

26 Plaintiffs raise a strong argument that Defendants have waived their right to enforce the class action waiver. See Pls.' Reply at 7-9. "[A]side from a one-line, boilerplate affirmative defense, Defendants litigated this case for more than 31 months before asserting that Plaintiffs are subject to a class waiver. Defendants did not raise it as part of the bellwether negotiation process, address it in dozens of meet-and-confer and scheduling conferences, or raise it as part of any, motion practice [prior to Defs.' Opp'n]." Id. at 8. Nevertheless, the Court need not rule on this issue at this time. Given that the Court has amended the class definitions, all class members will have the same (or substantially similar) contractual relationship with Marriott. Rule 23 typicality, adequacy, and predominance issues are thus not present. Therefore, the Court may address the Class action wavier defense-as it will all affirmative defenses-at the merits stage of the litigation. At that time when all discovery is complete, the Court can consider the arguments both parties have made as to the applicability of contractual provisions, such as the class action waiver, as well as the arguments related to waiver of the waiver provision. Any ruling on those issues will apply to all class members.

Accenture advances a second-and separate-argument related to typicality and unique defenses. It argues that Bellwether Plaintiff Amarena of Connecticut is an atypical class representative because she stayed at only one Starwood hotel, and that stay occurred before Accenture took on data security for Starwood. See Defs.' Opp'n at 59. The Court does not see how the number of stays or whether the stays occurred before Accenture contracted with Starwood matters in the context of her negligence claim. By virtue of her PII being stored by Starwood while Accenture provided data security, Ms. Amarena was just as foreseeable a victim of Accenture's alleged failure to adequately protect that PII as someone who stayed at Starwood properties dozens of times or someone who stayed at a Starwood property after Accenture's contract with Starwood began. The "measure of attenuation between [the defendant's] conduct, on the one hand, and the consequences to and the identity of the plaintiff, on the other hand," id. (quoting RK Constructors, Inc. v. Fusco Corp., 650 A.2d 153, 156-57 (1994)), would be the same for all individuals whose PII was stored with Starwood under Accenrure's watch.²⁷

27 It may very well be that Accenrure's conduct is too attenuated to establish liability-that is an issue to resolve later-but the measure of attenuation would be the same for all class members.

e. Adequacy of Representation

Rule 23 (a)'s adequacy requirement is that "the representative parties will fairly and adequately protect the interests of the class." Fed.R.Civ.P. 23(a)(4). "The adequacy inquiry under Rule 23 (a)(4) serves to uncover conflicts of interest between named parties and the class they seek to represent." Amchem Prods., 521 U.S. at 625. "'[A] class representative must be part of the class and '"possess the same interest and suffer the same injury'" as the class members.'" Id. at 625-26 (quoting E. Tex. Motor Freight Sys., Inc. v. Rodriguez, 431 U.S. 395, 403 (1977) (quoting Schlesinger v. Reservists Comm. to Stop the War, 418 U.S. 208, 216 (1974))). "Determining adequacy of representation...requires the Court to determine: (1) whether the named plaintiffs...have any conflicts of interest with other class members; and (2) whether the named plaintiffs... will prosecute the action vigorously on behalf of the entire class." Parker, 2015 WL 127930, at *8 (citing Thorn v. Jefferson-Pilot Life Ins. Co., No. 00-2782-22, 2004 WL 5745993, at *7 (D.S.C. Dec. 2, 2004), aff'd and remanded, 445 F.3d 311 (4th Cir. 2006) (citing Hanlon v. Chrysler Corp., 150 F.3d 1011, 1020 (9th Cir. 1998))).²⁸

28 While district courts' adequacy analysis under Rule 23(a)(4) traditionally evaluated the adequacy of class representatives and class counsel, the 2003 amendments to Rule 23 indicate that courts should change this approach. Adequacy of class representatives should still be analyzed under Rule 23(a)(4), but adequacy of class counsel should be analyzed separately under Rule 23(g)-a new subdivision created in 2003. See 1 Newberg § 3:80 ("The Advisory Committee noted that Rule 23(g) migrated the discussion of counsel's adequacy away from 23(a)(4), writing: 'Rule 23(a)(4) will continue to call for scrutiny of the proposed class representative, while this subdivision will guide the court in assessing proposed class counsel as part of the certification decision.'") Courts have been slow to adapt to this change, but "locating] [a court's] entire discussion of class counsel within the 23(g) analysis and restricting] [a court's] analysis under Rule 23(a)(4) to the topic of adequacy of the proposed class representative" appears to be the approach "intended by the rule makers" and "has the backing of the only circuit court decision directly on the topic." Id. (citing Sheinberg v. Sorensen, 606 F.3d 130, 132-35 (3d Cir. 2010)). Accordingly, the Court will address the adequacy of class counsel separately under Rule 23(g) in this Memorandum Opinion's conclusion. See, e.g., Earl, 339 F.R.D at 420 n.15.

"[T]here is an overlap between the requirement of adequacy of representation and the requirement of typicality." Wu, 269 F.R.D. at 564 (citing Gen. Tel. Co. of Sw., 457 U.S. at 157-58). Accordingly, the contractual relationship differences that raised concerns with regards to typicality also raise concerns with regards to adequacy. Had the Court not redefined the classes already, the class representatives would not have satisfied the adequacy requirement for the same reasons that they would not have satisfied typicality. However, because the classes have been redefined, those concerns that would have prevented a finding of adequate representation have fallen away.

With the classes redefined, Plaintiffs satisfy the first prong of the adequacy requirement. The named Plaintiffs' interests are not opposed to those of other class members. The named Plaintiffs suffered the same alleged injuries as the absent class members, and the absent class members would receive the same forms of damages should the named Plaintiffs succeed in this litigation. Other than the previously resolved differences in contractual relationships and a minor nominal damages issue, ²⁹ Defendants do not raise any intraclass conflict issues.

29 Defendants rely upon Gardner v. Equifax Info. Servs., LLC, No. 06-CV-3102, 2007 WL 2261688, at *5 (D. Minn. Aug. 6, 2007), to argue that Plaintiffs' pursuit of nominal damages could raise adequacy (and typicality) concerns. In Gardner, the named plaintiffs voluntarily forwent a claim for actual damages in order to pursue statutory damages only. Id. Thus, the court was concerned that absent class members would be forced to forego their own claims for actual damages unless they opted out of the class. Id. The court believed that the proposed opt-out" measures for absent class members to retain their possible "significant actual damage claims" was too great a burden considering failure to opt out would result in an adverse res judicata effect for such individuals. Id. Accordingly, the court found that the class representatives were inadequate. Id. However, Gardner is inapplicable to the present litigation. Plaintiffs are not voluntarily foregoing actual damages. In fact, they are pursuing actual damages on behalf of the proposed classes. Defendants' argument does nothing to alter the Court's view that Plaintiffs have satisfied the adequacy (and typicality) requirement.

Plaintiffs also satisfy the second prong of the adequacy requirement. The class representatives have demonstrated that they will vigorously pursue the claims of the class. As Plaintiffs note, the class representatives have "participated actively in this case by reviewing pleadings, responding to significant discovery (including enduring forensic scans of their electronic devices, engaging in supplemental document collections to address questions from defense counsel, supplementing their discovery responses several times, and reviewing extensive productions of documents from third parties...and sitting for lengthy depositions." Pls.' Mot. at 23-24; see also Defs.' Exs. 14-19, 25-54. These actions show the named Plaintiffs' commitment to representing the class.

III. Rule 23(b)(3) Damages Classes

a. Proposed Classes

Plaintiffs seek to certify a total of thirteen classes and subclasses for damages. The classes are grouped into three categories, which I will refer to as the Negligence Classes, the Contract Classes, and the Consumer Protection Classes. These classes correspond to the remaining bellwether claims. Some of the putative classes seek relief from both Marriott and Accenture, while others seek relief from either Marriott or Accenture only. Pursuant to these proposed classes, Plaintiffs seek classwide damages related to overpayment for hotel stays, the loss of the market value of their PII, statutory damages, and nominal damages.³⁰

30 Plaintiffs also allege claims for individual damages, such as time spent monitoring accounts or out-of-pocket expenses for credit monitoring or fraudulent charges. However, plaintiffs do not seek to certify these damages for classwide treatment, and instead propose issue classes under Rule 23(c)(4) to bifurcate liability and damages issues-the former to receive classwide treatment and the latter to be resolved through follow-on individual determinations.

Plaintiffs seek to certify the following Negligence Classes:

Florida Negligence Class (Against Marriott and Accenture)

All natural persons residing in Florida whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018. The proposed Class Representatives are Irma Lawrence, Michaela Bittner, and Kathleen Frakes Hevener.

Georgia Negligence Per Se Class (Against Marriott and Accenture)

All natural persons residing in Georgia whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018. The proposed Class Representatives are Brent Long and David Viggiano.

Maryland Negligence Class (Against Accenture Only)

All natural persons residing in Maryland whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018. The proposed Class Representative is Peter Maldini.

Connecticut Negligence Class (Against Accenture Only)

All natural persons residing in Connecticut whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018. The proposed Class Representative is Anne Marie Amarena.

Connecticut Negligence Per Se Class (Against Accenture Only)

All natural persons residing in Connecticut whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018. The proposed Class Representative is Anne Marie Amarena.

Pls.'Mot. at 4-5.

Plaintiffs seek to certify the following Contract Classes:

Maryland Breach of Contract Class (Against Marriott Only)

All natural persons residing in Maryland who had a Starwood Preferred Guest ("SPG") membership and whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 3 0, 2018. The proposed Class Representative is Peter Maldini.

Maryland Breach of Contract Benefit of the Bargain Subclass (Against Marriott Only)

All natural persons residing in Maryland who had a Starwood Preferred Guest ("SPG") membership and who paid for a stay at a Starwood property and whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018. The proposed Class Representative is Peter Maldini.

New York Breach of Contract Class (Against Marriott Only)

All natural persons residing in New York who had a Starwood Preferred Guest ("SPG") membership and whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018. The proposed Class Representatives are: Roger Cullen, Eric Fishon, and Paula O'Brien.

New York Breach of Contract Benefit of the Bargain Subclass (Against Marriott Only)

All natural persons residing in New York who had a Starwood Preferred Guest ("SPG") membership and who paid for a stay at a Starwood property and whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018. The proposed Class Representatives are: Roger Cullen, Eric Fishon, and Paula O'Brien.

Pls.' Mot. at 6-7.

Plaintiffs seek to certify the following Consumer Protection Classes:

California Unfair Competition Law ("UCL") Class (Against Marriott Only)

All natural persons residing in California who paid for a stay at a Starwood property and whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018. The proposed Class Representatives are Robert Guzikowski, Denitrice Marks, and Maria Maisto.

Maryland Consumer Protection Act ("MCPA") Class (Against Marriott Only)

All natural persons residing in Maryland who paid for a stay at a Starwood property and whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018. The proposed Class Representative is Peter Maldini.

Michigan Identity Theft Protection Act ("ITPA") Class (Against Marriott Only)

All natural persons residing in Michigan whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018. The proposed Class Representatives are Bryan Wallace and Laura Gononian.

New York General Business Law ("GBL ") Class (Against Marriott Only)

All natural persons residing in New York who paid for a stay at a Starwood property and whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018. The proposed Class Representatives are: Roger Cullen, Eric Fishon, and Paula O'Brien.

Pls.' Mot. at 5-6.

Each of these proposed classes must satisfy the requirements of Rule 23(b)(3), analyzed below. Before turning to those requirements, however, I will first address the applicability of Plaintiffs' two classwide theories of harm to this analysis.

b. Classwide Theories of Harm

Plaintiffs assert that two theories of harm support the certification of "full" damages classes. First, Plaintiffs argue that their overpayment theory is consistent with classwide damages. That overpayment theory can be summarized as follows: Marriott was able to charge higher prices for hotel rooms than they would have in a hypothetical "but-for" world in which consumer willingness to pay for a hotel room had shifted in response to consumer knowledge of Starwood's inadequate data security; consequently, named plaintiffs overpaid for their respective hotel stays as a result of Marriott's alleged data security failures. In the companion Daubert opinion, the Court determined that Plaintiffs' model calculating damages pursuant to this theory is admissible under Federal Rule of Evidence 702-at least for purposes of ruling on class certification. Plaintiffs are seeking compensatory damages under the overpayment theory for their contract and consumer protection claims. The overpayment theory is also relevant to Plaintiffs' request for statutory damages under New York's consumer protection statute and nominal damages under Maryland and New York contract law as an overpayment injury may supply the underlying injury required to seek those damages. Plaintiffs conceded at the class certification hearing that they are not seeking compensatory damages under the overpayment theory for their negligence claims.

Second, Plaintiffs assert that their loss of market value of PII theory is consistent with classwide damages. Contending that Starwood customers' PII had market value, Plaintiffs argue that putative class members lost that value when hackers gained access to, and/or exported, PII from the NDS database. While one could conceive of multiple ways of defining-and calculating market value-Plaintiffs and their expert Dr. Prince chose a loss of revenue (to individual class members) approach. Dr. Prince estimated the prices at which various combinations of Plaintiffs' PII (e.g., email address, phone number, credit card number, passport number) could be sold by entities (whether legal or illegal) that sell consumer data to others, in order to calculate the revenue these sales would have generated for each class member. Unlike the model accompanying the overpayment theory, the Court rejected Plaintiffs' loss of market value model under Rule 702.

In correspondence with the Special Master, see ECF No. 993, and at both the Daubert and class certification hearings, Plaintiffs raised another methodology by which one could measure market value-Marriott's own valuation of the monetary value of reward customers' PII to Marriott.³¹ As Judge Facciola noted in his Report and Recommendations on this issue, this methodology is disconnected from Dr. Prince's chosen model-and the conceptualization of Plaintiffs' theory underlying that model-and so it was irrelevant to the Daubert issues already addressed by the Court in its companion opinion. However, one can understand how this valuation . might be used to demonstrate damages on a classwide basis. This approach, though, has not been adequately developed on the record at this time. Without an accepted damages model, the loss of market value theory cannot support class certification today-even as to liability. In the absence of a working damages model that fleshes out the loss of market value theory, too many open questions remain as to individualization to satisfy the predominance requirement. A working model could show the Court how it should understand fact of injury, injury causation, etc. under a loss of market value theory.

31 Pursuant to a California Consumer Privacy Act ("CCPA") regulation that took effect August 20, 2020, Marriott publicly provided a valuation of Bonvoy Program members' PII. ECF No. 993-3. (Bonvoy is Marriott's customer rewards program. Id.) Marriott represented that members' PII was worth, on average, approximately $0.42 per consumer in 2021 to Marriott. ECF No. 993-2.

Taking into account my ruling on the Daubert motion, the emergence of Marriott's own valuation of customers' PII, and the undeveloped nature of the record on this issue, I DENY WITHOUT PREJUDICE Plaintiffs' motion for class certification as to damages (and liability) classes that would rely on the loss of market value theory. Following the issuance of this opinion and its accompanying order, the Court will schedule a call with the parties to discuss issues related to Marriott's valuation of customers' PII. The Court will ask Plaintiffs to further describe what discovery they seek on these issues and the mechanics of the discovery. The Court will hear from Defendants as well and schedule further communications with the parties as needed.

With the loss of market value theory presently excluded as a theory of harm, the remaining Rule 23(b)(3) analysis will focus on the overpayment theory.³²

32 As Plaintiffs are not seeking overpayment damages for their negligence claims, those claims will not be discussed in the Damages Classes section. Instead, the Court will only address the negligence claims in the context of issues certification. (Plaintiffs do seek nominal damages for their negligence claims, but they cannot pursue those damages at this time as neither the overpayment theory nor loss of market value theory is presently available to Plaintiffs for use in their negligence claims.)

c. Predominance

Rule 23(b)(3)'s requirement that common questions of law or fact predominate over individual ones is similar to, but "far more demanding" than Rule 23 (a)'s commonality requirement. Amchem Prods., 521 U.S. at 623-24; Stanley v. Cent. Garden & Pet Corp., 891 F.Supp.2d 757, 771 (D. Md. 2012). "An individual question is one where 'members of a proposed class will need to present evidence that varies from member to member,' while a common question is one where 'the same evidence will suffice for each member to make a prima facie showing [or] the issue is susceptible to generalized, class-wide proof" Tyson Foods, 577 U.S. at 453 (quoting 2 Newberg § 4:50 (5th ed. 2012)). In conducting the predominance analysis, a court first characterizes issues as common or individual. 2 Newberg § 4:50 (5th ed. 2021). Then, it '"asks whether the common, aggregation-enabling, issues in the case are more prevalent or important than the non-common, aggregation-defeating, individual issues.'" Tyson Foods, 577 U.S. at 453 (quoting 2 Newberg § 4:49 (5th ed. 2012)). "This is not simply a matter of counting common versus noncommon questions and checking the final tally. 'Rule 23(b)(3)'s [predominance] test is qualitative rather than quantitative.'" Soutter, 307 F.R.D, at 214 (quoting Stillmock v. Weis Mkts., Inc., 385 Fed.Appx. 267, 272 (4th Cir. 2010) (citing Gunnells, 348 F.3d at 429)). "If the 'qualitatively overarching issue[s]' are common, a class may be certified notwithstanding the need to resolve individualized issues." Id. (citing Ealy, 514 Fed.Appx. at 305). Thus, Rule 23(b)(3) "does not require a plaintiff seeking class certification to prove that each "elemen[fj of [her] claim [is] susceptible to classwide proof," but it "does require [] that common questions 'predominate over any questions affecting only individual [class] members.'" Amgen Inc., 568 U.S. at 469 (quoting Fed. Rule Civ. P. 23(b)(3)) (emphasis in Amgen, internal citation omitted). Ultimately, the predominance inquiry '"tests whether proposed classes are sufficiently cohesive to warrant adjudication by representation.'" Tyson Foods, 577 U.S. at 453 (quoting Amchem Prods., 521 U.S. at 623).

"Rule 23(b)(3) is normally satisfied where there is an essential common factual link, such . as standardized documents and practices, even though the nature and amount of damages may differ among class members." TD Bank, 325 F.R.D. at 154 (citations omitted). "[T]he glue binding this putative class action" is Defendants' data security policies and practices and the form contract outlining Defendants' responsibilities to class members regarding data protection to which all class members are subject. Cf. Earl, 339 F.R.D. at 435. This glue is strong enough such that Plaintiffs have satisfied the predominance requirement across two varieties of claims-breach of contract and consumer protection--as to the overpayment theory.³³ Defendants ably raise a number of important issues that they argue preclude a finding of predominance: injury, payment, contractual relationships, causation, reliance, exposure, affirmative defenses, ³⁴ and damages. Some of these issues are applicable to each of Plaintiffs' claims; others are specific to a particular type of claim. After weighing all the arguments, these issues do not defeat predominance for the overpayment theory-at least for a majority of the putative classes for which that theory is applicable.³⁵

33 Plaintiffs have not satisfied predominance as to every single claim though within those categories, nor have they satisfied predominance for full liability or damages as to the non-overpayment theories.

34 Defendants specifically addressed the statute of limitations defense. See Defs.' Opp'n at 51.

35 Plaintiffs are pursuing the overpayment theory via their claims against Marriott only. See Pls.' Reply at 28. The theory is inapplicable to Accenture.

1. Standing, Predominance, and Overpayment Theory

I have addressed Defendants' concern regarding uninjured class members and predominance previously in the standing section. To briefly summarize, Defendants argue that class members under the original class definitions would include many individuals who received reimbursement for their hotel stays and who booked outside the damages period. These individuals suffered no injury and had no standing under the overpayment theory. Consequently, legal issues of standing would defeat predominance. Taking stock of this argument, the Court has already redefined the classes so that only individuals who bore the ultimate economic burden of a hotel stay and only individuals who made reservations during the damages period are included. Thus, this predominance argument is no longer applicable. Having address this threshold predominance issue, the Court now turns to a predominance analysis by claim type.

2. Breach of Contract Claims

"Considering whether 'questions of law or fact common to class members predominate' begins, of course, with the element's of the underlying cause of action." Erica P. John Fund, Inc. v. Halliburton Co., 563 U.S. 804, 809 (2011). The essential elements of breach of contract in the bellwether states are broadly similar. Under Maryland law, "[f]he elements of a claim for breach of contract include 'contractual obligation, breach, and damages.'" Tucker v. Specialized Loan Servicing, LLC, 83 F.Supp.3d 635, 655 (D. Md. 2015) (quoting Kumar v. Dhanda, 17 A.3d 744, 749 (Md. Ct. Spec. App. 2011)). Under New York law, "the elements of a breach of contract claim are (1) the existence of a contract, (2) the plaintiffs performance, (3) the defendant's breach, and (4) resulting damages." Alloy Advisory, LLC v. 503 West 33rd St. Assoc, Inc., 195 A.D.3d 436, 436 (N.Y.App.Div. 2021) (Mem.) (citing Harris v. Seward Park Hous. Corp., 79 A.D.3d 425, 426 (N.Y.App.Div. 2010)).

"[C]ourts properly refuse to certify breach of contract class actions where the claims require examination of individual contract language." In re U.S. Foodservice Pricing Litig., 729 F.3d 108 (2d Cir. 2013) (citing Broussard, 155 F.3d at 340; Spencer v. Hartford Fin. Servs. Grp, Inc., 256 F.R.D. 284, 304 (D. Conn. 2009) (declining to certify class for breach of contract claims where contracts defined cost and value differently such that the language of each contract "would need to be carefully considered to determine whether defendants breached each contract at issue"); Sprague, 133 F.3d at 398 (decertifying class of early retirees in ERISA case where "side deals" contained myriad variations as to what each retiree Was promised)). Because the examination of individual contract language defeats class certification, contract claims that are successfully certified for class action typically involve form contracts. "It is the form contract, executed under like conditions by all class members, that best facilitates class treatment." Sacred Heart Health Sys., Inc. v. Humana Mil. Healthcare Servs., Inc., 601 F.3d 1159, 1171 (11th Cir. 2010) (citations omitted); see also TD Bank, 325 F.R.D. at 155 ("Rule 23(b)(3) predominance is therefore satisfied.' This conclusion arises from the fact that TD's checking account policies and practices were governed by form contracts with terms applicable to Plaintiffs and class members alike.") "[Standardized agreements should be 'interpreted wherever reasonable as treating alike all those similarly situated, without regard to their knowledge or understanding of the standard terms of the writing."' Id. at 157 (D.S.C. 2018) (quoting Restatement (Second) of Contracts § 211(2)).

The contract at issue here-the SPG Terms & Conditions and its incorporated elements like Starwood's Privacy Statement-is a classic form contract. See Pls.' Tab 50. What's more, it is a classic contract of adhesion, "involving non-negotiable terms and a vast bargaining/information imbalance between the parties." See Id. Starwood offered the SPG Terms & Conditions on a "take-it-or-leave-it basis," see Id. (quoting Simpson v. MSA of Myrtle Beach, Inc., 644 S.E.2d 663, 669 (S.C. 2007)), with no individualized negotiations.

The written contract itself does not vary person by person. See Pls.' Tab 50.³⁶ It is similar in its consistency to the standardized checking account agreement at issue in TD Bank that warranted a finding of predominance in that case. See TD Bank, 325 F.R.D. at 155-59. The contract standardization makes this case dissimilar from those where variation between class members' written contracts defeated class certification. Cf EQT Prod. Co., 764 F.3d at 367-68 (involving leases with language that varied with regards to the payment of royalties and post-production deductions); Broussard, 155 F.3d at 340 (involving franchise and trademark agreements with language that varied with regards to authorizing use of funds for advertising). Further, there is no evidence of individualized side agreements-oral or written-that supplemented or altered the form contract. Cf. Broussard, 155 F.3d at 340-41 (involving plaintiffs who "relied heavily on audiotapes of non-standard final review sessions" before signing contract). In other words, there is no need for individualized extrinsic evidence to interpret the contract.

36 Marriott attempts to cast doubt on this uniformity by noting that the SPG Program Terms and Website Terms of Use "went through several iterations since 2002," Defs.' Opp'n at 40 (citing Pls.' Tab 43). However, Plaintiffs note that the relevant contractual language has not changed since 2002, and further, each iteration of the contract "supersede[d] all previous terms and conditions." Pls.' Reply at 4 (quoting Pls.' Tab 50). Plaintiffs' response on this point is persuasive-the SPG members are all similarly situated as to the relevant terms of the contract.

Because all the class members are subject to this same form contract, ³⁷ common questions predominate-i.e., "the same evidence will suffice for each member to make a prima facie showing" of breach of contract, or at least "the issue is susceptible to generalized, class-wide proof." See Tyson Foods, 577 U.S. at 453 (quoting 2 Newberg § 4:50). Establishing contractual obligation or the existence of a contract relies upon the same set of facts for each class member. See Pls.' Mot. at 29. The Court will look to the standardized agreement to determine what obligations Marriott undertook to protect class members' data. Establishing breach will similarly rely upon the same evidence for each class member. That evidence will include Plaintiffs' expert Mary Frantz's report, Pls.' Tab 4, and the documents and testimony upon which it is based. See, . e.g., Pls.'Tabs 17, 19.

37 Because the Maryland and New York contract classes are limited to SPG members, each class member was subject to the SPG contract. See Pls.' Mot. at 27 (citing Tab 50).

i. Affirmative Defenses

Affirmative defenses "must be factored into the calculus of whether common issues predominate." Gunnells, 348 F.3d at438. "[W]hen the defendants' affirmative defenses...may depend on facts peculiar to each plaintiffs case, class certification is erroneous." Id. (quoting Broussard, 155 F.3d at 342). Some have interpreted this statement as establishing a per se rule in the Fourth Circuit precluding a finding of predominance if there are any individualized issues raised by affirmative defenses. See Waste Mgmt. Holdings, Inc. v. Mowbray, 208 F.3d 288, 296 n.4 (1st Cir. 2000). However, such an interpretation is implausible given the Fourth Circuit's post-Broussard jurisprudence. At the very least, individualized issues that can be resolved by "ministerial" exercises do not preclude predominance. See Alig v. Quicken Loans Inc., 990 F.3d 782, 792-93 (4th Cir. 2021), vacated and remanded for other reasons, 142 S.Ct. 748 (2022). Further, interpreting that statement in Broussard as a per se rule would be inconsistent with the overall approach to Rule 23(b)(3): "The predominance inquiry 'asks whether the common, aggregation-enabling, issues in the case are more prevalent or important than the non-common, aggregation-defeating, individual issues.'" Tyson Foods, 577 U.S. at 453 (quoting 2 Newberg § 4:50) (emphasis added). If any individualization defeated predominance, this inquiry related to prevalence and importance would be irrelevant. While the Fourth Circuit may take a stricter approach compared to other circuits, see 2 Newberg § 4:55 (5th ed. 2021), it still follows the basic principle of Rule 23(b)(3) when analyzing affirmative defenses in the predominance context. As with all other aspects of class certification, Plaintiffs bear the burden of showing compliance with Rule 23 as to this issue. See Thorn, 445 F.3d at 321-22.

Defendants note several affirmative defenses that they plan to raise. See Bellwether Class Certification Claims and Defenses Chart, ECF No. 982. Defendants focused on contractual defenses, such as class action waiver and limitation of liability, and the statute of limitations defense in their briefing. See Defs.' Opp'n at 36-42. As explained above, all class members will have the same, or substantially similar, contractual relationship with Marriott, and, so, these affirmative defenses will not raise individualized issue's that defeat predominance. Resolving issues related to the applicability and waiver of these contractual defenses will not involve individualized inquiries because of the amended class definitions. Accordingly, the Court will spend more time addressing the statute of limitations issue than the other defenses.³⁸

38 In the parties' jointly submitted Bellwether Class Certification Claims and Defenses Chart, ECF No. 982, Defendants noted affirmative defenses they may raise beyond the contractual defenses and statute of limitations defense. However, at this time, the Court does not see how those other affirmative defenses raise predominance issues--at least as to the overpayment theory. Defendants did not raise these other affirmative defenses in their briefing with regards to the damages classes, and, therefore, the Court will not address them at this time.

ii. Statute of Limitations

When "the statute-of-limitations question is straightforward and susceptible to class-wide determination," it does not defeat predominance. Alig, 990 F.3d at 792. A statute of limitations question that can be answered by referring to objective information to determine whose claims fall inside and outside the applicable limitations period does not defeat predominance. See Id. at 792-93. In other words, individual variation may exist between plaintiffs. A statute of limitations question that that can only be answered by analyzing "the contents of the plaintiffs mind," on the other hand, defeats predominance. See Thorn, 445 F.3d at 320-21.

Defendants assert that each putative class member's breach of contract cause of action accrued at a distinct time-when the individual gave his or her PII to Starwood. See Defs.' Opp'n at 42 (citing Few v. Excellus Health Plan, Inc., 502 F.Supp.3d 724, 736 (W.D.N.Y. 2020)). These differences, Defendants contend, present individualized issues that preclude a finding of predominance. See Id. Plaintiffs counter that Defendants are relying upon an inapplicable theory of liability to make this argument. See Pls.' Reply at 27. Plaintiffs assert that each class member's cause of action accrued at the same time-when Plaintiffs' PII "was exfiltrated from Defendants' network in November 2018"-so no individualized inquiries on this score are required. See Id. However, as Plaintiffs argue in the alternative, see Id. at 27-28, even if individual class members' causes of action accrued at different points in time and some members' claims are time-barred, the Court can mechanically determine whose claims are time-barred by referring to the hotel reservation dates in the NDS database. This type of individual inquiry will certainly not outweigh the common issues in the ease.³⁹ It is quintessentially "straightforward and susceptible to class-wide determination." Alig, 990 F.3d at 792. Without resolving the dispute between the parties as to when the statute of limitation began running, the Court finds that predominance is not defeated by this particular affirmative defense.⁴⁰

39 For comparison, consider that individual damages calculations of a mechanical nature do not defeat predominance. See 4 Newberg § 12:5.

40 The Court can resolve the underlying statute of limitations dispute at the merits stage.

3. Consumer Protection Claims

i. New York General Business Law ("GBL") § 349 Class

In a private action under GBL § 349, a consumer must establish "(1) the defendant's conduct was consumer-oriented; (2) the defendant's act or practice was deceptive or misleading in a material way; and (3) the plaintiff suffered an injury as a result of the deception." Himmelstein, McConnell, Gribben, Donoghue & Joseph, LLP v. Matthew Bender & Co., Inc. , 171 N.E.3d. 1192, 1197 (N.Y. 2021). Section 349 actions "do[] not require proof of actual reliance." McCracken v. Verisma Sys., Inc., 131 F.Supp.3d 38, 48 (W.D.N.Y.2015) (citations omitted). Instead of showing reliance, the plaintiff must demonstrate that a deceptive practice, such as a misrepresentation or omission, is "likely to mislead a reasonable consumer acting reasonably under the circumstances"-an objective test. Dupler v. Costco Wholesale Corp., 249 F.R.D. 29, 43 (E.D.N.Y. 2008) (quoting Maurizio v. Goldsmith, 230 F.3d 518, 521 (2d Cir. 2000) (quoting Oswego Laborers' Local 214 Pension Fund v. Marine Midland Bank, N.A., 647 N.E.2d 741, 744-45 (N.Y. 1995))).⁴¹ Of course, to conduct this analysis, one must at least know whether a plaintiff was "exposed" to the allegedly deceptive conduct even if one does not need to know whether he or she relied upon the conduct. See Fero, 502 F.Supp.3d at 740:

41 Omissions are actionable under Section 349. See Dupler, 249 F.R.D. at 43 (citing Henry v. Rehab Plus Inc., 404 F.Supp.2d 435, 445 (E.D.N.Y. 2005)).

That Plaintiffs need not show reliance reduces the possibility that individualized inquiries will outweigh common issues. Yet, Defendants still argue that Plaintiffs cannot satisfy predominance as to the Section 349 claims. Defendants contend that individualized inquiries will be required to determine exposure, and these inquiries will overwhelm the common issues. See Defs.' Opp'n at 44-45. This contention hinges on Defendants' view that Plaintiffs have failed to demonstrate that class members were uniformly exposed to the allegedly deceptive conduct. Id. Whatever merit that argument had originally, it now falls flat as the Court has already limited the consumer protection class definitions to SPG members only. SPG members "were subjected to the same or similar putative misrepresentations or omissions" as they all received the same contract and did not have individualized negotiations with Marriott. TD Bank, 325 F.R.D. at 161, ⁴² Contrary to Marriott's assertion, the Court does not see a "mixed bag of interactions" between individual class members and the company. See Defs.' Opp'n at 45 (citing Fero, 502 F.Supp.3d at 740). Instead, the Court sees incredibly similar interactions between individual class members and Marriott.⁴³ In such circumstances involving uniform disclosures, "courts have certified Rule 23(b)(3) classes under [New York's] consumer protection statute[]." TD Bank, 325 F.R.D. at 161 (citing In re Checking Account Overdraft Litig., 281 F.R.D. 667, 681 (S.D.' Fla. 2012)).

42 Plaintiffs may argue that this analysis is unnecessary as they are only seeking class certification based on Marriott's omissions, Pls.' Reply at 9 n.6, and "thus no individual issues of what the defendant[]^said will predominate." Id. at 9 (quoting Dupler, 249 F.R.D. at 44 (quoting In re Coordinated Title Ins. Cases, 784 N.Y.S.2d 919, at *7 (N.Y. Sup. Ct. 2004))). Nevertheless, I find it prudent to grapple with Defendants' arguments here.

43 I am satisfied at this time that the SPG member limitation has adequately addressed concerns regarding individualized exposure inquiries. Even if class members used different means of booking reservations with Marriott, they are all SPG members and received (or do not receive) disclosures related to data security through that membership. Should this, conclusion be upended by further developments in this litigation, the Court may modify its class certification order. See In re Visa Check/MasterMoney Antitrust Litig, 280 F.3d 124, 141 (2d Cir. 2001) (Sotomayor, J.); see also 2 Newberg § 4:80.

In addition to challenging predominance based on the exposure issue, Defendants argue that New York's statute of limitations for consumer fraud raises individualized issues that overwhelm common issues in this case. See Defs.' Opp'n at 41-42. For the same reasons that New York's statute of limitations for breach of contract did not defeat predominance, issues related to New York's consumer fraud statute of limitations do not defeat predominance.

Given this analysis related to exposure and the statute of limitations, the Court finds that the predominance requirement as to liability for the New York GBL § 349 class is satisfied.

ii. Maryland Consumer Protection Act ("MCPA") Class

In a private action under the MCPA, a consumer must establish "(1) an unfair or deceptive practice.. .that is (2) relied upon, and (3) causes them actual injury." Bey v. Shapiro Brown & Alt, LLP, 997 F.Supp.2d 310, 319 (D. Md. 2014). A deceptive practice has been defined to include a "[f]ailure to state a material fact if the failure... tends to deceive." Tait v. BSH Home Appliances Corp., 289 F.R.D. 466, 484 (CD. Cal. 2012) (quoting Md. Code Ann., Com. Law § 13-301(3))⁴⁴ The MCPA is distinct from the New York GBL § 349 because it requires reliance, and "[i]t is true that reliance as an element of proof typically forecloses class treatment because of the individualized questions it raises." TD Bank, 325 F.R.D. at 161. However, it does not foreclose class, treatment in this case.

44 Plaintiffs are pursuing class certification based on Marriott's alleged omissions. Pls.' Reply at 9 n.6.

Under the MCPA, whether the failure to state a material fact tends to deceive is "judged from the point of view of a reasonable, but unsophisticated consumer." Tait, 289 F.R.D. at 484 (quoting Sager v. Hous. Comm 'n of Anne Arundel Cty., 855 F.Supp.2d 524 (D. Md. 2012) (citing Luskin's, Inc. v. Consumer Prot. Div., 726 A.2d 702, 713 (1999))). The use of an objective test to determine materiality allows courts to presume classwide reliance under the MCPA when the alleged omission is uniformly applicable to the putative class. See TD Bank, 325 F.R.D. at 161-62 (citing Tait, 289 F.R.D. at 484 ("[T]he MPCA imposes an objective test whereby a plaintiffs reliance on a defendant's omission can be presumed by the materiality of the omitted fact."); Demmick v. Cellco P'ship, No. Civ.A. 06-2163 JLL, 2010 WL 3636216, at *23 (D.N.J. Sept. 8, 2010) (presuming satisfaction of reliance element under the specific circumstances of the claim, and certifying MCPA subclass based on uniform, material misrepresentation)).

As outlined in the New York consumer protection analysis, the Court is persuaded that the alleged omissions were uniformly made to the putative class, and the objective test under the MCPA will afford Plaintiffs the opportunity to prove their claims without individualized inquiries overwhelming the common issues. Accordingly, the Court finds that the predominance requirement as to liability for the MCPA class is satisfied.

iii. California Unfair Competition Law ("UCL") Class

As in a MCPA action, reliance is an element in establishing "deceptive or fraudulent acts or practices" in a UCL action. See Watkins v. MGA Entm't, Inc., 550 F.Supp.3d 815, 833-34 (N.D. Cal. 2021) (citations omitted).⁴⁵ However, in UCL class actions involving these acts or practices, i.e., misrepresentations or omissions, class members "are not required to prove their individual reliance on the allegedly misleading statements [or omissions]." Bradach v. Pharmavite, LLC, 735 Fed.Appx. 251, 254 (9th Cir. 2018) (emphasis added). Instead, the standard in class actions under the UCL is whether "members of the public are likely to be deceived"-an objective test. Id. (quoting Kasky v. Nike, Inc., 45 P.3d 243, 250 (2002), as modified (May 22, 2002)) (internal quotations omitted). "UCL.. .claims that rely on a theory of fraudulent omission [as is the case here] are also susceptible to classwide proof because under California law, reliance can be inferred when an omission is material, and whether an omission is material is determined using a 'reasonable consumer' standard." In re Arris Cable Modem Consumer Litig., 327 F.R.D. 334, 365 (N.D. Cal. 2018) (citing Daniel v. Ford Motor Co., 806 F.3d 1217, 1225 (9th Cir. 2015); McAdams v. Monier, Inc., 182 Cal.App.4th 174, 178 (Cal.Ct.App. 2010)).⁴⁶ At least one court has stated that UCL claims are "ideal for class certification because they will not require the court to investigate class members' individual interaction with the product." Id. at 254-55 (quoting Tait, 289 F.R.D. at 480). Of course, this statement assumes that class members were uniformly exposed to the conduct at issue. See Mazza v. Am. Honda Motor Co., 666 F.3d 581, 595-96 (9th Cir. 2012) (citations Omitted).

45 Plaintiffs allege at least three violations of law that serve as predicates for their UCL claim, and each predicate has its own elements in addition to elements common to all UCL claims. See Compl. at ¶¶ 452-55; Bellwether Class Certification Claims and Defenses Spreadsheet, ECF No. 982. For purposes of summary judgment or trial, each element is important, but for class certification purposes, the parties have concentrated their attention on reliance. The Court also focuses on reliance as its effect on predominance is at issue.

46 As stated previously, Plaintiffs are pursuing class certification based on Marriott's alleged omissions. Pls.' Reply at 9 n.6.

The Court's predominance analysis regarding the California UCL class follows from the New York and Maryland analyses and, accordingly, the Court finds that the predominance requirement as to liability for the UCL class is satisfied.

iv. Michigan Identity Theft Protection Act ("ITPA") Class

The Michigan Identity Theft Protection Act "requires businesses to provide notice of a. security breach 'without unreasonable delay' to a Michigan resident if that resident's unencrypted and unredacted 'personal information' was accessed by an unauthorized person. Marriott, 440 F.Supp.3d at 390 (quoting Mich. Comp. Laws § 445.72(1)). "Courts have found that consumers may bring a civil action to enforce Michigan's data breach notice statute through Michigan's consumer protection statute or other laws." In re Solara Med. Supplies, LLC Customer Data Sec. Breach Litig., Ho. 19-CV-2284, 2020 WL 2214152 (S.D. Cal. May 7, 2020); see also In re Target Corp. Data Sec. Breach Litig., 66 F.Supp.3d 1154, 1169 (D. Minn. 2014). "As there is no Michigan Consumer Protection Act bellwether claim, Plaintiffs seek to enforce the [ITPA] under the other laws they have brought." Pls.' Mot. at 33.

As Defendants note, this cause of action is not tied to Plaintiffs' classwide theories of harm. See Defs.' Opp'n at 45. The injury at issue in this cause of action is an "incremental harm suffered by Plaintiffs as a result of any delay." Corona v. Sony Pictures Entm % Inc.', No. 14-CV-09600, 2015 WL 3916744, at *5 (CD. Cal. June 15, 2015). Assessing this harm would naturally involve individualized inquiries into whether and how a delay caused the theft of an individual's identity, etc. Plaintiffs fail to adequately demonstrate that common issues will predominate as to liability for this class, and the Court will not certify an ITPA class.

4. Compensatory Damages

Having analyzed predominance with respect to liability issues, the Court now addresses the predominance question as to damages. As described in the Daubert decision, Plaintiffs plan to use Dr. Prince's BLP model-informed by Ms. Butler's conjoint analysis-to formulaically calculate the amount that class members overpaid for their respective hotel stays.

To satisfy predominance, Plaintiffs' damages must be "capable of measurement on a classwide basis." See Comcast, 569 U.S. at 34. However, there is no requirement that Plaintiffs' damages "must be calculated on a. class-wide basis." Parker, 2015 WL 127930, at *14; see also 4 Newberg § 12:5 ("The fact that damage calculations would require individualized inquiries does not defeat certification.").⁴⁷ Instead, "where the case is complex and certified for both liability and damages, class proponents can demonstrate that they have a common, classwide method for determining individual damages." Id. at § 12:4 (emphasis added). Plaintiffs can demonstrate that such a common, classwide method exists by using a variety of techniques, including "mathematical, mechanical, and statistical formulae." Id. at § 12:5. "Moreover, damages calculations made pursuant to a common methodology 'need not be exact' at the class-certification stage." TD Bank, 325 F.R.D. at 173 (citing Comcast, 569 U.S. at 35).

47 It remains true that individual damage calculations can "overwhelm questions common to the class," thus defeating predominance, see Comcast, 569 U.S. at 34 (emphasis added), but they do not in all, or even most, cases. See Id. at 42 (Ginsburg, J., dissenting) (citing 2 Newberg § 4:54) » ("Recognition that individual damages calculations do not preclude class certification under Rule 23(b)(3) is well nigh universal."); see also Stillmock, 385 Fed.Appx. at 274 (quoting Smilow v. Sw. Bell Mobile Sys., Inc., 323 F.3d 32, 40 (1st Cir. 2003) ("The individuation of damages in consumer class actions is rarely determinative under Rule 23(b)(3). Where, as here, common questions predominate regarding liability, then courts generally find the predominance requirement to be satisfied even if individual damages issues remain.")).

In addition to putting forward a model that calculates damages via a common, classwide method, Plaintiffs must show that their model only measures "those damages attributable to the theory [of harm]" advanced. Comcast, 569 U.S. at 35. In other words, "any model supporting a 'plaintiffs damages case must be consistent with its liability case.'" Id.

The outcome of this predominance analysis largely hinges on the Court's determination as to whether Dr. Prince's model is a common statistical formula that applies classwide. At the outset, I acknowledge that this model is complex in that it requires a large amount of data and will be run thousands of times--at least once for each class member.⁴⁸ Despite this complexity, however, each class member will use the same model to calculate his or her individual overpayment damages. The model relies upon the same set of variables for every hotel stay. Of course, the numerical value assigned to those consistent variables will change for each class member based on the personal and market data related to their hotel stay(s). However, such differences in the computation of damages does not undermine the common, classwide nature of a methodology. See Parker, 2015 WL 127930, at *14 (citing Gunnells, 348 F.3d at 428) ("The mathematical computation of the [] damages, of course, is different. And, the Fourth Circuit has made it clear that Rule 23 'explicitly envisions class actions with...individual damage determinations."); see also Earl, 339 F.R.D. at 442 ("[C]lass members will be able to use this class-wide theory of damages to calculate their own individual damages") (emphasis added); Lester v. Percudani, 217 F.R.D. 345, 352 (M.D. Pa. 2003) ("[Variations in the amount of damages do not preclude certification.") The numerical inputs vary by class member, but the model itself stays consistent.

48 For a fuller discussion of the model's attributes, see the Court's Daubert opinion.

Even if individual damages calculations accord with predominance, Defendants still argue that acquiring the information necessary to calculate damages requires too much individualized inquiry. See Defs.' Opp'n at 20-22. However, the kind of individualized inquiry required here does not preclude a finding of predominance. The information that the model needs to work is objective and administrative in nature. See Parra v. Bashas' Inc., 291 F.R.D. 360, 393 (D. Ariz. 2013) (citations omitted) ("Furthermore, through a computer program, and relying upon 'objective factors' such as 'the individual employee payroll record (dates of employment job position, hours worked) and the wage scale,' which is part of the record, the plaintiffs will be able to calculate back pay losses for 'each eligible class member[.]'"). The model requires (1) personal data of an administrative nature that is in Defendants' NDS database, including the exact Starwood hotel at which a class member stayed, the price paid for that hotel stay, and the date(s) of that stay, and (2) verifiable market data information such as historical prices and hotel attributes that Dr. Prince has demonstrated are available. See Rebuttal Rep. of Jeffrey T. Prince, Ph.D. ("Prince Rebuttal Rep."), ECF No. 916-1 (sealed). Acquiring, and then processing, this information will be time intensive, but it does not require resolving individualized issues of a substantive nature.⁴⁹ See Checking Account Overdraft Litig., 286 F.R.D. 645, 658 (S.D. Fla. 2012) ("[Calculations will be merely ministerial in nature, and will not be plagued by resolution of individual class member issues.") Of course, the BLP model does not quite reduce the question of individualized damages to "mouse-clicking simplicity." See Dreher v. Experian Info. Sols,, Inc., No. CIV-02-0591, 2014 WL 2800766, at *5 (E.D. Va. June 19, 2014). Nevertheless, the necessary inquiries are really part of a "mechanical process," Parra, 291 F.R.D. at 393, that is qualitatively unimportant even if it is quantitatively significant-and the predominance test is a qualitative, not a quantitative test. See Soutter, 307 F.R.D. at 214 (quoting Stillmock, 385 Fed.Appx. at 272 (citing Gunnells, 348 F.3d at 429)). Despite individualized inquiries related to damages, the qualitatively overarching issues are still common. See Id. (citing Ealy, 514 Fed.Appx. at 305).

49 Importantly, overpayment damages are not wrapped up in individualized causation issues like damages related to identity theft, time spent responding to the data breach, or other out-of-pocket losses would be. Such individualized causation issues have led other courts to deny class certification of damages classes in data breach cases. See S. Indep. Bank v. Fred's, Inc., No. 15-CV-799, 2019 WL 1179396, at *19 (M.D. Ala. Mar. 13, 2019); McGlenn v. Driveline Retail • Merck, Inc., No. 18-CV-2097, 2021 WL 165121, at *6, *10-11 (CD. Ill. Jan 19, 2021); but see Brinker, 2021 WL 1405508, at * 12-13. However, that individualized causation issue is not applicable in the overpayment context.

Reading Defendants' arguments regarding individualized inquiries, one Wonders whether "Defendants are essentially arguing that due to the [hotel] market's nature and the myriad variables involved, determining the existence of the alleged overcharge is impossible." Earl, 339 F.R.D. at 428. However, "[t]his contention cannot be correct-this train of 'logic would have the effect of immunizing...any [unlawful]...conduct concerning...[the hotel industry]' from class treatment." Id. at 428-29 (citation omitted). Plaintiffs' proposed model respects that hotel markets vary by geography and tier and avoids problems related to averaging that would have arisen with a simpler model-e.g., one that generated a nationwide overpayment percentage-while remaining formulaic in nature.

Dr. Prince has not provided precise calculations for overpayment damages for each class member yet-indeed it would have been impossible for him to do so given that he does not have access to the full NDS database-but he is not required to provide precise calculations at this time to satisfy predominance. See TD Bank, 325 F.R.D. at 173 (citing Comcast, 569 U.S. at 35). As fully discussed in the Daubert opinion, he adequately tested his model using bellwether plaintiffs' data and he sufficiently demonstrated how his model would precisely calculate damages for each class member once it is applied classwide.

Further, Dr. Prince's model is consistent with Plaintiffs' overpayment theory of harm, satisfying the Comcast requirement that "[a] plaintiffs damages case [] be consistent with its liability case." Comcast, 569 U.S. at 35. As stated previously, that overpayment theory can be summarized as follows: Marriott was able to charge higher prices for hotel rooms than they would have in a hypothetical "but-for" world in which consumer willingness to pay for a hotel room had shifted in response to consumer knowledge of Starwood's inadequate data security; consequently, named plaintiffs overpaid for their respective hotel stays as a result of Marriott's alleged data security failures. Dr. Prince's model, which incorporates Ms. Butler's conjoint analysis, only measures the amount that class members overpaid pursuant to that theory. The model works independently of Plaintiffs' other theories of harm and it has isolated the overpayment damages from the other types of damages that Plaintiffs seek.⁵⁰

50 Defendants argue that the overpayment model's failure to account for international hotel stays speaks to a disconnect between the model and the theory of harm. See Defs.' Opp'n at 24-25. Meanwhile, Plaintiffs assert that they did not-and do not-intend for their model to produce overpayment damages for international hotel stays. See Prince Dep. 1 at 336:9-337:10. But rather than revealing a Comcast "fit" issue, this dispute simply highlights that Plaintiffs' proposed overpayment damages class definitions are imprecisely written, since they apparently encompass international hotel stays. Accordingly, I will narrow the relevant class definitions to hotel stays within the United States, which Plaintiffs agreed to do during the class certification hearing. I will not flat-out deny certification of overpayment damages classes, however, as Defendants ask me to do.

Finally, if at a later point in the litigation the individual inquiries related to damages calculations metastasize to an impermissible level, the Court retains the ability to modify its class certification order. The Court could create subclasses, bifurcate liability and damages, ⁵¹ or decertify the class altogether to address these individualized damages issues. See In re Visa Check/MasterMoney Antitrust Litig., 280 F.3d 124, 141 (2d Cir. 2001) (Sotomayor, J.); see also 2 Newberg § 4:80.

51 Under bifurcation, liability issues would proceed as a class action-given that the liability issues would still satisfy the class action requirements-and damages would be left for follow-on proceedings. The Fourth Circuit has not directly addressed whether courts may use Rule 23(c)(4) to bifurcate liability and damages, but it has implied that it would follow the majority of circuits in adopting such a view. 2 Newberg § 4:91 (citing Gunnells, 348 F.3d at 439-45). Lower courts within the Fourth Circuit have adopted a broad view of Rule 23 (c)(4)' s use. See, e. g., Parker, 2015 WL 127930, at *11 ("Under [Gunnells], which appears to follow the practice of the Second, Seventh, and Ninth Circuits, this Court holds that it may use Rule 23(c)(4) to certify a class as to an issue regardless of whether the claim as a whole satisfies the predominance test in Rule 23(b)(3)."); Good v. Am. Water Works Co., Inc., 310 F.R.D. 274, 296 (S.D. W.Va. 2015) (quoting Manual for Complex Litig, § 21.24 (4th ed. 2004)) ("Rule 23(c)(4)(A) permits a class to be certified/or specific issues or elements of claims raised in the litigation... .An issues-class approach contemplates a bifurcated trial where the common issues are tried first, followed by individual trials on questions such as proximate causation and damages.").

5. Statutory Damages

Section 349 of the New York General Business Law authorizes "any person who has been injured by reason of any violation of this section [to] bring an action in his own name to enjoin such unlawful act or practice, an action to recover his actual damages or fifty dollars, whichever is greater, or both such actions." N.Y. Gen. Bus. Law § 349(h) (emphasis added). These statutory damages "can be assessed on the basis of common proof, as they are [set] at $50." Sykes v. Mel S. Harris and Assocs. LLC, 780 F.3d 70, 87 (2d Cir. 2015). Any possible individualization as to-calculating damages would be mechanical in nature, i.e., counting the number of hotel stays for which a class member is eligible for damages. When individualized statutory damages questions are "simple and straightforward"-as they would be here-they do not preclude a finding of predominance. See Soutter, 307 F.R.D. at 217 (quoting Stillmock, 385 Fed.Appx. at 273).

Indeed, Defendants do not challenge predominance as to statutory damages based on the calculation method. See Defs.' Opp'n at 35-36. Instead, Defendants argue that proving "actual injury" or the "fact of damage," as required under § 349, ⁵² is too individualized. Id. This assertion merely recycles arguments made in the overpayment theory context. The Court has already found that establishing liability, and even damages, under the overpayment theory is consistent with predominance. Defendants' arguments regarding individualization are no more successful in the statutory damages context. Plaintiffs have satisfied the predominance requirement as to statutory damages under § 349.

52 '"Actual injury' is an element of any claim asserted under GBL § 349." Marshall v. Hyundai Motor Am., 334 F.R.D. 36, 57 (S.D.N.Y.2019) (citing Small v. Lorillard Tobacco Co., 720 N.E.2d 892, 897-98 (N.Y. 4999)).

6. Nominal Damages

One may recover nominal damages in breach of contract actions in the bellwether states.⁵³ See Compania Embotelladora Del Pacifico, S.A. v. Pepsi Cola Co., 976 F.3d 239, 247 n.10 (2d Cir. 2020); Yacoubou v. Wells Fargo Bank, N.A., 901 F.Supp.2d 623, 638 (D. Md. 2012).⁵⁴ Of course, by their nature, nominal damages do not require individualized calculation and, thus, they are consistent with a predominance finding on that score.

53 Under certain circumstances, one may recover nominal damage in negligence actions in the bellwether states as well, but the Court need not address nominal damages for negligence claims here. As indicated previously, Plaintiffs have not established the fact of injury classwide that could support nominal damages-neither the overpayment theory nor the loss of market value theory are applicable to the negligence claims" at this time. As for the consumer protection claims, Plaintiffs are not seeking nominal damages. See Pls.' Mot. at 34-35; Pls.' Reply at 18-20.

54 Defendants assert that New York law applies to the breach of contract claims, see Defs.' Opp'n at 37, but the Court need not decide that issue now. Accordingly, the Court includes the applicable Maryland case law here, in addition to the New York case law.

As with statutory damages, Defendants do not challenge predominance as to nominal damages based on the calculation method. See Defs.' Opp'n at 34. Defendants make a few other arguments against Plaintiffs' effort to certify nominal damages classes. See Defs.' Opp'n at 33- 35.⁵⁵ One such argument unrelated to the predominance requirement is easily addressed here. Defendants assert that Plaintiffs cannot obtain nominal damages because Plaintiffs did not seek nominal damages in the Complaint. Id. at 33. While Plaintiffs did not use the term "nominal damages" in their request for relief, they did seek "general damages," Compl. at | 355, which encompasses nominal damages. See Liberty Mut. Fire Ins. Co. v. JT Walker Indus., Inc., 554 Fed.Appx. 176, 190 (4th Cir. 2014) (citing Ins. Servs. of Beaufort, Inc. v. Aetna Cas. & Sur. Co., 966 F.2d 847, 853 (4th Cir. 1992)) ("Nominal damages need not be specifically pleaded where a party alleges a claim for general damages; the general damage allegation sufficiently encompasses nominal damages.") Therefore, Plaintiffs have adequately pleaded nominal damages in the Complaint. Based on this analysis, the Court finds that Plaintiffs have satisfied the predominance requirement as to nominal damages.

55 The Court has already addressed Defendants' res judicata/adequacy requirement argument related to nominal damages in the adequacy of representation section.

d. Superiority

"[A Rule 23(b)(3)] class action [must be] superior to other available methods for fairly and efficiently adjudicating the controversy." Fed.R.Civ.P. 23(b)(3). The court must compare possible alternatives to the class action to determine "whether Rule 23 is sufficiently effective to justify the expenditure of the judicial time and energy that is necessary to adjudicate a class action and to assume the risk of prejudice to the rights of those who are not directly before the court." Stillmock, 385 Fed.Appx. at 274 (quoting 7AA Federal Practice and Procedure § 1779 (3d ed. 2005). Courts consider the following four factors when assessing the superiority of the class action: (1) "the class members' interests in individually controlling the prosecution or defense of separate actions"; (2) "the extent and nature of any litigation concerning the controversy already begun by or against class members"; (3) "the desirability or undesirability of concentrating the litigation of the claims in the particular forum"; and (4) "the likely difficulties in managing a class action." Fed.R.Civ.P. 23(b)(3); see also Thorn, 445 F.3d at 319.⁵⁶ Ultimately, the "determination of superiority necessarily depends greatly on the circumstances surrounding each case." Stillmock, 385 Fed.Appx. at 274 (quoting 7AA Federal Practice and Procedure § 1779).

56 "Rule 23 states that these factors are pertinent to the assessment of predominance and superiority, but most courts analyze [these] factors solely in determining whether a class suit will be a superior method of litigation." 2 Newberg § 4:68 (5th ed.).

After considering each factor, the Court finds that a Rule 23(b)(3) class action is "superior to the other available methods for fairly and efficiently adjudicating" this case. The first factor clearly weighs in favor of class certification. "The vast majority of class members have a de minimis interest in individually controlling the prosecution of their [] claims because the monetary value of their damages would be dramatically outweighed by the cost of litigating an individual case." TD Bank, 325 F.R.D. at 162 (citing Fed.R.Civ.P. 23(b)(3)).⁵⁷ In other words, this case "is the classic negative value case; if class certification is denied, class members will likely be precluded from bringing their claims individually because the cost to bring the claim outweighs the potential payout." Brinker, 2021 WL 1405508, at *13; see also Earl, 339 F.R.D. at 445.⁵⁸ "For most class members the only realistic alternative to a class action is no action at all." TD Bank, 325 F.R.D. at 162. In such a case, "the adjudication of [the] matter through a class action [is]... superior to no adjudication of the matter at all." Gunnells, 348 F.3d at 426 (citing 5 Moore's Federal Practice § 23.48[1] (1997)). "As the Supreme Court put the matter, '[t]he policy at the very core of the class action mechanism is to overcome the problem that small recoveries do not provide the incentive for any individual to bring a solo action prosecuting his or her rights.'" Id. (quoting Amchem, 521 U.S. at 617 (citation omitted)).

57 "If any individual class member does wish to retain control of his claim, or seek actual damages where a different remedy might be imposed upon him, the opt-out mechanism will allay such a presumption upon his individual interests." TD Bank, 325 F.R.D. at 162.

58 This analysis holds true for statutory damages as well as overpayment damages. Overpayment damages are clearly, quite small here. See Prince Rebuttal Rep. at Figure 3. Statutory damages are potentially larger-the court may exercise its discretion under N.Y. Gen. Bus. § 349(h) to award treble damages up to $1,000 and award reasonable attorneys' fees. However, the damages are still small enough that class members' calculus with regards to bringing individual lawsuits would not change. See Stillmock, 385 Fed.Appx. at 274 (citations omitted) ("[T]here is no reasoned basis to conclude that the fact that an individual plaintiff can recover attorney's fees in addition to statutory damages of up to $1,000 will result in... individual actions of a scale comparable to the potential enforcement by way of class action.").

The second factor also supports class certification. Because "numerous putative class action lawsuits based on the same facts and containing substantively identical claims have already been filed against Defendants," the Judicial Panel on Multidistrict Litigation "has seen fit to consolidate the handling of those common claims" in this Court. TD Bank, 325 F.R.D. at 162. This decision "favors a consolidated disposition generally." Id.

The third factor weighs in favor of class certification as well. This factor "embodies two independent concerns: (1) 'the desirability of concentrating the. trial of the claims... by means of a class action, in contrast to allowing the claims to be litigated separately,' and (2) 'the desirability of concentrating the trial of the claims in the particular forum ... in contrast to ... forums to which they would ordinarily be brought.'" 2 Newberg § 4:71 (quoting Fed.R.Civ.P. 23(b)(3) advisory committee's note to 1966 amendments). The Court's preceding predominance analysis implicitly addressed the first of these two concerns. It is nevertheless worth noting that class certification will likely reduce litigation costs by consolidating recurring common issues here. See Gunnells, 348 F.3d at 427 (citing Central Wesleyan Coll. v. W.R. Grace & Co., 6 F.3d 177, 185 (4th Cir. 1993)). Proving the common issues addressed in the commonality and predominance sections in individual.trials would "require enormous redundancy of effort, including duplicative discovery, testimony by the same witnesses in potentially hundreds of actions, and relitigation of many similar, and even identical, legal issues." Id. If the litigation were to proceed via individual trials, plaintiffs could use requests for admission under Fed.R.Civ.P. 36 to request that Defendants admit to the accuracy of certain undisputed factual statements and thereby expedite the individual trials. See Parker, 2015 WL 127930, at *14. However, this case has a sufficient number of contested issues that a significant amount of duplication and redundancy across individual trials would remain.

Further on this point regarding the desirability of concentration via class action, the Court notes that class certification serves Defendants here. Class certification "provides a single proceeding in which to determine the merits of the plaintiffs' claims, and therefore protects the defendant from inconsistent adjudications." Gunnells, 348 F.3d at 427 (quoting 5 Moore's Federal Practice § 23.02 (1999)); see also Stillmoch, 385 Fed.Appx. at 275 ("[C]lass certification promotes consistency of results, giving [the defendant] the benefit of finality and repose."). "This protection from inconsistent adjudications derives from the fact that the class action is binding on all class members.. .By contrast, proceeding with individual claims makes the defendant vulnerable to the asymmetry of collateral estoppel...." Id. (citing Fed.R.Civ.P. 23(c)(2)(B)).

As to the second concern embodied in the third factor, it is desirable to concentrate the litigation in this particular forum. That this Court has issued many rulings over three years in this case weighs in favor of class certification. See Earl, 339 F.R.D. at 445 ("[T]he value of concentrating litigation in the Eastern District of Texas is clear given that this Court has already ruled on a number of matters in this case."); see also Brinher, 2021 WL 1405508, at *13. That Marriott is headquartered in Maryland and that many of its corporate employees live and work here also supports concentrating the litigation in this forum. See Calderon v. GEICO Gen. Ins. Co., 279 F.R.D. 337, 347 (D. Md. 2014).

The fourth factor-manageability-also supports class certification. Manageability is "the most critical concern in determining whether a class action is a superior means of adjudication." 2 Newberg § 4:72. Even so, "courts deny class certification on manageability grounds relatively infrequently and primarily in certain carefully circumscribed situations. This is so...because the cases most likely to be unmanageable are those involving myriad individual issues, the manageability concern often simply echoes the predominance analysis. Therefore, courts generally hold that if the predominance requirement is met, then the manageability requirement is met as well." Nichols v. GEICO Gen. Ins. Co., No. 18-cv-01253, 2021 WL 1661158, at *11 (W.D. Wash. 2021) (quoting 2 Newberg § 4:72). Here, the manageability concerns raised by Defendants echo their predominance concerns, i.e., they believe that the overpayment model requires too much individualized inquiry. See Defs.' Opp'n at 32, However, in the predominance section, the Court concluded that Plaintiffs' overpayment model provides a common, formulaic method for calculating individual damages and does not require too much individualized inquiry. Accordingly, the Court is satisfied that the overpayment model does not make this litigation unmanageable.

Of course, the size of the proposed classes and the administrative logistics discussed previously in the ascertainability section do raise some additional manageability concerns. It will be time consuming to identify class members, review Defendants' administrative records, and collect supporting documentation from class members. However, as with the superiority analysis overall, courts compare the effectiveness of a class action with the alternatives. See Williams v. Mohawk Indus., Inc., 568 F.3d 1350, 1358 (11th Cir. 2009) (quoting Klay v. Humana, 382 F.3d 1241, 1273 (11th Cir. 2004) ("[W]e are not assessing whether this class action will create significant management problems, but instead determining whether it will create relatively more management problems than any of the alternatives.")). .While this class action presents management difficulties, those difficulties are ultimately outweighed by those associated with the alternative: thousands of individual trials. See TD Bank, 325 F.R.D. at 162 (citing Fed.R.Civ.P. 23(b)(3)(D)). As discussed earlier, "separate actions by each of the class members would be repetitive, wasteful, and an extraordinary burden on the courts." Id. (quoting Checking Account Overdraft Litig., 286 F.R.D. at 659 (quoting Kennedy v. Tallant, 710 F.2d 711, 718 (11th Cir. 1983))).

If existing manageability concerns were to grow or new issues arise-particularly as it relates to individualized damages-the Court "recognize[s] its ability to modify its class certification order, sever liability and damages, or even decertify the class if such an action ultimately [becomes] necessary." Visa Check/MasterMoney, 280 F.3d at 141; see also 2 Newberg § 4:80.

IV. Rule 23(c)(4) Issues Classes

a. Proposed Issues Classes

Plaintiffs ask the Court to certify the following issues:

1. Were Marriott or Accenture Negligent?

a. Did they owe a common law duty to the class;

b. Did they breach that duty; and c. Did the breach of that duty cause harm to the class.

2. Were Marriott or Accenture Negligent Per Se?

a. Did they owe a statutory duty to the class;

b. Did they breach that duty; and

c. Did the breach of that duty cause harm to the class.

3. Did Marriott and Starwood breach their contracts?

a. Did the companies' Privacy Policies create contractual obligations?

b. Did the companies breach those obligations?

c. Did those breaches cause harm?

4. Did Marriott violate state consumer protection statutes?

a. Did Marriott and Starwood make actionable representations or omissions about their security? .

b. Did they fail to meet those representations?,

c. Did those failures cause harm?

As the Court has certified Rule 23(b)(3) damages classes pertaining to the breach of contract and consumer protection claims, separately certifying questions related to Issues 3 and 4-as well as their sub-issues-under Rule 23(c)(4) is unnecessary at this time.⁵⁹ Those issues will be resolved in the Rule 23(b)(3) context anyway. However, the Court must still consider whether to certify the negligence-related liability issues, i.e., Issues 1 and 2-as well as their sub-issues. Given that (1) the overpayment theory is inapplicable to Accenture, (2) Dr. Prince's inherent value model has been excluded, and (3) nominal damages for Plaintiffs' negligence claims are unavailable (at this time) without the classwide fact of injury provided by the loss of market value theory, Rule 23(c)(4) issue certification is the remaining classwide path for Plaintiffs to take with regards to their negligence claims against Marriott and Accenture. As for these proposed liability issues, individualized damages like time spent responding to the data breach and out-of-pocket fraud losses are the relevant harms to bear in mind during the analysis-not an overpayment or loss of market value injury.

59 Of course, should the damages classes be decertified at any time, the Court may revisit the question of certifying issues classes.

b. Scope and Function of Rule 23(c)(4)

In considering Plaintiffs' request for certification of various issues, the Court must start with an analysis of Rule 23(c)(4) and its scope and function. "Rule 23 specifically dictates that '[w]hen appropriate' a class action may be 'maintained' as to 'particular issues' and, after that is done, 'the provisions of this rule,' such as the predominance requirement of (b)(3), 'shall then.. .be construed and applied.'" Gunnells, 348 F.3d at 439 (quoting Fed.R.Civ.P. 23(c)(4)). Given the rule's language, judicial interpretation has coalesced in recent years around a "broad view" of Rule 23(c)(4) in which common questions need predominate over individual ones only for the specific issues that are certified, not for the entire cause of action." 2 Newberg § 4:91.⁶⁰ Under the broad view, courts may use Rule 23(c)(4) to certify a class as to an issue "regardless of whether the claim as a whole satisfies the predominance test in Rule 23(b)(3)." Parker, 2015 WL 127930, at *11; see also Martin v. Behr Dayton Thermal Prods., LLC, 896 F.3d 405, 411 (6th Cir. 2018) (citations omitted), cert, denied, 139 S.Ct. 1319 (Mem.) (2019) ("The broad view permits utilizing Rule 23(c)(4) even where predominance has not been satisfied for the cause of action as a whole."); but see Castano v. Am: Tobacco Co., 84 F.3d 734, 745 n.21 (5th Cir. 1996) ("The proper interpretation of the interaction between subdivisions (b)(3) and (c)(4) is that a cause of action, as a whole, must satisfy the predominance requirement of (b)(3)."). As the district court in Good v. Am. Water Works Co., Inc., put it: "There is no impediment to certifying particular issues in a case as opposed . to entire claims or defenses. That is the very approach urged by the authoritative Manual for Complex Litigation: 'Rule 23(c)(4)(A) permits a class to be certified for specific issues or elements of claims raised in the litigation.'" 310 F.R.D. 274, 296 (S.D. W.Va. 2015) (quoting Manual for Complex Litig. § 21.24 (4th 2004)). This approach accords with the Fourth Circuit's admonition to district courts to '"take full advantage of the provision in [Rule 23(c)(4)] permitting class treatment of separate issues' in order 'to promote the use of the class device and to reduce the range of disputed issues' in complex litigation." Central Wesleyan, 6 F.3d at 185 (quoting In re A.H. Robins Co., Inc., 880 F.2d 709, 740 (4th Cir. 1989)). Accordingly, the Court adopts the broad view as to Rule 23(c)(4)'s usage.

60 While the Fourth Circuit has not explicitly adopted the broad view, courts and commentators have interpreted Gunnells to indicate support for it. See Parker, 2015 WL 12793 0, at * 11; see also Martin v. Behr Dayton Thermal Prods., LLC, 896 F.3d 405, 411 (6th Cir. 2018) (citations omitted), cert, denied, 139S.Ct. 1319 (Mem.) (2019); 2 Newberg§ 4:91. Gunnells found that Rule 23(c)(4) could be used to maintain a class action as to particular causes of action-if those causes of action satisfied the requirements of Rule 23-even if the lawsuit as a whole did not satisfy all the Rule 23 requirements. 348 F.3d at 441 (quoting In re A.H. Robins Co., Inc., 880 F.2d 709, 740 (4th Cir. 1989)).

c. Applying Rule 23(c)(4)

Having established that the Court may certify specific issues, I must now apply the provisions of Rule 23(a) and (b)(3)-discussed at length above-to the specific issues for which Plaintiffs seek certification. The Court's prior overall Rule 23(a) findings apply across Plaintiffs' theories of harm and claim types and, for the most part, apply to both Defendants. I have also already found that specific concerns raised by Accenture regarding the Connecticut class representative did not defeat typicality. Per that prior analysis, the Rule 23(a) prerequisites are satisfied as to the negligence issues classes. .

As with my Rule 23(b)(3) predominance analysis related to the breach of contract and consumer protection claims, I begin the predominance analysis of the negligence and negligence per se issues by looking at the elements of the causes of action.⁶¹ The elements of negligence and negligence per se are quite consistent across the bellwether states, and Plaintiffs' proposed issues align with the consistent elements: duty (either common law or statutory), breach, and causation.⁶² See Right v. Breen, 890 A.2d 1287, 1294 (Conn. 2006); Williams v. Davis, 974 So.2d 1052, 1056 (Fla. 2007); Warr v. JMGM Group, LLC, 70 A.3d 347, 353 (Md. 2013); Duncan v. Mill Mgmt. Co. of Greenwich, 60 A.3d 222, 238-39 (Conn. 2013); Goldstein, Garber, & Salama v. J.B., LLC, 797 S.E.2d 87, 92 (Ga. 2017) (quoting Murphy v. Bajjani, 647 S.E.2d 54, 58 (Ga. 2007)).

61 The rules pertaining to the predominance requirement laid out in the damages classes section of this opinion apply here as well. I adopt them for this analysis and, therefore, it is not necessary to repeat them again in this section.

62 Actual injury, or damages, are a fourth consistent element--one that is required to establish liability-but Plaintiffs do not seek to certify that issue given the individualized nature of the non-overpayment theories of harm.

When considering Plaintiffs' identity fraud and related mitigation theories of harm-which are the relevant theories of harm here-individualized issues related to causation are quite significant. As the discovery taken to date from the bellwether plaintiffs has demonstrated, a large number of class members' PII may have been exposed in data breaches other than the Starwood breach or exposed in another manner. See Defs.' Exs. 26, 34. As a result, substantial individualized inquiry is required to determine whether Defendants proximately caused any actual identity theft that might have occurred. "The functional equivalent of a full-blown trial on damages causation for each putative class member would be required to determine to which individuals [Defendants are] liable...." Lienhart v. Dryvit Sys., Inc., 255 F.3d 138, 149 (4th Cir. 2001). Defendants have raised substantial doubts regarding predominance as it relates to the proposed certification of causation issues that are separate and apart from the overpayment theory, and Plaintiffs have not met their burden of demonstrating compliance with Rule 23(b)(3) here. Consequently, common issues do not predominate within the causation sub-issues, i.e., Issues 1(c) and 2(c).

While individual issues block a predominance finding as to the causation sub-issue, they do not for the duty and breach sub-issues. Plaintiffs will use the same evidence in their attempt to establish duty and breach for their negligence and negligence per se claims against Marriott and Accenture. As to claims against Marriott, that evidence includes Plaintiffs' expert Mary Frantz's report, Pls.' Tab 4, and the documents and testimony upon which it is based. See,, e.g., Pls.' Tabs 17, 19. As to claims against Accenture, that evidence includes testimony regarding Accenture's business relationship with Starwood and Marriott, Accenture's data security responsibilities, and Accenture's data security practices related to multifactor authentication, account privileges, monitoring, and encryption. See Pls.' Tabs 36, 47-49.

Marriott largely does not contest that common issues predominate as to duty and breach. See Pls.' Reply at 3. Marriott primarily challenges predominance as to Plaintiffs' negligence claims by arguing that different contractual relationships between class members and Marriott undermine the necessary cohesiveness for class certification. See Defs.' Opp'n at 41. Because the originally proposed negligence classes were not restricted to SPG members, some class members may have been subject to the SPG Terms & Conditions and the agreements incorporated therein, such as the Website Terms of Use, while other class members may not have been subject to these same documents. Because the SPG Terms & Conditions included provisions like a liability release clause that Defendants would use as affirmative defenses, see Defs.' Opp'n at 36-37; ECF No. 982, one would have to engage in individual inquiry as to the contractual relationships of class members. This individualized inquiry would likely defeat predominance in this context. However, because of related typicality concerns, the Court has already redefined the proposed negligence classes to only include SPG members. Therefore, Marriott's argument regarding these contractual relationship differences is no longer applicable.

At least with respect to common law duty in Connecticut, Florida, and Maryland, Accenture does challenge Plaintiffs' assertion that common issues predominate. Accenture contends that individualized issues will emerge when analyzing class members' respective relationships with the company. See Defs.' Opp'n at 58. However, there is little or no variation between class members as to this relationship. As Plaintiffs note, "it is difficult to see how [there] could [be] given Accenture's argument that it made 'no representation to plaintiffs, had no interactions with plaintiffs, and did not request, accept, or store their personal information.'" Pls.' Reply at 28 (quoting ECF No. 464-1 at 10, 14). Ultimately-with regards to Accenture and Marriott-common issues will predominate over any individual questions as to the duty and breach elements of negligence and negligence per se, i.e., Issues l(a)-(b) and 2(a)-(b).

Because "Rule 23(c)(4) eases the demands of the predominance requirement" by isolating specific issues for analysis, it "shifts the focus to Rule 23(b)(3)'s second requirement, superiority." Romig v. Pella Corp., No. 14-cv-00433, 2016 WL 3125472, at *13 (D. S.C. June 3, 2016).⁶³ For the most part, the factors supporting a finding of superiority as to the damages classes-the class members' de minimis interest in individually pursuing their claims, the Judicial Panel on Multidistrict Litigation's decision to consolidate the handling of Plaintiffs' claims, the protection for Defendants against inconsistent adjudications, and the Court's accumulated time spent with this case-also support a finding of superiority here.

63 The rules pertaining to the superiority requirement laid out in the damages classes section of this opinion apply here as well and are adopted for that purpose. Therefore, they need not be repeated.

When considering superiority in the context of Rule 23(c)(4) however, courts should additionally consider whether the "efficiency gains of certification...outweigh[]...the fact that individualized issues requiring significant time and attention remain for later. See Id. at * 13-16; Parker, 2015 WL 127930, at * 14-16. Importantly, courts are "not required under Rule 23...to sacrifice class adjudication of a driving issue in the case simply because many individualized inquiries will remain thereafter." Good, 310 F.R.D. at 298. Nevertheless, courts should evaluate this question of efficiency carefully.

Clearly, important issues related to causation, affirmative defenses, and damages related to Accenture's conduct will not be resolved during issue-class adjudication. Nevertheless, efficiency gains stemming from certification of the duty and breach issues outweigh this fact. Given that the Court has certified damages classes against Marriott, the Court will already be analyzing the intertwined factual circumstances relevant to the duty and breach issues. Not certifying the duty and breach issue classes would result in totally unnecessary duplication as Plaintiffs and Defendants litigated the Marriott class action and the presumably numerous individual Accenture-related cases. The parties would have to repeatedly put on the same witnesses and produce the same documents, incurring considerable expense. This situation speaks to the "economy" of class treatment for these issues. Cf. Fella Corp. v. Saltzman, 606 F.3d 391, 394 (7th Cir. 2010) (citation omitted) ("[H]ere there is an economy to class treatment of the question whether the ProLine windows suffer from a basic design defect, the resolution of which has the potential to eliminate the need for multiple, potentially expensive expert testimony and proof that would cost considerably more to litigate than the claims would be worth to the plaintiffs.")

Now, it is true that other methods such as Fed.R.Civ.P. 36, the submission of special verdicts, and collateral estoppel, may exist to avoid relitigating an issue in each individual case. See Parker, 2015 WL 127930, at *15. However, in my mind, they are not as efficient as issue certification here, particularly because the Court is already certifying some damages classes. At this juncture, it is worth reiterating that in the event that the results of the issues trials are favorable to Marriott and Accenture, the litigation against them as to the negligence and negligence per se claims would end. Defendants would not obtain this benefit by any of the foregoing alternatives to certifying an issues class. This observation supports a finding of superiority as well.

Finally, "[b]efore certifying an issues class...the judge should be satisfied that common questions are sufficiently separate from other issues and that a severed trial will not infringe any party's constitutional right to a jury trial and will permit all the parties fairly to present the claims and defenses." 2 Newberg § 4:90. As the preceding analysis demonstrates, certifying the described issues against Accenture does not raise concerns on this front.

V. Injunctive or Declaratory Relief Class

A class may be certified pursuant to Rule 23(b)(2) when "the party opposing the class has acted or refused to act on grounds that apply generally to the class, so that final injunctive relief or corresponding declaratory relief is appropriate respecting the class as a whole." Fed.R.Civ.P. 23(b)(2). In interpreting the requirements of Rule 23(b)(2), the Fourth Circuit has held that certification is appropriate where final injunctive relief is sought and will settle "the legality of the behavior with respect to the class as a whole." Thorn, 445 F.3d at 329 (quoting Fed.R.Civ.P. 23(b)(2) advisory committee's note to 1966 amendments). Further, where the harm referenced in the requested relief refers to a ceased activity or no longer present practice, it is "moot and cannot serve as a predicate for Rule 23(b)(2) certification." Id. at 331. I find certification of the Rule 23(b)(2) class to be inappropriate as Plaintiffs have not established that the proposed relief would provide "an indivisible injunction benefitting all its members at once," in relation to a present, imminent, or possible future harm. Wal-Mart, 564 U.S. at 362.

Plaintiffs "seek certification of declaratory and injunctive relief claims, the substance of which will be reserved for a later time deemed appropriate by the Court," and "the opportunity to conduct discovery into data security measures" to determine the substance of the future injunction. Pls.' Mot. at 40. Defendants challenge certification arguing that Plaintiffs cannot "offer the basic contours of the injunctive and declaratory relief." Defs.' Opp'n at 49. Defendants also state that Plaintiffs can offer no evidence of any "ongoing security inadequacies...that would justify declaratory or injunctive relief," regarding the "retired and now safely offline" database containing the PII at issue. Id. at 50.

Without any direction as to the nature of the injunction sought, besides a request for further discovery, Plaintiffs' motion goes no further than requesting that Defendants discontinue their current practices with respect to the PII at issue. Such a general request does not support class certification under Rule 23(b)(2).⁶⁴ See Ginwright v. Exeter Fin. Corp., 280 F.Supp.3d 674, 690 (D. Md. 2017). While lack of specificity describing an injunctive remedy sought is not a bar to class certification, "general contours of the requested injunction" are still necessary. See Adkins v. Facebook, Inc., 424 F.Supp.3d 686, 698 (N.D. Cal. 2019) (certifying an injunction compelling security measures correction pending specific remedies to be determined at a future time). Here, Plaintiffs fail to establish the general contours for an injunctive remedy under Rule 23(b)(2) that go beyond a general statement for Defendants not to continue as they currently are.

64 Plaintiffs ask the Court "[to] issue corresponding prospective injunctive relief requiring Marriott to employ adequate security protocols consistent with law and industry standards to protect consumers' Personal information." Compl. at ¶ 351.

Plaintiffs also seek a declaratory remedy under Rule 23(b)(2). Declaratory relief "as a practical matter [] affords injunctive relief or serves as a basis for later injunctive relief." Fed.R.Civ.P. 23(b)(2) Advisory Committee Commentary. Plaintiffs assert that Defendants "are still in possession of class members' PII" at issue in this case, and that Defendants have not "adequately secured the PII." The Court finds Plaintiffs' asserted declaration unpersuasive to support standalone declaratory relief or a declaration for the basis of future injunctive relief. For declaratory relief to serve as a basis for an injunctive relief there must be some present harm or alternatively a "likelihood of a future harm."⁶⁵ A declaratory judgment would be appropriate if it established a benefit of a "valuable injunctive relief that will accrue to all members" relief from the harm or threatened harm, Berry v. LexisNexis Risk and Info. Analytics Grp., Inc., No. ll-CV-754, 2014 WL 4403524, at *12 (E.D. Va. Sept. 5, 2014), but here no classwide benefit is clear. Defendants counter, and the record supports, that the "systems [housing the PII at issue] are now retired, offline, and boxed away." See Defs.' Opp'n at 51.; see also Pls.' Tab 19.

65 The current requested declaration is not comparable with the requested relief in Adkins, 424 F.Supp.3d at 698. First, in Adkins the existing personal data at issue was still in use by the defendant. Second, the defendant's assertion that it had fixed the specific security vulnerability that had "caused the, data breach" was viewed insufficient by the court to prevent Rule 23(b)(2) class certification and award an injunctive remedy. The defendant's "repetitive losses of users' privacy supplie[d] a long-term need for supervision," given a "likelihood of future harm" to the plaintiffs' PII. Id.

The Court finds that Plaintiffs have failed to establish either the general contours of the injunctive relief requested beyond a general discontinuance statement or provide evidence of some present or likely future harm regarding the PII at issue to support declaratory relief either independently or as the basis for a future injunctive relief.⁶⁶

66 Should further proceedings produce evidence that provides details currently missing from the motion, Plaintiffs may be afforded the opportunity to seek a Rule 23(b)(2) class at that time. Before renewing their motion to certify an injunctive or declaratory relief class, however, Plaintiffs would need to submit a three-page letter to the Court setting forth the anticipated grounds for doing so. The Court would hold a scheduling conference with respect to briefing the motion. Mindful of this possibility, I DENY WITHOUT PREJUDICE the motion to certify a class for injunctive or declaratory relief. I reiterate, however, that the present record does not warrant a 23(b)(2) class, and Plaintiffs would need to put forward a substantially more detailed motion in order for the Court to grant class certification in this respect.

CONCLUSION

In sum, Plaintiffs' motion for class certification is GRANTED IN PART and DENIED IN PART. As Judge Corrigan did in Brinker, I acknowledge that this Court is one of the first to certify Rule 23(b)(3) classes involving individual consumers complaining of a data breach. See 2021 WL 1405508, at *14.⁶⁷ Nevertheless, Plaintiffs have satisfied the Rule 23 requirements as to several classes. Accordingly, the Court CERTIFIES the following Rule 23(b)(3) damages class with respect to Plaintiffs' Maryland breach of contract and MCPA claims:

67 Of course, as Judge Corrigan also noted, many cases do not reach this point "either due to settlement or other disposition." See Banker, 2021 WL 1405508, at *14.

All natural persons residing in Maryland whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property in the United States, was compromised in a data breach announced by Marriott on or about November 30, 2018, and who: (1) had a Starwood Preferred Guest ("SPG") membership, (2) bore the economic burden for the hotel stay, and (3) made the reservation from July 28, 2014 to November 30, 2018.

Peter Maldini will serve as the Class Representative.

The Court CERTIFIES the following Rule 23(b)(3) damages class with respect Plaintiffs' New York breach of contract and GBL § 349 claims:

All natural persons residing in New York whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property in the United States, was compromised in a data breach announced by Marriott on or about November 30, 2018, and who: (1) had a Starwood Preferred Guest ("SPG") membership, (2) bore the economic burden for the hotel stay, and (3) made the reservation from July 28, 2014 to November 30, 2018.

Roger Cullen, Eric Fishon, and Paula O'Brien will serve as the Class Representatives.

The Court CERTIFIES the following Rule 23(b)(3) damages class for Plaintiffs' California UCL claim:

All natural persons residing in California whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property in the United States, was compromised in a data breach announced by Marriott on or about November 30, 2018, and who: (1) had a Starwood Preferred Guest ("SPG") membership, (2) bore the economic burden for the hotel

stay, and (3) made the reservation from July 28, 2014 to November 30, 2018.

Robert Guzikowski, Denitrice Marks, and Maria Maisto will serve as the Class Representatives.

The Court CERTIFIES the following Rule 23(c)(4) class as to the common law duty and breach issues relevant to Plaintiffs' Florida negligence claims:

All natural persons residing in Florida who had a Starwood Preferred Guest ("SPG") membership and whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018.

Irma Lawrence, Michaela Bittner, and Kathleen Frakes Hevener will serve as the Class Representatives.

The Court CERTIFIES the following Rule 23(c)(4) class as to the common law duty and breach issues relevant to Plaintiffs' Maryland negligence claims:

All natural persons residing in Maryland who had a Starwood Preferred Guest ("SPG") membership and whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood properly, was compromised in a data breach announced by Marriott on or about November 30, 2018.

Peter Maldini will serve as the Class Representative.

The Court CERTIFIES the following Rule 23(c)(4) class as to the common law duty, statutory duty, and breach issues relevant to Plaintiffs' Connecticut negligence and negligence per se claims:

All natural persons residing in Connecticut who had a Starwood Preferred Guest ("SPG") membership and whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018.

Anne Marie Amarena will serve as the Class Representative.

The Court CERTIFIES the following Rule 23(c)(4) class as to the statutory law duty and breach issues relevant to Plaintiffs' Georgia negligence per se claims:

All natural persons residing in Georgia who had a Starwood Preferred Guest ("SPG") membership and whose Personal Information, given to Starwood in connection with the making of a reservation at a Starwood property, was compromised in a data breach announced by Marriott on or about November 30, 2018.

Brent Long and David Viggiano will serve as the Class Representatives.

Each of the class definitions incorporate the modifications that the Court previously discussed. The Court DENIES the motion to certify the Michigan ITPA damages class. The Court DENIES WITHOUT PREJUDICE damages (and liability) classes that rely on the loss of market value theory. The Court also DENIES WITHOUT PREJUDICE the motion to certify a class for injunctive or declaratory relief.

The Court "must appoint class counsel" at this stage of the litigation. Fed.R.Civ.P. 23(g)(1). When appointing class counsel, courts must consider: (1) "the work counsel has done in identifying or investigating potential claims in the action"; (2) "counsel's experience in handling class actions, other complex litigation, and the types of claims asserted in the action"; (3) "counsel's knowledge of the applicable law"; and (4) "the resources that counsel will commit to representing the class." Fed.R.Civ.P. 23(g)(1)(A)(i)-(iv). Courts must also consider whether class counsel will "fairly and adequately represent the interests of the class." Fed.R.Civ.P. 23(g)(4).

The Court previously appointed interim class counsel in accordance with Rule 23(g). See ECF No. 238 ("Case Mgmt. Order No. 2."). At the time that order was issued, I indicated that-based on counsel's submissions to the Court and representations at oral argument-proposed Class Counsel had adequate professional experience in this type of litigation and had access to sufficient resources to advance this litigation in a timely manner. Id. Since that order, Plaintiffs' attorneys have ably engaged in a complex discovery process, conducted numerous depositions, and submitted well-researched briefing to the Court, among other tasks. See Pls.' Mot. at 24-25. These efforts have shown that proposed Class Counsel have appropriately identified and investigated potential claims in this action and that they have appropriate knowledge of the applicable law. Accordingly, considering this experience and the Rule 23(g) factors, I will remove the interim designation and appoint the following individuals as Co-Lead Class Counsel: Andrew Friedman of Cohen Milstein Sellers & Toll PLLC, Amy Keller of DiCello Levitt Gutzler LLC, and James Pizzirusso of Hausfeld LLP. I will also remove the interim designation for Consumer Plaintiffs' Liaison Counsel and Consumer Plaintiffs' Steering Committee. The individuals currently serving in those roles shall continue doing so. The duties for Co-Lead Class Counsel, Liaison Counsel, and members of the Steering Committee remain the same as outlined in the case management order. See Case Mgmt. Order No. 2. As in that order, all the foregoing appointments are personal to the individual attorney appointed. Although the Court expects that the individual attorneys will draw upon their firms, including their firms' resources, to assist them with their duties, each individual attorney is personally responsible for his or her duties. The Court may add or replace individual attorneys, if and as circumstances warrant.

A separate ORDER memorializing this opinion follows.

California	Connecticut	Florida	Georgia	Maryland	Michigan	New York
19, 904, 659	2, 502, 905	7, 370, 612	4, 190, 332	2, 407, 570	2, 824, 108	8, 518, 671