Opinion
Case No. 18-cv-2097
01-19-2021
LYNN MCGLENN, on behalf of herself and all others similarly situated, Plaintiff, v. DRIVELINE RETAIL MERCHANDISING, INC., Defendant.
ORDER AND OPINION SUE E. MYERSCOUGH, U.S. District Judge :
This cause is before the Court on the Renewed Motion for Class Certification (d/e 52) filed by Plaintiff Lynn McGlenn. Defendant filed a response opposing Plaintiff's Motion. See d/e 54. Plaintiff filed a reply. See d/e 57. For the reasons stated below, the Renewed Motion for Class Certification is DENIED.
I. BACKGROUND
The Complaint before the Court was originally brought by Shirley Lavender, individually and on behalf of all others similarly situated, against Defendant Driveline Retail Merchandising, Inc. ("Driveline"). However, Plaintiff filed a Motion for Leave to Substitute Class Representative and for Leave to File an Amended Class Action Complaint in Accordance with the Substitution. See d/e 34. On September 6, 2019, Plaintiff's Motion for Leave to Substitute was granted. See Order, d/e 43. On September 10, 2019, an Amended Complaint was filed and Plaintiff Lynn McGlenn was substituted as Plaintiff in this case. See Amended Complaint, d/e 44.
Plaintiff alleges that Defendant Driveline Retail Merchandising, Inc. ("Driveline") provides retail merchandising services, including setting up product displays and shelving products at big-box retail establishments throughout the United States. See d/e 44, p. 2. In the ordinary course of Driveline's business, Driveline maintains current and former employees' personal and tax information, including the name, address, zip code, date of birth, wage and withholding information, and Social Security number. Id. On January 25, 2017, an employee in Driveline's payroll department, Susan Merciel, sent an email to a phishing perpetrator with 15,878 2016 W-2s. See d/e 54, p. 8; d/e 44, p. 3. The phishing perpetrator posed as Driveline's Chief Financial Officer and asked for all employee W-2s for 2016. See d/e 54, p. 8. The Driveline employee complied with the email request and sent the phishing perpetrator a data file containing copies of W-2 statements for employees who worked at and received wages from Driveline during the time period of January 1, 2016 through December 31, 2016 (the "Disclosure"), which contained sensitive personally identifiable information ("PII"), including names, mailing addresses, Social Security numbers, and wage and withholding information. See d/e 44, p. 3. Plaintiff alleges that the Driveline employee, Susan Merciel, voluntarily made an authorized disclosure of PII of former and current employees of Driveline to a third party without encryption or password protection. Id.; Memorandum of law in Support, d/e 52-1, pp. 3, 5. On February 14, 2017, Driveline sent a letter to its current and former employees advising that their 2016 W-2 had been subjected to a data breach. Id. at 2-3. Driveline offered the compromised employees 12 months of credit monitoring service through AllClear ID. Some employees - 317 of them - accepted the services, others did not. See d/e 54, p. 35.
Phishing is defined as "a scam by which an Internet user is duped (as by a deceptive e-mail message) into revealing personal or confidential information which the scammer can use illicitly." Phishing, Merriam-Webster.com, https://www.merriam-webster.com/dictionary/phishing (last accessed December 28, 2020).
Plaintiff alleges that Driveline's actions allows thieves to file fraudulent tax returns, file for unemployment benefits, and apply for a job using a false identity due to disclosure of the Social Security numbers. See d/e 52-1, p. 3. Plaintiff further alleges that the disclosed information may be used to obtain driver's licenses, government benefits, medical services, and housing and may be given to police as falsely identifiable information. Id. at 4.
Prior to the Disclosure, Ms. Merciel had no training from Driveline that would have aided her in spotting a phishing email nor had she been trained or advised by Driveline that W-2 phishing emails were being perpetrated on payroll departments. Id. at 5; Merciel Deposition, d/e 52-5, pp. 50, 121. Plaintiff alleges that encryption and/or password protection of the PII of the 15,878 employees would have prevented access to Driveline employee's W2 data even if disclosed. See d/e 52-1, p. 5. However, Driveline's CFO Lori Bennett had previously requested confidential personal information of employees be sent to her without encryption or password protection. See d/e 52-1, p. 6; d/e 52-5, pp. 102-103.
After the Disclosure, Plaintiff was alerted that someone used her PII to open a new credit card account with Capital One. See d/e 44, p. 4. Plaintiff alleges that as a result of this, she was required to spend 10 hours trying to close the account and resolving and mitigating the issues arising out of the misuse of her personal information. Id. Additionally, Plaintiff argues that she has had to spend time every week checking her credit report and, as a result of the Disclosure, she will continue to spend numerous hours monitoring her credit reports and bank accounts. See d/e 44, p. 4. As alleged in the Amended Complaint, all class members will be at heightened risk of further identity theft and fraud. Id. Plaintiff argues that Plaintiff and the putative class members have and will continue to suffer damages, including monetary loss, lost time, anxiety, and emotional distress. Id. at 14. Moreover, Plaintiff and class members have suffered or are at increased risk of suffering: unauthorized use and misuse of their PII; the loss of the opportunity to control how their PII is used; the diminution in value of their PII; the compromise, publication and/or theft of their PII; out-of-pocket costs associated with the prevention, detection, recovery and remediation from identity theft or fraud; lost opportunity costs and lost wages associated with effort expended and the loss of productivity from addressing and attempting to mitigate the actual and future consequences of the Data Disclosure, including but not limited to efforts spent researching how to prevent, detect, contest and recover from identity theft and fraud; delay in receipt of tax refund monies; lost opportunity and benefits of electronic filing of income tax returns; the imminent and certain impending injury flowing from potential fraud and identity theft posed by their PII being placed in the hands of criminals; the continued risk to their PII, which remains in the possession of Driveline and is subject to further breaches so long as Driveline fails to undertake appropriate measures to protect the PII in their possession; and current and future costs in terms of time, effort and money that will be expended to prevent, detect, contest, remediate and repair the impact of the Data Disclosure for the remainder of the lives of Plaintiff and Class members. See d/e 44, pp. 14-15.
Plaintiff filed a claim for negligence (Count I), invasion of privacy (Count II), breach of implied contract (Count III), breach of fiduciary duty (Count IV), violation of Illinois Personal Information Protection Act ("IPIPA") (Count V), and violation of Illinois Consumer Fraud and Deceptive Business Practices Act ("ICFA") (Count VI) against Driveline. Plaintiff seeks a mandatory injunction directing Driveline to adequately safeguard the PII of compromised employees by implementing improved security procedures and measures and to provide adequate notice to each employee relating to the full nature and extent of the Disclosure and ordering Driveline pay an award of monetary damages. See d/e 44.
Plaintiff filed the instant renewed motion for class certification seeking to certify a class and have Plaintiff Lynn McGlenn serve as class representative. See Renewed Motion, d/e 52. Plaintiff seeks to certify the class pursuant to Rule 23(a) and Rule 23(b)(2) and Rule 23(b)(3). Alternatively, Plaintiff requests to have certain issues certified for class treatment pursuant to Rule 23(c)(4). Defendant filed a response objecting to certifying the proposed class. See Response, d/e 54. Defendant argues that the commonality requirement is not met pursuant to Rule 23(a)(2), Plaintiff is not an adequate class representative pursuant to Rule 23(a)(4), and Plaintiff's proposed class does not meet any category of Rule 23(b). More specifically, Defendant contends that Plaintiff's class does not meet the predominance requirement of Rule 23(b)(3) because each individual will have to prove causation and damages on an individualized basis. For that same reason, Defendant argues certifying certain issues under Rule 23(c)(4) is not practical. Defendant also argues that certifying the class under Rule 23(b)(2) is inappropriate because Plaintiff's claim for damages are her primary goal and is not incidental to her claim for an injunction.
II. JURISDICTION AND VENUE
Plaintiff invokes jurisdiction under the Class Action Fairness Act, 28 U.S.C. § 1332(d) (CAFA). The CAFA provides federal courts with jurisdiction over certain class actions if the class has more than 100 members, the parties are minimally diverse, and the amount in controversy exceeds $5 million, exclusive of interest and costs. 28 U.S.C. § 1332(d)(2), (5)(B); Standard Fire Ins. Co. v. Knowles, 568 U.S. 588, 592 (2013). The claims of the individual class members are aggregated to determine whether the amount in controversy threshold is met. 28 U.S.C. § 1332(d)(6).
Plaintiff alleges that the aggregate amount in controversy exceeds $5 million, exclusive of interest and costs, that there are more than 100 class members, and that at least one class member is a citizen of a state different from Defendant. See Amended Complaint, d/e 44, ¶ 3. Plaintiff is a citizen of Georgia. Id. Defendant has indicated that Defendant is a citizen of New Jersey and Texas because Defendant is incorporated in New Jersey and has its principal place of business in Texas. See Defendant's Declaration of State of Incorporation and Principal Place of Business, d/e 42. Therefore, this Court has jurisdiction.
III. LEGAL STANDARD
"The purpose of class action litigation is to avoid repeated litigation of the same issue and to facilitate prosecution of claims that any one individual might not otherwise bring on her own." Chicago Teachers Union, Local No. 1 v. Bd. of Educ. of City of Chicago, 797 F.3d 426, 433 (7th Cir. 2015). The Court's decision to certify a class action under Federal Rule of Civil Procedure 23 "is not free-form, but rather has been carefully scripted by the Federal Rules of Civil Procedure." Id. To be certified as a class action, a proposed class must meet the requirements of Federal Rule of Civil Procedure 23(a), as well as one of the three provisions in Rule 23(b). Messner v. Northshore Univ. HealthSystem, 669 F.3d 802 (7th Cir. 2012).
Under Rule 23(a), class actions can only be brought if:
(1) the class is so numerous that joinder of all members is impracticable;Fed. R. Civ. P. 23(a). The four requirements are often referred to as numerosity, commonality, typicality, and adequacy of representation. See Orr v. Shicker, 953 F.3d 490, 497 (7th Cir. 2020).
(2) there are questions of law or fact common to the class;
(3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and
(4) the representative parties will fairly and adequately protect the interests of the class
In addition to these requirements, the proposed class must fall within one of the class categories set forth in Rule 23. Rule 23(b) sets forth four primary categories of classes: (1) to avoid indivisible relief or inconsistent standards of conduct for defendant (Fed. R. Civ. P. 23(b)(1)(A)); (2) to protect absent class members when the existence of a limited fund or stare decisis would be dispositive as to non-members or hinder their ability to protect their interests (Fed. R. Civ. P. 23(b)(1)(B)); (3) where the primary relief sought is equitable, such as injunctive relief, to control defendant's behavior when defendant acts or refuses to act on grounds that apply generally to the class (Fed. R. Civ. P. 23(b)(2)); and (4) when common questions predominate over individual questions and a class is the superior method to dispose of the claims (Fed. R. Civ. P. 23(b)(3)).
The parties focus on two of these class types: injunctive relief under Rule 23(b)(2) and predominance and superiority under Rule 23(b)(3). A class can be certified under Rule 23(b)(2) when "the class has acted or refused to act on grounds that apply generally to the class, so that final injunctive relief or corresponding declaratory relief is appropriate respecting the class as a whole." Fed. R. Civ. P. 23(b)(2). "Rule 23(b)(2) applies only when a single injunction or declaratory judgment would provide relief to each member of the class[;] ... [i]t does not authorize class certification when each class member would be entitled to an individualized award of monetary damages." Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 360-61 (2011).
To certify a class under Rule 23(b)(3), a plaintiff must prove: "(1) that the questions of law or fact common to the members of the proposed class predominate over questions affecting only individual class members; and (2) that a class action is superior to other available methods of resolving the controversy." Messner, 669 F.3d at 811.
Alternatively to the four class types, under Rule 23(c)(4), if the Rule 23(a) requirements are met, the court may rule on certain issues as to the class which do not dispose of the cases in full. "When appropriate, an action may be brought or maintained as a class action with respect to particular issues." Fed. R. Civ. P. 23(c)(4). Rule 23(c)(4) relief may be appropriate "[i]f there are genuinely common issues, issues identical across all the claimants, issues moreover the accuracy of the resolution of which is unlikely to be enhanced by repeated proceedings, then it makes good sense, especially when the class is large, to resolve those issues in one fell swoop while leaving the remaining, claimant-specific issues to individual follow-on proceedings." McReynolds v. Merrill Lynch, Pierce, Fenner & Smith, Inc., 672 F.3d 482, 491 (7th Cir. 2012), quoting Mejdrech v. Met-Coil Sys. Corp., 319 F.3d 910, 911 (7th Cir. 2003).
The Court must first analyze whether Plaintiff has met each Rule 23(a) requirement. In analyzing class certification, "a court should not turn the class certification proceedings into a dress rehearsal for the trial on the merits." Messner, 669 F.3d at 811. "A party seeking class certification must affirmatively demonstrate his compliance with the Rule—that is, he must be prepared to prove that there are in fact sufficiently numerous parties, common questions of law or fact, etc." Wal-Mart Stores, 564 U.S. at 350 (emphasis in original) abrogated on other grounds by Phillips v. Sheriff of Cook Cnty., 828 F.3d 541 (7th Cir. 2016). Plaintiff bears the burden of showing that the proposed class meets the Rule 23 requirements, but this showing need not be "to a degree of absolute certainty. It is sufficient if each disputed requirement has been proven by a preponderance of evidence." Messner, 669 F.3d at 811.
IV. ANALYSIS
A. Rule 23(a) is Sufficiently Satisfied.
1. The Numerosity requirement is met.
Rule 23(a)(1) requires that the class be "so numerous that joinder of all members is impracticable." Fed. R. Civ. P. 23(a)(1). Plaintiff defines the class as "[a]ll current and former Driveline employees whose PII was compromised as a result of the Data Disclosure." See d/e 52, p. 2. Plaintiff alleges, and Defendant does not dispute, that 15,878 individuals were affected by the Disclosure. The Court finds that the numerosity requirement is met.
2. The commonality requirement is not met.
The commonality requirement is met if a plaintiff shows "there are questions of law or fact common to the class." Fed. R. Civ. P. 23(a)(2). Plaintiff must show that the class members have suffered the same injury and that their claims depend on a common contention that "is capable of classwide resolution—which means that determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke." Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 349-50 (2011). "Where the same conduct or practice by the same defendant gives rise to the same kind of claims from all class members, there is a common question." Suchanek v. Sturm Foods, Inc., 764 F.3d 750, 756 (7th Cir. 2014).
Plaintiff argues that the issue of liability is common to each class member and that all claims arise from a common set of facts, namely, that Driveline disclosed over 15,000 employees' PII to a third party. As Plaintiff argues, if each putative class member brought a separate lawsuit, each individual would prove the same acts of Defendant in failing to use reasonable care to protect and safeguard the PII.
Defendant's main contention is that Plaintiff's proposed class fails to meet the requirements of Rule 23(b)(3), which requires questions of law or fact common to class members that predominate over any questions affecting individual members. "While similar to Rule 23(a)'s requirements for typicality and commonality, 'the predominance criterion is far more demanding.'" Messner, 669 F.3d at 814 (quoting Amchem Products, Inc. v. Windsor, 521 U.S. 623-24 (1997). Defendant argues that Plaintiff cannot prove claims of causation and injury on a classwide basis and that these injuries do not predominate over common issues.
Plaintiff seems to agree that inquiry on an individual basis is likely required to prove causation and damages. However, an individual inquiry on damages is typical for class actions. See Kohen, 571 F.3d at 677 ("a class will often include persons who have not been injured by the defendant's conduct; indeed this is almost inevitable because at the outset of the case many of the members of the class may be unknown, or if they are known still the facts bearing on their claims may be unknown. Such a possibility or indeed inevitability does not preclude class certification . . . .").
In the same vein, Defendant argues that the individual inquiries of causation and injury void commonality. Defendant argues because each putative class member will have to prove his or her own individual injuries, the class is not "capable of classwide resolution." See Wal-Mart Stores, Inc., 564 U.S. at 349-50. Moreover, Defendant argues that Plaintiff is incapable of proving that all class members suffered the same injury.
As stated in more detail below, the Court is concerned with individual questions that predominate over common questions of the proposed class. Individualized issues on causation, injury, and damages will require more than the common questions. While the Court recognizes that Plaintiff has proven certain issues are common to the proposed class, such as liability, the issues of causation and injury require individual inquiry. The Court finds that Plaintiff has not met the commonality requirement. All requirements of Rule 23(a) must be met to certify a class. However, the Court continues its analysis for completeness and to address Plaintiff's request for certification under Rule 23(c)(4).
3. The typicality requirement is met.
A plaintiff must show "the claims or defenses of the representative parties are typical of the claims or defenses of the class[.]" Fed. R. Civ. P. 23(a)(3). To satisfy that requirement, the plaintiff's claims must "arise from the same events or course of conduct that gives rise to the putative class members' claims." Beaton v. SpeedyPC Software, 907 F.3d 1018, 1026 (7th Cir. 2018), cert. denied, 139 S. Ct. 1465, 203 L. Ed. 2d 684 (2019); Retired Chicago Police Ass'n v. City of Chicago, 7 F.3d 584, 597 (7th Cir. 1993) ("A plaintiff's claim is typical if it arises from the same event or practice or course of conduct that gives rise to the claims of the other class members and his or her claims are based on the same legal theory."). Plaintiff was one of the 15,878 individuals whose PII was disclosed. She also received the same notification of the Disclosure that the other employees received. Plaintiff argues that her claims arise from the same events and course of conduct that give rise to the putative class members' claims. Defendant does not contest the issue of typicality. The Court finds that the typicality requirement is satisfied.
4. The class representative is adequate.
The adequacy of representation inquiry "consists of two parts: (1) the adequacy of the named plaintiffs as representatives of the proposed class's myriad of members, with their differing and separate interests, and (2) the adequacy of the proposed class counsel." Gomez v. St. Vincent Health, Inc., 649 F.3d 583, 592 (7th Cir. 2011).
Defendant argues that Plaintiff Lynn McGlenn is an inadequate class representative. "A class is not fairly and adequately represented if class members have antagonistic or conflicting claims." Riffey v. Rauner, 873 F.3d 558, 563-64 (7th Cir. 2017). "Conflicts between class members are different from differences in class members' entitlements, which we discussed earlier. Conflicts of interest, as distinct from differences in entitlements, create an issue of adequacy of representation by requiring the class representative to choose between competing class members." Johnson v. Meriter Health Servs. Employee Ret. Plan, 702 F.3d 364, 372 (7th Cir. 2012)
First, Defendant contends that Plaintiff is conflicted from being class representative because she suffered a different type of injury than many putative class members and Plaintiff chose to bring the class action in Illinois, which limits the putative class members' options. Plaintiff alleges she spent 10 hours trying to close a fraudulently opened Capital One credit card account and mitigating the issues arising out of the misuse of her personal information. The former class representative, Ms. Lavender, contends that she was required to make a 2-hour round trip to an IRS office to verify her identity prior to receiving her federal income tax refund. Many other putative class members spent no time dealing with potential identity theft or were not required to verify their identities with the IRS prior to receiving their federal income tax refund.
Defendant relies on Culver v. City of Milwaukee, 277 F.3d 908 (7th Cir. 2002). In Culver, plaintiff filed a discrimination suit to represent a class of police officers who were denied job applications or completed job applications and took the entrance exam but were denied the job based on being scored in a discriminatory manner. The lower court ruled that Culver was an inadequate class representative because Culver "made only perfunctory efforts . . . to obtain a job application" and soon after obtained another job. Culver, 277 F.3d at 912. The Seventh Circuit affirmed the lower court's decision. Id. ("Although the mootness of a named plaintiff's claim does not automatically disqualify him from serving as class representative, since it does not make the suit moot (the unnamed class members' claims are not moot), it makes him presumptively inadequate, in our view, unless the defendant is executing a strategy of buying off class representatives successively in an effort to derail the suit.").However, the case sub judice is inapposite to Culver. Plaintiff McGlenn has alleged injuries similar to other class members - time spent protecting her identity and investigating potential fraud.
Defendant also argues that Illinois law disadvantages other class members who could bring suit elsewhere. Defendant contends that Illinois does not consider risk of future harm as a stand-alone claim, that economic loss is unrecoverable in tort damages in this case under Illinois law, and that Plaintiff's fraud damages are limited by the ICFA and IPIPA. But, these arguments are more appropriate for summary judgment. Moreover, Defendant cites to no authority for the proposition that a choice of forum renders a class representative inadequate.
Defendant further argues that Defendant is entitled to raise several defenses applicable to Plaintiff that may not be applicable to the class as a whole. The Seventh Circuit has held that a proposed class representative is improper where "it is predictable that a major focus of the litigation will be on an arguable defense unique to the named plaintiff or small subclass," Books v. First Nat'l Bank of Peoria, 496 F.2d 1162, 1164-65 (7th Cir. 1974).
The Court cannot make such a prediction in this case. The evidence does not clearly indicate that the defenses Defendant may raise will be a major focus of the case. See Johnson, 702 F.3d at 372 ("It is premature to declare the alleged conflicts of interest an insoluble bar to the class action.").Therefore, the Court finds that Plaintiff is an adequate class representative.
B. Certification Under Rule 23(b)(2) Is Inappropriate Because Money Damages Are Not Incidental to the Equitable Relief.
Plaintiff contends that certifying the class pursuant to Rule 23(b)(2) is also appropriate because Defendant failed to adequately safeguard and protect Plaintiff's and the putative class member's PII and final injunctive relief is needed to remediate Defendant's inadequate data security. A class may be certified pursuant to Rule 23(b)(2) if "the party opposing the class has acted or refused to act on grounds that apply generally to the class, so that final injunctive relief or corresponding declaratory relief is appropriate respecting the class as a whole." Fed. R. Civ. P. 23(b)(2). Plaintiff seeks a mandatory injunction directing Driveline to adequately safeguard the PII of the proposed class in the future by implementing improved security procedures. Additionally, the mandatory injunction would require Driveline to provide "notice to each member of the class relating to the full nature and extent of the Data Disclosure and the disclosure of PII to unauthorized persons." See d/e 57, p. 10.
Defendant contends that certification under Rule 23(b)(2) is improper because prospective injunctive relief would not remedy the alleged injuries suffered by Plaintiff and the proposed class. The Court agrees. Plaintiff seeks a mandatory injunction to further protect PII from disclosure and to provide adequate notice of the full extent of the Disclosure. However, Plaintiff has not sufficiently shown that a mandatory injunction would remedy the alleged harm. Moreover, the allegations and arguments indicate that Plaintiff's main goal is monetary damages. Monetary damages may be sought if "incidental to the injunctive or declaratory relief." Johnson v. Meriter Health Servs. Employee Ret. Plan, 702 F.3d 364, 369 (7th Cir. 2012); see also Lemon v. Int'l Union of Operating Engineers, Local No. 139, AFL-CIO, 216 F.3d 577, 580-81 (7th Cir. 2000)(" [N]onequitable monetary relief may be obtained in a class action certified under Rule 23(b)(2) only if the predominant relief sought is injunctive or declaratory."); Jefferson v. Ingersoll Int'l Inc., 195 F.3d 894, 898 (7th Cir. 1999). The Court finds that Plaintiff's monetary relief is not incidental to the injunctive relief. Therefore, certification under Rule 23(b)(2) is inappropriate.
C. Certification as a Whole Under Rule 23(b)(3) Is Inappropriate.
1. Certifying the Class as a Whole Under Rule 23(b)(3) Is Inappropriate.
Rule 23(b)(3) applies to class actions when the proposed class seeks money damages. Bell v. PNC Bank, Nat. Ass'n, 800 F.3d 360, 373 (7th Cir. 2015). Rule 23(b)(3) requires the named plaintiff to establish (1) that questions of law or fact common to class members predominate over any questions affecting only individual members and (2) that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy. Fed. R. Civ. P. 23(b)(3). "While similar to Rule 23(a)'s requirements for typicality and commonality, 'the predominance criterion is far more demanding.'" Messner, 669 F.3d at 814 (quoting Amchem Products, Inc. v. Windsor, 521 U.S. 623-24 (1997).
Plaintiff argues that Plaintiff and class members share common questions, including whether Driveline had adequate training and procedures in place for data security. Defendant contends that individual inquiries for causation, actual injury, and damages outweigh judicial economies gained from adjudicating the common issues as a class action and the common issues do not predominate over the individualized issues.
Plaintiff contends that each putative class member shares the same issue whether Defendant owed a duty to protect the class members' PII and whether Defendant breached that duty. Plaintiff says the same is true about the issue whether Defendant breached an implied contract. However, Defendant has raised doubt that a duty to protect from data breaches exists in Illinois. The Seventh Circuit held that Illinois has not created a common law duty between an employer and an employee to safeguard personal information beyond providing notice of a disclosure. Cooney v. Chicago Pub. Sch., 407 Ill. App. 3d 358, 363, 943 N.E.2d 23, 29 (2010) ("While we do not minimize the importance of protecting this information, we do not believe that the creation of a new legal duty beyond legislative requirements already in place is part of our role on appellate review. As noted, the legislature has specifically addressed the issue and only required the Board to provide notice of the disclosure."). Following Cooney, the Seventh Circuit ruled similarly in Cmty. Bank of Trenton v. Schnuck Markets, Inc, finding the defendant retailer, Schnuck Markets, did not owe a duty to the customer's banks where Schnucks suffered a major breach of its customers data. 887 F.3d 803, 816 (7th Cir. 2018) (interpreting Cooney as "a more general statement that no duty to safeguard personal information existed, regardless of the kind of loss" and predicting "that the state court would not impose the common law data security duty the plaintiff banks call for here."). Moreover, the Seventh Circuit held that "[e]ven if Cooney had not come to this conclusion, Illinois would probably apply the economic loss rule to bar recovery anyway." Schnuck Markets, 887 F.3d at 817.
Under each cause of action brought by Plaintiff and the proposed class, Plaintiff and the putative class members must prove damages. In the instant motion, Plaintiff alleged that each putative class member suffered damage and injury as a result of the Disclosure and "each suffered the same general type of damages - loss of value of PII, out of pocket monetary expenses, and other foreseeable losses stemming from identify theft." See d/e 52-1, p. 26-27. Plaintiff argues that the class members will use the same expert testimony to establish that they have suffered lost value of their PII.
Plaintiff's expert, Mr. James Van Dyke, identifies "multiple steps necessary for each victim of the Driveline Employee W-2 Disclosure including: monitoring all three major credit bureaus, credit freezes at all three bureaus, new account fraud protection, [and] regular monitoring of all accounts." See d/e 52-1, p. 32. Additionally, Mr. Van Dyke opines "that the cost or value of remedial services that should be provided to mitigate the harms suffered by each class member range[s] from $179 - $360 per year per class member." Id. at 33. While Plaintiff notes that damages may need to be calculated individually, Plaintiff argues that should not serve as an impediment to class certification. See Comcast Corp v. Behrend, 133 S.Ct. 1426, 1437 (2013) (dissent) ("Recognition that individual damages calculations do not preclude class certification under Rule 23(b)(3) is well nigh universal.").
Plaintiff offers James Van Dyke as an expert in data security. See d/e 52-1, p. 31. Mr. Van Dyke is the founder of a "research consulting firm specializing in areas including identity fraud and security." Id.
Defendant contends that Plaintiff has failed to show evidence of a common injury as to Plaintiff and all class members and that Plaintiff has offered no evidence that the hacker misused the data stolen from the Disclosure. Mr. Van Dyke did not present testimony that the putative class members sustained bank charges or service reinstatement fees as a result of the disclosure, suffered negative credit ratings, were denied a loan, sought public assistance, were the victims of medical identity thefts, or had their Social Security numbers used to file a fraudulent tax return. Id. at 22. Defendant argues that Plaintiff has failed to prove that a substantial number of the class members have suffered actual injury. See Kohen v. Pac. Inv. Mgmt. Co. LLC, 571 F.3d 672, 677-78 (7th Cir. 2009) ("A related point is that a class should not be certified if it is apparent that it contains a great many persons who have suffered no injury at the hands of the defendant, see Oshana v. Coca-Cola Co., 472 F.3d 506, 514-15 (7th Cir.2006); Romberio v. Unumprovident Corp., 2009 WL 87510, at *8 (6th Cir. Jan.12, 2009); cf. Brown v. American Honda, 522 F.3d 6, 28-29 (1st Cir.2008), if only because of the in terrorem character of a class action."). Further, as noted by the Kohn Court, a concern surrounding class actions is potentially imposing "a huge contingent liability on a defendant." Id. at 678. The concern lies in the class definition - if the class is stated broadly, "this would be a compelling reason to require that it be narrowed." Id.
Mr. Van Dyke opines that a substantial number of victims of any data breach run no imminent threat of identity theft at the time they are notified of a breach, after 12 months, or after 24 months. See d/e 83, p. 29. Defendant argues that only two individuals of the proposed class - McGlenn and Lavender - have claims of damages, which are unsubstantiated. While most class members may have faced an increased risk of future harm, the risk of future harm is an element of damages for a present injury. Williams v. Manchester, 228 Ill. 2d 404, 425, 888 N.E.2d 1, 13 (2008) ("[A]n increased risk of future harm is an element of damages that can be recovered for a present injury—it is not the injury itself."). Mr. Van Dyke did not opine on each class member's individual risk of future harm.
Mr. Van Dyke objects to the publication of the exact figures in his opinions, claiming that the figures are confidential. At this time, the Court does not make a ruling on this issue and will protect the data in this Opinion.
Additionally, Defendant argues that a detailed analysis of proximate cause is necessary for each individual class member and Plaintiff relating to the claims of negligence, breach of fiduciary duty, ICFA, and breach of contract. Plaintiff does not disagree that an individual inquiry into causation is likely. Defendant argues, and Plaintiff's expert agrees, that several Driveline employees likely had been involved in other data breaches in the two to four years prior to the Disclosure. See d/e 54, p. 21. Defendant also notes that Mr. Van Dyke's testimony related to data breaches in general, not the Disclosure in particular. As for Plaintiff McGlenn, McGlenn claims that the Disclosure resulted in a person fraudulently attempting to activate a Capitol One credit card account in McGlenn's name in July 2017. Defendant argues, however, that the attempt may have been the result of a different data breach and that McGlenn's experience should not be imputed to the class as a whole. See Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 356 (2011) ("[O]ne named plaintiff's experience of discrimination was insufficient to infer that discriminatory treatment is typical of the employer's employment practices."). Evidence shows that some putative class members may have suffered suspicious credit activity within a year of the Disclosure, while others did not. Additionally, some class members received a letter from the IRS requiring the individual to verify their identity before obtaining a tax refund, while many other class members did not receive such a letter. See d/e 54, p. 10. Plaintiff McGlenn did not receive a letter from the IRS. However, the former class representative, Ms. Lavender, was required to travel to an IRS office to verify her identity. Id. Others who received the letter were allowed to verify by telephone. Id. Mr. Van Dyke opines that the jury could infer that the IRS letter was related to the Disclosure because Ms. Lavender had to verify her identity less than a month after the Disclosure. Defendant argues Mr. Van Dyke's opinion is speculative, the Disclosure and the letter occurred during tax season, and no evidence proves that the IRS letter resulted from the Disclosure. Further, Mr. Van Dyke did not know if other class members received communication from the IRS.
Plaintiff argues that the need for individual inquiries does not prevent class certification and she is not required to prove the underlying merits of her case at this time. See Messner, 669 F.3d at 815 ("It is well established that the presence of individualized questions regarding damages does not prevent certification under Rule 23(b)(3)."). In Messner, the defendant contested whether all class members could prove an injury. At issue there was whether the defendant violated the Clayton Act, which requires a showing that defendant violated federal antitrust law and that the antitrust violation caused plaintiffs' injuries. Id. at 816. The Seventh Circuit rejected the defendant's argument because inquiry into injury should occur at the end of the case. The Seventh Circuit reasoned, "[u]nder the proper standard, plaintiffs' burden at the class certification stage was not to prove the element of antitrust impact, but only to demonstrate that the element of antitrust impact is capable of proof at trial through evidence that is common to the class rather than individual to its members." Id. at 818.
Here, Plaintiff has pled five causes of action which involve causation and all six causes of action require proof of damages. Individualized issues on causation, injury, and damages require more than what was required in Messner. Defendant has raised sufficient doubt, and Plaintiff has failed to establish that the common questions will predominate over the individual issues.
As Plaintiff notes, a court may "bifurcate the case into a liability phase and a damages phase" if the case requires individual determinations of causation and damages. Mullins v. Direct Digital, LLC, 795 F.3d 654, 671 (7th Cir. 2015). Such option is discussed in more detail below. The Court has considerable concerns relating to individual proof required for causation and damages in this case. Moreover, Driveline has raised doubt as to whether Plaintiff and other class members have actually suffered any injury. Plaintiff has not presented sufficient evidence that a number of class members have suffered a compensable injury. Accordingly, the Court finds that Plaintiff has not satisfied the predominance requirement of Rule 23(b)(3) to certify all questions for class consideration.
2. The Court Will Not Certify the Class for Particular Issues Pursuant to Rule 23(c)(4).
While the Court finds that certification of the class as to all issues is inappropriate, the Court considers whether class certification of certain issues is proper pursuant to Rule 23(c)(4). "When appropriate, an action may be brought or maintained as a class action with respect to particular issues." Fed. R. Civ. P. 23(c)(4). In the alternative to full class certification, Plaintiff seeks class certification on certain issues. Specifically, Plaintiff contends the following issues would lead to an efficient disposition of the parties' interests:
(1) Whether Defendant owed a legal duty to Plaintiff and the class to exercise due care in collecting, storing, using, transmitting, and safeguarding their PII;
(2) Whether Defendant breached a legal duty to Plaintiff and the class to exercise due care in collecting, storing, using, transmitting, and safeguarding their PII;
(3) Whether Defendant failed to comply with their own policies and applicable laws, regulations, and industry standards relating to data security;
(4) Whether Defendant timely, adequately, and accurately informed class members that their PII had been disclosed without authorization;
(5) Whether Defendant failed to implement and maintain reasonable security procedures and practices appropriate to the nature and scope of the information disclosed and compromised in the Data Disclosure;
(6) Whether Defendant engaged in unfair, unlawful, or deceptive practices by failing to safeguard and disclosing without authorization the PII of class members; and
(7) Whether class members are entitled to actual damages, statutory damages, injunctive relief, and/or
punitive damages as a result of Defendant's wrongful conduct.See d/e 52-1, pp. 38-39.
Defendant argues that partial certification is unworkable because "whether any particular potential class member is entitled to damages is inextricably tied to whether the Disclosure proximately caused any individual injury." See d/e 54, p. 41. Further, Defendant contends that the issue of duty of care and standard of care are only at issue in two of Plaintiff's claims - negligence and breach of fiduciary duty - and whether Plaintiff gave adequate notice is only relevant to one claim - negligence. However, both parties agree that damages will require individual assessments for each putative class member. Moreover, several other claims brought by Plaintiff will remain untouched and unanswered even if the Court adopts all of Plaintiff's proposed issues.
The Court recognizes that the putative class members share certain issues, including whether Defendant owed a duty and whether Defendant breached that duty. However, these issues do not predominate over all claims as they are only related to two claims. Plaintiff has alleged six claims against Defendant. Additionally, Plaintiff agrees that damages will require individual assessment for each class member, and Plaintiff seems to acknowledge that causation may require an individual inquiry, to which the Court agrees. The Court finds that certifying the issues identified by Plaintiff for class purposes would not promote judicial efficiency. As stated in Matter of Rhone-Poulenc Rorer, Inc.:
The first jury will not determine liability. It will determine merely whether one or more of the defendants was negligent under one of the two theories. The first jury may go on to decide the additional issues with regard to the named plaintiffs. But it will not decide them with regard to the other class members. Unless the defendants settle, a second (and third, and fourth, and hundredth, and conceivably thousandth) jury will have to decide, in individual follow-on litigation by class members not named as plaintiffs in the Wadleigh case, such issues as comparative negligence—did any class members knowingly continue to use unsafe blood solids after they learned or should have learned of the risk of contamination with HIV?—and proximate causation. Both issues overlap the issue of the defendants' negligence. Comparative negligence entails, as the name implies, a comparison of the degree of negligence of plaintiff and defendant.51 F.3d 1293, 1303 (7th Cir. 1995). Similarly here, Plaintiff's suggestion to determine a portion of her negligence and breach of fiduciary duty claims on a class-wide basis would be inefficient. Accordingly, the Court denies Plaintiff's request to certify the class for particular issues pursuant to Rule 23(c)(4).
V. CONCLUSION
For the reasons set forth above, Plaintiff's Renewed Motion for Class Certification (d/e 52) is DENIED.
ENTERED: January 19, 2021
FOR THE COURT:
/s/ _________
SUE E. MYERSCOUGH
UNITED STATES DISTRICT JUDGE