IN RE ZAPPOS SECURITY BREACH LITIGATION

ORDER

VALERIE P. COOKE, Magistrate Judge.

At the April 21, 2014, case management conference, the court directed plaintiffs and defendant Zappos.com, Inc. ("Zappos") to submit a proposed letter to be sent to customers who previously complained about the January 2012, cyber-attack that Zappos suffered (the "incident") (#170). The parties jointly submitted a supplemental case management report in response (#171), and this order follows.

The parties agree on to the following protocol:

However, the parties dispute whether the third and final notice to this group of customers should once again be sent by email or regular mail.

Plaintiffs wish to contact by regular mail those Zappos customers who have already complained about the incident. Plaintiffs complain that Zappos has redacted customer contact information in discovery that goes to the heart of this case, and this information will allow witnesses the opportunity to share their stories with plaintiffs' counsel. However, plaintiffs' counsel acknowledges that because of the data breach in this case, customers may be sensitive to having any information disclosed, which is why plaintiffs agreed to the two-email protocol to ask the targeted group of customers whether they wish to share their contact information. Plaintiffs' concern is that witnesses who have not responded to the first two emails may either be ignoring Zappos, or they are no longer using the email address Zappos has on file. Therefore, it makes sense to send the final communication by regular mail.

Zappos' view is that in having all notices sent by email, those customers who wish to contact plaintiffs' counsel may do so without disclosing additional contact information. Zappos argues that plaintiffs have shown no compelling reason to contact the customers, which plaintiffs' counsel characterized as "witnesses" at the April 2014, hearing, and the court should insure the customers affirmatively consent to contact before such contact is allowed. Since Zappos is an online retailer, its customers are more accustomed to receiving electronic communications from Zappos, as opposed to traditional mail, and it is more likely they will respond to email communications.

Before class certification occurs under Rule 23, discovery is within the discretion of the court. Vinole v. Countrywide Home Loans, Inc., 571 F.3d 935, 942 (9th Cir. 2009). It is the plaintiff's burden either to make a prima facie showing that Rule 23's class action requirements are satisfied, or to show that "discovery is likely to produce substantiation of the class allegations." Manolete v. Bolger, 767 F.2d 1416, 1424 (9th Cir. 1985). The court must decide whether the action may be maintained as a class action as soon as practicable after the action is filed. Fed.R.Civ.P. 23(c)(1). This means that discovery may be proper where it will resolve factual issues required to decide whether the action should be maintained as a class action. Kamm v. California City Development Co., 509 F.2d 205, 210 (9th Cir. 1975). "To deny discovery where it is necessary to determine the existence of a class or set of subclasses would be an abuse of discretion." McArdle v. AT&T Mobility LLC, 2010 WL 1532334 at *2 (N.D.Cal. 2010) (citations omitted). The court may permit the disclosure of names, address, and telephone numbers in the pre-certification class action context. Id. at *2, citing Sanbrook v. Office Depot, 2009 WL 840019 at *1 (N.D.Cal. 2009); Salazar v. Avis Budget Group, Inc., 2007 WL 2990281, *1 (S.D.Cal. 2007). However, the court must balance the right of privacy against the plaintiff's need for the discovery. See, e.g., Pioneer Electronics v. Superior Court, 40 Cal.4th 360, 372 (2007).

In this case, the parties agree that potentially aggrieved customers shall be contacted twice by email because Zappos is an online company, and it is likely that customers routinely communicate by email. The email notices will also safeguard their privacy rights. However, as to the third and final communication, the court agrees that it should be sent by regular mail for three reasons. First, since there was a data breach, Zappos customers may have changed their email addresses to safeguard their security. Second, given the data breach, the group of customers being contacted may ignore or delete emails sent by Zappos. Third, it is reasonable that the third and final communication be sent by regular mail to insure notice is given to those whose email addresses have changed or to customers do not wish to communicate with Zappos. It seems likely they would open a letter sent to their homes.

Based upon the foregoing, the court orders as follows:

1. The third and final communication to this limited group of Zappos' customers be sent by regular mail, and the parties shall revise Exhibit 2 to the supplemental case management report (#171) accordingly.

IT IS SO ORDERED.