ADKINS v. FACEBOOK, INC.

FINAL SETTLEMENT APPROVAL AND ORDER GRANTING IN PART AND DENYING IN PART MOTION FOR ATTORNEY'S FEES

WILLIAM ALSUP, District Judge.

INTRODUCTION

Both sides seek final approval of a class action settlement and class counsel seek a large sum in fees and costs.

STATEMENT

A coding error allowed hackers to break into the Facebook platform and pilfer the personal information of millions of users in the United States. This came to light in 2018, leading to a flurry of complaints. A prior order explained the coding vulnerability responsible for the data breach (Dkt. 153). In brief, if three particular features on the Facebook platform aligned simultaneously, "access tokens" became visible. Similar to a password, access tokens permitted access to accounts. The compromising of access tokens made millions of users accounts vulnerable to entry (Dkt. 193).

A consolidated complaint sought relief in the form of a credit monitoring service for the victims, in addition to compensatory, statutory, and punitive damages, and declaratory relief based on ten claims. To this end, counsel moved to certify a class of users whose information had been compromised. An order declined to certify a damages class but allowed an injunctive relief class. Users were left to pursue damages claims on their own but no one ever filed one (Dkt. 338 at 4). All but two of plaintiffs' claims were dismissed and by the time the case settled, only one named class representative remained out of the 11 plaintiffs involved in the case after consolidation. The terms of the settlement included commitments by Facebook to prevent future vulnerabilities related specifically to access tokens and consent to be independently monitored.

More specifically, Facebook's security commitments include (Dkt. 315-5 at 27-29):

Class counsel also move for attorney's fees in the amount of $10,700,000 (based on a 1.253 multiplier), $1,210,900.75 in costs, a reserve of $15,000 for a data security vendor to monitor compliance with the settlement terms (by way of the SOC2 Type II assessments), and a $5,000 service award for plaintiff Stephen Adkins (Br. at 2-3).

ANAYLSIS

After the coding error in the Facebook platform exposed users to possible loss of personal information, at least ten civil actions were immediately filed in this district and consolidated. A previous order certified a class seeking injunctive relief but rejected certification of a damages class. A class settlement followed whereby Facebook agreed to maintain certain security fixes almost all of which Facebook would likely have maintained anyway. This order will approve the settlement as fair and adequate in light of the substantial risks of litigation. All damages claims have been preserved but none have been asserted anywhere by any of the millions potentially affected. This order will also grant reasonable attorney's fees and expenses for class counsel but not for other lawyers.

1. PROPOSED CLASS SETTLEMENT FINAL APPROVAL

Under FRCP 23(e), the Court must approve any settlement agreement that will bind absent class members. In reviewing a proposed settlement agreement, the district court must perform two tasks: (1) direct notice in a reasonable manner to all class members who would be bound by the proposal; and (2) approve the settlement only after a hearing and on finding that the terms of the agreement are fair, reasonable, and adequate. In determining if a settlement is fair, reasonable, and adequate, district courts take into account (1) the strength of the plaintiffs' case; (2) the risk, expense, complexity, and likely duration of further litigation; (3) the risk of maintaining class action status throughout the trial; (4) the amount offered in settlement; (5) the extent of discovery completed and the stage of the proceedings; (6) the experience and view of counsel; (7) the presence of a governmental participant; and (8) the reaction of the class members to the proposed settlement. In re Online DVD-Rental Antitrust Litig., 779 F.3d 934, 944 (9th Cir. 2015).

A prior order approved the form, content, and planned distribution of the class notice. The claims administrator has fulfilled the notice plan. This order further finds that notice to class members was adequate. For the following reasons and for the reasons stated in the November 2020 order (Dkt. 314), the proposed class settlement is fair, reasonable, and adequate under FRCP 23(e).

In considering the strength of plaintiff's case, this order notes that what Facebook did wrong was not an intentional betrayal of its users for profit. At most Facebook was negligent in allowing a confluence of rare circumstances to open up access tokens to strangers and, arguably, being too slow to catch this vulnerability. The heart of this case was a software coding mistake. Given the many millions of lines of codes, Facebook cannot entirely rid its complex system of all risk of software coding errors. So, the relief obtained herein will not eliminate all future breaches or leaks. Though Facebook reports in supplemental briefing that no further breaches related to access tokens have occurred since putting the settlement measures into place, other intrusions of one sort or another will eventually recur.

Class counsel characterize their success achieved by settlement as "momentous." In the Court's view the success of the settlement seems modest as best and cosmetic at worst. This will be discussed further in connection with the motion for attorney's fees.

The benefit obtained, however, meets the threshold of adequacy in light of the above explained context, as well as the expense to the parties' and the drain on resources that would result from continued litigation.

These proceedings have been ongoing for more than two years and extensive discovery has been taken, including 20 depositions. There has been a motion to dismiss which was granted in part and denied in part, but no dispositive motions. This makes settlement appropriate given the limited relief that could be awarded even if the case were litigated all the way through trial.

One individual responded to the notice of class settlement. The objector claims her personal information was compromised and led to identity theft and phone malfunction. Facebook submitted a declaration stating the class notice administrator, Angeion Group, LLC, searched data provided by Facebook and could not verify that the objector was a class member (Dkt. 327-2 at 2). Angeion was unable to contact the objector with the email and phone number provided in the objection (Dkt. 327-2 at 2). The objection raises no points that warrant denial of settlement because the objector remains free under the settlement to independently pursue any claim for damages.

2. ATTORNEY'S FEES AND COSTS

In the class settlement agreement, Facebook agreed to pay attorney's fees and costs awarded by the Court to "Class Counsel" (Dkt. 315-5 at § 7.4):

The agreement further defined "Class Counsel" as (Dkt. 315-5 at § 1.6):

This definition tracked the definition in the class certification order that had appointed these very lawyers, describing them as "class counsel" (Dkt. 260 at 16).

This order will, accordingly, award all reasonable attorney's fees, costs, and expenses to class counsel but will not do so for lawyers other than class counsel.

Although most of the work appears to have been done by class counsel, the application includes time and expenses for 17 law firms and over 100 timekeepers, including law firms that represented one or more early plaintiffs (all but one of whom eventually withdrew or were dismissed). None of these other firms were ever designated as class counsel.

Applicants, however, answer that the work of class counsel was farmed out to many of these other firms, and therefore seek to include them, albeit after the fact. At the recent hearing, Attorney de Bartolomeo stated (Tr.):

(Dkt. 348, Tr. at 35). Therefore, applicants say, Facebook should pay the committee members for their work.

This is not quite what the record shows.

Under Rule 23, there is a difference between "class counsel" versus "interim counsel." Class counsel refers to counsel appointed at the time of class certification by the district court to represent the certified class through discovery, pretrial, trial, and appeal and must, where there are more than one applicant, be the counsel "best able to represent the interests of the class." By contrast, "interim counsel" refers to counsel "to act on behalf of a putative class before determining whether to certify the action as a class action." Interim counsel are the exception and not the rule. (Class counsel are not only the rule but mandatory.) Interim counsel are usually helpful early on when a number of related actions are moving toward consolidation. Interim counsel can act as a coordinator for the jumble of cases. But once the cases are consolidated and class counsel expressly appointed, interim counsel disappear and there is no need for coordination.

During an early case management conference on January 12, 2019, counsel said they would move to be interim counsel to help coordinate the various cases. The Court replied:

In response, Attorney McNamara of Cohen Milstein stated, "That is helpful guidance, and we will abide by it" (Dkt. 71, at 114-15).

Three days later, on January 15, 2019, counsel filed their motion to appoint John Yanchunis of Morgan & Morgan, Ariana Tadler of Milberg Tadler Phillips Grossman LLP, and Andrew Friedman of Cohen Milstein Sellers & Toll, PLLC as "interim counsel" (Dkt. 72). At the end of the attachments to that motion, counsel included a table depicting a committee structure for delegating work across 17 law firms and a protocol for time and expense reporting (Dkt 72, Exhs. 5, 6). The protocol included the statement "before you expend any time in this litigation for which you may seek compensation, you must obtain written approval in advance from Co-Lead Counsel" (Dkt. 72, Exh. 6) (emphasis in original). The full section read (Dkt. 72, Exh. 6):

On February 14, the Court approved the proposed interim counsel (Dkt. 79). That order acknowledged that (Dkt. 79 at 4):

The order again "remind[ed] interim counsel that, as usual, duplicative or excessive requests for attorney's fees will be looked upon with disfavor" (Dkt. 79 at 4).

The committee structure made sense at the interim stage under Rule 23(g)(3) so as to allow more lawyers to have a shot at becoming class counsel and to give various contenders a role prior to selection of class counsel at the certification stage. All of the above occurred before any motion for class certification.

Many months later at the class certification stage, interim counsel moved to certify a damages class and argued for the adequacy of the existing interim counsel for the continued representation of the class (Dkt. 197-4). The motion for class certification simply stated, "Proposed class counsel, approved by this Court as interim counsel, are experienced class action attorneys and are committed to prosecuting this case," recited class counsel's work on the case up to that point, and concluded that "[p]laintiff and proposed Class Counsel meet the adequacy requirement" (Dkt. 197-4 at 14). No mention was made of any committee structure.

The Court's order certifying a class and appointing class counsel, unlike the interim order, did not approve or refer to any committee structure (Dkt. 260). That order stated (Dkt. 260 at 16):

This definition is the very definition used in the settlement agreement — three firms and three firms only. Attorney de Bartolomeo was incorrect, therefore, in suggesting that the applications for class counsel informed the Court that a committee would assist class counsel. Although the committee structure surfaced in the interim motion (and resulting order appointing interim counsel), no references were made to a committee in the later motion for appointment of class counsel (or in the resulting order appointing class counsel). Class counsel were specifically called out as the three firm in the order.

It was therefore improper for class counsel to delegate class representation after appointment. Any work farmed out to lawyers other than class counsel shall not be included in the lodestar.

Turning to the work of class counsel, our review even for work by class counsel raises questions concerning reasonableness of time spent and costs requested. For example:

These are but two examples. The special master shall scrutinize the entire lodestar of class counsel to reduce it to a reasonable amount.

The benefit obtained for the class is of foremost importance in determining the reasonableness of fees so "where the plaintiff has achieved only limited success, counting all hours expended on the litigation — even those reasonably spent — may produce an excessive amount, and the Supreme Court has instructed district courts to instead award only that amount of fees that is reasonable in relation to the results obtained." In re Bluetooth Headset Prod. Liab. Litig., 654 F.3d 935, 942 (9th Cir. 2011). Here, the settlement is really little more than what Facebook would have done anyway. In the preliminary settlement approval and in their supplemental briefing, both parties explained that Facebook voluntarily adopted most of the security measures upon the recommendation of a working group created in 2018. Though many of the security measures came about after the filing of complaints related to the breach, class counsel do not state that these measures arose specifically from settlement discussions. In fact, two of the settlement terms were practices Facebook had been using even before the breach occurred (undergoing annual security assessments and board oversight of cybersecurity) (Dkt. 334 at 5, Dkt. at 7). The only truly novel element of the settlement agreement is the involvement of the Court, class counsel, and an independent monitor in ensuring that Facebook maintains the security measures they would have implemented anyway.

Again, what Facebook did wrong was a coding mistake, not an attempt to sell users' private information. Most claims got dismissed. No damages class got certified. What survived for trial was a negligence claim and a claim for declaratory and injunctive relief. The settlement implicates limited aspects of Facebook's overall data security responsibilities — those related to access tokens — and provides neither monetary damages nor individualized credit monitoring for class members. In light of the thinness of the surviving claims and limited class certification obtained, the settlement itself is understandably thin as well but acceptable in view of the probable merits, but the benefit achieved in this case for the class is modest. Class counsel waxed poetic about the complexity, technicality, and novelty of the data security issues presented in this case, but note well the settlement calls for only pocket change to the monitor who will ensure that Facebook abides by the settlement terms. That amount is merely $15,000 over five years. This is further evidence of a cosmetic settlement.

This order will allow recover for all of the reasonable time incurred by class counsel in the case (without reduction for limited success) because Facebook agreed to pay it in the settlement agreement. But no bonus or multiplier will be allowed in view of the limited success in this case (even if the agreement could be stretched to cover a bonus or multiplier).

3. INCENTIVE AWARD

Incentive awards pose the risk that a class representative has gone along with a settlement, not because it secures a good outcome for the class, but simply for the incentive award. Such awards should therefore be subject to careful scrutiny. This order finds the $5,000 incentive award for plaintiff Adkins unreasonably high. A reasonable amount is $500 in order to compensate plaintiff Adkins for the use of his vacation time from work to travel to San Francisco for proceedings and his role in discovery (including allowing his phone to be forensically examined).

4. SPECIAL MASTER APPOINTMENT

The companion order appointing a special master gives further instruction on how billing entries must be organized. A review of the excel document submitted in camera suggests that the time keeping in this case was relatively thorough, but class counsel should resubmit their billing records to align the instructions set out in the companion order if needed.

CONCLUSION

The final settlement is APPROVED and class counsel's fees motion is GRANTED in part as to entitlement of class counsel (and class counsel only), but DENIED as to amount. The special master will recalculate fees and costs to a reasonable sum based on the foregoing considerations and the companion order.

IT IS SO ORDERED.

ORDER APPOINTING SPECIAL MASTER

A companion order found class counsel entitled to reasonable attorney's fees.

1. Under Rules 53 and 54, the Court appoints ATTORNEY ELLEN EAGEN as the special master to determine the reasonable value of services rendered herein by class counsel (and class counsel only). By special accommodation of the Court, Attorney Eagen has agreed to provide this service at the reduced rate of $300 per hour. By MAY 14 AT NOON, each side shall submit a statement with any objection to the appointment, including any suggestions for alternative candidates or other requests to be heard. If neither side objects, then the Court will proceed with the appointment described herein.

2. Plaintiff's counsel shall provide the special master with an itemized accounting for unreimbursed expenses listed as "Travel" and "Expert Witness Fees." Travel must be broken down into at least the following categories: air transportation, ground travel, meals, and lodging. Non-working travel time must be distinguished from working travel time. Counsel may include additional categories, if necessary. Within each category, each expense must be listed with the date, description, and cost. Professional fees may be broken down into separate categories if counsel deems appropriate. The date, description, and cost for each expense incurred, such as the fee paid to an expert to produce an expert report on a specific issue, must be listed for all professional fees.

3. Counsel must also provide the special master a detailed declaration, organized by discrete projects, breaking down all attorney and paralegal time sought to be recovered. For each project, there must be a detailed description of the work, giving the date, hours expended, attorney name, and task for each work entry, in chronological order. A "project" means a deposition, a motion, a witness interview, and so forth. It does not mean generalized statements like "trial preparation" or "attended trial." It includes discrete items like "prepare supplemental trial brief on issue X." The following is an example of time collected by a project.

4. All entries for a given project must be presented chronologically one after the other, i.e., uninterrupted by other projects, so that the timeline for each project can be readily grasped. Entries can be rounded to the nearest quarter-hour and should be net of write-down for inefficiency or other cause. Please show the sub-totals for hours and fees per project, as in the example above, and show grand totals for all projects combined at the end. Include only entries for which compensation is sought, i.e., after application of "billing judgment." For each project, the declaration must further state, in percentage terms, the proportion of the project directed at issues for which fees are awardable and must justify the percentage. This percentage should then be applied against the project total to isolate the recoverable portion (a step not shown in the example above).

5. A separate summary chart of total time and fees sought per individual timekeeper (not broken down by project) should also be shown at the end of the declaration. This cross-tabulation will help illuminate all timekeepers' respective workloads and roles in the overall case.

6. The declaration must also set forth (a) the qualifications, experience and role of each attorney or paralegal for whom fees are sought; (b) the normal rate ordinarily charged for each in the relevant time period; (c) how the rates were comparable to prevailing rates in the community for like-skilled professionals; and (d) proof that "billing judgment" was exercised. On the latter point, as before, the declaration should describe adjustments made to eliminate duplication, excess, associate-turnover expense, and so forth. These adjustments need not be itemized but totals for the amount deleted per timekeeper should be stated. The declaration must identify the records used to compile the entries and, specifically, state whether and the extent to which the records were contemporaneous versus retroactively prepared. It must state the extent to which any entries include estimates (and what any estimates were based on). Estimates and/or use of retroactively-made records may or may not be allowed, depending on the facts and circumstances.

7. Ordinarily, no more than one attorney and one paralegal need be present at a deposition; more will normally be deemed excessive. Ordinarily, no more than one attorney need attend a law-and-motion hearing; more will normally be deemed excessive. To allow for symmetry, however, the award will take into account the staffing used by the opposing party.

8. The special master shall review the briefs and declarations by the parties, hear argument, and then determine a reasonable amount to award, including any fees on fees. The special master shall also determine the extent to which any discovery should be permitted — with the caution that further discovery should be the exception and not the rule.

9. Except for any supplementation allowed by the special master, the foregoing submissions shall be the entire record for this dispute. There will be no further briefing unless allowed by the special master. After the special master's appointment, any further submissions solely for the special master's use should not be filed with the Court.

IT IS SO ORDERED.

ACCEPTANCE OF SPECIAL MASTER APPOINTMENT

1. By signing below, ATTORNEY EAGEN IS HEREBY ACCEPTS APPOINTMENT AS SPECIAL MASTER to determine, with all reasonable diligence, the reasonable amount of attorney's fees and costs which Facebook shall pay to class counsel. She shall have all powers set forth in Federal Rule of Civil Procedure 53(c) with respect to this dispute but shall not revisit prior rulings in this case.

2. The procedure set forth in the prior order is incorporated into and deemed a part of this order. Attorney Eagen may set a briefing and argument schedule as she deems appropriate. The parties shall provide the special master with electronic text searchable copies of all documents relevant to this dispute and shall provide print copies (such as a tabbed binder for attorney-billing records) to an appropriate address as Attorney Eagen shall request.

3. By AUGUST 27 AT NOON, the special master shall file a written report and recommendation that includes her proposed findings and the recommended award of attorney's fees and costs to which class counsel is entitled. Her report should identify all amounts disallowed and state whether the amounts disallowed qualify for treble deduction, per the order granting the motion for fees.

4. Any objections to or motions regarding the special master's report and recommendation must be filed by SEPTEMBER 10 AT NOON, to be heard on the normal 35-day track, and shall not exceed 25 PAGES in length. The response to any such objection or motion shall be due SEVEN DAYS from the filing thereof and shall also not exceed 25 PAGES in length. No reply briefing, please.

5. The Court will then review and consider any timely objections to or motions regarding the special master's report and recommendation pursuant to Rule 53(f). The objecting party must file a declaration submitting to the Court a complete appendix of relevant communications with the special master. An order will follow.

6. Ex parte communications with the special master should be avoided if possible. Any objection to an ex parte communication or motion to disqualify must be filed within SEVEN CALENDAR DAYS of discovery.

7. Objections to this order shall be filed by MAY 14 AT NOON. Any proposed modification to this order must be promptly raised in a joint letter brief, not to exceed THREE PAGES in length, to be filed only after the parties have met and conferred — either in person or telephonically — under the special master's supervision.

8. Attorney Eagen shall please indicate her acceptance of this appointment as special master by signing and filing the below statement:

I accept this appointment and reference:

IT IS SO ORDERED.