Adkins v. Facebook, Inc.

Background

Stephen Adkins brought a putative class action against Facebook, Inc., alleging negligence based on Facebook’s security practices for collecting and storing user information. The opinion states that hackers exploited a coding vulnerability in September 2018 and obtained information from 29 million Facebook users worldwide, including more than four million users in the United States. The stolen information included names, telephone numbers, email addresses, dates of birth, gender, hometowns, and other data; the opinion states that Social Security and credit-card numbers were not taken.

Adkins sought a credit-monitoring service, compensatory, statutory, and punitive damages, declaratory relief, and orders requiring Facebook to improve its security practices. He moved to certify a worldwide class seeking injunctive relief, a nationwide damages class, and a nationwide class concerning individual damages for time spent responding to the breach. Facebook opposed certification, particularly the damages class, and moved to exclude declarations from two of Adkins’s experts.

Standing

The court held that Adkins had Article III standing, meaning he had shown a sufficient personal injury to bring the case in federal court. The court found a substantial risk of future identity theft because hackers specifically targeted sensitive information that would remain associated with users for a long time. The court also found injury from Adkins’s loss of time. He testified that he spent about 1.8 hours researching the breach, changing his password, and monitoring his accounts. His expert estimated the value of that time at between $32.50 and $36.30.

Expert Testimony

Facebook’s motion to strike identity-theft expert James Van Dyke’s report was GRANTED. Applying the standards governing expert evidence, the court found that Van Dyke’s opinions were not based on sufficient facts or data, did not use reliable principles and methods, and did not reliably apply those methods to this case. The court also identified errors and unsupported assumptions in his report, including references to information that was not taken in the breach. The court found that his report was largely boilerplate and lacked sufficient case-specific analysis.

Facebook’s motion to strike CPA Ian Ratner’s opinion was DENIED. The court held that Ratner’s economic models concerning the value of personal information and his calculations concerning time, stress, and identity-theft risk were sufficiently admissible. The court stated that Facebook could challenge weaknesses in that analysis through cross-examination and contrary evidence rather than exclusion.

Class Certification

The motion to certify a damages class under Rule 23(b)(3) was DENIED. The court applied California law because Facebook’s terms of service selected California law for claims. It held that neither proposed damages theory presented a cognizable injury for Adkins’s negligence claim.

For the credit-monitoring theory, Adkins had not paid for credit monitoring after the breach. The court held that the increased risk of future identity theft, without an already incurred expense, did not establish an actionable negligence injury under California law. The court noted that people who had purchased credit monitoring because of the breach might be able to assert such a claim, but held that Adkins could not represent a class on that theory.

For the diminished-value theory, Adkins argued that users lost the economic value of keeping their information private and could have received payment for access to it. The court held that this calculation was too speculative for a negligence claim because Adkins did not allege that he would have paid someone to access comparable information or that his information had independent economic value to him.

The motion to certify an issues-only class under Rule 23(c)(4) was DENIED. Adkins proposed trying duty and breach on a common basis while determining causation and damages individually. The court held that issue certification would not materially advance the case because individualized questions about injury, causation, and damages would remain.

The motion to certify an injunctive class under Rule 23(b)(2) was GRANTED. The court found that the requirements for class certification were satisfied and held that Facebook’s alleged repeated losses of users’ privacy created a sufficient likelihood of future harm at the class-certification stage. The certified class was defined as: “All current Facebook users whose personal information was compromised in the data breach announced by Facebook on September 28, 2018.” The class was certified for injunctive purposes only. Adkins was appointed class representative, and the listed attorneys were appointed class counsel.

Disposition

Judge William Alsup ordered that Facebook’s motion to strike James Van Dyke’s expert opinion was GRANTED; Facebook’s motion to strike Ian Ratner’s expert opinion was DENIED; Adkins’s motions to certify damages classes under Rules 23(b)(3) and 23(c)(4) were DENIED; and Adkins’s motion to certify an injunctive class under Rule 23(b)(2) was GRANTED. The parties were ordered to submit a proposed class-notification plan by December 19 at noon.