IN RE: CANON U.S.A. DATA BREACH LITIGATON (2023)

ORDER GRANTING PLAINTIFFS’ MOTION FOR PRELIMINARY APPROVAL OF CLASS SETTLEMENT

Before the Court is Plaintiffs’ Unopposed Motion for Preliminary Approval of Class Action Settlement, (Mot. for Settlement dated July 7, 2023 (the “Motion”), Dkt. No. 62), the terms of which are set forth in an amended settlement agreement and accompanying exhibits.² (Am. Settlement Agreement dated June 29, 2021 (“Amended Settlement Agreement”), attached as Ex. 1 to Mem. of Law in Supp. of Pls.’ Mot. (“Mem. of Law”), Dkt. No. 61).³

I. Procedural History and Standard for Approval

1. Plaintiffs (the “Plaintiffs” or “Named Plaintiffs”) allege that Canon U.S.A., Inc., Canon Solutions America, Inc., Canon Software America, Inc., Canon Information and Imaging Solutions, Inc., Canon Financial Services, Inc., Canon Medical Components U.S.A., Inc., Canon Information Technology Services, Inc., and NT-ware USA, Inc. (collectively, the “Defendants” or “Canon”) failed to properly secure and safeguard Plaintiffs’ personally identifiable information, including names, Social Security numbers, driver's license numbers or government-issued identification numbers, financial account numbers provided for direct deposit, electronic signatures, and dates of birth. (See generally Consolidated Am. Class Action Compl. dated Aug. 2, 2021, Dkt. No. 30). Plaintiffs were employees of Canon, (id. ¶ 1), and their information was allegedly compromised during intrusions into Canon's network that took place between July 20, 2020, and August 6, 2020. (Id. ¶ 4).

2. Plaintiffs allege that, following the disclosure and release of their personal information, Defendants failed to provide timely, accurate, and adequate notice to Plaintiffs and class members that their personally identifiable information had been lost or identify what types of information were compromised and in the possession of unknown third parties. (Id. ¶ 1). Plaintiffs assert common-law claims of negligence, breach of implied contract, third-party beneficiary, invasion of privacy, and breach of confidence, as well as violations of state statutory unfair competition laws. (See id. Counts I–V; id. Counts VI–XI (asserting claims under the unfair business practices laws in New York, Ohio, California, and Florida, as well as California's Consumer Privacy Act)).

3. The parties’ proposed settlement resolves all claims in the above-captioned actions.

4. The Court held a preliminary approval hearing on March 23, 2023. The Court discussed revisions that were needed to the first settlement agreement. (First Mot. for Settlement dated Feb. 2, 2023, Dkt. No. 54-1).

5. The parties made certain revisions to the first settlement agreement, which was re-executed and re-submitted to the Court on July 7, 2023, reflecting the edits discussed with the Court at the March 23, 2023 hearing and the June 7, 2023 status conference. (See generally Amended Settlement Agreement).

6. The Court has reviewed the submissions made by counsel in connection with the proposed settlement, which include a memorandum of law and declarations. (Dkt. Nos. 61–64). Plaintiffs’ counsel has provided detailed information regarding the discovery completed to date, the formal and informal negotiations that led to the finalized settlement, (see generally Mem. of Law), the Amended Settlement Agreement, (see generally Amended Settlement Agreement), and the mechanisms for class members to participate in the settlement, to exclude themselves from the settlement, or to object to the terms of the settlement. (See generally Decl. of Cameron R. Azari, Esq. (“Azari Decl.”), Dkt. No. 63).

7. The putative class action members (the “Class Members”) are all individuals residing in the United States who received a notice dated November 24, 2020 (the “Notice of Data Breach”) from Canon regarding the data breach (the “Data Incident”). (Amended Settlement Agreement ¶ 1.26). The “Settlement Class” specifically excludes: (i) Canon (including all Defendants) and its officers and directors; (ii) all Settlement Class Members who timely and validly request exclusion from the Settlement Class; (iii) the Judge assigned to evaluate the fairness of this settlement and members of his or her immediate family; and (iv) the attorneys representing the parties in the litigation. (Id.).

8. Court approval of a proposed class action settlement is governed by Fed. R. Civ. P. 23(e). “Under Rule 23(e), a court first grants preliminary approval of a class settlement. If preliminary approval is granted, plaintiffs are permitted to disseminate notice of a hearing to the class members where class members and settling parties are provided an opportunity to be heard on the question of final court approval. Under Rule 23(e)(1)(B), preliminary approval is warranted when the parties have shown that a court will likely be able to: ‘(i) approve the proposal under Rule 23(e)(2); and (ii) certify the class for purposes of judgment on the proposal.’ ” Hernandez v. Between the Bread 55th Inc., 496 F. Supp. 3d 791, 798 (S.D.N.Y. 2020) (citation omitted) (quoting Fed. R. Civ. P. 23(e)(1)(B)).

9. The Settlement Class meets all requirements for class certification under Fed. R. Civ. P. 23(a) and 23(b)(3). There are over 40,000 potential class members; thus, joinder is impracticable. Fed. R. Civ. P. 23(a)(1); (Azari Decl. ¶ 21). Class Members share common issues of fact and law, including whether Canon breached a duty to protect Class Members’ data. Fed. R. Civ. P. 23(a)(2); (Mem. of Law at 24–25). Named Plaintiffs’ claims for negligence are typical of the claims of the Class Members. Fed. R. Civ. P. 23(a)(3); (Mem. of Law at 25–26). There is nothing to suggest that the Named Plaintiffs will not fairly and adequately protect the interests of the class. Fed. R. Civ. P. 23(a)(4).

10. Plaintiffs also satisfy Rule 23(b)(3). Common factual allegations and common legal theory predominate over any issues affecting only individual employees. The central common questions in this case are whether Canon had a duty to the Plaintiffs and whether Canon breached that duty. (Mem. of Law at 28). It is likely that these questions—which are dependent almost solely on Canon's action or inaction in connection with the Data Incident—may be answered with “generalized proof” for the entire Settlement Class. (See id.) Furthermore, class adjudication of this case is superior to individual adjudication because it will conserve judicial resources and is more efficient for class members, particularly those who lack the resources to bring their claims individually. The large number of class members, the uncertainty of each Plaintiff's damages, and the disbursement of litigation costs across the entire class all weigh in favor of certifying a class in this case. (Id. at 29).

11. “[T]he granting of [preliminary approval] is not tantamount to a finding that the settlement is fair and reasonable. It is at most a determination that there is what might be termed ‘probable cause’ to submit the proposal to class members and hold a full-scale hearing as to its fairness.” Lora v. To-Rise, LLC, 452 F. Supp. 3d 5, 7 (E.D.N.Y. 2019) (alterations in original) (quoting In re Traffic Exec. Ass'n-E. R.Rs., 627 F.2d 631, 634 (2d Cir. 1980)). This concept is embodied in Rule 23, which directs the Court to determine whether to disseminate notice of a class action settlement. Fed. R. Civ. P. 23(e)(1)(A) (“The parties must provide the court with information sufficient to enable it to determine whether to give notice of the proposal to the class.”). And the court “must direct notice ․ if giving notice is justified by the parties’ showing that the court will likely be able to: (i) approve the proposal under Rule 23(e)(2); and (ii) certify the class for purposes of judgment on the proposal.” Id. r. 23(e)(1)(B); see also Geiss v. Weinstein Co. Holdings LLC, 474 F. Supp. 3d 628, 633 (S.D.N.Y. 2020) (quoting Fed. R. Civ. P. 23(e)(1)(B)). The Court preliminarily approves the Amended Settlement Agreement. The Court certifies the following class pursuant to Rule 23(e), for settlement purposes (the “Settlement Class”): all individuals residing in the United States who received the Notice of Data Breach from Canon regarding the Data Incident dated November 24, 2020. (Amended Settlement Agreement ¶ 1.26).

12. The Court appoints John Yanchunis, Esq. of Morgan & Morgan Complex Litigation Group and Gary M. Klinger of Milberg Coleman Bryson Phillips Grossman LLC as Lead Class Counsel; they meet all of the requirements of Fed. R. Civ. P. 23(g). Co-Lead Class Counsel identified, investigated, and prosecuted the claims and negotiated the proposed settlement. See Damassia v. Duane Reade, Inc., 250 F.R.D. 152, 165 (S.D.N.Y. 2008) (explaining that Rule 23(g) requires the court to consider “the work counsel has done in identifying or investigating potential claims in the action, ․ counsel's experience in handling class actions, other complex litigation, and claims of the type asserted in the action, ․ counsel's knowledge of the applicable law, and ․ the resources counsel will commit to representing the class.” (quotations omitted)). The Court also appoints Lori Feldman of George Gesten McDonald, PLLC as additional Class Counsel. The Court finds that Plaintiffs Michael Finnigan, Kenneth Buchbinder, Brian McCartney, Tyrone Villacis, Luis Pichardo, Andrew Hamid, Amy Lynn Hamid, Woodrow Moss, and Diana Rouse satisfy the requirements of Rule 23(e)(2)(A) and should be appointed as Settlement Class Representatives.

13. Rule 23(e)(2) provides that the Court may only approve a class settlement upon “finding that it is fair, reasonable, and adequate.” Moses v. N.Y. Times Co., 79 F.4th 235, 242 (2d Cir. 2023) (quoting Fed. R. Civ. P. 23(e)(2)). That determination must be made by the Court's evaluation of four “primary procedural considerations and substantive qualities” that “always matter” in determining “whether to approve a settlement proposal.” Id. (alteration omitted) (quoting Fed. R. Civ. P. 23 advisory committee's note to 2018 amendment). Those four considerations are whether: “(A) the class representatives and class counsel have adequately represented the class; (B) the proposal was negotiated at arm's length; (C) the relief provided for the class is adequate ․ [and] (D) the proposal treats class members equitably relative to each other.” Fed. R. Civ. P. 23(e)(2). The first two factors—all of which must be considered “holistically”—are “procedural in nature,” while “the latter two guide the substantive review of a proposed settlement.” Moses, 79 F.4th at 242–43.⁴

14. That is, there are “two core factors” that must be considered in evaluating the “substantive fairness of a settlement: the adequacy of relief provided to a class and the equitable treatment of class members.” Id. at 244. But those factors cannot be evaluated without consideration of proposed attorney's fees and incentive awards. Id. at 244 (“[T]he district court is required to review both the terms of the settlement and any fee award encompassed in a settlement agreement in tandem” (emphasis added) (quotations omitted)).

15. In response to the Court's Order dated September 11, 2023, counsel for both parties submitted supplemental briefs on the applicability of Moses v. New York Times Co., 79 F.4th 235 (2d Cir. 2023), to the present settlement. (Joint Mem. of Law in Resp. to Ct.’s Order dated Sept. 25, 2023 (“Joint Mem.”), Dkt. No. 65).

16. With respect to the proposed settlement here, the relief provided to Class Members is as follows: the parties have agreed to an Ordinary Expense Reimbursement of up to Three Hundred Dollars ($300.00) per Class Member. (Amended Settlement Agreement ¶ 2.1). Ordinary Expenses are those costs incurred by Class Members between August 4, 2020 and the date of the Amended Settlement Agreement that were plausibly caused by the Data Incident. These costs must fall into at least one of ten enumerated categories in the Amended Settlement Agreement. (Id.).⁵ Class Members are also eligible to receive an Extraordinary Expense Reimbursement of up to Seven Thousand and Five Hundred Dollars ($7,500). (Id. ¶ 2.2). Extraordinary Expenses are out-of-pocket losses that were (1) documented and unreimbursed, (2) caused by the Data Incident, (3) incurred between August 4, 2020 and the date of the Amended Settlement Agreement, (4) not covered as Ordinary Expenses, and (5) incurred despite the claimant's reasonable efforts to avoid those costs. (Id.). Each Class Member is also eligible for two years of credit monitoring services. (Id. ¶ 2.3). In the original Notice of Data Breach, Canon provided for one year of credit monitoring services to alleviate any identity theft that may have resulted from the Data Incident. (Id. ¶ 2). Under the Settlement Agreement, Class Members are eligible for two additional years if they participate in the settlement. (Amended Settlement Agreement ¶ 2.3).

17. The parties contend this relief is substantial because those who sustained damages will be able to recover some monetary compensation for those damages, and even those who did not incur monetary damages will be eligible for two free years of credit monitoring. (Mem. of Law at 21; see Tr. dated Mar. 23, 2023, Dkt. No. 57 at 29:17–30:13). To buttress this argument, the parties cite to a number of other data-breach settlements that have been reached and approved by courts throughout the country. (See Mem. of Law at 21–23; see also id. at 29 n.4). The Court agrees that the relief is within the range of resolutions that can be considered fair and reasonable to Class Members: individuals who suffered minimal harm receive minimal compensation, while those suffering greater harm from the data breach receive greater, if not complete, compensation. And all Class Members are entitled to some relief for the breach, in the form of two free years of credit monitoring services, paid for by Canon.⁶

18. Unlike in Moses, an award of attorney's fees would not affect the Class Members’ recovery. The parties have agreed that any award of attorney's fees will be determined by the Court, and the Defendants will pay any such award separate and apart, and in addition to the amounts paid to Class Members. (Joint Mem. at 3–4; Amended Settlement Agreement ¶¶ 7.2–7.3, 7.5); see Moses, 79 F.4th at 252 n.7 (discussing Blessing v. Sirius XM Radio Inc., 507 F. App'x 1, 5 (2d Cir. 2012)).

19. As to the incentive awards, the nine class representatives would receive an incentive award of $1,000 each. Moses and Rule 23 permit the distribution of “fair and appropriate” incentive awards. 79 F.4th at 254. Citing to pre-Moses case law, the parties suggest that incentive awards at this stage must only fall within the range of reasonableness. (Joint Mem. at 7–8). But simply finding other cases where identical awards have been granted, and analyzing them in a vacuum, fails to take into account the recovery of an average class member as compared to that of a class representative receiving an incentive award. Such comparison is necessary to determine whether an incentive award is so disproportionate to the recovery of an average class member, such that the incentive award recipient—notwithstanding any additional contributions to the litigation outcome—is being compensated inequitably. Here, the Court cannot at this stage conclude that the incentive award treats class members inequitably. The total value of the incentive awards is $9,000.⁷ A Class Member is entitled to receive potentially up to $7,500 (along with the value of credit monitoring services), which may lead to some Class Members receiving more than the representatives obtaining incentive awards. For those Class Members who are only entitled to an Ordinary Expense Reimbursement, their recovery maxes out at $300 (plus the value of credit monitoring services), while Class Members who suffered no identifiable or demonstrable financial harm are entitled to the additional credit monitoring services. Though obviously greater in amount, an incentive award of $1,000 in these circumstances—and at this stage, (supra at n.7)—is not so obviously disproportionate to the recovery obtained by such Class Members, to find that Class Members are being treated inequitably to representative plaintiffs. However, additional proof at the final approval stage will be required to justify any incentive award. E.g., Hyland v. Navient Corp., 48 F.4th 110, 124 (2d Cir. 2022) (upholding the district court's approval of a $15,000 service award based on declarations of named plaintiffs identifying work done on behalf of class).

II. The Proposed Notice

1. Counsel has provided a proposed long form and short form Notice of Proposed Class Settlement (the “Proposed Notice”), which likewise provides Class Members with detailed information regarding the settlement procedure, the estimated allocation from the settlement, and the manner by which they can choose to participate or exclude themselves from the settlement. (See Revised Long Form Notice, attached as Ex. A to Amended Settlement Agreement; Revised Short Form Notice, attached as Ex. B to Amended Settlement Agreement).⁸

12. A notice must provide “the best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort.” Fed. R. Civ. P. 23(c)(2)(B). “The notice must clearly and concisely state in plain, easily understood language: (i) the nature of the action; (ii) the definition of the class certified; (iii) the class claims, issues, or defenses; (iv) that a class member may enter an appearance through an attorney if the member so desires; (v) that the court will exclude from the class any member who requests exclusion; (vi) the time and manner for requesting exclusion; and (vii) the binding effect of a class judgment on members under Rule 23(c)(3).” Id.

13. The Proposed Notices, attached as Exhibits A and B to the Amended Settlement Agreement, satisfy each of these requirements and adequately give Class Members notice of the proposed settlement. The Proposed Notices describe the terms of the settlement, inform the class about the allocation of attorney's fees, and provide specific information regarding the date, time, and place of the final approval hearing. The Proposed Notices detail how, to opt into the settlement, class members must submit a claim form via the settlement website or mail. They also inform individuals of their right to exclude themselves from the class and bring their own lawsuit against Defendants. Class members must mail a written notice clearly stating their intent to opt out of the settlement to be excluded. The Proposed Notices also make clear that class members have the right to object to the terms of the settlement and explain how they may have their concerns heard at the Court's final fairness hearing. Class members must mail a written notice of their objection and include (1) their contact information; (2) proof of their class-member status; (3) their grounds of objection; (4) the identity of any counsel representing them; (5) whether they will be appearing at the final fairness hearing; and (6) their signature or their counsel's signature. The Proposed Notice Plan set forth in the Amended Settlement Agreement and the Declaration of Cameron R. Azari, and the Notices and Claim Form attached to the Amended Settlement Agreement as Exhibits A–C, are hereby approved. Before distribution, the Proposed Notices must include any relevant changes warranted by this Order.

14. The Court appoints Epiq Class Action and Claims Solutions, Inc. as the Claims Administrator, with responsibility for class notice and claims administration. The Claims Administrator is directed to perform all tasks the Amended Settlement Agreement requires and is directed to carry out the Notice in conformance with the Amended Settlement Agreement. The Claims Administrator's fees will be paid by Canon pursuant to the terms of the Amended Settlement Agreement.

15. An in-person Final Approval Hearing shall be held on April 25, 2024, at 2:30 P.M. at 225 Cadman Plaza East, Brooklyn, NY 11201, to determine, among other things, whether: (a) this Litigation should be finally certified as a class action for settlement purposes pursuant to Fed. R. Civ. P. 23(a) and 23(b)(3); (b) the Amended Settlement Agreement should be approved as fair, reasonable, and adequate, and finally approved pursuant to Fed. R. Civ. P. 23(e); (c) this Litigation should be dismissed with prejudice pursuant to the terms of the Amended Settlement Agreement; (d) Settlement Class Members should be bound by the releases set forth in the Amended Settlement Agreement; (e) the application of Settlement Class Counsel for an award of Attorney's Fees, Costs, and Expenses should be approved pursuant to Fed. R. Civ. P. 23(h); and (f) the application of the Named Plaintiffs for a Service Award should be approved.

16. The Court adopts the following timeline to govern the settlement process in this case:

Tabular or graphical material not displayable at this time.

SO ORDERED.

FOOTNOTES

2.   Unless otherwise stated, all citations are to the docket sheet in the lead case, Finnigan et al v. Canon U.S.A., Inc., Dkt. 20-CV-6239.

3.   All defined terms herein have the same meaning as set forth in the Amended Settlement Agreement.

4.   Courts in the Second Circuit may no longer apply a presumption of fairness to proposed settlements that arise from arm's-length negotiations. Moses, 79 F.4th at 243. Although the parties present evidence of arm's-length negotiations in their motion for preliminary approval, (see Mem. of Law at 15), the Court does not therefore presume that the settlement is fair, but rather reviews the negotiation history and dynamics holistically and in light of the Rule 23(e)(2) factors.

5.   The ten categories are as follows: “(i) [C]ost to obtain credit reports; (ii) fees relating to a credit freeze; (iii) card replacement fees; (iv) late fees; (v) overlimit fees; (vi) interest on payday loans taken as a result of the Data Incident; (vii) other bank or credit card fees; (viii) postage, mileage, and other incidental expenses resulting from lack of access to an existing account; (ix) costs associated with credit monitoring or identity theft insurance purchased prior to the Effective Date of the Settlement, if purchased primarily as a result of the Data Incident; and (x) compensation for attested-to lost time spent monitoring accounts, reversing fraudulent charges, or otherwise dealing with the aftermath/cleanup of the Data Incident, at a rate of $20 for up to four (4) hours.” (Amended Settlement Agreement ¶ 2.1).

6.   Moses involved the appeal of a class action settlement after its final approval by the district court. 79 F.4th at 241. But the parties are wrong to suggest as they do, (Joint Mem. at 5), that Moses and the evaluation of the Rule 23(e)(2) factors is irrelevant at the preliminary approval stage. Rule 23, as noted, provides that in granting preliminary approval, the Court must determine whether final approval under those factors is likely, see Fed. R. Civ. P. 23(e)(1), making Moses not tangential, but central to any preliminary approval.

7.   The parties fail to provide the Court with any information about the efforts made by the Named Plaintiffs that would entitle them to an incentive award, and state that they will provide that information in connection with the final approval process. (Joint Mem. at 8–9). That information should have been provided with the current submissions; the Court's approval of the incentive award is contingent on subsequent and adequate proof being provided to justify a recovery greater than that of an average class member.

8.   The initial draft of the Proposed Notice, which was submitted to the Court in connection with the first Motion for Preliminary Approval, (Dkt. No. 54-2), was revised in accordance with the Court's direction at the March 23, 2023 hearing and June 7, 2023 conference, and submitted to the Court via ECF on July 7, 2023. (Dkt. No. 61-1).

SANKET J. BULSARA United States Magistrate Judge