MEMORANDUM

GENE E.K. PRATTER, District Judge.

In this putative class action, Accolade, Inc. allegedly released the plaintiffs' personal identifying information in a company-wide data breach. Early in the life of this litigation, the parties reached a settlement agreement. They now request preliminary approval of the proposed class settlement. The Court grants the motion for preliminary approval because it is within the range of possible approval, the requirements of conditional class certification are met, and the notice plan is reasonably designed to notify class members of the settlement agreement.

BACKGROUND

In January 2017, Accolade, Inc. was the target of a "phishing" scheme."1 A cybercriminal requested the W-2s for current and former U.S.-based Accolade employees from an Accolade employee who then sent the unencrypted files via email. The W-2s included personally identifying information (PII) such as employees' names, addresses, Social Security Numbers, salaries, and taxes withheld for 2016. Tashica Fulton-Green and Daniel Crevak's PII was included in the breach. They filed suit against Accolade on behalf of themselves and all others similarly situated alleging negligence, negligence per se, breach of implied contract, and breach of fiduciary duty.

The parties entered into a settlement agreement following negotiations and a private mediation overseen by Rodney A. Max of Upchurch Watson White & Max. The parties agreed to settle this action, pursuant to the terms of their settlement agreement, and subject to the approval and determination of the Court as to the fairness, reasonableness, and adequacy of the settlement. Final approval of the settlement will result in dismissal of this action with prejudice.

LEGAL STANDARD

The preliminary approval determination for settlement of litigation such as this requires the Court to consider whether "(1) the negotiations occurred at arm's length; (2) there was sufficient discovery; (3) the proponents of the settlement are experienced in similar litigation; and (4) only a small fraction of the class objected." In re Linerboard Antitrust Litig., 292 F.Supp.2d 631, 638 (E.D. Pa. 2003) (citing In re General Motors Corp. Pick-Up Truck Fuel Tank Products Liability Litig., 55 F.3d 768, 785-86 (3d Cir. 1995)); see also In re Cendant Corp. Litig., 264 F.3d 201, 233 n.18 (3d Cir. 2001). If, after consideration of those factors, a court concludes that the settlement should be preliminarily approved, ". . . an initial presumption of fairness . . ." is established. In re Linerboard, 292 F.Supp.2d at 638 (citing In re Gen. Motors Corp., 55 F.3d at 785).

In addition, where, as here, the Court has not already certified a class, the Court must also determine whether the proposed settlement class satisfies the requirements of Rule 23. Amchem v. Windsor, 521 U.S. 591, 620 (1997). At the preliminary approval stage, the Court may conditionally certify the class for purposes of providing notice. Manual for Complex Litigation, § 21.632 (4th ed. 2004) (hereinafter "MCL 4th") ("The judge should make a preliminary determination that the proposed class satisfies the criteria set out in Rule 23(a) and at least one of the subsections of Rule 23(b)."). Accordingly, at this stage, the Court must determine whether the proposed class should be conditionally certified, leaving the final certification decision for the subsequent fairness hearing.

Rule 23(a) requires that the parties moving for class certification demonstrate the following:

Fed. R. Civ. P. 23(a). Even if the requirements of Rule 23(a) are met, the parties must also show that the action can be maintained under at least one of the subsections of Rule 23(b).

DISCUSSION

For the reasons outlined in this Memorandum, the Court concludes that an initial presumption of fairness has been established in this case and the parties' settlement should be preliminarily approved.

I. Proposed Class

The proposed settlement class will consist of:

Under the proposed settlement, all class members are entitled to enroll in identity theft protection for 24 months through Experian's ProtectMyID service. Class members who have already enrolled in the program will be instructed on how to enroll for an additional 24 months. Class members will also be entitled to seek reimbursement for four claim categories (A-D), with an overall cap of $1500 paid to each class member. However, participants must have spent at least one full hour dealing with the theft of their PII before they can claim any lost time. The treatment of each claim category is set out as follows:

Claim Category A: Class members who had a false tax return filed after January 16, 2017 are eligible for a basic payment of $75. They must provide proof of the false tax return, attest that they have no knowledge of a false return being filed in the previous three years, submit a self-verifying statement for time spent dealing with the effects of the breach, and submit documentation of recovery. Accolade will reimburse claimants at $25 per hour spent dealing with the effects of a false tax return. There is a maximum recovery of $275 per claimant for claims made pursuant to Claim Category A.

Claim Category B: Class members who had an IRS tax transcript requested using their PII after January 16, 2017 and submitted an identity theft affidavit to the IRS are eligible for payment of $75. They must provide proof of the issuance of a tax transcript by the IRS and submission of an identity theft affidavit, attest that they have no knowledge of an IRS transcript being fraudulently requested using their PII in the previous three years, and submit a self-verifying statement for time spent dealing with the effects of the breach. Accolade will reimburse Category B claimants at $25 per hour spent dealing with the effects of having their IRS tax transcript requested using their PII. There is a maximum per claimant recovery of $125 for claims made pursuant to Claim Category B.

Claim Category C: Class members who experienced incidents of identity theft or financial fraud (other than those covered by Categories A and B) after January 16, 2017 are eligible for payment of $75. This includes the opening of new bank accounts, credit applications, FAFSA applications, etc. It does not include fraud on existing credit cards. These Category C class members must provide proof of fraudulent activity or details of such activity and why proof does not exist, attest that they have no knowledge of identity theft (other than fraudulent credit card activity) filed in the previous three years, and submit a self-verifying statement for time spent dealing with the effects of the breach. Accolade will reimburse claimants at $25 per hour spent dealing with the effects of identity theft. There is a maximum per claimant recovery of $275 for claims made pursuant to Claim Category C.

Claim Category D: Class members who claim they suffered out of pocket expenses (other than those covered in categories A, B, or C) as a result of the data disclosure are entitled to reimbursement of such amount. They must submit reasonable documentation supporting their claim for expenses, proof of fraudulent activity or details of such activity or why proof does not exist, include a detailed explanation of the activities related to the data disclosure that the claimant spent time on, and submit a self-verifying statement for time spent dealing with the effects of the breach. Accolade will reimburse claimants at $25 per hour spent for up to 3 hours for claims made pursuant to Claim Category D. Claimants are not entitled to reimbursement of expenses that have already been reimbursed through Experian or any other source.

The settlement agreement also provides for injunctive relief which includes undertaking and maintaining the following cybersecurity measures for two years: cybersecurity awareness and training program, training employees on new policies for handling PII, implementing and operating systems to help detect and filter phishing attempts, restricting access to tax and payroll information, random testing of policies, and access control review.

I. Range of Reasonableness

At this preliminary stage, there is little disputing that the proposed settlement easily passes the reasonableness test. The parties assure the Court that the settlement was reached as a result of arm's length negotiations with an experienced mediator. The mediator, who will also serve as claims referee, has experience in that capacity as well. Based on the information provided and critically considered by the Court, proposed Class Counsel are experienced in litigating and resolving data breach class actions such as this. Even though formal discovery has not started, reflecting a rational appreciation of the immediately verifiable matters giving rise to this claim, the parties exchanged a substantial amount of information regarding the discrete issues in this case. There are no objectors as of yet. Costs associated with notice and claims administration will be separate from the monies made available to pay claims. Although the Court notes that the Class Representatives are expected to receive a service award, the parties state that the award is nominal and will also be separate from the monies made available to pay claims. The Court finds nothing to indicate that the Class Representatives have interests antagonistic to the rest of the class members. Finally, the settlement agreement appears to deal with the major issues central to this case: protecting class members whose PII was released in the data breach, reimbursing them for the time and expense spent dealing with the effects of the data breach, and putting systems in place at Accolade to prevent a similar breach in the future.

II. Rule 23(a) Factors

The Court also has reviewed the Rule 23(a) factors: numerosity, commonality, typicality and adequacy of representation.

A. Numerosity

Under Federal Rule of Civil Procedure 23(a), the first factor to consider in certifying a class is whether "the class is so numerous that joinder of all members is impracticable." The proposed class in this case includes 973 people, easily meeting the numerosity requirement. Stewart v. Abraham, 275 F.3d 220, 227-28 (3d Cir. 2001) ("No minimum number of plaintiffs is required to maintain a suit as a class action, but generally if the named plaintiff demonstrates that the potential number of plaintiffs exceeds 40, the first prong of Rule 23(a) has been met."). This factor is met, particularly for the limited purpose of conditionally certifying a class.

B. Commonality

Under Federal Rule of Civil Procedure 23(a), the second factor to consider in certifying a class is whether "there are questions of law or fact common to the class." Here, the proposed class members all suffered from the same data breach. There are common questions as to how the data breach occurred, whether Accolade had a duty to protect PII, and whether the employees were harmed by the breach. Thus, this factor is satisfied for purposes of conditional certification.

C. Typicality

The third 23(a) factor is typicality, i.e., whether "the claims or defenses of the representative parties are typical of the claims or defenses of the class." Accolade released the W-2s for Ms. Fulton-Green and Mr. Crevak in the same data breach as that of all the other class members. Their claims are not only similar to those of other class members but are virtually identical. Ms. Fulton-Green and Mr. Crevak each seek to hold Accolade liable for damages related to the breach and share common questions of law and fact with all other class members. Thus, their claims are typical of the class delineated for the proposed settlement.

D. Adequacy of Representation

The final Rule 23(a) factor focuses on adequacy — whether "the representative parties will fairly and adequately protect the interests of the class." Fed. R. Civ. P. 23(a)(4). The rule "tests the qualifications of class counsel and the class representatives. It also aims to root out conflicts of interest within the class to ensure that all class members are fairly and adequately represented in negotiations." In re Nat'l Football League Players Concussion Injury Litig., 821 F.2d 410, 428 (3d Cir. 2016). There are no discernable conflicts between named class representatives and other potential class members. Class Counsel are well experienced and qualified, as previously mentioned. Therefore, this final factor weighs in favor of conditionally certifying a settlement class.

III. Rule 23(b)(3) Factors

Under Fed. R. Civ. P. 23(b)(3), a class action may be maintained if common questions of law or fact predominate questions affecting only individuals and a class action is "superior to other available methods for fairly and efficiently adjudicating the controversy." In making this determination, courts should consider: "(A) the class members' interests in individually controlling the prosecution or defense of separate actions; (B) the extent and nature of any litigation concerning the controversy already begun by or against class members; (C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and (D) the likely difficulties in managing a class action." Fed. R. Civ. P. 23(b)(3).

In this case, all of the claims are almost identical because they arise from the same underlying activity and the damages should be easily provable and quantifiable. Furthermore, the value of the individual claims may be modest and thus impractical to litigate on a case by case basis. This is particularly true for people like Ms. Fulton-Green who have not suffered identity theft but have had to spend time notifying institutions and signing up for identity theft protection programs.

IV. Proposed Notice

Under Rule 23(e), the Court's final duty in preliminarily approving a settlement is to ensure that potential class members receive appropriate notice of the proposed settlement. Here, the proposed notice program is sufficient. The parties propose to hire Epiq Systems as Settlement Administrator. Notice will be provided by direct notice and notice on the settlement website. Accolade will provide Epiq Systems with the names and addresses of the settlement class members within seven (7) days of the entry of this preliminary order. Epiq Systems will secure updated addresses via the National Change of Address database and will mail directly the Class Notice and a claim form to all class members within 30 days of the entry of this preliminary order. If a forwarding address is provided for an undeliverable notice, Epiq Systems will re-mail the notice to that address.

There will also be a settlement website up and running within 30 days of the entry of the preliminary approval order. It will include the complaint, short form notice, long form notice, claim form, settlement agreement, and other relevant settlement and Court documents. The settlement website will be maintained until 30 days after the claims deadline has passed.

The notice itself explains the settlement in plain language with helpful charts and FAQs. Thus, the Court finds that the proposed notice program offers the best practicable notice to class members under the circumstances.

CONCLUSION

For the foregoing reasons, the Court will grant the Motion for Preliminary Settlement Approval in this matter. An appropriate Order, with attendant time requisites, follows.