In re Uber Techs., Inc., Data Sec. Breach Litig.

Before the Panel :* Plaintiffs in one action in the Northern District of California *1353move under 28 U.S.C. § 1407 to centralize this litigation in that district. This litigation currently consists of 10 actions pending in five districts,1 as listed on Schedule A. Since the filing of the motion, the Panel has been notified of seven related federal actions.2 The actions arise out of the announcement by Uber Technologies, Inc., on November 21, 2017, that certain personal information of 57 million Uber drivers and riders was inappropriately downloaded by individuals outside the company in late 2016.

All responding plaintiffs support centralization, but there is some disagreement on the transferee district. Plaintiffs in three Northern District of Illinois actions request centralization in their district or, alternatively, the Central District of California. Plaintiffs in six other actions support centralization in the Northern District of California. The responding Uber defendants3 oppose centralization and, alternatively, propose the Central District of California as the transferee district. Defendant Apple opposes inclusion of Harang (the sole action naming Apple as a defendant) and, in the alternative, requests separation and remand of the claims against Apple. Apple takes no position on centralization of the claims against Uber.

On the basis of the papers filed and the hearing session held, we find that these actions involve common questions of fact, and that centralization will serve the convenience of the parties and witnesses and promote the just and efficient conduct of this litigation. These putative class actions share complex factual questions arising from Uber's announcement on November 21, 2017, that a data security breach of its network occurred in late 2016 in which the personal information of 57 million Uber users was downloaded by unauthorized individuals outside the company.4 Common factual questions are presented with respect to Uber's practices in safeguarding its users' personal information, the investigation into the breach, the alleged delay in disclosing the breach, and the nature of the alleged damages. Centralization will eliminate duplicative discovery; prevent inconsistent pretrial rulings, including with respect to class certification; and conserve the resources of the parties, their counsel, and the judiciary.

The Uber defendants principally object to centralization based on the asserted likelihood that their pending and anticipated motions to compel individual arbitration will be granted in all actions, prior to the commencement of any discovery, bringing an early end to this litigation.

*1354But such an assessment of the merits of the actions is beyond the Panel's authority. See In re: Maxim Integrated Prods., Inc., Patent Litig. , 867 F.Supp.2d 1333, 1335 (J.P.M.L. 2012) (" '[t]he framers of Section 1407 did not contemplate that the Panel would decide the merits of the actions before it and neither the statute nor the implementing Rules of the Panel are drafted to allow for such determinations' ") (quoting In re: Kauffman Mut. Fund Actions , 337 F.Supp. 1337, 1339-40 (J.P.M.L. 1972) ). Thus, where the litigation involves common factual questions, centralization may be appropriate even though defendants predict that they will prevail on dispositive motions prior to commencement of discovery.5 Centralization will avoid inconsistent rulings on these and other common pretrial motions. We decline Uber's suggestion to delay ruling on centralization until their motions to compel arbitration are decided, as the timing and outcome of such rulings in this growing litigation is highly speculative.

The Uber defendants further oppose centralization on the ground that (1) the involvement of different state law claims for relief will undermine efficiencies; (2) there are pending state court actions, and consequently, an MDL would not be effective in eliminating duplicative pretrial proceedings; and (3) informal coordination is preferable to centralization. These arguments are unconvincing. As the Panel recently observed in other data breach litigation, "the presence of ... differing legal theories is not significant where, as here, the actions still arise from a common factual core." See In re: Sonic Corp. Customer Data Security Breach Litig. , 276 F.Supp.3d 1382, 1383 (J.P.M.L. 2017) (internal quotation marks and citation omitted). Additionally, the Panel often has granted centralization where there are pending state court actions, observing that an MDL will make it easier "to coordinate both the state and federal cases, because there will now be just one judge handling the latter."6

We do not believe that informal coordination is a practicable alternative to centralization here. There are ten actions on the motion and seven potential tag-along actions, which are pending in nine districts. Fourteen distinct groups of plaintiffs' counsel represent plaintiffs in these actions. In our judgment, the number of actions, districts, and involved counsel, and the complexity of the litigation, make effective coordination on an informal basis impracticable.

The Harang action, which asserts claims against both Uber and Apple, will be included in the MDL. Apple contends that the claims against Apple are unrelated to the Uber data breach, arguing that they relate solely to an alleged "entitlement" given by Apple to Uber that allowed the Uber app to capture screen images and other data on an iPhone without the user's knowledge. At oral argument, counsel for the Harang plaintiffs also characterized their claims against Apple as distinct from the data breach claims against Uber. But as pled in the complaint, the alleged entitlement and the *1355data breach are related with respect to the scope of personal information accessed by the alleged hackers-that is, that the entitlement allegedly allowed the hackers to access the personal information in the captured screen images.7 Moreover, 12 of the 13 claims in Harang are brought against both Apple and the Uber defendants in terms that are not amenable to separation.8 In these circumstances, inclusion of Harang in its entirety is appropriate.

As this litigation progresses, it may become apparent that certain actions or claims could be more efficiently handled in the actions' respective transferor courts. Should the transferee judge deem remand of any claims or actions appropriate, then he may file a suggestion of remand to the Panel. See Panel Rule 10.1. As always, we leave the question of when Section 1407 remand is appropriate to the sound discretion of the transferee judge.

We conclude that the Central District of California is an appropriate transferee district for this litigation. Three actions are pending in this district. The Uber defendants support this district if centralization is granted over their objection, and plaintiffs in two Northern District of Illinois actions support it as their second choice. California has a significant connection to this litigation, as Uber Technologies, Inc., has its headquarters in this state, where much of the common evidence, including witnesses, will be located. Judge Philip S. Gutierrez, to whom we assign this litigation, is an experienced transferee judge, and we are confident he will steer this litigation on a prudent course.

IT IS THEREFORE ORDERED that the actions listed on Schedule A and pending outside the Central District of California are transferred to the Central District of California and, with the consent of that court, assigned to the Honorable Philip S. Gutierrez for coordinated or consolidated pretrial proceedings.

SCHEDULE A

MDL No. 2826 - IN RE: UBER TECHNOLOGIES, INC., DATA SECURITY BREACH LITIGATION

Northern District of Alabama

GRICE v. UBER TECHNOLOGIES, INC., C.A. No. 5:17-01975

Central District of California

FLORES v. RASIER, LLC, ET AL., C.A. No. 2:17-08503

HELLER, ET AL. v. RASIER, LLC, ET AL., C.A. No. 2:17-08545

Northern District of California

WEBBER, ET AL. v. UBER TECHNOLOGIES, INC., ET AL., C.A. No. 3:17-06758 *1356AGANS, ET AL. v. UBER TECHNOLOGIES, INC., C.A. No. 3:17-06759

BURNETT, ET AL. v. UBER TECHNOLOGIES, INC., C.A. No. 4:17-06835

Northern District of Illinois

HARANG, ET AL. v. UBER TECHNOLOGIES, INC., ET AL., C.A. No. 1:17-08500

WEST v. UBER USA, LLC, ET AL., C.A. No. 1:17-08593

PATNI, ET AL. v. UBER TECHNOLOGIES, INC., ET AL., C.A. No. 1:17-08709

Eastern District of Pennsylvania

DESIGNOR v. UBER TECHNOLOGIES, INC., ET AL., C.A. No. 5:17-05289