OPINION & ORDER

[Resolving Docs. 151, 162]

JAMES S. GWIN, District Judge.

In 2017, not yet identified third parties stole Sonic1 customer payment card data from more than three-hundred Sonic Drive-Ins. Consumer Plaintiffs sued Sonic, alleging that Sonic's inadequate security practices allowed the breach. The parties have now reached a settlement.

Having previously obtained preliminary approval, Plaintiffs now move for final settlement approval, service awards, and attorneys' fees, costs, and expenses.

For the following reasons, the Court CERTIFIES the Settlement Class, APPROVES the Settlement Agreement, and GRANTS service awards and attorneys' fees, costs, and expenses as stated in this order.

I. Background

In late September 2017, news outlets reported that Sonic customer payment card data had been compromised. Numerous lawsuits seeking class action status followed.

On December 12, 2017, the Judicial Panel on Multidistrict Litigation transferred five cases to this Court. Three more cases followed shortly after.2 After motion-to-dismiss briefing, an amended complaint,3 three mediations, and extensive settlement discussions, the parties reached a settlement agreement. On October 10, 2019, Plaintiffs moved for preliminary approval of the class action settlement and for preliminary certification of the Settlement Class.4

The Court denied Plaintiffs' initial motion for settlement approval because thirteen of the twenty-two proposed Settlement Class representatives were not members of the Settlement Class. Discovery evidence showed that these thirteen plaintiffs had made purchases at Sonic stores that were not actually impacted by the data theft.

The parties then entered an amended settlement agreement ("Settlement Agreement") and Plaintiffs again sought preliminary approval.5 The Settlement Agreement defines the Settlement Class as all U.S. residents who made a debit or credit card purchase at one of 325 involved Sonic Drive-In locations between April 7, 2017 and October 28, 2017.6

Under the Settlement Agreement, Sonic will pay $4,325,000 into a settlement fund. After notice costs, settlement administrator fees, service awards, attorneys' fees, costs, and expenses, the fund balances will be distributed to class members. Sonic will not object to Plaintiffs' requested attorneys' fees, up to one-third of the total fund ($1,441,66.67), reasonable costs and expenses ($311,693.53), or service awards ($42,000). On December 20, 2018, the Court preliminarily approved the settlement and preliminarily certified the class.7

Plaintiffs now move for final settlement approval, for service awards, and for attorneys' fees, costs, and expenses.8 The Court held a fairness hearing on July 25, 2019.9

II. Discussion

A. Standing

While the parties do not dispute standing, considering the Supreme Court's recent decision in Frank v. Gaos, the Court briefly examines it.

Article III standing requires: (1) an injury in fact, (2) a causal connection between the injury and the conduct complained of, and (3) that it is "likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision."10 In class actions, the Court examines the class representatives only.

Here, some class representatives allege that they experienced unauthorized charges on their payment cards (although each received complete reimbursement from their banks). Other representatives did not experience unauthorized charges but their banks preemptively cancelled their cards.

The representatives allege they spent time dealing with issues related to their compromised credit or debit cards; most continue to spend time checking their accounts. Each representative also was deprived of their credit or debit card for some period, ranging from two days to over a year. This deprivation itself caused inconveniences—having to update account payment methods or use a less desired payment method, to name a couple. One representative did not replace her debit card for six months out of fear that it would happen again.

Accepting the class representatives' allegations as true and construing them in their favor, the representatives suffered concrete and particularized injuries caused by Sonic.11 Further, the sought monetary and injunctive relief would redress these harms. Plaintiffs have standing.

B. Certifying the Settlement Class

The Court first decides whether to certify the Settlement Class.12 The Court gives "undiluted, even heightened, attention" to certification requirements when the class is for settlement purposes only.13 Plaintiffs must show that: (i) the class is too numerous for joinder, (ii) there are legal or factual questions common to the entire class, (iii) the class representatives' claims are typical of the class, and (iv) they will adequately represent the class' interests. Further, because Plaintiffs seek Rule 23(b)(3) certification, they must show that common questions predominate over individualized ones and proceeding as a class is superior to other methods.

Numerosity: Sonic estimates that there are 1.5 million Settlement Class members. The numerosity requirement is satisfied.

Commonality & Predominance: Class claims satisfy commonality if they "depend upon a common contention" that "is capable of class-wide resolution—which means that determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke."14

The class members' claims arise from the same event—the Sonic data breach. And they concern the same general legal questions, including: whether Sonic was legally required to protect Plaintiffs' data, whether Sonic failed to adequately safeguard Plaintiffs' data, and whether Sonic failed to promptly notify Plaintiffs.

Typicality: Here, the class representatives' claims and those of the other class members both arise from the same data breach at the same 325 Sonic Drive-Ins. Further, they both involve the same general legal theories relating to Sonic's failure to adequately protect payment card data. As Settlement Class representatives advance their own interests, they also advance the interests of Settlement Class members.15

Adequacy of Representation: Class representatives are adequate when they have vigorously prosecuted the interests of the class through qualified counsel.16 "[A]dequacy of representation turns in part on the competency of class counsel and in part on the absence of conflicts of interest."17

As discussed above, the class representatives' interests align with other class members' interests. Class counsel are qualified, experienced, and generally able to conduct the litigation. Accordingly, the Court finds that the class representatives fairly and adequately protected the class interests.18

Predominance: "The `predominance inquiry tests whether proposed classes are sufficiently cohesive to warrant adjudication by representation.'"19 The numerous common questions of fact and law that arise from Sonic's conduct predominate over any individualized issues.

Superiority: The class members' claims are too small to pursue individually. The class vehicle allows Plaintiffs to pool their claims and allows the Court to conserve resources.

The Court finally certifies the class for settlement purposes.

C. Notice Program

The Court next considers whether the class received adequate notice of the settlement. Rule 23 and due process require "the best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort."20

In this case, because Sonic did not possess contact information for class members, direct notice was impossible. Instead, the notice program lasted ninety days and included: (1) in-store notice at the 325 Sonic Drive-Ins; (2) geographically targeted Facebook and Google internet ads; (3) notice in publications; (4) banner notice on Sonic's website and Facebook page; and (5) long-form notice on the Sonic website. The claim submission process was simple and required no supporting documentation, only a signature attesting that the information provided was true.21

Plaintiffs' notice program was not perfect. One obvious flaw was the Southern Living magazine notice. Unlike the full page, easily readable, dual-column notice that Plaintiffs attached to their preliminary approval motion, the published notice had been compressed into a single, one-third page column with type so small that it greatly reduced the odds that the notice would be read.

Plaintiffs and the KKC administrator give little useful information regarding how the notice program "reached" 74.1% of Settlement Class members. Plaintiffs simply aver that they used "advertising-industry standard reach calculations."22 Once again, without more, this is unhelpful.23 The parties do not know the identities of Settlement Class members— hence the indirect notice program. And they give no information to explain how they were able to make this estimation.

Despite these deficiencies, the Court finds that the Sonic Drive-In in-store notice, and the Sonic webpage and Facebook banner notices satisfy constitutional and Rule 23 standards.

The in-store notice directly targeted the affected Sonic customer group. Common sense suggests that the class members likely to remember whether they made a purchase two years ago are likely to be longtime (and continuing) Sonic customers. Further, the in-store notices were well-designed and conspicuously posted on the main customer entrance door of all affected 325 locations.

Additionally, the Sonic website and Facebook page banner were likely to reach Sonic customers, some of whom may have been Settlement Class members.24

Although the claims rate was somewhat low (59,953 timely claims out of an estimated 1.5 million class members)25 the Court finds that the notice methods and claims rate were reasonable under the circumstances. Especially considering the challenges of eliciting class member response where notice is not individually addressed, where the recovery amount is limited, and where class members may not recall a life event as insignificant as eating at Sonic.

Although the risk of fraud is likely higher than usual, the Court notes that the Settlement Agreement does require the Settlement Claims Administrator to perform basic verification and fraud detection measures.26 Based on the unique features of this case, this is enough.

D. The Settlement Is Fair, Reasonable, and Adequate

Before approving a binding settlement, the Court must conclude that it is "fair, reasonable, and adequate."27 Following a December 1, 2018 amendment, Rule 23(e)(2) now instructs courts to consider certain factors when deciding whether the settlement meets this standard:

Before this Rule 23(e)(2) amendment, circuit courts had developed their own multi-factor inquiries. According to the `Amendment's Advisory Committee Notes, so long as courts use the 23(e)(2) factors as the primary framework, courts may still consider circuit-specific factors in the analysis. In the Sixth Circuit, those factors are "(1) the risk of fraud or collusion; (2) the complexity, expense and likely duration of the litigation; (3) the amount of discovery engaged in by the parties; (4) the likelihood of success on the merits; (5) the opinions of class counsel and class representatives; (6) the reaction of absent class members; and (7) the public interest."28

1. Class Representatives' and Class Counsels' Adequate Representation

The Court finds that class representatives and class counsel adequately represented the class during the litigation and in settlement negotiations. The negotiations were contentious and hard fought.29 And class counsel secured substantial benefits for the class. The Court finds no evidence of fraud or collusion.30 In fact, the parties obtained the settlement with the help of a magistrate judge, which supports an absence of fraud.

Further, roughly eight months of discovery adequately informed the parties' negotiation.31 Plaintiffs knew about the important facts and relevant legal issues, such as information concerning how the breach occurred, how it was contained, and bases for determining the stores affected, and the potential class size.

None of the thirteen non-class named Plaintiffs excluded in the settlement have raised an objection.32 In any event, the Settlement Agreement does not bar excluded individuals from bringing suit later. The Court is satisfied that absentees are not harmed by an unwarranted class definition.

The Court notes that there has not been a single objection to, or opt-out from, the settlement. This further signals that the class representatives and class counsel have adequately represented absent class members.

2. The Settlement Was Negotiated at Arm's Length

The parties engaged in substantial negotiations when seeking to settle the litigation. This included two formal, full-day mediation sessions with a Northern District of Ohio magistrate judge, after this Court's referral. They returned to mediation when there was an impasse. These were arm's length settlement negotiations.

3. Considering Various Factors, the Settlement Provides Adequate Relief

To assess the fairness of a proposed settlement, the Court "weigh[s] the plaintiff's likelihood of success on the merits against the amount and form of the relief offered in the settlement."33 Here, the Settlement Agreement provides monetary and injunctive relief to Settlement Class members that appears "structured to remedy all damages suffered, both actual and future."34 No unclaimed funds revert to Sonic.

The Court "cannot judge the fairness of a proposed compromise without weighing the plaintiff[s'] likelihood of success on the merits against the amount and form of the relief offered in the settlement."35 However, "our task is not to decide whether one side is right or even whether one side has the better of the[ ] arguments.... The question rather is whether the parties are using settlement to resolve a legitimate legal and factual disagreement."36 The realm of data breach litigation is complex and largely undeveloped. It would present the parties and the Court with novel questions of law. The Court does not doubt that the settlement serves to resolve the legitimate dispute between the parties and therefore this requirement is satisfied.

Considering the injuries alleged, the settlement gives substantial benefits to Settlement Class members.

Further, even though Sonic changed certain security practices before the Settlement Agreement, the settlement requires Sonic to continue those practices. This is also a benefit for class members who have continued to shop at these Sonics, even if they did not submit a claim to the settlement fund.

The costs, risks, and delay of trial and appeal. The costs, risks, and delay of trial and appeal further support accepting this settlement. Data breach litigation is complex and risky. This unsettled area of law often presents novel questions for courts. And of course, juries are always unpredictable.

This settlement, by contrast, gives immediate compensation to Settlement Class members. Class interests are better served by settlement than continued litigation.

The effectiveness of the proposed method for distributing relief. The proposed claims procedure is the most effective method for distributing the benefits obtained from this settlement. As noted, Plaintiffs' estimated typical damages were small. Because locating records from a two-year-old Sonic purchase is no simple task, requiring documentary support for each claim would significantly reduce the number of claims filed.

So, the parties did not require documentation. Instead the claim form (online or paper) asked for the claimant's address and contact information, the location of the Sonic location where they made their purchase, and the last four digits of the payment card number they used to make the purchase and whether the fraud occurred before February 28, 2018 (if applicable). By signing the claim form, the claimant attested to the truthfulness of the information they had provided.

The Claim Administrator also checked claimants against lists of settlement claimants in other cases.

"Given the low value of individual awards in most consumer class actions, a sworn statement attesting to the purchase may often be sufficient documentation."37 Other data breach settlements have used this approach,38 and the Court finds that it is proper here.

The terms of the proposed attorneys' fee award. The Settlement Agreement contains a "clear-sailing" provision-—a Sonic promise not to object to a request for attorneys' fees up to one-third of the $4,325,000 aggregate fund, or reasonable costs and expenses. Sonic does not take a position on the fee application; it simply agrees not to oppose a fee application less than one-third the fund. Accordingly, the Court gives closer scrutiny to the proposed attorneys' fee award.39

Upon close inspection, the Court finds no reason to reject the settlement due to this "clear sailing" clause. The parties did not negotiate attorneys' fees terms until reaching an agreement on the class member benefits.40 Absent evidence of improper incentives, a clear-sailing provision alone does not doom the settlement.41

Rule 23(e)(3) agreements. Parties seeking approval must file a statement identifying any agreement made in connection with the settlement.42 Here, the parties represented that there was no such agreement.

4. The Settlement Agreement's Equitable Treatment of Class Members Relative to One Another

In assessing whether the Settlement Agreement treats Settlement Class members fairly vis-a-vis one another, the Court considers whether the "apportionment of relief among class members takes appropriate account of differences among their claims."43

The Court finds that the Settlement Agreement does. The Settlement Agreement creates two categories for the recovery amounts. These two categories seem to directly track the estimated damages for a typical data breach victim, for those whose information has been compromised and those who additionally suffered fraudulent charges.44

E. Plaintiffs' Request for Service Awards for Settlement Class Representatives and Non-Class Named Plaintiffs

Plaintiffs seek service awards for the nine Settlement Class representatives and the thirteen non-class named Plaintiffs in amounts ranging from $1,000 to $5,500.

Incentive awards encourage class members to become class representatives and reward their individual efforts on behalf of the class.45 However, courts carefully scrutinize service award requests for indicators that an award has led "named plaintiffs to expect a bounty for bringing suit or to compromise the interest of the class for personal gain."46

1. Request for Settlement Class Representative Service Awards

The Court finds that service awards for Settlement Class representatives are appropriate, as this is a case where public policy supports such awards. It is unlikely that these representatives' individual damages would encourage them to be named plaintiffs and, later, Settlement Class representatives.47

Considering the description of Settlement Class representatives' contributions and attorney timesheet entries, these award amounts also fairly align with each representative's contributions. The Court grants the awards in the requested amounts, for a total of $15,500.

2. Request for Non-Class Named Plaintiff Service Awards

For the non-class named Plaintiffs, the evidence did not pan out as expected. Under the Settlement Agreement, these plaintiffs are not Settlement Class members and cannot recover from the common fund. Nonetheless, non-class named Plaintiffs release any claims against Sonic under the Settlement Agreement relating to the breach, and Plaintiffs still seek service awards and their behalves.

At the hearing, the Court asked Plaintiffs for additional briefing on the Court's authority to issue a service awards to the non-class named Plaintiffs. Reviewing Plaintiffs' supplemental briefing on the service awards, the Court notes that courts have occasionally issued such awards to plaintiffs who were not class representatives. But they have not given these service awards to plaintiffs who were not class members.

For this reason, the Court must deny the service awards for the thirteen non-class named Plaintiffs. The Court has no reason to doubt the genuineness of non-class named Plaintiffs' efforts and initial claims. However, none of the policy factors that support the issuance of service awards apply to the non-class named Plaintiffs.

F. Plaintiffs' Request for Attorneys' Fees

Plaintiffs moves for attorneys' fees, costs, and expenses.48 This Court considers two methods when considering what attorneys' fees should be paid: lodestar and the percentage-of-the-fund.49

The Court chooses the percentage-of-the-fund method. This method is preferred in common fund cases.50 In common fund cases, the attorneys' fees award "be reasonable under the circumstances."51

In calculating a fee award as a percentage of the common fund, courts consider the ratio between attorneys' fees and the benefit to the class.52 Courts enjoy discretion to define the "total class benefit" based on each case's circumstances.53

In this case, Plaintiffs seek one-third of the $4,325,000 aggregate settlement amount: $1,441,66.67. In other words, Plaintiffs claim the $4,325,000 as the total class benefit—the aggregate settlement amount that funds the class member payments, service awards, attorneys' fees and costs, and settlement administration and notice costs.

In this case, the Court agrees that this is the proper approach and finds the total class benefit to be $4,325,000.

In this data breach MDL, as in some other data breach litigation, the identities of Settlement Class members are unknown. Efforts to notify class members and weed out fraudulent claims therefore take on heightened importance, and this process usually requires above-average expenditures. In the present case, the failure to include these expenditures in the total class benefit would create a conflict: for every dollar not expended on notice and administration, a dollar is added to the class member common pool—and thus a dollar added to the "total class benefits." This increases the attorney fee award.

Using the $4,325,000 amount as the total class benefits ensures that attorneys' fees are not tied to notice and administration expenditures. It also does not mean that the overall award necessarily will be any greater; courts can adjust recovery percentage rates.

And in fact, the Court finds that Plaintiffs' request for one-third of this aggregate amount is not reasonable under this case's circumstances.

In determining appropriate attorneys' fees, courts often consider: "(1) the value of the benefit rendered to the plaintiff class; (2) the value of the services on an hourly basis; (3) whether the services were undertaken on a contingent fee basis; (4) society's stake in rewarding attorneys who produce such benefits in order to maintain an incentive to others; (5) the complexity of the litigation; and (6) the professional skill and standing of counsel involved on both sides."54

Several factors support the payment of Plaintiffs' attorneys' fees. First, the settlement presents a high percentage of the total damages to the class, as estimated by an expert and a data breach survey.55 The claims rate was lower than hoped, but it is unclear that any alternative notice method could have improved the claim rate. Counsel should not be penalized for a low claims rate in cases where claims are inherently less likely to be made.56

Third, Plaintiffs' counsel undertook this action on a contingent fee basis, investing large amounts of attorney time and significant discovery expenses, taking a risk that they would recover nothing. Further, the defense was well-funded, and certainly did not roll over.

Fourth, Class Counsels' efforts also deserve to be rewarded. The alleged damages at issue in a case are often "too small to justify the expense and time required to challenge the practice—both for the individual harmed and the attorney who represents that consumer."57 Yet Class Counsel brought the suit and succeeded.

The fifth and sixth factors—the complexity of the litigation and the professional skill and standing of both sides' counsel—weighs in favor of Class Counsel as well. This litigation was challenging. It involved laws spanning many state jurisdictions, and of course centered on unsettled data breach litigation. Plaintiffs faced stiff opposition from Defendants' counsel throughout the proceedings.

Finally, the Court considers the second factor, a cross check using the hourly rate. Plaintiff Class Counsel spent 3,530.2 hours on the case.58 They claim that their attorneys' fee request of $1,441,666.67 results in a lodestar multiplier of 0.85.

Although the billing records are good overall, the records suggest that Plaintiffs' lodestar is overstated. Concerning the attorney time spent, two items immediately stand out. The first is the time entries that bill for attorney travel. These entries total approximately $49,200 in fees, with entries reaching as high as $3,672 billed for a 7.2 hour block of travel time. Although travel time can be billable if counsel shows that billing such time is the local practice,59 Plaintiffs have not made any such showing.

The second item is the attorney time spent opposing the MDL panel's transfer of the separate financial institution cases to this Court. When the $16,228 in attorneys' fees were accrued for this opposition, the Sonic consumer litigation had only the fairness hearing and final motions to go. The Court questions the utility of opposing the transfers, and notes that this took place during a time when work, no doubt, had slowed. Without more, the Court finds this time unreasonable.

The Court also has other concerns such as the secretarial nature of some paralegal work and some data breach statute violation time.

More concerning are the hourly rates. The Court assesses the prevailing market rate in the relevant community.60 The ten paralegals/office staff, assessed a mean hourly rate of $210/hour—significantly higher than the average rates reported by the paralegal association NALA in 2016.61 Revised to reflect a reasonable market rate for a paralegal, at rates from $45 for office staff to $145 for paralegals, the lodestar comparator is reduced by $51,765.

And this is only the paralegals. Even greater reductions are warranted for the attorney rates. The average billing rate at Lead Counsel's firm Federman & Sherwood (Oklahoma City, Oklahoma) was $553/hours. Yet attorneys' fee surveys indicate that Oklahoma City-based attorneys handling class actions had a median billing rate of $300 in 2016, and a $375/hour rate was the 95th percentile median attorney rate for all attorneys.62 If the Court sets the average Federman & Sherwood rate at $450/hour—reflecting the level of legal work, the national scope of the action, and any increase in the past few years—this would reduce the overall lodestar by $168,589.

These are just a few items, and the lodestar multiplier is already a positive one. The Court need not continue further.

Considering the above factors, the Court finds that 30 percent of the $4,325,000 aggregate amount is appropriate. The Court will approve a total fee award of $1,297,500. In the Sixth Circuit, 20 to 30 percent of the common fund appears to be the typical range.63

G. Plaintiffs' Request for Reasonable Costs and Expenses

The Court considers Plaintiffs' request for $311,693.53 in costs and expenses. "Recoverable out-of-pocket expenses are those incurred by the attorney which are normally charged to a fee-paying client, in the course of providing legal services, such as reasonable photocopying, paralegal expenses, and travel and telephone costs."64

The amounts that Plaintiffs request generally appear to be reasonable, despite being well above the average fee and costs award in data breach litigation.65

The computer forensic and damages experts' fees were high—$252,930.29. At the hearing, Plaintiffs' counsel attempted to justify the high damage expert expense as related to consumer polling regarding how important customers rated transaction security. This expert expense only marginally assisted settlement. The Court reduces these damage expert expenses by $75,000.

The Court, however, will not award the $27,156.77 in computerized research expenses (categorized as "Pacer" and "Research"). Class Counsel does not contend that passing on computerized legal research charges to the client is standard practice in its local legal community.66 The Court therefore awards $209,536.76 in costs and expenses.

IT IS SO ORDERED.