MEMORANDUM OF DECISION DENYING MOTION OF IRIS LARA, TANYA LLERA, AND JARMAINE JOHNS FOR AUTHORIZATION TO FILE A CLASS PROOF OF CLAIM
ERNEST M. ROBLES, Bankruptcy Judge.
At the above-captioned date and time, the Court conducted a hearing on the Motion of Iris Lara, Tanya Llera, and Jarmaine Johns for Authorization to File a Class Proof of Claim on Behalf of Claimants Similarly Situated [Doc. No. 2025] (the "Motion").1 The Court took the Motion under submission at the conclusion of the hearing. For the reasons set forth below, the Motion is DENIED.2
I. Facts and Summary of Pleadings
On August 31, 2018 (the "Petition Date"), Verity Health Systems of California ("Verity") and certain of its subsidiaries (collectively, the "Debtors") filed voluntary petitions for relief under Chapter 11 of the Bankruptcy Code. On August 31, 2018, the Court entered an order granting the Debtors' motion for joint administration of the Debtors' Chapter 11 cases. Doc. No. 17.
Iris Lara, Tanya Llera, and Jarmaine Johns (collectively, the "Movants") seek authorization to file a class prepetition unsecured proof of claim on behalf of similarly situated creditors. Movants were prepetition employees of VHS. The Debtors oppose the Motion.
A. The Prepetition State Court Complaint
On May 12, 2017, Iris Lara and Tanya Llera, individually and on behalf of all other employees similarly situated, filed a complaint against Verity in the Los Angeles Superior Court, alleging negligence, breach of implied contract, violation of the California Customer Records Act, and violation of § 17200 et seq. of the California Business & Professions Code.
On May 19, 2017, Jarmaine Johns, individually and on behalf of all other employees similarly situated, file a complaint against Verity in the San Mateo Superior Court, alleging violation of the California Confidentiality of Medical Information Act, invasion of privacy, breach of contract, negligence, and breach of implied contract. The two actions were consolidated and a consolidated complaint was filed on June 21, 2018 (the "Complaint") in the Los Angeles Superior Court (the "State Court").
The material allegations of the Complaint are as follows:
1) On April 27, 2016, Verity was targeted in a "phishing" scam, in which cybercriminals contacted Verity's human resources department requesting employee W-2 files.
2) Verity responded by sending the requested information, which included the names, addresses, and full Social Security numbers of thousands of current and former employees, as well as the personally identifiable information ("PII") of beneficiaries designated by those employees for certain of their employment benefits.
3) The cybercriminals were able to perpetrate this breach because Verity failed to maintain reasonable and adequate security measures to protect the employees' information from access and disclosure, and failed to properly train employees with access to PII.
4) As a result of Verity's substandard cybersecurity protocols, the breach was not discovered until May 22, 2016, nearly four weeks after the employee PII was released. Written notification to those affected was not sent until June 1, 2016, more than a month after the breach.
5) As a result of Verity's failure to maintain adequate security measures and timely notify employees of security breaches, Verity's employees have suffered an ascertainable loss in that they have had tax refunds withheld or otherwise delayed, and have been required to (a) engage professional tax, legal, or other professional assistance and (b) undertake additional security measures to minimize the risk of future data breaches at their own expense.
Based upon the foregoing allegations, the Complaint asserts claims for invasion of privacy, negligence, unjust enrichment, breach of implied contract, violation of the California Customer Records Act, violation of the Confidentiality of Medical Information Act, and violation of the Unfair Competition Law. The proposed class consists of "[a]ll current and former employees of Verity, and their spouses and dependents, whose Personally Identifiable Information was in the possession and control of Verity at any time from January 2015 to the present and was compromised by the Data Breach [of April 27, 2016]." Complaint at ¶ 54. The State Court did not certify the proposed class prior to the Petition Date.
B. Undisputed Facts Regarding the Data Breach
Verity does not dispute certain of Movants' allegations regarding the data breach. Specifically, Verity admits the following with respect to the data breach:
On April 27, 2016, Verity was targeted with an e-mail "phishing" scam. In response to an individual impersonating a Verity executive, a Verity employee sent files containing W-2 information for employees employed between January 1, 2015 and December 31, 2015 to a third party criminal. The information sent included names, addresses, Social Security numbers, earnings, and withholding information for employees who were issued a W-2 for the 2015 tax year.
On May 22, 2016, Verity's senior leadership discovered that the breach had occurred. On May 23, 2016, Mitch Creem, then the Chief Executive Officer of Verity, sent a memorandum to all employees and physicians alerting them to the breach and advising that Verity would provide a formal notification letter, identity protection systems, and a hotline for questions. On May 26, 2016, Mr. Creem sent an updated memorandum to employees, advising them that Verity had contracted with Epiq, a national firm, to notify affected individuals and to provide identity protection services and advice. On June 1, 2016, Epiq mailed a formal notice of the data breach to affected employees. Verity offered every employee two years of free identity protection services through Equifax.
C. Summary of the Motion
Movants make the following arguments and representations in support of the Motion:
The factors supporting application of Bankruptcy Rule 7023 to the claims administration process are satisfied here. First, a class proof of claim will benefit the claims administration process. The proposed class consists of approximately 7,300 claimants. Collective resolution through a class proof of claim will be more efficient. Many of the claims are relatively small, making them economically infeasible for claimants to prosecute. Second, the Debtors provided notice of the claims bar date (the "Bar Date") to employees that were employed as of the Petition Date, but did not provide notice of the Bar Date to former employees. Absent class certification, employees who did not receive notice of the Bar Date will be unable to vindicate their rights. Third, permitting a class proof of claim will not adversely affect the administration of the estate. The Debtors have been aware of the class claim since May 2016, listed the class claim in their list of 50 largest unsecured creditors, and have not yet confirmed a plan of reorganization.
The elements of numerosity, commonality, typicality, and adequacy set forth in Civil Rule 23(a) are satisfied. With respect to numerosity, joinder of approximately 7,300 current and former employees would be impractical. With respect to commonality, the claims are based on a data breach that affected all employees. Courts have recognized that data breach claims are amenable to class treatment. See Ree v. Zappos.com, Inc. (In re Zappos.com, Inc.), 888 F.3d 1020 (9th Cir. 2018).
Typicality is satisfied because class members "have the same or similar injury" and "have been injured by the same course of conduct." Hanon v. Dataproducts Corp., 976 F.2d 497, 508 (9th Cir. 1992). Movants and members of the proposed class have been injured in the same manner in that their personal data was not secured by Verity and as a result was taken by cybercriminals.
Adequacy is satisfied because Movants will fairly and adequately protect the interests of the class. Movants have no interests that diverge from those of the class and have been injured in the same manner as other class members. The same strategies that will vindicate Movants' claims will vindicate the claims of the class.
Civil Rule 23(b)(1)(B) is satisfied. Rule 23(b)(1)(B) provides that a class action may be maintained if prosecuting separate actions by individual class members would create a risk of "adjudications with respect to individual class members that, as a practical matter, would be dispositive of the interests of other members not parties to the individual adjudications or would substantially impair or impede their ability to protect their interests." Courts have found that Rule 23(b)(1)(B) is satisfied in "limited fund" cases—that is, "an action in which any recovery will come from a fixed pool of assets that is or may be insufficient to satisfy all claims against the fund." 5 Moore's Federal Practice—Civil § 23.42[2][a] (2019). This proceeding qualifies as a limited fund case because the Debtors intend to liquidate all their assets.
In the alternative, Civil Rule 23(b)(3) is satisfied because common questions of law or fact predominate over any individual questions and a class action is the superior method to adjudicate the action fairly and efficiently. The common questions applicable to this case include whether Verity owed a duty to Movants and the class members to protect their private information, whether Verity's security measures were adequate, whether Verity failed in its duty to protect this private information, and whether Verity's notice to Movants and the class members of the breach was timely and sufficient.
A class action is superior because it is not economically feasible for most claimants to individually prosecute their claims. In addition, former employees were not notified of the Bar Date. Absent a class proof of claim, those former employees may never know that they were required to file an individual proof of claim in order to recover from the estate.
Superiority is further supported by the fact that damages can be determined on a class-wide basis. Damages are anticipated to fall into two categories: (1) proof of monetary loss as a result of use of the breached private data; and (2) costs associated with ongoing creditor monitoring to prevent use of the breached private data. This information can efficiently be presented to the Court through expert testimony.
If the Court does not permit a class proof of claim, the Court should (1) extend the Bar Date as to members of the class and (2) establish a practical process for collectively adjudicating the claims. The process should be similarly to that used in In re Buffets LLC's, No. 16-50557-RBK (Bankr. W.D. Tex.). In Buffets, a notice and consent form was mailed to all putative class members to participate in the bankruptcy proceedings. All consent forms had to be filed within 30 days. The procedures elicited over 1,600 unpaid wage claims.
D. Summary of Verity's Opposition
Verity makes the following arguments and representations in its Opposition to the Motion:
The Court should not apply Civil Rule 23 to the claims administration process. First, the class was not certified prepetition despite adequate time to do so. Second, although Debtors did not provide actual notice of the Bar Date to all former employees affected by the data breach, such employees received constructive notice of the Bar Date. Notice of the Bar Date was published in the Los Angeles Times, San Francisco Chronicle, San Jose Mercury News, and USA Today. Notice of the Bar Date was also posted on the website of the Debtors' claims and balloting agent.
Third, class certification would be more costly and burdensome than normal bankruptcy processes. Verity has reason to believe that only a few proposed class members would have valid claims, and such claims can be resolved through the normal bankruptcy process of individual claims. Fewer than 30 employees ever complained to Verity of injury from the data breach. Verity proposes that its Chapter 11 Plan will provide relief to affected former and current employees by including an offer for an additional two years of identity protection services. This would provide relief not easily recoverable through class treatment.
Class certification should be denied because the claims set forth in the Complaint are without merit. Movants' negligence claim fails because damages for negligence cannot be recovered absent actual injury. "Plaintiffs asserting negligence claims ordinarily may not recover purely economic damages unconnected to physical injury or property damage." Castillo v. Seagate Tech., LLC, No. 16-CV-01958-RS, 2016 WL 9280242, at *2 (N.D. Cal. Sept. 14, 2016). Movants cannot recover damages for the projected future costs of ongoing credit monitoring. See Castillo, 2016 WL 9280242, at *4 (holding that "those who claim only that they may incur expenses in the future have not" pleaded a cognizable injury).
Movants' claim for implied breach of contract fails because for such a claim, "[n]ominal damages, speculative harm, or threat of future harm do not suffice to show legally cognizable injury." Low v. LinkedIn Corp., 900 F.Supp.2d 1010, 1028 (N.D. Cal. 2012). Movants allege a great variety of speculative out-of-pocket damages that they indisputably did not experience.
Movants' claim under the Customer Records Act fails because the statute does not apply to "[a] provider of health care, [a] health care service plan, or [a] contractor regulated by the Confidentiality of Medical Information Act." Cal. Civ. Code § 1798.81.5(e). Movants admit in the Complaint that Verity is a provider of health care. Complaint at ¶¶ 6 and 27.
Movants' claim for damages under the Confidentiality of Medical Information Act (the "CMIA") fails because the statute applies only to "medical information." Cal. Civ. Code § 56 et seq. Under the statutory definitions, the personal information of employees does not qualify. Movants' claim under the Unfair Competition Law fails because "reliance on the threat of future harm does not satisfy the UCL's `lost money or property' standing requirement." In re Yahoo! Inc. Customer Data Sec. Breach Litig., 313 F.Supp.3d 1113, 1130 (N.D. Cal. 2018).
Movants' claim for invasion of privacy fails because such a claim requires an intentional intrusion into private matters. See Hernandez v. Hillside, Inc., 47 Cal.4th 272, 286 (2009). Here, the Movants' personal information was inadvertently disclosed, not intentionally disclosed.
Movants' claim for unjust enrichment fails because by providing their personal information, class members conferred nothing of value on Verity. "The doctrine (of unjust enrichment) applies where plaintiffs, while having no enforceable contract, nonetheless have conferred a benefit on defendant which defendant has knowingly accepted under circumstances that make it inequitable for the defendant to retain the benefit without paying for its value." Hernandez v. Lopez, 180 Cal.App.4th 932, 938, 103 Cal.Rptr.3d 376 (2009).
Movants cannot satisfy Civil Rule 23's commonality requirement. Movants contend that commonality is satisfied because Verity allegedly had deficient policies with respect to safeguarding employee personal information. However, Movants have failed to demonstrate, as opposed to allege, the existence of such a deficient policy.
Movants cannot satisfy the typicality requirement. Movants have failed to establish that their claims are typical of other class members. Movants do not provide any showing regarding the nature of other employees' injuries. Verity's preliminary investigation shows that Movants' claims are not typical. The three Movants allegedly experienced fraudulent tax returns involving out-of-pocket costs. Verity knows of only a small group of employees (less than 30 or approximately 0.4% of the proposed class) who experienced similar issues. The vast majority of affected employees (approximately 80%) never complained of any harm and did not even avail themselves of the free identity protection services on offer despite Verity's urging.
Movants do not satisfy the adequacy requirement. First, Llera is a former employee and should not be a class representative on behalf of current employees. Second, Movants have a conflict of interest because the injuries they suffered (being subjected to fraudulent tax filings) were more severe than the injuries suffered by most members of the proposed class. Movants would not be adequately incentivized to pursue relief that would benefit most members of the proposed class.
Movants' attempt to certify a class under Civil Rule 23(b)(1) fails. There is no danger of inconsistent or varying adjudications because the low value of the individualized claims means that the risk of multiple separate lawsuits is low.
Movants' request for certification under Civil Rule 23(b)(3) fails. Common issues do not predominate over individualized issues. There are many individualized issues regarding causation and the fact of injury, such as whether class members suffered any cognizable harm and whether that harm was caused by Verity's disclosure, or instead resulted from a different data breach.
E. Summary of Movant's Reply
Movants make the following arguments and representations in their Reply to Verity's Opposition:
The Debtors' objection is substantively a premature summary judgment motion on the merits of the underlying claims. As the merits of the underlying claims are not at issue in connection with the Motion, Movants will not take the bait. The only issue before the Court is whether it makes sense for a class representative to be appointed to have standing to resolve the bankruptcy claims which arise from the violations of law alleged in the Complaint.
There is no dispute that the Debtors served notice of the Bar Date only upon employees who remained employed as of the Petition Date, and did not provide notice to former employees. The fact that former employees did not receive notice is a compelling reason for class treatment of the claim. Permitting a class claim will not adversely affect the administration of the estate because the Debtors have not yet filed a plan. There is no merit to the Debtors' contention that the proposed class members will be protected by a plan provision giving class members a further two years of identity protection services. Such unilateral treatment is not preferable to good-faith negotiations with a class representative.
The Court should reject the Debtors' attempt to turn the Motion into a hearing on the merits of the underlying claims. Nonetheless, Movants' claims have merit. There is no merit to the Debtors' contention that Movants' claims for damages are not cognizable because they are speculative and/or non-monetary. Where PII is exposed during a data breach, an injury-in-fact is established where the misuse of such PII is alleged to be imminent. Krottner v. Starbucks Corp., 628 F.3d 1139, 1143 (9th Cir. 2010); In re Adobe Systems, Inc. Priv. Litig., 66 F.Supp.3d 1197, 1215 (N.D. Cal. 2014). The increased, immediate risk that the class members' data will be misused, as clearly demonstrated by the fact the Movants were victimized by having their information used to file fraudulent tax returns, establishes imminent injury and satisfies the pleading standard. Id.; In re Yahoo!, 2017 WL 3727318 *12. Additionally, the necessity to mitigate damages by ongoing credit monitoring to guard against future theft is also recognized as a cognizable injury for purposes of negligence. Krottner, 628 F.3d at 1141-42; In re Yahoo!, 2017 WL 3727318 *16 (finding expenses paid for credit monitoring is sufficient to demonstrate an injury in fact).
Movants have sufficiently pleaded a claim under the California Customer Recording Act (the "CRA"). The CRA requires that any business that "owns, licenses, or maintains personal information about a California resident ... implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure." By failing to implement reasonable security measures appropriate to the nature of the personal information of its current and former employees, the Debtors violated the CRA.
Movants have sufficiently alleged a claim under the Confidentiality of Medical Information Act (the "CMIA"). The Debtors assert that the PII disclosed does not fall within the scope of the CMIA. Whether the PII is covered under the CMIA requires a factual finding which is not properly determined in the context of a motion for class certification.
Movants have sufficiently alleged a claim under the Unfair Competition Law (the "UCL"). Debtors argue that Movants do not have standing under the UCL because they have not pleaded any cognizable injury. Debtors ignore that Movants and the proposed class members have been injured from the filing of fraudulent tax returns and the continued improper use of their identities.
Movants have sufficiently alleged a claim for invasion of privacy. The elements of a claim for invasion of privacy are as follows: "(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy." Pettus v. Cole, 49 Cal.App.4th 402, 439 (1996). Contrary to Debtors' contention, Movants are not required to allege an "intentional intrusion."
Movants have sufficiently alleged a claim for unjust enrichment. Under California law, unjust enrichment claims can exist as a separate cause of action when "the claim is grounded in equitable principles of restitution." Hirsch v. Bank of Am., 107 Cal.App.4th 708, 721-22 (2003). Restitution is permitted under the UCL. Bank of the West v. Superior Court, 2 Cal.4th 1254 (1992). Given that the Movants have stated a valid cause of action under the UCL, the Debtors' arguments regarding the Movants' unjust enrichment claims should be rejected. Furthermore, the cases the Debtors rely upon to support their argument are inapposite, as they did not involve employee-employer relationships in the context of data breaches.
Movants have satisfied Civil Rule 23's commonality requirement. Movants have alleged that they suffered the same injury—their PII was released by the Debtors in April 2016. "[O]ne type of injury allegedly inflicted by one actor in violation of one legal norm" satisfies the commonality requirement. Vaquero v. Ashley Furn. Indus., Inc., 824 F.3d 1150, 1154 (9th Cir. 2016). The extent and adequacy of the Debtors' security measures are at the heart of all of the claims. In re Anthem, Inc. Data Breach Litig. ("Anthem II"), 327 F.R.D. 299, 308 (N.D. Cal. Aug. 15, 2008). The answer does not vary among class members, making this a common issue which will drive the resolution. Id.
Movants have satisfied the typicality requirement. The Debtors argue that Movants' claims are not typical of the class because Movants do not provide any showing regarding the nature of their or other employees' injuries. The argument is misdirected, because the focus on typicality is not on the "injury suffered" but on whether the class is victimized and harmed by the same event as the representative plaintiffs. Brown v. DirecTV, 2019 WL 1434669 *3 (C.D. Cal. Mar. 29 2019). The focus is not on the injury, but on the conduct of the defendant. Hanon v. Dataproducts Corp., 976 F.2d 497, 508 (9th Cir. 1992).
II. Findings and Conclusions
Class certification is governed by Civil Rule 23. Bankruptcy Rule 7023 provides that Civil Rule 23 "applies in adversary proceedings." Under Bankruptcy Rule 9014(c), the Court has discretion to apply Bankruptcy Rule 7023 to the claims administration process. Courts have developed a three-factor framework to guide the exercise of this discretion:
1) whether the class was certified pre-petition;
2) whether the members of the putative class received notice of the bar date; and
3) whether class certification will adversely affect the administration of the estate.
In re Chaparral Energy, Inc., 571 B.R. 642, 646 (Bankr. D. Del. 2017).
These factors were first articulated in In re Musicland Holding Corp., 362 B.R. 644, 654 (Bankr. S.D.N.Y. 2007) and are commonly referred to as the "Musicland factors." "No one factor is dispositive; a factor may take on more or less importance in any given case." Chaparral Energy, 571 B.R. at 646.
Only if the Court determines that it is appropriate to apply Bankruptcy Rule 7023 to the claims administration process does the Court proceed to determine whether the requirements of Civil Rule 23 have been satisfied. As explained by the Chapparal Energy court:
Whether to permit a class action proof of claim is a matter of discretion. In exercising that discretion, a two-step analysis is performed. First, the court must decide whether it is beneficial to apply Bankruptcy Rule 7023, via Bankruptcy Rule 9014(c), to the claims administration process. Second, the court must determine whether the requirements of Federal Rule 23 have been satisfied, such that a class proof of claim may properly be filed.
Id. (internal citations omitted); see also Gentry v. Siegel, 668 F.3d 83, 93 (4th Cir. 2012) ("Civil Rule 23 factors do not become an issue until the bankruptcy court determines that Rule 7023 applies by granting a Rule 9014 motion. The issue on such a motion centers more directly on whether the benefits of applying Rule 7023 (and Civil Rule 23) are superior to the benefits of the standard bankruptcy claims procedures.").
Careful consideration of the Musicland factors is necessary because "class certification may be `less desirable in bankruptcy than in ordinary civil litigation.'" In re Ephedra Prod. Liab. Litig., 329 B.R. 1, 5 (S.D.N.Y. 2005). Consequently, "[e]ven class actions that were certified prior to the filing for bankruptcy may ... be disallowed." Id.
In In re First Alliance Mortgage Co., the District Court for the Central District of California stated that "class action devices ... are particularly appropriate" in bankruptcy proceedings, and that "the party opposing the use of class devices [bears] the burden." First All. Mortg. Co., 269 B.R. 428, 445 (C.D. Cal. 2001). In the eighteen years since it was published, no decision—either published or unpublished—has cited First Alliance for this proposition.3 More recent decisions within the Ninth Circuit have approached class proofs of claim in a manner inconsistent with the standard set forth in First Alliance.
For example, in In re Aughney, the court expunged a class proof of claim, reasoning that the "essential problem with a class proof of claim is that class action procedures often conflict with established bankruptcy procedures." Aughney, No. 10-12666, 2011 WL 479010, at *1 (Bankr. N.D. Cal. Feb. 4, 2011). The court held that "class claims can be allowed, especially where a class was certified before bankruptcy or principles of equity and simple justice militate in favor of a claim being pursued on behalf of a class," but emphasized that a "prerequisite for allowance... is that the proponent must seek and obtain a determination of the Bankruptcy Court that Rule 7023 of the Federal Rules of Bankruptcy Procedure be made applicable to the claims process." Id. In Westfall v. MII Liquidation Inc., the District Court upheld the Bankruptcy Court's denial of class certification, explaining that "bankruptcy courts have broad discretion to allow or disallow such class claims." Westfall, No. 06-CV-02343-BENNLS, 2007 WL 2700951, at *4 (S.D. Cal. Sept. 11, 2007).
Courts outside the Ninth Circuit have also declined to follow First Alliance. Instead of placing the burden upon the party opposing class certification, the Fourth Circuit Court of Appeals held that it was appropriate for the Bankruptcy Court to weigh "the benefits and costs of class litigation against the efficiencies created by the bankruptcy claims resolution process." Gentry v. Siegel, 668 F.3d 83, 92 (4th Cir. 2012). The Fourth Circuit found that "[e]ach bankruptcy case must be assessed on a case-by-case basis to determine whether allowing a class action to proceed would be superior to using the bankruptcy claims process." Gentry, 668 F.3d at 93. First Alliance's burden standard is also fundamentally inconsistent with the Musicland factors, which have been widely adopted.
The Court declines to follow First Alliance for the propositions that class actions are particularly appropriate in bankruptcy and that the party opposing a class proof of claim bears the burden of proof. In determining whether application of Civil Rule 23 to the claims administration process is warranted, the Court will apply the Musicland factors, keeping in mind that "[w]hether to permit a class action proof of claim is a matter of discretion." Chapparal Energy, 571 B.R. at 646.
A. The Musicland Factors Do Not Support Applying Civil Rule 23 to the Claims Administration Process
As set forth below, the Court finds that the Musicland factors weigh against applying Civil Rule 23 to the claims administration process.
1. Factor One: Whether the Class was Certified Prepetition
The putative class was not certified prepetition, so the first Musicland factor weighs against applying Civil Rule 23 to the claims administration process.
2. Factor Two: Whether Putative Class Members Received Notice of the Bar Date
Where putative class members have received actual notice of the bar date, the second factor weighs against applying Civil Rule 23 to the claims administration process. Musicland, 362 B.R. at 655. The reason is that such putative class members have an opportunity to share in the distribution from the estate by filing a proof of claim. Id. By contrast, putative class members who did not receive actual notice of the bar date lack the ability to file a proof of claim. The filing of a class proof of claim vindicates the ability of such putative class members to assert a claim against the estate.
Here, the proposed class consists of "[a]ll current and former employees of Verity, and their spouses and dependents, whose Personally Identifiable Information was in the possession and control of Verity at any time from January 2015 to the present and was compromised by the Data Breach [of April 27, 2016]." Complaint at ¶ 54. The Debtors provided actual notice of the Bar Date to employees that were employed as of the Petition Date but not to former employees.
That not all employees received actual notice of the Bar Date does not compel the Court to apply Civil Rule 23 to the claims administration process. As discussed below with respect to Factor Three, the Court finds that class certification will adversely affect the administration of the estate. To vindicate the ability of class members to receive a distribution from the estate, the Court will extend the Bar Date to September 30, 2019; the extension shall apply only to members of the putative class and not to other creditors. See In re Connaught Grp., Ltd., 491 B.R. 88, 97 (Bankr. S.D.N.Y. 2013) (holding that where a court denies a class certification motion, "it should set a reasonable bar date to allow the members of the putative class to file individual claims"). The Debtors shall provide notice of the extended bar date (the "Notice") to all members of the putative class (the "Claimants"). The Claimants are entitled to receive the Notice by first-class mail rather than by publication.4
The Debtors have represented that they intend to "propose a plan with specific classification for employees subject to the data breach, which will include continued credit monitoring." Opposition at 1. The Notice shall include a copy of Official Form 410 (Proof of Claim) and shall:
1) Advise Claimants that they are receiving the Notice because their personally identifiable information was disclosed in error to an unauthorized party on April 27, 2016.
2) Advise Claimants that they may have a claim for damages against the Debtors on account of the disclosure.
3) Advise Claimants that unless they assert a claim for damages by returning the attached Proof of Claim form by no later than September 30, 2019, they will not be entitled to receive a distribution from the estate on account of such claim.
4) Advise Claimants that if they assert a claim for damages, they may be entitled to receive free credit monitoring services in connection with the Debtors' plan.
5) Advise Claimants that they may contact the counsel for the Official Committee of Unsecured Creditors with any questions.5
The Debtors shall file a proposed form of Notice with the Court by no later than June 7, 2019. Any part in interest may file an opposition to the proposed Notice by no later than June 21, 2019. If an opposition is filed the Court will determine if a hearing is required and will set a hearing date, if appropriate. The Notice shall be mailed to Claimants by no later than July 8, 2019. The Notice shall also be published on the website of the Debtors' claims and balloting agent, Kurtzman Carson Consultants, LLC.
Issues pertaining to the scope of the credit monitoring services to be offered in the Debtors' plan are preserved for the plan confirmation hearing and will not be decided at this time.6
3. Factor Three: Whether Class Certification Will Adversely Affect the Administration of the Estate
The Court finds that class certification will adversely affect the administration of the estate. A class proof of claim will prove more unwieldy and be less efficient than individual proofs of claim.
The Debtors have demonstrated that significant variation exists in the types of injuries suffered by members of the proposed class. Only approximately thirty employees (or 0.4% of the proposed class) experienced practical issues resulting from the data breach. Declaration of Pascale Sonia-Roy (the "Sonia-Roy Decl.") at ¶ 21. Of these thirty employees experiencing issues, certain employees reported being victims of fraudulent tax return filings. Id. One employee reported the unauthorized use of a credit card. Id. One employee reported a fraudulent request for a second credit card. Id. One employee reported an attempt by a third-party to refinance a mortgage and draw on equity. Id. One employee reported a fraudulent request for a mortgage payment refund. None of these attempts to defraud the employees were successful. Id. All employees ultimately received their tax returns and suffered no direct damages. Id. at ¶ 22.
The Debtors received only two claims for reimbursement of out-of-pocket expenses: (1) a request by six nurses employed at St. Francis Medical Center for compensation for time and mileage to meet in-person with the Internal Revenue Service; and (2) a $30 dollar reimbursement request by another employee for the purchase of additional identity theft protection. Id. at ¶ 23.
In sum, only a very small percentage of the putative class has suffered any damages on account of the data breach. Of those employees who were injured, the out-of-pocket costs incurred vary significantly. The most effective way to address the claims of employees who have suffered damages is to allow such employees the opportunity to file proofs of claim. In contrast to a class proof of claim, individualized proofs of claim will be precisely tailored to the damages suffered by each claimant.
Movants assert that classwide litigation as to damages can be effectively managed through expert testimony that will estimate damages. Such expert testimony would be expensive, time-consuming, and inevitably less precise than individual proofs of claim. There is no point in engaging in such an exercise where a process already exists that can effectively address any claims asserted by employees.
As explained by the court in Gentry v. Siegel, the normal bankruptcy claims process allows all claims to be consolidated in one forum and permits claimants to file proofs of claim without counsel at virtually no cost to themselves. Gentry, 668 F.3d at 93. In contrast to these systemic advantages, classwide litigation is frequently expensive, time-consuming, and protracted. Id. The normal policy concerns that typically favor a class action process—the risk of inconsistent adjudications and the deterrence of improper defendant behavior—are not a concern in a bankruptcy proceeding involving a single court. Id.
The court in In re Ephedra Prod. Liab. Litig., 329 B.R. 1, 9 (S.D.N.Y. 2005) reached a similar conclusion:
[The] superiority of the class action vanishes when the "other available method" is bankruptcy, which consolidates all claims in one forum and allows claimants to file proofs of claim without counsel and at virtually no cost. In efficiency, bankruptcy is superior to a class action because in practice small claims are often "deemed allowed" under § 502(a) for want of objection, in which case discovery and fact-finding are avoided altogether. As for fairness, although the notice requirements of Rule 23 are superior for class members to the usual bankruptcy notice by publication, this shortcoming is easily remedied by a bankruptcy notice directed specifically at class members, either at the time of the original notice or thereafter by order extending the bar date for class members.
In re Ephedra Prod. Liab. Litig., 329 B.R. 1, 9 (S.D.N.Y. 2005).
For these reasons, the Musicland factors weigh against applying Civil Rule 23 to the claims administration process. Accordingly, the Court declines to apply Civil Rule 23 and declines to authorize Movants to proceed with the proposed class proof of claim. Because the Court will not apply Civil Rule 23, it is not necessary for the Court to address whether Movants have met the class certification requirements of numerosity, commonality, typicality, and adequacy.
B. Movants Are Not Entitled to a Further Opportunity to Conduct Discovery in Support of the Class Certification Motion
Movants contend that due process requires that they be afforded the opportunity to take formal discovery in support of the Motion. Movants' argument incorrectly presupposes that they have been denied the opportunity to take discovery. The Debtors sought bankruptcy protection on August 31, 2018. At any time after this date, Movants could have sought information from the Debtors in support of their class proof of claim under Bankruptcy Rule 2004. An examination under Rule 2004 may relate "to the acts, conduct, or property or to the liabilities and financial condition of the debtor, or to any matter which may affect the administration of the debtor's estate ...." In Chapter 11 cases, the examination "may also relate to ... any ... matter relevant to the case or to the formulation of a plan." "The scope of a Rule 2004 examination is exceptionally broad," and Rule 2004 examinations "have been compared to a `fishing expedition.'" In re Duratech Indus., Inc., 241 B.R. 283, 289 (E.D.N.Y. 1999). Rule 2004 contains a mechanism for compelling the production of documents. See Bankruptcy Rule 2004(c).
In In re Associated Cmty. Servs., Inc., the court declined to allow a claimant an additional opportunity to conduct discovery in support of a class certification motion. Associated Cmty. Servs., 520 B.R. 650, 655-56 (Bankr. E.D. Mich. 2014). The court reasoned that the claimant could have conducted the necessary discovery under Bankruptcy Rule 2004:
If Pepper [the claimant] needed to conduct discovery before filing a motion to apply Rule 7023, he had ample time to do so under Fed. R. Bankr. P. 2004. Rule 2004 examinations are routinely granted, and are one of the few instances where the Federal Rules of Civil Procedure permit discovery to be taken before filing a motion or commencing an action. Pepper offers no explanation as to why he has not taken a Rule 2004 examination or sought any other discovery to date that could assist him in assembling whatever facts he believes are necessary before filing a motion to apply Rule 7023.
In re Associated Cmty. Servs., Inc., 520 B.R. 650, 655-56 (Bankr. E.D. Mich. 2014).
The Court is obligated to construe and apply the Bankruptcy Rules, including the rules governing discovery, in a manner that secures "the just, speedy, and inexpensive determination" of the proceedings before it. See Bankruptcy Rule 1001. Further, in determining the appropriate scope of discovery, the Court must consider "the importance of the issues at stake in the action, the amount in controversy, the parties' relative access to relevant information, the parties' resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit." Civil Rule 26(b)(1).
Debtors have already devoted significant resources to opposing the Motion. Where, as here, Movants have already had an ample opportunity to conduct discovery in support of the Motion, further discovery would needlessly result in increased expense to the estate. In addition, such further discovery would not likely yield facts which would cause the Court to reconsider its conclusion that the normal claims process is superior to a class proof of claim. In particular, the proposed discovery is unlikely to defeat the Debtors' showing that the individualized damages suffered by proposed class members varies significantly. Consequently, the Court finds that the burden or expense of the proposed discovery outweighs its likely benefit.
III. Conclusion
Based upon the foregoing, the Motion is DENIED. The Court will enter orders consistent with this Memorandum of Decision.
