COTTER

v.

CHECKERS DRIVE-IN RESTAURANTS, INC.

This matter comes before the Court upon consideration of United States Magistrate Judge Christopher P. Tuite’s Report and Recommendation (Doc. # 65), entered on July 7, 2021, recommending that Plaintiffs’ Motion for Final Approval of Class Action Settlement (Doc. # 48) and Plaintiffs’ Motion for Attorneys’ Fees, Costs, Expenses, and Service Awards (Doc. # 47) both be denied without prejudice and that Plaintiffs be allowed to amend their complaint to address the issue of standing in light of recent decisions issued by the United States Supreme Court and the Eleventh Circuit. On July 28, 2021, Plaintiffs filed their objections to the Report and Recommendation (Doc. # 68). The next day, Defendant Checkers Drive-In Restaurants, Inc. (“Checkers”) filed a response. (Doc. # 69). Upon careful review, the Court declines to adopt the Report and Recommendation for the reasons explained below. In addition, the Court grants final approval of this class action settlement. Finally, the Plaintiffs’ Motion for Attorneys’ Fees, Costs, Expenses, and Service Awards is granted in part and denied in part. Discussion After conducting a careful and complete review of the findings and recommendations, a district judge may accept, reject or modify the magistrate judge’s Report and Recommendation. 28 U.S.C. § 636(b)(1); Williams v. Wainwright, 681 F. 2d 732 (11th Cir. 1982). In the absence of specific objections, there is no requirement that a district judge review factual findings de novo, Garvey v. Vaughn, 993 F. 2d 776, 779 n.9 (11th Cir. 1993), and the court may accept, reject or modify, in whole or in part, the findings and recommendations. 28 U.S.C. § 636(b)(1)(C). The district judge reviews legal conclusions de novo, even in the absence of an objection. See Cooper-Houston v. S. Ry. Co., 37 F. 3d 603, 604 (11th Cir. 1994); Castro Bobadilla v. Reno, 826 F. Supp. 1428, 1431-32 (S.D. Fla. 1993), aff’d, 28 F. 3d 116 (11th Cir. 1994).

A. Procedural History

In April 2020, Plaintiffs filed an amended complaint against Checkers, alleging multiple causes of action arising from a data breach affecting Checkers’ point-of-sale systems. (Doc. # 40). Plaintiffs alleged that hackers utilizing malicious software stole copies of customers’ payment card data and other personal information (collectively, “Private Information” or “PII”). (Id. at 1-2). The malware remained on Checkers’ point-of-sale systems from September 2016 until April 2019. (Id.). Before Checkers filed an answer, the parties entered into a class-wide Settlement Agreement and Release (“Settlement Agreement”) and petitioned this Court for preliminary approval of the settlement. (Doc. ## 43, 43-1). On June 30, 2020, the Court entered an order preliminarily approving the proposed settlement pursuant to the terms of the parties’ Settlement Agreement and directing that notice be given to the settlement class. (Doc. # 46). Commencing in July 2020, and pursuant to the notice requirements set forth in the Settlement Agreement and the Court’s preliminary approval order, the settlement class was notified of the terms of the proposed Settlement Agreement, of the right of settlement class members to opt-out, and the right of settlement class members to object to the Settlement Agreement and to be heard at the final approval hearing. (Doc. 48-1). In October 2020, the Plaintiffs filed a Motion for Final Approval of the Class Action Settlement (Doc. # 48) and Motion for Attorneys’ Fees, Costs, and Expenses and Service Awards (Doc. # 47), both of which are unopposed. The Court referred these motions to Judge Tuite for a Report and Recommendation, and Judge Tuite held a hearing on the motions on December 8, 2020. (Doc. ## 49, 55). As Judge Tuite correctly noted in his Report and Recommendation, during the fall of 2020 and the winter of 2021, the Eleventh Circuit issued two decisions pertaining to the issue of standing in the context of data breaches and/or identity theft: Muransky v. Godiva Chocolatier, Inc., 979 F. 3d 917 (11th Cir. 2020) (en banc) and Tsao v. Captiva MVP

Restaurant Partners, LLC, 986 F. 3d 1332 (11th Cir. 2021). In light of these decisions, Judge Tuite expressed concerns about whether Plaintiffs had standing to pursue this action and ordered supplemental briefing on that issue. (Doc. ## 57, 58, 60, 61). As part of this supplemental briefing, Plaintiffs submitted three sworn declarations to the Court. First, Plaintiffs submitted a declaration from a representative of the settlement administrator, stating that of the more than 11,000 claim form submissions received,¹,665 of those were for out-of-pocket expenses related to the data breach. (Doc. 61-1 at 1). And of those¹,665 submissions, nine included documentation showing unreimbursed unauthorized charges on payment cards and/or other out-of-pocket expenses related to misuse of the customers’ information. (Id. at 1-2). Second, Plaintiffs submitted a declaration from class member Contessa McCormick. (Doc. # 61-2). McCormick averred that, after she used a payment card to make a purchase at a Checkers location, she experienced fraudulent activity on that card, including unauthorized purchases and fraudulent ATM withdrawals. (Id.). Third, Plaintiffs submitted a declaration from class member Yolanda Jackson. (Doc. # 62- 1). Similar to McCormick, Jackson stated that she incurred fraudulent charges and corresponding fees that were not reimbursed after using a payment card at a Checkers location. (Id.). She also incurred expenses in attempting to freeze, monitor, and repair her credit. (Id.). On July 7, 2021, Judge Tuite issued the instant Report and Recommendation. (Doc. # 65). Judge Tuite rightly pointed out that, in the months between when this Court issued its preliminary approval of the settlement and July 2021, four decisions bearing on the issue of standing in this matter had been issued by the Eleventh Circuit and the U.S. Supreme Court: Muransky, Tsao, In re Equifax Inc. Customer Data

Security Breach Litigation, 999 F. 3d 1247 (11th Cir. 2021), and TransUnion LLC v. Ramirez, 594 U.S. ___, 141 S. Ct. 2190 (2021). (Id. at 1-2).

B. Article III standing

A short overview of the law surrounding standing is in order. Because federal courts are courts of limited jurisdiction, if a “court determines at any time that it lacks subject-matter jurisdiction, the court must dismiss the action.” Fed. R. Civ. P. 12(h)(3). That is so even when a court is asked only to approve a class-action settlement, since “[a] court is powerless to approve a proposed class settlement if it lacks jurisdiction over the dispute.” Frank v. Gaos, 139 S. Ct. 1041, 1046 (2019). In a class action, “federal courts lack jurisdiction if no named plaintiff has standing.” Id. “To establish standing under Article III of the Constitution, a plaintiff must demonstrate (1) that he or she suffered an injury in fact that is concrete, particularized, and actual or imminent, (2) that the injury was caused by the defendant, and (3) that the injury would likely be redressed by the requested judicial relief.” Thole v. U.S. Bank N.A., 140 S. Ct. 1615, 1618 (2020). “The party invoking federal jurisdiction bears the burden of establishing” each element of standing, which “must be supported in the same way as any other matter on which the plaintiff bears the burden of proof, i.e., with the manner and degree of evidence required at successive stages of litigation.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992). This case concerns only the first element of Article III standing: the existence of an injury in fact. With respect to that element, the Supreme Court has made clear that “allegations of possible future injury” or even an “objectively reasonable likelihood” of future injury are insufficient to confer standing. Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409–10 (2013) (internal quotation marks, alterations, and emphasis omitted). Rather, a future injury constitutes an Article III injury in fact only “if the threatened injury is certainly impending, or there is a substantial risk that the harm will occur.” Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014) (internal quotation marks omitted). That brings the Court to the recent case law, handed down in the intervening months between this Court’s preliminary approval of the settlement and Judge Tuite’s issuance of his Report and Recommendation. The Report and

Recommendation ably and thoroughly describes the facts and holdings of those cases, and so this Court will not reiterate or belabor those points. Instead, the Court will limit itself to an analysis of the Tsao case, which is highly pertinent to the issue of standing in this matter. Tsao involved a data breach at the restaurant chain PDQ that exposed customers’ personal financial information. 986 F. 3d at 1334-35. There, as here, hackers infiltrated the restaurant’s point-of-sale system to gain access to payment card data such as the cardholder’s name, account number, expiration date, and the card verification value. See Id. at

1335; (Doc. # 40 at 1, 5). Having made at least two purchases at PDQ locations during the data breach period, Tsao filed a class action complaint on behalf of a nationwide class.¹ Tsao,

Id. On appeal, Tsao argued that “he could suffer future injury from misuse of the personal information disclosed during the cyber-attack (though he has not yet), and this risk of misuse alone is enough to satisfy the standing requirement.” Id. at 1337. The Eleventh Circuit rejected this argument. Id. After reviewing the holdings in Clapper and Muransky, the panel “distill[ed] two legal principles.” Id. at 1339. “First, a plaintiff alleging a threat of harm does not have Article III standing unless the hypothetical harm alleged is either ‘certainly impending’ or there is a ‘substantial risk’ implied contract, negligence, negligence per se, unjust enrichment, and violation of the Florida Unfair and Deceptive Trade Practices Act. 986 F. 3d at 1336; (Doc. # 40). of such harm.” Id. “Second, if the hypothetical harm alleged is not ‘certainly impending,’ or if there is not a substantial risk of the harm, a plaintiff cannot conjure standing by inflicting some direct harm on itself to mitigate a perceived risk.” Id. The Eleventh Circuit ultimately rejected Tsao’s standing argument for three reasons. Id. at 1343. First, as in

Muransky, conclusory allegations of an “elevated” or “continuing” risk of identity theft are not enough to confer standing. Id. While Tsao relied on reports outlining the general risks of identity theft, the reports did not “clarify the risks to the plaintiffs in this case, and Tsao’s threadbare allegations of ‘increased risk’ are insufficient to confer standing.” Id. Second, and crucial to the outcome in this case, the Eleventh Circuit wrote that “without specific evidence of some misuse of class members’ data, a named plaintiff’s burden to plausibly plead factual allegations sufficient to show that the threatened harm of future identity theft was ‘certainly impending’ – or that there was a ‘substantial risk’ of such harm – will be difficult to meet.” Id. at 1344. Relying on case law from its sister circuits², the panel explained that “most plaintiffs that have failed to offer at least some evidence of actual misuse of class members’ data have fared poorly in disputes over standing.” Id. Third, the court noted that Tsao had immediately cancelled the affected credit cards following disclosure of the PDQ data breach, effectively eliminating the risk of future credit card fraud. Id.

C. Plaintiffs here have Article III standing

The Court finds the description of the relevant case law in the Report and Recommendation to be thorough and helpful. However, the Court must respectfully disagree with the magistrate judge’s finding that the Plaintiffs lack standing. First, the Report and Recommendation alludes to a holding in TransUnion regarding concreteness that the Court believes it must address as an initial matter. See (Doc. # 65

Supreme Court or the Eleventh Circuit on this issue, the Court concludes that these facts take the instant matter outside of TransUnion’s reach. See In re Blackbaud, Inc., Customer Data Breach Litig., No. 3:20-mm-2972-JMC, 2021 WL 2718439, at *6 n.15 (D.S.C. July¹, 2021) (stating that, if it had reached the issue of injury in fact, the court would have held that TransUnion would not impact its injury analysis at the pleading stage because the court in TransUnion had the benefit of the facts, or lack thereof, adduced at trial); cf. Beaudry v. TeleCheck Servs., Inc., 854 F. App’x 44, 46 (6th Cir. 2021) (affirming judgment against plaintiff for lack of standing in a Fair Credit Reporting Act case and applying TransUnion’s holding that a claim for statutory damages cannot redress a risk of future harm standing alone). The Court now turns to the findings in the Report and Recommendation. The Report and Recommendation concluded that the instant case was governed by the Eleventh Circuit’s decision in Tsao and, as in that case, Plaintiffs’ allegations about their risk of future harm were too vague and conclusory to demonstrate standing. (Doc. # 65 at 22-26). The Report and Recommendation also found that the declarations submitted by the settlement administrator and class members McCormick and Jackson were not the type of evidence sufficient to establish standing because none of that evidence demonstrated that the named Plaintiffs – Cotter and Dinh – suffered an injury arising from “some misuse” of their data. (Id. at 26-27). The Court wholeheartedly agrees with Judge Tuite that named plaintiffs must have standing for the case, or any individual claim, to advance. Frank, 139 S. Ct. at 1046; Muransky, 979 F. 3d at 924. However, the Court views both the proper application of Tsao and the Plaintiffs’ submitted declarations differently than did Judge Tuite. The Eleventh Circuit is Tsao did not require that plaintiffs show “some misuse” of their own data. Instead, the court required “specific evidence of some misuse of class members’ data.” Tsao, 986 F. 3d at 1344 (emphasis added). The declarations submitted here show that at least some members of the proposed class have incurred fraudulent charges and suffered out-of-pocket expenses in connection with the Checkers data breach. While the Eleventh Circuit did not clarify what constitutes “some misuse,” it seemed to acknowledge that specific allegations or evidence of unauthorized charges would meet this standard. See Id. at 1343. And the Eleventh Circuit has made it clear that evidence of actual identity theft or misuse is not required to demonstrate standing. See Id. (“[E]vidence of actual misuse is not necessary for a plaintiff to establish standing following a data breach.”); In re Equifax, 999 F. 3d at 1262 (“[A]ctual identity theft is by no means required when there is a sufficient risk of identity theft[.]”). Nor did the Tsao court state that some misuse of the named plaintiff’s data was required in order to find standing under a risk-of-future-injury theory. This makes sense, as “requiring plaintiffs to allege that they have already suffered identity theft or fraud as the result of a data breach would seem to run afoul of the Supreme Court’s recognition that ‘an allegation of future injury may suffice’ to establish Article III standing ‘if the threatened injury is certainly impending, or there is a substantial risk that the harm will occur.’” McMorris v. Carlos Lopez & Assocs., LLC, 995 F. 3d 295, 300 (2d Cir. 2021) (citing Susan B. Anthony List, 573 U.S. at 158). The Court holds that the declarations submitted by Plaintiffs constitute specific evidence of some misuse of the class members’ data, which is sufficient to demonstrate that all class members – including the named Plaintiffs Cotter and Dinh – face a substantial risk of identity theft or fraud following the Checkers data breach. See Tsao, 986 F. 3d at

1343-44; see also In re Equifax (reasoning that allegations of some plaintiffs’ actual identity theft supported the sufficiency of all plaintiffs’ allegations of their increased risk of identity theft); Remijas v. Neiman Marcus Grp., LLC, 794 F. 3d 688, 692-94 (7th Cir. 2015) (holding that plaintiffs established an injury in fact based on an increased risk of identity theft where plaintiffs alleged that their personal data had “already been stolen” and that 9,200 cards had experienced fraudulent charges). This evidence distinguishes the instant case from Tsao, where the named plaintiff “did not point to any specific instances in which his – or any other class member’s –

identity was stolen, cards were fraudulently charged, or data was misused.” 986 F. 3d at 1336 (emphasis added); see McMorris, 995 F. 3d at 301-02 (“[C]ourts have been more likely to conclude that plaintiffs have established a substantial risk of future injury where they can show that at least some part of the compromised dataset has been misused.”) (collecting cases)). Having found that Plaintiffs have sufficiently shown standing based on a risk of future harm, the Court need not address their other theories of standing, beyond noting that any costs associated with mitigating that risk would also provide standing, based on the Court’s assessment that the risk was substantial and imminent. See In re Marriott Int’l, Inc., Customer Data Sec. Breach Litig., 440 F. Supp. 3d 447, 460 (D. Md. 2020) (explaining that where a threatened harm is sufficiently non-speculative to establish injury in fact, money and time spent mitigating that risk will also provide standing because “the two theories of injury-in-fact stand or fall together”). Cf. Tsao, 986 F. 3d at 1344-45 (finding that where plaintiff’s mitigation risks were bound up with his arguments about perceived risk, the plaintiff could not “conjure standing by inflicting injuries on himself to avoid an insubstantial, non-imminent risk of identity theft”).

D. The Motion for Final Settlement Approval

Having determined that the Plaintiffs have Article III standing, the Court now turns to the Plaintiffs’ motion for final settlement approval, which is unopposed. (Doc. # 48).

1. Class Certification for Settlement Purposes

Only

As explained in greater detail below, for purposes of the settlement and pursuant to this Final Approval Order and Federal Rules of Civil Procedure 23(b)(3) and (e), the Court certifies a class in this matter defined as follows: All residents of the United States who made a credit or debit card purchase at any Affected Restaurant during the period of the Data Breach Incident.³

The Settlement Class specifically excludes: (i) Checkers and its officers and directors; (ii) all Settlement Class Members who timely and validly request exclusion from the Settlement Class; (iii) the Judge or Magistrate Judge to whom

The Court finds, for settlement purposes only, that: (a) the Settlement Class is so numerous that joinder of all Settlement Class Members would be impracticable; (b) there are issues of law and fact common to the Settlement Class; (c) the claims of the Representative Plaintiffs are typical of and arise from the same operative facts and seek similar relief as the claims of the Settlement Class Members; (d) the Representative Plaintiffs and Settlement Class Counsel will fairly and adequately protect the interests of the Settlement Class as the Representative Plaintiffs have no interests antagonistic to or in conflict with the Settlement Class and have retained experienced and competent counsel to prosecute this matter on behalf of the Settlement Class; (e) questions of law or fact common to Settlement Class Members predominate over any questions affecting only individual members; and (f) a class action and class settlement is superior to other methods available for a fair and efficient resolution of this controversy.

2. Representative Plaintiffs and Settlement

Class Counsel

Plaintiffs Breandan Cotter and Jack Dinh are hereby designated and appointed as the Representative Plaintiffs. The Court finds that the Representative Plaintiffs are similarly situated to absent Class Members and therefore typical of the Class and will be adequate Settlement Class Representatives. The Court finds that the following counsel are experienced and adequate counsel and are hereby designated as Settlement Class Counsel pursuant to Federal Rule of Civil Procedure 23(g): Tina Wolfson and Bradley K. King of Ahdoot & Wolfson, PC, Jean Sutton Martin of Morgan & Morgan Complex Litigation Group, Abbas Kazerounian and Jason Ibey, Esq. of Kazerouni Law Group, APC.

3. Class Notice

The record reflects that Plaintiffs, through the settlement administrator, sent notice of the settlement to putative class members in multiple ways – targeted digital banner ads, Facebook ads, a printed publication in USA Today, and direct notice via email to the more than 700,000 members of Checkers’ “Flav-R-Hood” loyalty program, of which 699,142 emails were delivered. (Doc. # 48-1 at 2-4). The settlement administrator also established a website and toll-free telephone number for dispersing information about the proposed settlement. (Id. at 4-5). The Court concludes that settlement class members were provided with the best practicable notice under the circumstances. In addition, the Court-approved class notice was “reasonably calculated, under [the] circumstances, to apprise interested parties of the pendency of the action and afford them an opportunity to present their objections.” Phillips Petroleum Co. v. Shutts, 472 U.S. 797, 812 (1985). The settlement agreement was widely publicized, and any settlement class member who wished to express comments or objections had ample opportunity and means to do so. Despite that opportunity, there were no objections to the settlement and only 19 requests for exclusion, which speaks favorably of the settlement terms. (Doc. # 48-1 at 5). 4. Settlement Approval under Rule 23(e)(2) A class action may be settled only with court approval.

Fed. R. Civ. P. 23(e)(2).4 Approval of a class action

WL 5848620, at *3 (S.D. Fla. Oct.¹, 2020) (citing In re Chicken Antitrust Litig. Am. Poultry, 669 F. 2d 228, 238 (5th Cir. Unit B 1982)). The policy favoring settlement is especially relevant in class actions and other complex matters, where the inherent costs, delays, and risks of continued litigation might otherwise overwhelm any potential benefit the class could hope to obtain. See Ass’n for Disabled Americans, Inc. v. Amoco Oil Co., 211 F.R.D. 457, 466 (S.D. Fla. 2002) (“There is an overriding public interest in favor of settlement, particularly in class actions that have the well-deserved reputation as being most complex.”) (citing

Cotton v. Hinton, 559 F. 2d 1326, 1331 (5th Cir. 1977)). In evaluating a proposed class action settlement, “the district court may rely upon the judgment of experienced counsel for the parties.” Colourpop Cosmetics, 2020 WL 5848620, at *3 (quoting Nelson v. Mead Johnson & Johnson Co., 484 F. App’x 429, 434 (11th Cir. 2012)). “Absent fraud, collusion, or the like, the district court should be hesitant to substitute its own judgment for that of counsel.” Id. (citations and internal quotation marks omitted). Having considered the factors set forth in Rule 23(e)(2) and Bennett, the Court finds the settlement here to be fair, reasonable, and adequate. There is no indication of fraud or collusion behind this settlement. See Leverso v. SouthTrust Bank of Al., N.A., 18 F. 3d 1527, 1530 & 1530 n.6 (11th Cir. 1994) (citing evidence of fraud or collusion as a factor courts should consider); see also Warren v. City of Tampa, 693 F. Supp. 1051, 1055 (M.D. Fla. 1988) (record showed no evidence of collusion, but to the contrary showed parties conducted discovery and negotiated the terms of settlement for an extended period of time). Furthermore, the class representatives and class counsel have adequately represented the class. The Plaintiffs here retained counsel with extensive experience in large class-

action lawsuits who have vigorously represented the class during this matter. (Doc. # 48-2 at 2, 3-5). The Settlement Agreement resulted from arm’s-length negotiations between experienced counsel with an understanding of the strengths and weaknesses of their respective positions in this case, with the assistance of a neutral and experienced mediator. See Wilson v. EverBank, No. 14-CIV-22264, 2016 WL 457011, at *6 (S.D. Fla. Feb.³, 2016) (concluding that settlement negotiations overseen by a “nationally renowned” mediator weighed in favor of final settlement approval); Poertner v. Gillette Co., 618 F. App’x 624, 630 (11th Cir. 2015) (stating that “self-dealing contention” was “belied” by involvement of experienced mediator). Counsel for the parties were therefore well-positioned to evaluate the benefits of the agreement, considering the risk, expense, and uncertainty of protracted litigation. The relief provided for the class is adequate. Here, the parties have agreed on the following relief: (1) cash payment of up to $5,000 per class member for reimbursement of documented out-of-pocket expenses incurred as a result of the data breach; (2) four Checkers vouchers of $5.00 each for any class member who submitted a valid and timely claim form; and (3) Checkers’s agreement to adopt and maintain certain remedial measures meant to better protect customers’ Personal Information in the future. Taking into account the costs, risks, and delay of trial and appeal (which can be significant in large class action cases), the effectiveness of the proposed method of distributing relief to the class, including the method of processing class-member claims, and the terms of the proposed award of attorneys’ fees, the Court is convinced that the relief provided for the class is adequate. The settlement treats all class members equitably relative to one another. Thus, the factors laid out in Rule 23(e)(2) are satisfied here.

Turning to the Bennett factors, Plaintiffs’ likelihood of success at trial is far from certain given Checkers’ vigorous opposition with respect to any liability for the data breach. The uncertainty of recovery suggests that the Settlement Agreement is a better alternative for Plaintiffs and the class versus continued litigation. As for the range of possible recovery, this Court finds that the settlement here is within the range of reasonableness. See Behrens v. Wometco Enters., Inc., 118 F.R.D. 534, 541 (S.D. Fla. 1988) (“The second and third considerations of the Bennett test are easily combined. A court first determines the range of recovery by resolving various damages issues. The court then determines where in this range of possible recovery do fair, adequate, and reasonable settlements lie.”). As for the complexity, expense, and duration of litigation, the issues raised in this case were complex, and the law surrounding data-breach cases is new and evolving. The parties represent that, although they entered a settlement agreement relatively early in litigation, the settlement negotiations were hard-fought, and that the parties expended significant time and energy on this litigation. This factor weighs in favor of approving the Settlement Agreement.

Moving on, “[t]he reaction of the class [to the settlement] is an important factor.” Saccoccio v. JP Morgan Chase Bank, N.A., 297 F.R.D. 683, 694 (S.D. Fla. 2014) (“A low number of objections suggests that the settlement is reasonable, while a high number of objections would provide a basis for finding that the settlement was unreasonable.”). Here, no objections were filed to the settlement and only 19 have timely opted out. (Doc. # 48-1 at 5). Further, 10,044 claims have been submitted. (Id.). This lack of opposition and settlement class member support “weigh strongly” in favor of Court approval of the Settlement Agreement. See Hanley v. Tampa Bay Sports & Ent. LLC, No. 8:19-cv-550-CEH-CPT, 2020 WL 2517766, at *4 (M.D. Fla. Apr. 23, 2020). “The stage of the proceedings at which settlement is achieved is ‘evaluated to ensure that Plaintiffs had access to sufficient information to adequately evaluate the merits of the case and weigh the benefits of settlement against further litigation.’” Saccoccio, 297 F.R.D. at 694 (citations omitted). In addition, “[e]arly settlements are favored” such that “vast formal discovery need not be taken.” Id. (citations omitted). While the parties here settled relatively early, the parties here had experienced counsel who had sufficient information to evaluate the merits of the case, engaged in a full-day mediation, and also engaged in post-mediation discovery. This factor also weighs in favor of settlement. Finally, the opinions of class counsel, class representatives, and the absent class members all favor approval of the settlement. The Court again notes here the experience of class counsel and the fact that, to date, there have been no objections and 10,044 claims received. See Hall v. Bank of America, N.A., No. 1:12-cv-22700, 2014 WL 7184039, at *5 (S.D. Fla. Dec. 17, 2014) (noting that where objections from settlement class members equated to less than 1/10th of a percentage of the class and no attorney general or regulator submitted an objection, “such facts are overwhelming support for the settlement and evidence of its reasonableness and fairness”).

5. Exclusions

The Settlement Class, which is bound by this Final Approval Order, includes all members of the Settlement Class who did not submit timely and valid requests to be excluded from the Settlement Class. A list of those putative Settlement Class Members who have timely elected to opt out of the Settlement and the Settlement Class, and who therefore are not bound by the Settlement, this Order and the Judgment to be entered hereon, has been submitted to the Court in the Declaration of Steven Weisbrot, filed in advance of the Final Approval Hearing. (Doc. # 48-1, Exh. J). All Settlement Class Members (as permanently certified below) shall be subject to all of the provisions of the Settlement, this Final Approval Order and the Judgment to be entered hereon. Upon the Effective Date, members of the Settlement Class who did not validly and timely exclude themselves from the Settlement Class shall, by operation of this Final Approval Order, have fully, finally, forever, and irrevocably released,

relinquished and discharged Defendant from all claims that were or could have been asserted in the Litigation, as specified in Article X of the Settlement Agreement. All such Settlement Class Members shall be bound by the terms of the Settlement Agreement upon entry of this Order. 6. Appeal Notwithstanding the certification of the foregoing Settlement Class and appointment of the Representative Plaintiffs for purposes of effecting the Settlement, if this Order is reversed on appeal or the Settlement is terminated or is not consummated for any reason, the foregoing certification of the Settlement Class and appointment of the

Representative Plaintiffs shall be void and of no further effect, and the parties to the proposed Settlement shall be returned to the status each occupied before entry of this Order without prejudice to any legal argument that any of the parties to the Settlement might have asserted but for the Settlement.

7. Timing of Relief

Within the time period set forth in Article XII of the Settlement Agreement, the relief provided for in the Settlement Agreement shall be made available to the various Settlement Class Members submitting valid Claim Forms,

pursuant to the terms and conditions of the Settlement Agreement.

8. Finality of Litigation

Plaintiffs and Settlement Class Members are hereby permanently barred and enjoined from filing, commencing, prosecuting, maintaining, intervening in, participating in, conducting or continuing, either directly or in any other capacity, any action or proceeding in any court, agency, arbitration, tribunal or jurisdiction, asserting any claims released pursuant to the Settlement Agreement and this Order, or seeking any award of fees and costs of any kind or nature whatsoever and pursuant to any authority or theory whatsoever, relating to or arising from the Litigation and/or as a result of or in addition to those provided by the Settlement Agreement. In addition, Plaintiffs and each Settlement Class Member are hereby enjoined from asserting as a defense, including as a setoff or for any other purpose, any argument that if raised as an independent claim would be a Released Claim.

9. Release of Claims

With respect to all Released Claims, Plaintiffs and each of the other Settlement Class Members have released, waived, and relinquished to the fullest extent permitted by law (a) the provisions, rights and benefits conferred by Section 1542 of the California Civil Code, which provides:

A GENERAL RELEASE DOES NOT EXTEND TO CLAIMS WHICH

THE CREDITOR DOES NOT KNOW OR SUSPECT TO EXIST IN

HIS OR HER FAVOR AT THE TIME OF EXECUTING THE

RELEASE, WHICH IF KNOWN BY HIM OR HER MUST HAVE

MATERIALLY AFFECTED HIS OR HER SETTLEMENT WITH THE

DEBTOR. and (b) any law of any state or territory of the United States, federal law, or principal of common law, or of international or foreign law, that is similar, comparable or equivalent to Section 1542 of the California Civil Code.

10. Claim and Issue Preclusion

The terms of the Settlement Agreement, this Final Approval Order and the Judgment to be entered hereon shall have maximum res judicata, collateral estoppel, and all other preclusive effect in any and all claims for relief, causes of action, suits, petitions, demands in law or equity, or any allegations of liability, damages, debts, contracts, agreements, obligations, promises, attorney’s fees, costs, interest or expenses which were or could have been asserted in the Litigation or are in any way related to the Data Breach Incident at issue in the Litigation.

11. Use of Order

The Final Approval Order, the Judgment to be entered hereon, the Settlement Agreement, the Settlement which it reflects and all acts, statements, documents or proceedings relating to the Settlement are not, and shall not be construed as, used as, or deemed to be evidence of, an admission by or against Defendant of any fault, wrongdoing, or liability on the part of Defendant or of the validity or certifiability for litigation of any claims that have been, or could have been, asserted in the Litigation. This Order, the Settlement or any such communications shall not be offered or received in evidence in any action of proceeding, or be used in any way as an admission or concession or evidence of any liability or wrongdoing of any nature or that Plaintiff, any Settlement Class Member, or any other person has suffered any damage; provided, however, that the Settlement, this Order and the Judgment to be entered hereon may be filed in any action by Defendant or Settlement Class Members seeking to enforce the Settlement or the Judgment by injunctive or other relief, or to assert defenses including, but not limited to, res judicata, collateral estoppel, release, good faith settlement, or any theory of claim preclusion or issue preclusion or similar defense or counterclaim. The Settlement’s terms shall be forever binding on, and shall have res judicata and preclusive effect in, all pending and future lawsuits or other proceedings as to Released Claims and other prohibitions set forth in this Order that are maintained by, or on behalf of, the Settlement Class Members or any other person subject to the provisions of this Order. In sum, the Court finds the Settlement Agreement to be a fair, adequate, and reasonable resolution of the class members’ claims and approves the Settlement Agreement. Plaintiffs’ Unopposed Motion for Final Approval of Class Action Settlement (Doc. # 48) is granted. E. Motion for Attorneys’ Fees, Costs, Expenses, and Awards

Here, Plaintiffs’ counsel seeks an award of $575,000 in attorneys’ fees and expenses, which it represents is less than 3% of the first-tier monetary benefits made available to the class. (Doc. # 47). “In a certified class action, the court may award reasonable attorney’s fees and nontaxable costs that are authorized by law or by the parties’ agreement.” Fed. R. Civ. P. 23(h). In common fund settlements like this one, an attorney’s fee award “shall be based upon a reasonable percentage of the fund established for the benefit of the class.” Camden I Condo. Ass’n, Inc. v. Dunkle, 946 F. 2d 768, 774 (11th Cir. 1991).5

“The percentage applies to the total fund created, even where the actual payout following the claims process is lower.” Pinto v. Princess Cruise Lines, Ltd., 513 F. Supp. 2d 1334, 1339 (S.D. Fla. 2007) (citing Waters v. Int’l Precious Metals Corp., 190 F. 3d 1291, 1295-96 (11th Cir. 1999)); see also Montoya v. PNC Bank, N.A., No. 14-20474, 2016 WL 1529902, at *23 (S.D. Fla. Apr. 13, 2016) (“[T]he valuation of counsel’s fee should be based on the opportunity created for the Settlement Class . . . [a]nd counsel should not be penalized for class members’ failure to take advantage of such a settlement”). For this reason, the Court will accept the Plaintiffs’ position that their request for an award of

$575,000 represents less than 3% of the aggregate value of monetary relief made available to the class in the form of four vouchers of $5 each, assuming that¹,000,000 class members could make such a claim.⁶ Although “[t]here is no hard and fast rule mandating a certain percentage of a common fund which may reasonably be awarded as a fee,” an award of one-third of the common fund is “consistent with the trend in this Circuit.” Hanley, 2020 WL 2517766, at *6 (quoting In re Sunbeam Sec. Litig., 176 F. Supp. 2d 1323, 1333 (S.D. Fla. 2001)).

Approval Order in light of the Eleventh Circuit’s recent Johnson decision holding that such awards are impermissible,” a fact which “Class Counsel conceded” at the fairness hearing); Woznicki v. Raydon Corp., No. 6:18-cv-2090-WWB-GJK, 2021 WL 1341655, at *11 (M.D. Fla. Jan. 29, 2021) (finding that $5,000 service awards to the plaintiff and another individual were prohibited under Johnson), report and recommendation adopted, 2021 WL 1341523 (M.D. Fla. Feb. 17, 2021); Miller v. Creative Hairdressers, Inc., No. 8:20-cv- 912-CEH-TGW, 2021 WL 231347, at *1 (M.D. Fla. Jan.⁴, 2021) (noting that, based on the Eleventh Circuit’s holding in

Johnson, “‘incentive’ awards to [the] named plaintiffs are prohibited”), report and recommendation adopted, 2021 WL 229607 (M.D. Fla. Jan. 22, 2021); Smith v. KFORCE, Inc., No. 8:19-cv-2068-CEH-CPT, 2020 WL 7250603, at *2 (M.D. Fla. Dec. 9, 2020) (“Given the recent decision from the Eleventh Circuit Court of Appeals . . . no service award will be approved for the class representatives.”). However, it is important to note that the mandate has been withheld in Johnson and a ruling for rehearing en banc is pending. Accordingly, this Court will follow the lead of its sister courts in this Circuit and deny Plaintiffs’ request for service awards without prejudice, but it will retain jurisdiction for the limited purpose of revisiting the denial of service awards should Johnson ultimately be overruled. See Marcrum v. Hobby Lobby Stores, Inc., No. 2:18-cv-1645-JHE, 2021 WL 3710133, at *5 (N.D. Ala. Aug. 20, 2021) (noting this approach to be “the current best practice”); Fruitstone, 2021 WL 2012362, at *13; Metzler v. Med. Mgmt. Int’l, Inc., No. 8:19-cv-2289—VMC-CPT, 2020 WL 5994537, at *3 (M.D. Fla. Oct. 9, 2020). Thus, upon due consideration of the record, including Judge Tuite’s Report and Recommendation as well as Plaintiffs’ objections thereto, the Court declines to adopt the Report and Recommendation for the reasons explained herein, grants the Plaintiffs’ Unopposed Motion for Final Approval of Class Action Settlement, and grants in part and denies in part Plaintiffs’ Unopposed Motion for Attorneys’ Fees, Costs, Expenses, and Service Awards. Accordingly, it is now ORDERED, ADJUDGED, and DECREED: (1) The Report and Recommendation (Doc. # 65) is REJECTED. (2) Plaintiffs’ Unopposed Motion for Final Approval of Class Action Settlement (Doc. # 48) is GRANTED. (3) Plaintiffs’ Unopposed Motion for Attorneys’ Fees, Costs, Expenses, and Service Awards (Doc. # 47) is GRANTED IN

PART and DENIED IN PART. Specifically, the Plaintiffs’ request for $575,000 in combined attorneys’ fees and costs is granted but the Plaintiffs’ request for service awards is denied without prejudice. (4) This action is hereby dismissed with prejudice. The Clerk is directed to CLOSE THE CASE. (5) The Court will retain jurisdiction for the limited purpose of revisiting the denial of service awards, pending the ultimate resolution of the Eleventh Circuit’s decision in Johnson v. NPAS Solutions, LLC. The Court declines to retain jurisdiction to enforce the settlement agreement. DONE and ORDERED in Chambers in Tampa, Florida, this 25th day of August, 2021. fan fr. Musmely (noiZh VIR! IA M. HERNANDEZ’COVINGTON

UNITED STATES DISTRICT JUDGE

4l