Lavender v. Driveline Retail Merchandising Inc
Filing
87
ORDER & OPINION entered by Judge Sue E. Myerscough on 1/19/2021. Plaintiff Lynn McGlenn's Renewed Motion for Class Certification, d/e 52 is DENIED. (SEE WRITTEN ORDER & OPINION) (MAS, ilcd)
2:18-cv-02097-SEM-TSH # 87
Page 1 of 36
E-FILED
Tuesday, 19 January, 2021 04:31:09 PM
Clerk, U.S. District Court, ILCD
IN THE UNITED STATES DISTRICT COURT
FOR THE CENTRAL DISTRICT OF ILLINOIS
SPRINGFIELD DIVISION
LYNN MCGLENN, on behalf of
herself and all others
similarly situated,
Plaintiff,
v.
DRIVELINE RETAIL
MERCHANDISING, INC.,
Defendant.
)
)
)
)
)
)
)
)
)
)
)
)
Case No. 18-cv-2097
ORDER AND OPINION
SUE E. MYERSCOUGH, U.S. District Judge:
This cause is before the Court on the Renewed Motion for
Class Certification (d/e 52) filed by Plaintiff Lynn McGlenn.
Defendant filed a response opposing Plaintiff’s Motion. See d/e 54.
Plaintiff filed a reply. See d/e 57. For the reasons stated below, the
Renewed Motion for Class Certification is DENIED.
I. BACKGROUND
The Complaint before the Court was originally brought by
Shirley Lavender, individually and on behalf of all others similarly
situated, against Defendant Driveline Retail Merchandising, Inc.
Page 1 of 36
2:18-cv-02097-SEM-TSH # 87
Page 2 of 36
(“Driveline”). However, Plaintiff filed a Motion for Leave to
Substitute Class Representative and for Leave to File an Amended
Class Action Complaint in Accordance with the Substitution. See
d/e 34. On September 6, 2019, Plaintiff’s Motion for Leave to
Substitute was granted. See Order, d/e 43. On September 10,
2019, an Amended Complaint was filed and Plaintiff Lynn McGlenn
was substituted as Plaintiff in this case. See Amended Complaint,
d/e 44.
Plaintiff alleges that Defendant Driveline Retail Merchandising,
Inc. (“Driveline”) provides retail merchandising services, including
setting up product displays and shelving products at big-box retail
establishments throughout the United States. See d/e 44, p. 2. In
the ordinary course of Driveline’s business, Driveline maintains
current and former employees’ personal and tax information,
including the name, address, zip code, date of birth, wage and
withholding information, and Social Security number. Id. On
January 25, 2017, an employee in Driveline’s payroll department,
Susan Merciel, sent an email to a phishing 1 perpetrator with 15,878
Phishing is defined as “a scam by which an Internet user is duped (as by a
deceptive e-mail message) into revealing personal or confidential information
which the scammer can use illicitly.” Phishing, Merriam-Webster.com,
1
Page 2 of 36
2:18-cv-02097-SEM-TSH # 87
Page 3 of 36
2016 W-2s. See d/e 54, p. 8; d/e 44, p. 3. The phishing
perpetrator posed as Driveline’s Chief Financial Officer and asked
for all employee W-2s for 2016. See d/e 54, p. 8. The Driveline
employee complied with the email request and sent the phishing
perpetrator a data file containing copies of W-2 statements for
employees who worked at and received wages from Driveline during
the time period of January 1, 2016 through December 31, 2016 (the
“Disclosure”), which contained sensitive personally identifiable
information (“PII”), including names, mailing addresses, Social
Security numbers, and wage and withholding information. See d/e
44, p. 3. Plaintiff alleges that the Driveline employee, Susan
Merciel, voluntarily made an authorized disclosure of PII of former
and current employees of Driveline to a third party without
encryption or password protection. Id.; Memorandum of law in
Support, d/e 52-1, pp. 3, 5. On February 14, 2017, Driveline sent
a letter to its current and former employees advising that their 2016
W-2 had been subjected to a data breach. Id. at 2-3. Driveline
offered the compromised employees 12 months of credit monitoring
https://www.merriam-webster.com/dictionary/phishing (last accessed
December 28, 2020).
Page 3 of 36
2:18-cv-02097-SEM-TSH # 87
Page 4 of 36
service through AllClear ID. Some employees – 317 of them –
accepted the services, others did not. See d/e 54, p. 35.
Plaintiff alleges that Driveline’s actions allows thieves to file
fraudulent tax returns, file for unemployment benefits, and apply
for a job using a false identity due to disclosure of the Social
Security numbers. See d/e 52-1, p. 3. Plaintiff further alleges that
the disclosed information may be used to obtain driver’s licenses,
government benefits, medical services, and housing and may be
given to police as falsely identifiable information. Id. at 4.
Prior to the Disclosure, Ms. Merciel had no training from
Driveline that would have aided her in spotting a phishing email nor
had she been trained or advised by Driveline that W-2 phishing
emails were being perpetrated on payroll departments. Id. at 5;
Merciel Deposition, d/e 52-5, pp. 50, 121. Plaintiff alleges that
encryption and/or password protection of the PII of the 15,878
employees would have prevented access to Driveline employee’s W2
data even if disclosed. See d/e 52-1, p. 5. However, Driveline’s
CFO Lori Bennett had previously requested confidential personal
information of employees be sent to her without encryption or
password protection. See d/e 52-1, p. 6; d/e 52-5, pp. 102-103.
Page 4 of 36
2:18-cv-02097-SEM-TSH # 87
Page 5 of 36
After the Disclosure, Plaintiff was alerted that someone used
her PII to open a new credit card account with Capital One. See
d/e 44, p. 4. Plaintiff alleges that as a result of this, she was
required to spend 10 hours trying to close the account and
resolving and mitigating the issues arising out of the misuse of her
personal information. Id. Additionally, Plaintiff argues that she has
had to spend time every week checking her credit report and, as a
result of the Disclosure, she will continue to spend numerous hours
monitoring her credit reports and bank accounts. See d/e 44, p. 4.
As alleged in the Amended Complaint, all class members will be at
heightened risk of further identity theft and fraud. Id. Plaintiff
argues that Plaintiff and the putative class members have and will
continue to suffer damages, including monetary loss, lost time,
anxiety, and emotional distress. Id. at 14. Moreover, Plaintiff and
class members have suffered or are at increased risk of suffering:
unauthorized use and misuse of their PII; the loss of the
opportunity to control how their PII is used; the diminution in value
of their PII; the compromise, publication and/or theft of their PII;
out-of-pocket costs associated with the prevention, detection,
recovery and remediation from identity theft or fraud; lost
Page 5 of 36
2:18-cv-02097-SEM-TSH # 87
Page 6 of 36
opportunity costs and lost wages associated with effort expended
and the loss of productivity from addressing and attempting to
mitigate the actual and future consequences of the Data Disclosure,
including but not limited to efforts spent researching how to
prevent, detect, contest and recover from identity theft and fraud;
delay in receipt of tax refund monies; lost opportunity and benefits
of electronic filing of income tax returns; the imminent and certain
impending injury flowing from potential fraud and identity theft
posed by their PII being placed in the hands of criminals; the
continued risk to their PII, which remains in the possession of
Driveline and is subject to further breaches so long as Driveline
fails to undertake appropriate measures to protect the PII in their
possession; and current and future costs in terms of time, effort
and money that will be expended to prevent, detect, contest,
remediate and repair the impact of the Data Disclosure for the
remainder of the lives of Plaintiff and Class members. See d/e 44,
pp. 14-15.
Plaintiff filed a claim for negligence (Count I), invasion of
privacy (Count II), breach of implied contract (Count III), breach of
fiduciary duty (Count IV), violation of Illinois Personal Information
Page 6 of 36
2:18-cv-02097-SEM-TSH # 87
Page 7 of 36
Protection Act (“IPIPA”) (Count V), and violation of Illinois Consumer
Fraud and Deceptive Business Practices Act (“ICFA”) (Count VI)
against Driveline. Plaintiff seeks a mandatory injunction directing
Driveline to adequately safeguard the PII of compromised employees
by implementing improved security procedures and measures and
to provide adequate notice to each employee relating to the full
nature and extent of the Disclosure and ordering Driveline pay an
award of monetary damages. See d/e 44.
Plaintiff filed the instant renewed motion for class certification
seeking to certify a class and have Plaintiff Lynn McGlenn serve as
class representative. See Renewed Motion, d/e 52. Plaintiff seeks
to certify the class pursuant to Rule 23(a) and Rule 23(b)(2) and
Rule 23(b)(3). Alternatively, Plaintiff requests to have certain issues
certified for class treatment pursuant to Rule 23(c)(4). Defendant
filed a response objecting to certifying the proposed class. See
Response, d/e 54. Defendant argues that the commonality
requirement is not met pursuant to Rule 23(a)(2), Plaintiff is not an
adequate class representative pursuant to Rule 23(a)(4), and
Plaintiff’s proposed class does not meet any category of Rule 23(b).
More specifically, Defendant contends that Plaintiff’s class does not
Page 7 of 36
2:18-cv-02097-SEM-TSH # 87
Page 8 of 36
meet the predominance requirement of Rule 23(b)(3) because each
individual will have to prove causation and damages on an
individualized basis. For that same reason, Defendant argues
certifying certain issues under Rule 23(c)(4) is not practical.
Defendant also argues that certifying the class under Rule 23(b)(2)
is inappropriate because Plaintiff’s claim for damages are her
primary goal and is not incidental to her claim for an injunction.
II. JURISDICTION AND VENUE
Plaintiff invokes jurisdiction under the Class Action Fairness
Act, 28 U.S.C. § 1332(d) (CAFA). The CAFA provides federal courts
with jurisdiction over certain class actions if the class has more
than 100 members, the parties are minimally diverse, and the
amount in controversy exceeds $5 million, exclusive of interest and
costs. 28 U.S.C. § 1332(d)(2), (5)(B); Standard Fire Ins. Co. v.
Knowles, 568 U.S. 588, 592 (2013). The claims of the individual
class members are aggregated to determine whether the amount in
controversy threshold is met. 28 U.S.C. § 1332(d)(6).
Plaintiff alleges that the aggregate amount in controversy
exceeds $5 million, exclusive of interest and costs, that there are
more than 100 class members, and that at least one class member
Page 8 of 36
2:18-cv-02097-SEM-TSH # 87
Page 9 of 36
is a citizen of a state different from Defendant. See Amended
Complaint, d/e 44, ¶ 3. Plaintiff is a citizen of Georgia. Id.
Defendant has indicated that Defendant is a citizen of New Jersey
and Texas because Defendant is incorporated in New Jersey and
has its principal place of business in Texas. See Defendant’s
Declaration of State of Incorporation and Principal Place of
Business, d/e 42. Therefore, this Court has jurisdiction.
III. LEGAL STANDARD
“The purpose of class action litigation is to avoid repeated
litigation of the same issue and to facilitate prosecution of claims
that any one individual might not otherwise bring on her own.”
Chicago Teachers Union, Local No. 1 v. Bd. of Educ. of City of
Chicago, 797 F.3d 426, 433 (7th Cir. 2015). The Court's decision to
certify a class action under Federal Rule of Civil Procedure 23 “is
not free-form, but rather has been carefully scripted by the Federal
Rules of Civil Procedure.” Id. To be certified as a class action, a
proposed class must meet the requirements of Federal Rule of Civil
Procedure 23(a), as well as one of the three provisions in Rule 23(b).
Messner v. Northshore Univ. HealthSystem, 669 F.3d 802 (7th Cir.
2012).
Page 9 of 36
2:18-cv-02097-SEM-TSH # 87
Page 10 of 36
Under Rule 23(a), class actions can only be brought if:
(1) the class is so numerous that joinder of all members
is impracticable;
(2) there are questions of law or fact common to the
class;
(3) the claims or defenses of the representative parties are
typical of the claims or defenses of the class; and
(4) the representative parties will fairly and adequately
protect the interests of the class
Fed. R. Civ. P. 23(a). The four requirements are often referred to as
numerosity, commonality, typicality, and adequacy of
representation. See Orr v. Shicker, 953 F.3d 490, 497 (7th Cir.
2020).
In addition to these requirements, the proposed class must fall
within one of the class categories set forth in Rule 23. Rule 23(b)
sets forth four primary categories of classes: (1) to avoid indivisible
relief or inconsistent standards of conduct for defendant (Fed. R.
Civ. P. 23(b)(1)(A)); (2) to protect absent class members when the
existence of a limited fund or stare decisis would be dispositive as
to non-members or hinder their ability to protect their interests
(Fed. R. Civ. P. 23(b)(1)(B)); (3) where the primary relief sought is
equitable, such as injunctive relief, to control defendant's behavior
Page 10 of 36
2:18-cv-02097-SEM-TSH # 87
Page 11 of 36
when defendant acts or refuses to act on grounds that apply
generally to the class (Fed. R. Civ. P. 23(b)(2)); and (4) when
common questions predominate over individual questions and a
class is the superior method to dispose of the claims (Fed. R. Civ. P.
23(b)(3)).
The parties focus on two of these class types: injunctive relief
under Rule 23(b)(2) and predominance and superiority under Rule
23(b)(3). A class can be certified under Rule 23(b)(2) when “the
class has acted or refused to act on grounds that apply generally to
the class, so that final injunctive relief or corresponding declaratory
relief is appropriate respecting the class as a whole.” Fed. R. Civ. P.
23(b)(2). “Rule 23(b)(2) applies only when a single injunction or
declaratory judgment would provide relief to each member of the
class[;] ... [i]t does not authorize class certification when each class
member would be entitled to an individualized award of monetary
damages.” Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 360–61
(2011).
To certify a class under Rule 23(b)(3), a plaintiff must prove:
“(1) that the questions of law or fact common to the members of the
proposed class predominate over questions affecting only individual
Page 11 of 36
2:18-cv-02097-SEM-TSH # 87
Page 12 of 36
class members; and (2) that a class action is superior to other
available methods of resolving the controversy.” Messner, 669 F.3d
at 811.
Alternatively to the four class types, under Rule 23(c)(4), if the
Rule 23(a) requirements are met, the court may rule on certain
issues as to the class which do not dispose of the cases in full.
“When appropriate, an action may be brought or maintained as a
class action with respect to particular issues.” Fed. R. Civ. P.
23(c)(4). Rule 23(c)(4) relief may be appropriate “[i]f there are
genuinely common issues, issues identical across all the claimants,
issues moreover the accuracy of the resolution of which is unlikely
to be enhanced by repeated proceedings, then it makes good sense,
especially when the class is large, to resolve those issues in one fell
swoop while leaving the remaining, claimant-specific issues to
individual follow-on proceedings.” McReynolds v. Merrill Lynch,
Pierce, Fenner & Smith, Inc., 672 F.3d 482, 491 (7th Cir. 2012),
quoting Mejdrech v. Met–Coil Sys. Corp., 319 F.3d 910, 911 (7th
Cir. 2003).
The Court must first analyze whether Plaintiff has met each
Rule 23(a) requirement. In analyzing class certification, “a court
Page 12 of 36
2:18-cv-02097-SEM-TSH # 87
Page 13 of 36
should not turn the class certification proceedings into a dress
rehearsal for the trial on the merits.” Messner, 669 F.3d at 811. “A
party seeking class certification must affirmatively demonstrate his
compliance with the Rule—that is, he must be prepared to prove
that there are in fact sufficiently numerous parties, common
questions of law or fact, etc.” Wal-Mart Stores, 564 U.S. at 350
(emphasis in original) abrogated on other grounds by Phillips v.
Sheriff of Cook Cnty., 828 F.3d 541 (7th Cir. 2016). Plaintiff bears
the burden of showing that the proposed class meets the Rule 23
requirements, but this showing need not be “to a degree of absolute
certainty. It is sufficient if each disputed requirement has been
proven by a preponderance of evidence.” Messner, 669 F.3d at 811.
IV. ANALYSIS
A. Rule 23(a) is Sufficiently Satisfied.
1. The Numerosity requirement is met.
Rule 23(a)(1) requires that the class be “so numerous that
joinder of all members is impracticable.” Fed. R. Civ. P. 23(a)(1).
Plaintiff defines the class as “[a]ll current and former Driveline
employees whose PII was compromised as a result of the Data
Disclosure.” See d/e 52, p. 2. Plaintiff alleges, and Defendant does
Page 13 of 36
2:18-cv-02097-SEM-TSH # 87
Page 14 of 36
not dispute, that 15,878 individuals were affected by the
Disclosure. The Court finds that the numerosity requirement is
met.
2. The commonality requirement is not met.
The commonality requirement is met if a plaintiff shows “there
are questions of law or fact common to the class.” Fed. R. Civ. P.
23(a)(2). Plaintiff must show that the class members
have suffered the same injury and that their claims depend on a
common contention that “is capable of classwide resolution—which
means that determination of its truth or falsity will resolve an issue
that is central to the validity of each one of the claims in one
stroke.” Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 349–50
(2011). “Where the same conduct or practice by the same
defendant gives rise to the same kind of claims from all class
members, there is a common question.” Suchanek v. Sturm Foods,
Inc., 764 F.3d 750, 756 (7th Cir. 2014).
Plaintiff argues that the issue of liability is common to each
class member and that all claims arise from a common set of facts,
namely, that Driveline disclosed over 15,000 employees’ PII to a
third party. As Plaintiff argues, if each putative class member
Page 14 of 36
2:18-cv-02097-SEM-TSH # 87
Page 15 of 36
brought a separate lawsuit, each individual would prove the same
acts of Defendant in failing to use reasonable care to protect and
safeguard the PII.
Defendant’s main contention is that Plaintiff’s proposed class
fails to meet the requirements of Rule 23(b)(3), which requires
questions of law or fact common to class members that
predominate over any questions affecting individual members.
“While similar to Rule 23(a)'s requirements for typicality and
commonality, ‘the predominance criterion is far more demanding.’”
Messner, 669 F.3d at 814 (quoting Amchem Products, Inc. v.
Windsor, 521 U.S. 623-24 (1997). Defendant argues that Plaintiff
cannot prove claims of causation and injury on a classwide basis
and that these injuries do not predominate over common issues.
Plaintiff seems to agree that inquiry on an individual basis is
likely required to prove causation and damages. However, an
individual inquiry on damages is typical for class actions. See
Kohen, 571 F.3d at 677 (“a class will often include persons who
have not been injured by the defendant's conduct; indeed this is
almost inevitable because at the outset of the case many of the
members of the class may be unknown, or if they are known still
Page 15 of 36
2:18-cv-02097-SEM-TSH # 87
Page 16 of 36
the facts bearing on their claims may be unknown. Such a
possibility or indeed inevitability does not preclude class
certification . . . .”).
In the same vein, Defendant argues that the individual
inquiries of causation and injury void commonality. Defendant
argues because each putative class member will have to prove his
or her own individual injuries, the class is not “capable of classwide
resolution.” See Wal-Mart Stores, Inc., 564 U.S. at 349–50.
Moreover, Defendant argues that Plaintiff is incapable of proving
that all class members suffered the same injury.
As stated in more detail below, the Court is concerned with
individual questions that predominate over common questions of
the proposed class. Individualized issues on causation, injury, and
damages will require more than the common questions. While the
Court recognizes that Plaintiff has proven certain issues are
common to the proposed class, such as liability, the issues of
causation and injury require individual inquiry. The Court finds
that Plaintiff has not met the commonality requirement. All
requirements of Rule 23(a) must be met to certify a class. However,
Page 16 of 36
2:18-cv-02097-SEM-TSH # 87
Page 17 of 36
the Court continues its analysis for completeness and to address
Plaintiff’s request for certification under Rule 23(c)(4).
3. The typicality requirement is met.
A plaintiff must show “the claims or defenses of the
representative parties are typical of the claims or defenses of the
class[.]” Fed. R. Civ. P. 23(a)(3). To satisfy that requirement, the
plaintiff’s claims must “arise from the same events or course of
conduct that gives rise to the putative class members' claims.”
Beaton v. SpeedyPC Software, 907 F.3d 1018, 1026 (7th Cir. 2018),
cert. denied, 139 S. Ct. 1465, 203 L. Ed. 2d 684 (2019); Retired
Chicago Police Ass’n v. City of Chicago, 7 F.3d 584, 597 (7th Cir.
1993) (“A plaintiff's claim is typical if it arises from the same event
or practice or course of conduct that gives rise to the claims of the
other class members and his or her claims are based on the same
legal theory.”). Plaintiff was one of the 15,878 individuals whose PII
was disclosed. She also received the same notification of the
Disclosure that the other employees received. Plaintiff argues that
her claims arise from the same events and course of conduct that
give rise to the putative class members’ claims. Defendant does not
Page 17 of 36
2:18-cv-02097-SEM-TSH # 87
Page 18 of 36
contest the issue of typicality. The Court finds that the typicality
requirement is satisfied.
4. The class representative is adequate.
The adequacy of representation inquiry “consists of two parts:
(1) the adequacy of the named plaintiffs as representatives of the
proposed class’s myriad of members, with their differing and
separate interests, and (2) the adequacy of the proposed class
counsel.” Gomez v. St. Vincent Health, Inc., 649 F.3d 583, 592 (7th
Cir. 2011).
Defendant argues that Plaintiff Lynn McGlenn is an
inadequate class representative. “A class is not fairly and
adequately represented if class members have antagonistic or
conflicting claims.” Riffey v. Rauner, 873 F.3d 558, 563–64 (7th
Cir. 2017). “Conflicts between class members are different from
differences in class members' entitlements, which we discussed
earlier. Conflicts of interest, as distinct from differences in
entitlements, create an issue of adequacy of representation by
requiring the class representative to choose between competing
class members.” Johnson v. Meriter Health Servs. Employee Ret.
Plan, 702 F.3d 364, 372 (7th Cir. 2012)
Page 18 of 36
2:18-cv-02097-SEM-TSH # 87
Page 19 of 36
First, Defendant contends that Plaintiff is conflicted from
being class representative because she suffered a different type of
injury than many putative class members and Plaintiff chose to
bring the class action in Illinois, which limits the putative class
members’ options. Plaintiff alleges she spent 10 hours trying to
close a fraudulently opened Capital One credit card account and
mitigating the issues arising out of the misuse of her personal
information. The former class representative, Ms. Lavender,
contends that she was required to make a 2-hour round trip to an
IRS office to verify her identity prior to receiving her federal income
tax refund. Many other putative class members spent no time
dealing with potential identity theft or were not required to verify
their identities with the IRS prior to receiving their federal income
tax refund.
Defendant relies on Culver v. City of Milwaukee, 277 F.3d 908
(7th Cir. 2002). In Culver, plaintiff filed a discrimination suit to
represent a class of police officers who were denied job applications
or completed job applications and took the entrance exam but were
denied the job based on being scored in a discriminatory manner.
The lower court ruled that Culver was an inadequate class
Page 19 of 36
2:18-cv-02097-SEM-TSH # 87
Page 20 of 36
representative because Culver “made only perfunctory efforts . . . to
obtain a job application” and soon after obtained another job.
Culver, 277 F.3d at 912. The Seventh Circuit affirmed the lower
court’s decision. Id. (“Although the mootness of a named plaintiff's
claim does not automatically disqualify him from serving as class
representative, since it does not make the suit moot (the unnamed
class members' claims are not moot), it makes him presumptively
inadequate, in our view, unless the defendant is executing a
strategy of buying off class representatives successively in an effort
to derail the suit.”).However, the case sub judice is inapposite to
Culver. Plaintiff McGlenn has alleged injuries similar to other class
members – time spent protecting her identity and investigating
potential fraud.
Defendant also argues that Illinois law disadvantages other
class members who could bring suit elsewhere. Defendant
contends that Illinois does not consider risk of future harm as a
stand-alone claim, that economic loss is unrecoverable in tort
damages in this case under Illinois law, and that Plaintiff’s fraud
damages are limited by the ICFA and IPIPA. But, these arguments
are more appropriate for summary judgment. Moreover, Defendant
Page 20 of 36
2:18-cv-02097-SEM-TSH # 87
Page 21 of 36
cites to no authority for the proposition that a choice of forum
renders a class representative inadequate.
Defendant further argues that Defendant is entitled to raise
several defenses applicable to Plaintiff that may not be applicable to
the class as a whole. The Seventh Circuit has held that a proposed
class representative is improper where “it is predictable that a
major focus of the litigation will be on an arguable defense unique
to the named plaintiff or small subclass,” Books v. First Nat’l Bank
of Peoria, 496 F.2d 1162, 1164-65 (7th Cir. 1974).
The Court cannot make such a prediction in this case. The
evidence does not clearly indicate that the defenses Defendant may
raise will be a major focus of the case. See Johnson, 702 F.3d at
372 (“It is premature to declare the alleged conflicts of interest an
insoluble bar to the class action.”).Therefore, the Court finds that
Plaintiff is an adequate class representative.
B. Certification Under Rule 23(b)(2) Is Inappropriate Because
Money Damages Are Not Incidental to the Equitable Relief.
Plaintiff contends that certifying the class pursuant to Rule
23(b)(2) is also appropriate because Defendant failed to adequately
safeguard and protect Plaintiff’s and the putative class member’s PII
Page 21 of 36
2:18-cv-02097-SEM-TSH # 87
Page 22 of 36
and final injunctive relief is needed to remediate Defendant’s
inadequate data security. A class may be certified pursuant to Rule
23(b)(2) if “the party opposing the class has acted or refused to act
on grounds that apply generally to the class, so that final injunctive
relief or corresponding declaratory relief is appropriate respecting
the class as a whole.” Fed. R. Civ. P. 23(b)(2). Plaintiff seeks a
mandatory injunction directing Driveline to adequately safeguard
the PII of the proposed class in the future by implementing
improved security procedures. Additionally, the mandatory
injunction would require Driveline to provide “notice to each
member of the class relating to the full nature and extent of the
Data Disclosure and the disclosure of PII to unauthorized persons.”
See d/e 57, p. 10.
Defendant contends that certification under Rule 23(b)(2) is
improper because prospective injunctive relief would not remedy the
alleged injuries suffered by Plaintiff and the proposed class. The
Court agrees. Plaintiff seeks a mandatory injunction to further
protect PII from disclosure and to provide adequate notice of the full
extent of the Disclosure. However, Plaintiff has not sufficiently
shown that a mandatory injunction would remedy the alleged harm.
Page 22 of 36
2:18-cv-02097-SEM-TSH # 87
Page 23 of 36
Moreover, the allegations and arguments indicate that Plaintiff’s
main goal is monetary damages. Monetary damages may be sought
if “incidental to the injunctive or declaratory relief.” Johnson v.
Meriter Health Servs. Employee Ret. Plan, 702 F.3d 364, 369 (7th
Cir. 2012); see also Lemon v. Int'l Union of Operating Engineers,
Local No. 139, AFL-CIO, 216 F.3d 577, 580–81 (7th Cir. 2000)(“
[N]onequitable monetary relief may be obtained in a class action
certified under Rule 23(b)(2) only if the predominant relief sought is
injunctive or declaratory.”); Jefferson v. Ingersoll Int'l Inc., 195 F.3d
894, 898 (7th Cir. 1999). The Court finds that Plaintiff’s monetary
relief is not incidental to the injunctive relief. Therefore,
certification under Rule 23(b)(2) is inappropriate.
C. Certification as a Whole Under Rule 23(b)(3) Is Inappropriate.
1. Certifying the Class as a Whole Under Rule 23(b)(3) Is
Inappropriate.
Rule 23(b)(3) applies to class actions when the proposed class
seeks money damages. Bell v. PNC Bank, Nat. Ass’n, 800 F.3d 360,
373 (7th Cir. 2015). Rule 23(b)(3) requires the named plaintiff to
establish (1) that questions of law or fact common to class members
predominate over any questions affecting only individual members
Page 23 of 36
2:18-cv-02097-SEM-TSH # 87
Page 24 of 36
and (2) that a class action is superior to other available methods for
fairly and efficiently adjudicating the controversy. Fed. R. Civ. P.
23(b)(3). “While similar to Rule 23(a)'s requirements for typicality
and commonality, ‘the predominance criterion is far more
demanding.’” Messner, 669 F.3d at 814 (quoting Amchem
Products, Inc. v. Windsor, 521 U.S. 623-24 (1997).
Plaintiff argues that Plaintiff and class members share
common questions, including whether Driveline had adequate
training and procedures in place for data security. Defendant
contends that individual inquiries for causation, actual injury, and
damages outweigh judicial economies gained from adjudicating the
common issues as a class action and the common issues do not
predominate over the individualized issues.
Plaintiff contends that each putative class member shares the
same issue whether Defendant owed a duty to protect the class
members’ PII and whether Defendant breached that duty. Plaintiff
says the same is true about the issue whether Defendant breached
an implied contract. However, Defendant has raised doubt that a
duty to protect from data breaches exists in Illinois. The Seventh
Circuit held that Illinois has not created a common law duty
Page 24 of 36
2:18-cv-02097-SEM-TSH # 87
Page 25 of 36
between an employer and an employee to safeguard personal
information beyond providing notice of a disclosure. Cooney v.
Chicago Pub. Sch., 407 Ill. App. 3d 358, 363, 943 N.E.2d 23, 29
(2010) (“While we do not minimize the importance of protecting this
information, we do not believe that the creation of a new legal duty
beyond legislative requirements already in place is part of our role
on appellate review. As noted, the legislature has specifically
addressed the issue and only required the Board to provide notice
of the disclosure.”). Following Cooney, the Seventh Circuit ruled
similarly in Cmty. Bank of Trenton v. Schnuck Markets, Inc, finding
the defendant retailer, Schnuck Markets, did not owe a duty to the
customer’s banks where Schnucks suffered a major breach of its
customers data. 887 F.3d 803, 816 (7th Cir. 2018) (interpreting
Cooney as “a more general statement that no duty to safeguard
personal information existed, regardless of the kind of loss” and
predicting “that the state court would not impose the common law
data security duty the plaintiff banks call for here.”). Moreover, the
Seventh Circuit held that “[e]ven if Cooney had not come to this
conclusion, Illinois would probably apply the economic loss rule to
bar recovery anyway.” Schnuck Markets, 887 F.3d at 817.
Page 25 of 36
2:18-cv-02097-SEM-TSH # 87
Page 26 of 36
Under each cause of action brought by Plaintiff and the
proposed class, Plaintiff and the putative class members must prove
damages. In the instant motion, Plaintiff alleged that each putative
class member suffered damage and injury as a result of the
Disclosure and “each suffered the same general type of damages –
loss of value of PII, out of pocket monetary expenses, and other
foreseeable losses stemming from identify theft.” See d/e 52-1, p.
26-27. Plaintiff argues that the class members will use the same
expert testimony to establish that they have suffered lost value of
their PII.
Plaintiff’s expert, Mr. James Van Dyke2, identifies “multiple
steps necessary for each victim of the Driveline Employee W-2
Disclosure including: monitoring all three major credit bureaus,
credit freezes at all three bureaus, new account fraud protection,
[and] regular monitoring of all accounts.” See d/e 52-1, p. 32.
Additionally, Mr. Van Dyke opines “that the cost or value of
remedial services that should be provided to mitigate the harms
suffered by each class member range[s] from $179 – $360 per year
Plaintiff offers James Van Dyke as an expert in data security. See d/e 52-1,
p. 31. Mr. Van Dyke is the founder of a “research consulting firm specializing
in areas including identity fraud and security.” Id.
2
Page 26 of 36
2:18-cv-02097-SEM-TSH # 87
Page 27 of 36
per class member.” Id. at 33. While Plaintiff notes that damages
may need to be calculated individually, Plaintiff argues that should
not serve as an impediment to class certification. See Comcast
Corp v. Behrend, 133 S.Ct. 1426, 1437 (2013) (dissent)
(“Recognition that individual damages calculations do not preclude
class certification under Rule 23(b)(3) is well nigh universal.”).
Defendant contends that Plaintiff has failed to show evidence
of a common injury as to Plaintiff and all class members and that
Plaintiff has offered no evidence that the hacker misused the data
stolen from the Disclosure. Mr. Van Dyke did not present
testimony that the putative class members sustained bank charges
or service reinstatement fees as a result of the disclosure, suffered
negative credit ratings, were denied a loan, sought public
assistance, were the victims of medical identity thefts, or had their
Social Security numbers used to file a fraudulent tax return. Id. at
22. Defendant argues that Plaintiff has failed to prove that a
substantial number of the class members have suffered actual
injury. See Kohen v. Pac. Inv. Mgmt. Co. LLC, 571 F.3d 672, 677–
78 (7th Cir. 2009) (“A related point is that a class should not be
certified if it is apparent that it contains a great many persons who
Page 27 of 36
2:18-cv-02097-SEM-TSH # 87
Page 28 of 36
have suffered no injury at the hands of the defendant, see Oshana
v. Coca–Cola Co., 472 F.3d 506, 514–15 (7th Cir.2006); Romberio v.
Unumprovident Corp., 2009 WL 87510, at *8 (6th Cir. Jan.12,
2009); cf. Brown v. American Honda, 522 F.3d 6, 28–29 (1st
Cir.2008), if only because of the in terrorem character of a class
action.”). Further, as noted by the Kohn Court, a concern
surrounding class actions is potentially imposing “a huge
contingent liability on a defendant.” Id. at 678. The concern lies in
the class definition – if the class is stated broadly, “this would be a
compelling reason to require that it be narrowed.” Id.
Mr. Van Dyke opines that a substantial number of victims of
any data breach run no imminent threat of identity theft at the time
they are notified of a breach, after 12 months, or after 24 months. 3
See d/e 83, p. 29. Defendant argues that only two individuals of
the proposed class – McGlenn and Lavender – have claims of
damages, which are unsubstantiated. While most class members
may have faced an increased risk of future harm, the risk of future
harm is an element of damages for a present injury. Williams v.
Mr. Van Dyke objects to the publication of the exact figures in his opinions, claiming
that the figures are confidential. At this time, the Court does not make a ruling on
this issue and will protect the data in this Opinion.
3
Page 28 of 36
2:18-cv-02097-SEM-TSH # 87
Page 29 of 36
Manchester, 228 Ill. 2d 404, 425, 888 N.E.2d 1, 13 (2008) (“[A]n
increased risk of future harm is an element of damages that can be
recovered for a present injury—it is not the injury itself.”). Mr. Van
Dyke did not opine on each class member’s individual risk of future
harm.
Additionally, Defendant argues that a detailed analysis of
proximate cause is necessary for each individual class member and
Plaintiff relating to the claims of negligence, breach of fiduciary
duty, ICFA, and breach of contract. Plaintiff does not disagree that
an individual inquiry into causation is likely. Defendant argues,
and Plaintiff’s expert agrees, that several Driveline employees likely
had been involved in other data breaches in the two to four years
prior to the Disclosure. See d/e 54, p. 21. Defendant also notes
that Mr. Van Dyke’s testimony related to data breaches in general,
not the Disclosure in particular. As for Plaintiff McGlenn, McGlenn
claims that the Disclosure resulted in a person fraudulently
attempting to activate a Capitol One credit card account in
McGlenn’s name in July 2017. Defendant argues, however, that
the attempt may have been the result of a different data breach and
that McGlenn’s experience should not be imputed to the class as a
Page 29 of 36
2:18-cv-02097-SEM-TSH # 87
Page 30 of 36
whole. See Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 356
(2011) (“[O]ne named plaintiff's experience of discrimination was
insufficient to infer that discriminatory treatment is typical of the
employer's employment practices.”). Evidence shows that some
putative class members may have suffered suspicious credit activity
within a year of the Disclosure, while others did not. Additionally,
some class members received a letter from the IRS requiring the
individual to verify their identity before obtaining a tax refund,
while many other class members did not receive such a letter. See
d/e 54, p. 10. Plaintiff McGlenn did not receive a letter from the
IRS. However, the former class representative, Ms. Lavender, was
required to travel to an IRS office to verify her identity. Id. Others
who received the letter were allowed to verify by telephone. Id. Mr.
Van Dyke opines that the jury could infer that the IRS letter was
related to the Disclosure because Ms. Lavender had to verify her
identity less than a month after the Disclosure. Defendant argues
Mr. Van Dyke’s opinion is speculative, the Disclosure and the letter
occurred during tax season, and no evidence proves that the IRS
letter resulted from the Disclosure. Further, Mr. Van Dyke did not
know if other class members received communication from the IRS.
Page 30 of 36
2:18-cv-02097-SEM-TSH # 87
Page 31 of 36
Plaintiff argues that the need for individual inquiries does not
prevent class certification and she is not required to prove the
underlying merits of her case at this time. See Messner, 669 F.3d
at 815 (“It is well established that the presence of individualized
questions regarding damages does not prevent certification under
Rule 23(b)(3).”). In Messner, the defendant contested whether all
class members could prove an injury. At issue there was whether
the defendant violated the Clayton Act, which requires a showing
that defendant violated federal antitrust law and that the antitrust
violation caused plaintiffs’ injuries. Id. at 816. The Seventh Circuit
rejected the defendant’s argument because inquiry into injury
should occur at the end of the case. The Seventh Circuit reasoned,
“[u]nder the proper standard, plaintiffs’ burden at the class
certification stage was not to prove the element of antitrust impact,
but only to demonstrate that the element of antitrust impact is
capable of proof at trial through evidence that is common to the
class rather than individual to its members.” Id. at 818.
Here, Plaintiff has pled five causes of action which involve
causation and all six causes of action require proof of damages.
Individualized issues on causation, injury, and damages require
Page 31 of 36
2:18-cv-02097-SEM-TSH # 87
Page 32 of 36
more than what was required in Messner. Defendant has raised
sufficient doubt, and Plaintiff has failed to establish that the
common questions will predominate over the individual issues.
As Plaintiff notes, a court may “bifurcate the case into a
liability phase and a damages phase” if the case requires individual
determinations of causation and damages. Mullins v. Direct Digital,
LLC, 795 F.3d 654, 671 (7th Cir. 2015). Such option is discussed
in more detail below. The Court has considerable concerns relating
to individual proof required for causation and damages in this case.
Moreover, Driveline has raised doubt as to whether Plaintiff and
other class members have actually suffered any injury. Plaintiff has
not presented sufficient evidence that a number of class members
have suffered a compensable injury. Accordingly, the Court finds
that Plaintiff has not satisfied the predominance requirement of
Rule 23(b)(3) to certify all questions for class consideration.
2. The Court Will Not Certify the Class for Particular
Issues Pursuant to Rule 23(c)(4).
While the Court finds that certification of the class as to all
issues is inappropriate, the Court considers whether class
certification of certain issues is proper pursuant to Rule 23(c)(4).
Page 32 of 36
2:18-cv-02097-SEM-TSH # 87
Page 33 of 36
“When appropriate, an action may be brought or maintained as a
class action with respect to particular issues.” Fed. R. Civ. P.
23(c)(4). In the alternative to full class certification, Plaintiff seeks
class certification on certain issues. Specifically, Plaintiff contends
the following issues would lead to an efficient disposition of the
parties’ interests:
(1) Whether Defendant owed a legal duty to Plaintiff and
the class to exercise due care in collecting, storing, using,
transmitting, and safeguarding their PII;
(2) Whether Defendant breached a legal duty to Plaintiff
and the class to exercise due care in collecting, storing,
using, transmitting, and safeguarding their PII;
(3) Whether Defendant failed to comply with their own
policies and applicable laws, regulations, and industry
standards relating to data security;
(4) Whether Defendant timely, adequately, and accurately
informed class members that their PII had been disclosed
without authorization;
(5) Whether Defendant failed to implement and maintain
reasonable security procedures and practices appropriate
to the nature and scope of the information disclosed and
compromised in the Data Disclosure;
(6) Whether Defendant engaged in unfair, unlawful, or
deceptive practices by failing to safeguard and disclosing
without authorization the PII of class members; and
(7) Whether class members are entitled to actual
damages, statutory damages, injunctive relief, and/or
Page 33 of 36
2:18-cv-02097-SEM-TSH # 87
Page 34 of 36
punitive damages as a result of Defendant’s wrongful
conduct.
See d/e 52-1, pp. 38-39.
Defendant argues that partial certification is unworkable
because “whether any particular potential class member is entitled
to damages is inextricably tied to whether the Disclosure
proximately caused any individual injury.” See d/e 54, p. 41.
Further, Defendant contends that the issue of duty of care and
standard of care are only at issue in two of Plaintiff’s claims –
negligence and breach of fiduciary duty – and whether Plaintiff gave
adequate notice is only relevant to one claim – negligence. However,
both parties agree that damages will require individual assessments
for each putative class member. Moreover, several other claims
brought by Plaintiff will remain untouched and unanswered even if
the Court adopts all of Plaintiff’s proposed issues.
The Court recognizes that the putative class members share
certain issues, including whether Defendant owed a duty and
whether Defendant breached that duty. However, these issues do
not predominate over all claims as they are only related to two
claims. Plaintiff has alleged six claims against Defendant.
Page 34 of 36
2:18-cv-02097-SEM-TSH # 87
Page 35 of 36
Additionally, Plaintiff agrees that damages will require individual
assessment for each class member, and Plaintiff seems to
acknowledge that causation may require an individual inquiry, to
which the Court agrees. The Court finds that certifying the issues
identified by Plaintiff for class purposes would not promote judicial
efficiency. As stated in Matter of Rhone-Poulenc Rorer, Inc.:
The first jury will not determine liability. It will determine
merely whether one or more of the defendants was
negligent under one of the two theories. The first jury
may go on to decide the additional issues with regard to
the named plaintiffs. But it will not decide them with
regard to the other class members. Unless the defendants
settle, a second (and third, and fourth, and hundredth,
and conceivably thousandth) jury will have to decide, in
individual follow-on litigation by class members not
named as plaintiffs in the Wadleigh case, such issues as
comparative negligence—did any class members
knowingly continue to use unsafe blood solids after they
learned or should have learned of the risk of
contamination with HIV?—and proximate causation.
Both issues overlap the issue of the defendants'
negligence. Comparative negligence entails, as the name
implies, a comparison of the degree of negligence of
plaintiff and defendant.
51 F.3d 1293, 1303 (7th Cir. 1995). Similarly here, Plaintiff’s
suggestion to determine a portion of her negligence and breach of
fiduciary duty claims on a class-wide basis would be inefficient.
Page 35 of 36
2:18-cv-02097-SEM-TSH # 87
Page 36 of 36
Accordingly, the Court denies Plaintiff’s request to certify the class
for particular issues pursuant to Rule 23(c)(4).
V. CONCLUSION
For the reasons set forth above, Plaintiff’s Renewed Motion for
Class Certification (d/e 52) is DENIED.
ENTERED: January 19, 2021
FOR THE COURT:
s/ Sue E. Myerscough___
SUE E. MYERSCOUGH
UNITED STATES DISTRICT JUDGE
Page 36 of 36
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?