McGlenn v. Driveline Retail Merchandising Inc

IN THE UNITED STATES DISTRICT COURT

FOR THE CENTRAL DISTRICT OF ILLINOIS

SPRINGFIELD DIVISION

LYNN MCGLENN, on behalf of )

herself and all others )

similarly situated, )

)

Plaintiff, ) Case No. 18-cv-2097

)

v. )

)

DRIVELINE RETAIL )

MERCHANDISING, INC., )

)

Defendant. )

ORDER AND OPINION

SUE E. MYERSCOUGH, U.S. District Judge:

This cause is before the Court on the Renewed Motion for

Class Certification (d/e 52) filed by Plaintiff Lynn McGlenn.

Defendant filed a response opposing Plaintiff’s Motion. See d/e 54.

Plaintiff filed a reply. See d/e 57. For the reasons stated below, the

Renewed Motion for Class Certification is DENIED.

I. BACKGROUND

The Complaint before the Court was originally brought by

Shirley Lavender, individually and on behalf of all others similarly

situated, against Defendant Driveline Retail Merchandising, Inc.

(“Driveline”). However, Plaintiff filed a Motion for Leave to

Substitute Class Representative and for Leave to File an Amended

Class Action Complaint in Accordance with the Substitution. See

d/e 34. On September 6, 2019, Plaintiff’s Motion for Leave to

Substitute was granted. See Order, d/e 43. On September 10,

2019, an Amended Complaint was filed and Plaintiff Lynn McGlenn

was substituted as Plaintiff in this case. See Amended Complaint,

d/e 44.

Plaintiff alleges that Defendant Driveline Retail Merchandising,

Inc. (“Driveline”) provides retail merchandising services, including

setting up product displays and shelving products at big-box retail

establishments throughout the United States. See d/e 44, p. 2. In

the ordinary course of Driveline’s business, Driveline maintains

current and former employees’ personal and tax information,

including the name, address, zip code, date of birth, wage and

withholding information, and Social Security number. Id. On

January 25, 2017, an employee in Driveline’s payroll department,

Susan Merciel, sent an email to a phishing1 perpetrator with 15,878

1 Phishing is defined as “a scam by which an Internet user is duped (as by a

deceptive e-mail message) into revealing personal or confidential information

which the scammer can use illicitly.” Phishing, Merriam-Webster.com,

2016 W-2s. See d/e 54, p. 8; d/e 44, p. 3. The phishing

perpetrator posed as Driveline’s Chief Financial Officer and asked

for all employee W-2s for 2016. See d/e 54, p. 8. The Driveline

employee complied with the email request and sent the phishing

perpetrator a data file containing copies of W-2 statements for

employees who worked at and received wages from Driveline during

the time period of January 1, 2016 through December 31, 2016 (the

“Disclosure”), which contained sensitive personally identifiable

information (“PII”), including names, mailing addresses, Social

Security numbers, and wage and withholding information. See d/e

44, p. 3. Plaintiff alleges that the Driveline employee, Susan

Merciel, voluntarily made an authorized disclosure of PII of former

and current employees of Driveline to a third party without

encryption or password protection. Id.; Memorandum of law in

Support, d/e 52-1, pp. 3, 5. On February 14, 2017, Driveline sent

a letter to its current and former employees advising that their 2016

W-2 had been subjected to a data breach. Id. at 2-3. Driveline

offered the compromised employees 12 months of credit monitoring

https://www.merriam-webster.com/dictionary/phishing (last accessed

December 28, 2020).

service through AllClear ID. Some employees – 317 of them –

accepted the services, others did not. See d/e 54, p. 35.

Plaintiff alleges that Driveline’s actions allows thieves to file

fraudulent tax returns, file for unemployment benefits, and apply

for a job using a false identity due to disclosure of the Social

Security numbers. See d/e 52-1, p. 3. Plaintiff further alleges that

the disclosed information may be used to obtain driver’s licenses,

government benefits, medical services, and housing and may be

given to police as falsely identifiable information. Id. at 4.

Prior to the Disclosure, Ms. Merciel had no training from

Driveline that would have aided her in spotting a phishing email nor

had she been trained or advised by Driveline that W-2 phishing

emails were being perpetrated on payroll departments. Id. at 5;

Merciel Deposition, d/e 52-5, pp. 50, 121. Plaintiff alleges that

encryption and/or password protection of the PII of the 15,878

employees would have prevented access to Driveline employee’s W2

data even if disclosed. See d/e 52-1, p. 5. However, Driveline’s

CFO Lori Bennett had previously requested confidential personal

information of employees be sent to her without encryption or

password protection. See d/e 52-1, p. 6; d/e 52-5, pp. 102-103.

After the Disclosure, Plaintiff was alerted that someone used

her PII to open a new credit card account with Capital One. See

d/e 44, p. 4. Plaintiff alleges that as a result of this, she was

required to spend 10 hours trying to close the account and

resolving and mitigating the issues arising out of the misuse of her

personal information. Id. Additionally, Plaintiff argues that she has

had to spend time every week checking her credit report and, as a

result of the Disclosure, she will continue to spend numerous hours

monitoring her credit reports and bank accounts. See d/e 44, p. 4.

As alleged in the Amended Complaint, all class members will be at

heightened risk of further identity theft and fraud. Id. Plaintiff

argues that Plaintiff and the putative class members have and will

continue to suffer damages, including monetary loss, lost time,

anxiety, and emotional distress. Id. at 14. Moreover, Plaintiff and

class members have suffered or are at increased risk of suffering:

unauthorized use and misuse of their PII; the loss of the

opportunity to control how their PII is used; the diminution in value

of their PII; the compromise, publication and/or theft of their PII;

out-of-pocket costs associated with the prevention, detection,

recovery and remediation from identity theft or fraud; lost

opportunity costs and lost wages associated with effort expended

and the loss of productivity from addressing and attempting to

mitigate the actual and future consequences of the Data Disclosure,

including but not limited to efforts spent researching how to

prevent, detect, contest and recover from identity theft and fraud;

delay in receipt of tax refund monies; lost opportunity and benefits

of electronic filing of income tax returns; the imminent and certain

impending injury flowing from potential fraud and identity theft

posed by their PII being placed in the hands of criminals; the

continued risk to their PII, which remains in the possession of

Driveline and is subject to further breaches so long as Driveline

fails to undertake appropriate measures to protect the PII in their

possession; and current and future costs in terms of time, effort

and money that will be expended to prevent, detect, contest,

remediate and repair the impact of the Data Disclosure for the

remainder of the lives of Plaintiff and Class members. See d/e 44,

pp. 14-15.

Plaintiff filed a claim for negligence (Count I), invasion of

privacy (Count II), breach of implied contract (Count III), breach of

fiduciary duty (Count IV), violation of Illinois Personal Information

Protection Act (“IPIPA”) (Count V), and violation of Illinois Consumer

Fraud and Deceptive Business Practices Act (“ICFA”) (Count VI)

against Driveline. Plaintiff seeks a mandatory injunction directing

Driveline to adequately safeguard the PII of compromised employees

by implementing improved security procedures and measures and

to provide adequate notice to each employee relating to the full

nature and extent of the Disclosure and ordering Driveline pay an

award of monetary damages. See d/e 44.

Plaintiff filed the instant renewed motion for class certification

seeking to certify a class and have Plaintiff Lynn McGlenn serve as

class representative. See Renewed Motion, d/e 52. Plaintiff seeks

to certify the class pursuant to Rule 23(a) and Rule 23(b)(2) and

Rule 23(b)(3). Alternatively, Plaintiff requests to have certain issues

certified for class treatment pursuant to Rule 23(c)(4). Defendant

filed a response objecting to certifying the proposed class. See

Response, d/e 54. Defendant argues that the commonality

requirement is not met pursuant to Rule 23(a)(2), Plaintiff is not an

adequate class representative pursuant to Rule 23(a)(4), and

Plaintiff’s proposed class does not meet any category of Rule 23(b).

More specifically, Defendant contends that Plaintiff’s class does not

meet the predominance requirement of Rule 23(b)(3) because each

individual will have to prove causation and damages on an

individualized basis. For that same reason, Defendant argues

certifying certain issues under Rule 23(c)(4) is not practical.

Defendant also argues that certifying the class under Rule 23(b)(2)

is inappropriate because Plaintiff’s claim for damages are her

primary goal and is not incidental to her claim for an injunction.

II. JURISDICTION AND VENUE

Plaintiff invokes jurisdiction under the Class Action Fairness

Act, 28 U.S.C. § 1332(d) (CAFA). The CAFA provides federal courts

with jurisdiction over certain class actions if the class has more

than 100 members, the parties are minimally diverse, and the

amount in controversy exceeds $5 million, exclusive of interest and

costs. 28 U.S.C. § 1332(d)(2), (5)(B); Standard Fire Ins. Co. v.

Knowles, 568 U.S. 588, 592 (2013). The claims of the individual

class members are aggregated to determine whether the amount in

controversy threshold is met. 28 U.S.C. § 1332(d)(6).

Plaintiff alleges that the aggregate amount in controversy

exceeds $5 million, exclusive of interest and costs, that there are

more than 100 class members, and that at least one class member

is a citizen of a state different from Defendant. See Amended

Complaint, d/e 44, ¶ 3. Plaintiff is a citizen of Georgia. Id.

Defendant has indicated that Defendant is a citizen of New Jersey

and Texas because Defendant is incorporated in New Jersey and

has its principal place of business in Texas. See Defendant’s

Declaration of State of Incorporation and Principal Place of

Business, d/e 42. Therefore, this Court has jurisdiction.

III. LEGAL STANDARD

“The purpose of class action litigation is to avoid repeated

litigation of the same issue and to facilitate prosecution of claims

that any one individual might not otherwise bring on her own.”

Chicago Teachers Union, Local No. 1 v. Bd. of Educ. of City of

Chicago, 797 F.3d 426, 433 (7th Cir. 2015). The Court's decision to

certify a class action under Federal Rule of Civil Procedure 23 “is

not free-form, but rather has been carefully scripted by the Federal

Rules of Civil Procedure.” Id. To be certified as a class action, a

proposed class must meet the requirements of Federal Rule of Civil

Procedure 23(a), as well as one of the three provisions in Rule 23(b).

Messner v. Northshore Univ. HealthSystem, 669 F.3d 802 (7th Cir.

2012).

Under Rule 23(a), class actions can only be brought if:

(1) the class is so numerous that joinder of all members

is impracticable;

(2) there are questions of law or fact common to the

class;

(3) the claims or defenses of the representative parties are

typical of the claims or defenses of the class; and

(4) the representative parties will fairly and adequately

protect the interests of the class

Fed. R. Civ. P. 23(a). The four requirements are often referred to as

numerosity, commonality, typicality, and adequacy of

representation. See Orr v. Shicker, 953 F.3d 490, 497 (7th Cir.

2020).

In addition to these requirements, the proposed class must fall

within one of the class categories set forth in Rule 23. Rule 23(b)

sets forth four primary categories of classes: (1) to avoid indivisible

relief or inconsistent standards of conduct for defendant (Fed. R.

Civ. P. 23(b)(1)(A)); (2) to protect absent class members when the

existence of a limited fund or stare decisis would be dispositive as

to non-members or hinder their ability to protect their interests

(Fed. R. Civ. P. 23(b)(1)(B)); (3) where the primary relief sought is

equitable, such as injunctive relief, to control defendant's behavior

when defendant acts or refuses to act on grounds that apply

generally to the class (Fed. R. Civ. P. 23(b)(2)); and (4) when

common questions predominate over individual questions and a

class is the superior method to dispose of the claims (Fed. R. Civ. P.

23(b)(3)).

The parties focus on two of these class types: injunctive relief

under Rule 23(b)(2) and predominance and superiority under Rule

23(b)(3). A class can be certified under Rule 23(b)(2) when “the

class has acted or refused to act on grounds that apply generally to

the class, so that final injunctive relief or corresponding declaratory

relief is appropriate respecting the class as a whole.” Fed. R. Civ. P.

23(b)(2). “Rule 23(b)(2) applies only when a single injunction or

declaratory judgment would provide relief to each member of the

class[;] ... [i]t does not authorize class certification when each class

member would be entitled to an individualized award of monetary

damages.” Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 360–61

(2011).

To certify a class under Rule 23(b)(3), a plaintiff must prove:

“(1) that the questions of law or fact common to the members of the

proposed class predominate over questions affecting only individual

class members; and (2) that a class action is superior to other

available methods of resolving the controversy.” Messner, 669 F.3d

at 811.

Alternatively to the four class types, under Rule 23(c)(4), if the

Rule 23(a) requirements are met, the court may rule on certain

issues as to the class which do not dispose of the cases in full.

“When appropriate, an action may be brought or maintained as a

class action with respect to particular issues.” Fed. R. Civ. P.

23(c)(4). Rule 23(c)(4) relief may be appropriate “[i]f there are

genuinely common issues, issues identical across all the claimants,

issues moreover the accuracy of the resolution of which is unlikely

to be enhanced by repeated proceedings, then it makes good sense,

especially when the class is large, to resolve those issues in one fell

swoop while leaving the remaining, claimant-specific issues to

individual follow-on proceedings.” McReynolds v. Merrill Lynch,

Pierce, Fenner & Smith, Inc., 672 F.3d 482, 491 (7th Cir. 2012),

quoting Mejdrech v. Met–Coil Sys. Corp., 319 F.3d 910, 911 (7th

Cir. 2003).

The Court must first analyze whether Plaintiff has met each

Rule 23(a) requirement. In analyzing class certification, “a court

should not turn the class certification proceedings into a dress

rehearsal for the trial on the merits.” Messner, 669 F.3d at 811. “A

party seeking class certification must affirmatively demonstrate his

compliance with the Rule—that is, he must be prepared to prove

that there are in fact sufficiently numerous parties, common

questions of law or fact, etc.” Wal-Mart Stores, 564 U.S. at 350

(emphasis in original) abrogated on other grounds by Phillips v.

Sheriff of Cook Cnty., 828 F.3d 541 (7th Cir. 2016). Plaintiff bears

the burden of showing that the proposed class meets the Rule 23

requirements, but this showing need not be “to a degree of absolute

certainty. It is sufficient if each disputed requirement has been

proven by a preponderance of evidence.” Messner, 669 F.3d at 811.

IV. ANALYSIS

A. Rule 23(a) is Sufficiently Satisfied.

1. The Numerosity requirement is met.

Rule 23(a)(1) requires that the class be “so numerous that

joinder of all members is impracticable.” Fed. R. Civ. P. 23(a)(1).

Plaintiff defines the class as “[a]ll current and former Driveline

employees whose PII was compromised as a result of the Data

Disclosure.” See d/e 52, p. 2. Plaintiff alleges, and Defendant does

not dispute, that 15,878 individuals were affected by the

Disclosure. The Court finds that the numerosity requirement is

met.

2. The commonality requirement is not met.

The commonality requirement is met if a plaintiff shows “there

are questions of law or fact common to the class.” Fed. R. Civ. P.

23(a)(2). Plaintiff must show that the class members

have suffered the same injury and that their claims depend on a

common contention that “is capable of classwide resolution—which

means that determination of its truth or falsity will resolve an issue

that is central to the validity of each one of the claims in one

stroke.” Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 349–50

(2011). “Where the same conduct or practice by the same

defendant gives rise to the same kind of claims from all class

members, there is a common question.” Suchanek v. Sturm Foods,

Inc., 764 F.3d 750, 756 (7th Cir. 2014).

Plaintiff argues that the issue of liability is common to each

class member and that all claims arise from a common set of facts,

namely, that Driveline disclosed over 15,000 employees’ PII to a

third party. As Plaintiff argues, if each putative class member

brought a separate lawsuit, each individual would prove the same

acts of Defendant in failing to use reasonable care to protect and

safeguard the PII.

Defendant’s main contention is that Plaintiff’s proposed class

fails to meet the requirements of Rule 23(b)(3), which requires

questions of law or fact common to class members that

predominate over any questions affecting individual members.

“While similar to Rule 23(a)'s requirements for typicality and

commonality, ‘the predominance criterion is far more demanding.’”

Messner, 669 F.3d at 814 (quoting Amchem Products, Inc. v.

Windsor, 521 U.S. 623-24 (1997). Defendant argues that Plaintiff

cannot prove claims of causation and injury on a classwide basis

and that these injuries do not predominate over common issues.

Plaintiff seems to agree that inquiry on an individual basis is

likely required to prove causation and damages. However, an

individual inquiry on damages is typical for class actions. See

Kohen, 571 F.3d at 677 (“a class will often include persons who

have not been injured by the defendant's conduct; indeed this is

almost inevitable because at the outset of the case many of the

members of the class may be unknown, or if they are known still

the facts bearing on their claims may be unknown. Such a

possibility or indeed inevitability does not preclude class

certification . . . .”).

In the same vein, Defendant argues that the individual

inquiries of causation and injury void commonality. Defendant

argues because each putative class member will have to prove his

or her own individual injuries, the class is not “capable of classwide

resolution.” See Wal-Mart Stores, Inc., 564 U.S. at 349–50.

Moreover, Defendant argues that Plaintiff is incapable of proving

that all class members suffered the same injury.

As stated in more detail below, the Court is concerned with

individual questions that predominate over common questions of

the proposed class. Individualized issues on causation, injury, and

damages will require more than the common questions. While the

Court recognizes that Plaintiff has proven certain issues are

common to the proposed class, such as liability, the issues of

causation and injury require individual inquiry. The Court finds

that Plaintiff has not met the commonality requirement. All

requirements of Rule 23(a) must be met to certify a class. However,

the Court continues its analysis for completeness and to address

Plaintiff’s request for certification under Rule 23(c)(4).

3. The typicality requirement is met.

A plaintiff must show “the claims or defenses of the

representative parties are typical of the claims or defenses of the

class[.]” Fed. R. Civ. P. 23(a)(3). To satisfy that requirement, the

plaintiff’s claims must “arise from the same events or course of

conduct that gives rise to the putative class members' claims.”

Beaton v. SpeedyPC Software, 907 F.3d 1018, 1026 (7th Cir. 2018),

cert. denied, 139 S. Ct. 1465, 203 L. Ed. 2d 684 (2019); Retired

Chicago Police Ass’n v. City of Chicago, 7 F.3d 584, 597 (7th Cir.

1993) (“A plaintiff's claim is typical if it arises from the same event

or practice or course of conduct that gives rise to the claims of the

other class members and his or her claims are based on the same

legal theory.”). Plaintiff was one of the 15,878 individuals whose PII

was disclosed. She also received the same notification of the

Disclosure that the other employees received. Plaintiff argues that

her claims arise from the same events and course of conduct that

give rise to the putative class members’ claims. Defendant does not

contest the issue of typicality. The Court finds that the typicality

requirement is satisfied.

4. The class representative is adequate.

The adequacy of representation inquiry “consists of two parts:

(1) the adequacy of the named plaintiffs as representatives of the

proposed class’s myriad of members, with their differing and

separate interests, and (2) the adequacy of the proposed class

counsel.” Gomez v. St. Vincent Health, Inc., 649 F.3d 583, 592 (7th

Cir. 2011).

Defendant argues that Plaintiff Lynn McGlenn is an

inadequate class representative. “A class is not fairly and

adequately represented if class members have antagonistic or

conflicting claims.” Riffey v. Rauner, 873 F.3d 558, 563–64 (7th

Cir. 2017). “Conflicts between class members are different from

differences in class members' entitlements, which we discussed

earlier. Conflicts of interest, as distinct from differences in

entitlements, create an issue of adequacy of representation by

requiring the class representative to choose between competing

class members.” Johnson v. Meriter Health Servs. Employee Ret.

Plan, 702 F.3d 364, 372 (7th Cir. 2012)

First, Defendant contends that Plaintiff is conflicted from

being class representative because she suffered a different type of

injury than many putative class members and Plaintiff chose to

bring the class action in Illinois, which limits the putative class

members’ options. Plaintiff alleges she spent 10 hours trying to

close a fraudulently opened Capital One credit card account and

mitigating the issues arising out of the misuse of her personal

information. The former class representative, Ms. Lavender,

contends that she was required to make a 2-hour round trip to an

IRS office to verify her identity prior to receiving her federal income

tax refund. Many other putative class members spent no time

dealing with potential identity theft or were not required to verify

their identities with the IRS prior to receiving their federal income

tax refund.

Defendant relies on Culver v. City of Milwaukee, 277 F.3d 908

(7th Cir. 2002). In Culver, plaintiff filed a discrimination suit to

represent a class of police officers who were denied job applications

or completed job applications and took the entrance exam but were

denied the job based on being scored in a discriminatory manner.

The lower court ruled that Culver was an inadequate class

representative because Culver “made only perfunctory efforts . . . to

obtain a job application” and soon after obtained another job.

Culver, 277 F.3d at 912. The Seventh Circuit affirmed the lower

court’s decision. Id. (“Although the mootness of a named plaintiff's

claim does not automatically disqualify him from serving as class

representative, since it does not make the suit moot (the unnamed

class members' claims are not moot), it makes him presumptively

inadequate, in our view, unless the defendant is executing a

strategy of buying off class representatives successively in an effort

to derail the suit.”).However, the case sub judice is inapposite to

Culver. Plaintiff McGlenn has alleged injuries similar to other class

members – time spent protecting her identity and investigating

potential fraud.

Defendant also argues that Illinois law disadvantages other

class members who could bring suit elsewhere. Defendant

contends that Illinois does not consider risk of future harm as a

stand-alone claim, that economic loss is unrecoverable in tort

damages in this case under Illinois law, and that Plaintiff’s fraud

damages are limited by the ICFA and IPIPA. But, these arguments

are more appropriate for summary judgment. Moreover, Defendant

cites to no authority for the proposition that a choice of forum

renders a class representative inadequate.

Defendant further argues that Defendant is entitled to raise

several defenses applicable to Plaintiff that may not be applicable to

the class as a whole. The Seventh Circuit has held that a proposed

class representative is improper where “it is predictable that a

major focus of the litigation will be on an arguable defense unique

to the named plaintiff or small subclass,” Books v. First Nat’l Bank

of Peoria, 496 F.2d 1162, 1164-65 (7th Cir. 1974).

The Court cannot make such a prediction in this case. The

evidence does not clearly indicate that the defenses Defendant may

raise will be a major focus of the case. See Johnson, 702 F.3d at

372 (“It is premature to declare the alleged conflicts of interest an

insoluble bar to the class action.”).Therefore, the Court finds that

Plaintiff is an adequate class representative.

B. Certification Under Rule 23(b)(2) Is Inappropriate Because

Money Damages Are Not Incidental to the Equitable Relief.

Plaintiff contends that certifying the class pursuant to Rule

23(b)(2) is also appropriate because Defendant failed to adequately

safeguard and protect Plaintiff’s and the putative class member’s PII

and final injunctive relief is needed to remediate Defendant’s

inadequate data security. A class may be certified pursuant to Rule

23(b)(2) if “the party opposing the class has acted or refused to act

on grounds that apply generally to the class, so that final injunctive

relief or corresponding declaratory relief is appropriate respecting

the class as a whole.” Fed. R. Civ. P. 23(b)(2). Plaintiff seeks a

mandatory injunction directing Driveline to adequately safeguard

the PII of the proposed class in the future by implementing

improved security procedures. Additionally, the mandatory

injunction would require Driveline to provide “notice to each

member of the class relating to the full nature and extent of the

Data Disclosure and the disclosure of PII to unauthorized persons.”

See d/e 57, p. 10.

Defendant contends that certification under Rule 23(b)(2) is

improper because prospective injunctive relief would not remedy the

alleged injuries suffered by Plaintiff and the proposed class. The

Court agrees. Plaintiff seeks a mandatory injunction to further

protect PII from disclosure and to provide adequate notice of the full

extent of the Disclosure. However, Plaintiff has not sufficiently

shown that a mandatory injunction would remedy the alleged harm.

Moreover, the allegations and arguments indicate that Plaintiff’s

main goal is monetary damages. Monetary damages may be sought

if “incidental to the injunctive or declaratory relief.” Johnson v.

Meriter Health Servs. Employee Ret. Plan, 702 F.3d 364, 369 (7th

Cir. 2012); see also Lemon v. Int'l Union of Operating Engineers,

Local No. 139, AFL-CIO, 216 F.3d 577, 580–81 (7th Cir. 2000)(“

[N]onequitable monetary relief may be obtained in a class action

certified under Rule 23(b)(2) only if the predominant relief sought is

injunctive or declaratory.”); Jefferson v. Ingersoll Int'l Inc., 195 F.3d

894, 898 (7th Cir. 1999). The Court finds that Plaintiff’s monetary

relief is not incidental to the injunctive relief. Therefore,

certification under Rule 23(b)(2) is inappropriate.

C. Certification as a Whole Under Rule 23(b)(3) Is Inappropriate.

1. Certifying the Class as a Whole Under Rule 23(b)(3) Is

Inappropriate.

Rule 23(b)(3) applies to class actions when the proposed class

seeks money damages. Bell v. PNC Bank, Nat. Ass’n, 800 F.3d 360,

373 (7th Cir. 2015). Rule 23(b)(3) requires the named plaintiff to

establish (1) that questions of law or fact common to class members

predominate over any questions affecting only individual members

and (2) that a class action is superior to other available methods for

fairly and efficiently adjudicating the controversy. Fed. R. Civ. P.

23(b)(3). “While similar to Rule 23(a)'s requirements for typicality

and commonality, ‘the predominance criterion is far more

demanding.’” Messner, 669 F.3d at 814 (quoting Amchem

Products, Inc. v. Windsor, 521 U.S. 623-24 (1997).

Plaintiff argues that Plaintiff and class members share

common questions, including whether Driveline had adequate

training and procedures in place for data security. Defendant

contends that individual inquiries for causation, actual injury, and

damages outweigh judicial economies gained from adjudicating the

common issues as a class action and the common issues do not

predominate over the individualized issues.

Plaintiff contends that each putative class member shares the

same issue whether Defendant owed a duty to protect the class

members’ PII and whether Defendant breached that duty. Plaintiff

says the same is true about the issue whether Defendant breached

an implied contract. However, Defendant has raised doubt that a

duty to protect from data breaches exists in Illinois. The Seventh

Circuit held that Illinois has not created a common law duty

between an employer and an employee to safeguard personal

information beyond providing notice of a disclosure. Cooney v.

Chicago Pub. Sch., 407 Ill. App. 3d 358, 363, 943 N.E.2d 23, 29

(2010) (“While we do not minimize the importance of protecting this

information, we do not believe that the creation of a new legal duty

beyond legislative requirements already in place is part of our role

on appellate review. As noted, the legislature has specifically

addressed the issue and only required the Board to provide notice

of the disclosure.”). Following Cooney, the Seventh Circuit ruled

similarly in Cmty. Bank of Trenton v. Schnuck Markets, Inc, finding

the defendant retailer, Schnuck Markets, did not owe a duty to the

customer’s banks where Schnucks suffered a major breach of its

customers data. 887 F.3d 803, 816 (7th Cir. 2018) (interpreting

Cooney as “a more general statement that no duty to safeguard

personal information existed, regardless of the kind of loss” and

predicting “that the state court would not impose the common law

data security duty the plaintiff banks call for here.”). Moreover, the

Seventh Circuit held that “[e]ven if Cooney had not come to this

conclusion, Illinois would probably apply the economic loss rule to

bar recovery anyway.” Schnuck Markets, 887 F.3d at 817.

Under each cause of action brought by Plaintiff and the

proposed class, Plaintiff and the putative class members must prove

damages. In the instant motion, Plaintiff alleged that each putative

class member suffered damage and injury as a result of the

Disclosure and “each suffered the same general type of damages –

loss of value of PII, out of pocket monetary expenses, and other

foreseeable losses stemming from identify theft.” See d/e 52-1, p.

26-27. Plaintiff argues that the class members will use the same

expert testimony to establish that they have suffered lost value of

their PII.

Plaintiff’s expert, Mr. James Van Dyke2, identifies “multiple

steps necessary for each victim of the Driveline Employee W-2

Disclosure including: monitoring all three major credit bureaus,

credit freezes at all three bureaus, new account fraud protection,

[and] regular monitoring of all accounts.” See d/e 52-1, p. 32.

Additionally, Mr. Van Dyke opines “that the cost or value of

remedial services that should be provided to mitigate the harms

suffered by each class member range[s] from $179 – $360 per year

2 Plaintiff offers James Van Dyke as an expert in data security. See d/e 52-1,

p. 31. Mr. Van Dyke is the founder of a “research consulting firm specializing

in areas including identity fraud and security.” Id.

per class member.” Id. at 33. While Plaintiff notes that damages

may need to be calculated individually, Plaintiff argues that should

not serve as an impediment to class certification. See Comcast

Corp v. Behrend, 133 S.Ct. 1426, 1437 (2013) (dissent)

(“Recognition that individual damages calculations do not preclude

class certification under Rule 23(b)(3) is well nigh universal.”).

Defendant contends that Plaintiff has failed to show evidence

of a common injury as to Plaintiff and all class members and that

Plaintiff has offered no evidence that the hacker misused the data

stolen from the Disclosure. Mr. Van Dyke did not present

testimony that the putative class members sustained bank charges

or service reinstatement fees as a result of the disclosure, suffered

negative credit ratings, were denied a loan, sought public

assistance, were the victims of medical identity thefts, or had their

Social Security numbers used to file a fraudulent tax return. Id. at

22. Defendant argues that Plaintiff has failed to prove that a

substantial number of the class members have suffered actual

injury. See Kohen v. Pac. Inv. Mgmt. Co. LLC, 571 F.3d 672, 677–

78 (7th Cir. 2009) (“A related point is that a class should not be

certified if it is apparent that it contains a great many persons who

have suffered no injury at the hands of the defendant, see Oshana

v. Coca–Cola Co., 472 F.3d 506, 514–15 (7th Cir.2006); Romberio v.

Unumprovident Corp., 2009 WL 87510, at *8 (6th Cir. Jan.12,

2009); cf. Brown v. American Honda, 522 F.3d 6, 28–29 (1st

Cir.2008), if only because of the in terrorem character of a class

action.”). Further, as noted by the Kohn Court, a concern

surrounding class actions is potentially imposing “a huge

contingent liability on a defendant.” Id. at 678. The concern lies in

the class definition – if the class is stated broadly, “this would be a

compelling reason to require that it be narrowed.” Id.

Mr. Van Dyke opines that a substantial number of victims of

any data breach run no imminent threat of identity theft at the time

they are notified of a breach, after 12 months, or after 24 months.3

See d/e 83, p. 29. Defendant argues that only two individuals of

the proposed class – McGlenn and Lavender – have claims of

damages, which are unsubstantiated. While most class members

may have faced an increased risk of future harm, the risk of future

harm is an element of damages for a present injury. Williams v.

3 Mr. Van Dyke objects to the publication of the exact figures in his opinions, claiming

that the figures are confidential. At this time, the Court does not make a ruling on

this issue and will protect the data in this Opinion.

Manchester, 228 Ill. 2d 404, 425, 888 N.E.2d 1, 13 (2008) (“[A]n

increased risk of future harm is an element of damages that can be

recovered for a present injury—it is not the injury itself.”). Mr. Van

Dyke did not opine on each class member’s individual risk of future

harm.

Additionally, Defendant argues that a detailed analysis of

proximate cause is necessary for each individual class member and

Plaintiff relating to the claims of negligence, breach of fiduciary

duty, ICFA, and breach of contract. Plaintiff does not disagree that

an individual inquiry into causation is likely. Defendant argues,

and Plaintiff’s expert agrees, that several Driveline employees likely

had been involved in other data breaches in the two to four years

prior to the Disclosure. See d/e 54, p. 21. Defendant also notes

that Mr. Van Dyke’s testimony related to data breaches in general,

not the Disclosure in particular. As for Plaintiff McGlenn, McGlenn

claims that the Disclosure resulted in a person fraudulently

attempting to activate a Capitol One credit card account in

McGlenn’s name in July 2017. Defendant argues, however, that

the attempt may have been the result of a different data breach and

that McGlenn’s experience should not be imputed to the class as a

whole. See Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 356

(2011) (“[O]ne named plaintiff's experience of discrimination was

insufficient to infer that discriminatory treatment is typical of the

employer's employment practices.”). Evidence shows that some

putative class members may have suffered suspicious credit activity

within a year of the Disclosure, while others did not. Additionally,

some class members received a letter from the IRS requiring the

individual to verify their identity before obtaining a tax refund,

while many other class members did not receive such a letter. See

d/e 54, p. 10. Plaintiff McGlenn did not receive a letter from the

IRS. However, the former class representative, Ms. Lavender, was

required to travel to an IRS office to verify her identity. Id. Others

who received the letter were allowed to verify by telephone. Id. Mr.

Van Dyke opines that the jury could infer that the IRS letter was

related to the Disclosure because Ms. Lavender had to verify her

identity less than a month after the Disclosure. Defendant argues

Mr. Van Dyke’s opinion is speculative, the Disclosure and the letter

occurred during tax season, and no evidence proves that the IRS

letter resulted from the Disclosure. Further, Mr. Van Dyke did not

know if other class members received communication from the IRS.

Plaintiff argues that the need for individual inquiries does not

prevent class certification and she is not required to prove the

underlying merits of her case at this time. See Messner, 669 F.3d

at 815 (“It is well established that the presence of individualized

questions regarding damages does not prevent certification under

Rule 23(b)(3).”). In Messner, the defendant contested whether all

class members could prove an injury. At issue there was whether

the defendant violated the Clayton Act, which requires a showing

that defendant violated federal antitrust law and that the antitrust

violation caused plaintiffs’ injuries. Id. at 816. The Seventh Circuit

rejected the defendant’s argument because inquiry into injury

should occur at the end of the case. The Seventh Circuit reasoned,

“[u]nder the proper standard, plaintiffs’ burden at the class

certification stage was not to prove the element of antitrust impact,

but only to demonstrate that the element of antitrust impact is

capable of proof at trial through evidence that is common to the

class rather than individual to its members.” Id. at 818.

Here, Plaintiff has pled five causes of action which involve

causation and all six causes of action require proof of damages.

Individualized issues on causation, injury, and damages require

more than what was required in Messner. Defendant has raised

sufficient doubt, and Plaintiff has failed to establish that the

common questions will predominate over the individual issues.

As Plaintiff notes, a court may “bifurcate the case into a

liability phase and a damages phase” if the case requires individual

determinations of causation and damages. Mullins v. Direct Digital,

LLC, 795 F.3d 654, 671 (7th Cir. 2015). Such option is discussed

in more detail below. The Court has considerable concerns relating

to individual proof required for causation and damages in this case.

Moreover, Driveline has raised doubt as to whether Plaintiff and

other class members have actually suffered any injury. Plaintiff has

not presented sufficient evidence that a number of class members

have suffered a compensable injury. Accordingly, the Court finds

that Plaintiff has not satisfied the predominance requirement of

Rule 23(b)(3) to certify all questions for class consideration.

2. The Court Will Not Certify the Class for Particular

Issues Pursuant to Rule 23(c)(4).

While the Court finds that certification of the class as to all

issues is inappropriate, the Court considers whether class

certification of certain issues is proper pursuant to Rule 23(c)(4).

“When appropriate, an action may be brought or maintained as a

class action with respect to particular issues.” Fed. R. Civ. P.

23(c)(4). In the alternative to full class certification, Plaintiff seeks

class certification on certain issues. Specifically, Plaintiff contends

the following issues would lead to an efficient disposition of the

parties’ interests:

(1) Whether Defendant owed a legal duty to Plaintiff and

the class to exercise due care in collecting, storing, using,

transmitting, and safeguarding their PII;

(2) Whether Defendant breached a legal duty to Plaintiff

and the class to exercise due care in collecting, storing,

using, transmitting, and safeguarding their PII;

(3) Whether Defendant failed to comply with their own

policies and applicable laws, regulations, and industry

standards relating to data security;

(4) Whether Defendant timely, adequately, and accurately

informed class members that their PII had been disclosed

without authorization;

(5) Whether Defendant failed to implement and maintain

reasonable security procedures and practices appropriate

to the nature and scope of the information disclosed and

compromised in the Data Disclosure;

(6) Whether Defendant engaged in unfair, unlawful, or

deceptive practices by failing to safeguard and disclosing

without authorization the PII of class members; and

(7) Whether class members are entitled to actual

damages, statutory damages, injunctive relief, and/or

punitive damages as a result of Defendant’s wrongful

conduct.

See d/e 52-1, pp. 38-39.

Defendant argues that partial certification is unworkable

because “whether any particular potential class member is entitled

to damages is inextricably tied to whether the Disclosure

proximately caused any individual injury.” See d/e 54, p. 41.

Further, Defendant contends that the issue of duty of care and

standard of care are only at issue in two of Plaintiff’s claims –

negligence and breach of fiduciary duty – and whether Plaintiff gave

adequate notice is only relevant to one claim – negligence. However,

both parties agree that damages will require individual assessments

for each putative class member. Moreover, several other claims

brought by Plaintiff will remain untouched and unanswered even if

the Court adopts all of Plaintiff’s proposed issues.

The Court recognizes that the putative class members share

certain issues, including whether Defendant owed a duty and

whether Defendant breached that duty. However, these issues do

not predominate over all claims as they are only related to two

claims. Plaintiff has alleged six claims against Defendant.

Additionally, Plaintiff agrees that damages will require individual

assessment for each class member, and Plaintiff seems to

acknowledge that causation may require an individual inquiry, to

which the Court agrees. The Court finds that certifying the issues

identified by Plaintiff for class purposes would not promote judicial

efficiency. As stated in Matter of Rhone-Poulenc Rorer, Inc.:

The first jury will not determine liability. It will determine

merely whether one or more of the defendants was

negligent under one of the two theories. The first jury

may go on to decide the additional issues with regard to

the named plaintiffs. But it will not decide them with

regard to the other class members. Unless the defendants

settle, a second (and third, and fourth, and hundredth,

and conceivably thousandth) jury will have to decide, in

individual follow-on litigation by class members not

named as plaintiffs in the Wadleigh case, such issues as

comparative negligence—did any class members

knowingly continue to use unsafe blood solids after they

learned or should have learned of the risk of

contamination with HIV?—and proximate causation.

Both issues overlap the issue of the defendants'

negligence. Comparative negligence entails, as the name

implies, a comparison of the degree of negligence of

plaintiff and defendant.

51 F.3d 1293, 1303 (7th Cir. 1995). Similarly here, Plaintiff’s

suggestion to determine a portion of her negligence and breach of

fiduciary duty claims on a class-wide basis would be inefficient.

Accordingly, the Court denies Plaintiff’s request to certify the class

for particular issues pursuant to Rule 23(c)(4).

V. CONCLUSION

For the reasons set forth above, Plaintiff’s Renewed Motion for

Class Certification (d/e 52) is DENIED.

ENTERED: January 19, 2021

FOR THE COURT:

s/ Sue E. Myerscough___

SUE E. MYERSCOUGH

UNITED STATES DISTRICT JUDGE