Last Friday, the Judicial Panel on Multidistrict Litigation (“JPML”) transferred and centralized over 40 data event and cybersecurity class actions brought against T-Mobile in the Western District of Missouri.  In re: T-Mobile Customer Data Security Breach Litigation, Judicial Panel on Multidistrict Litigation, MDL No. 3019.  The centralized cases will undoubtedly be one of the must-watch data privacy litigations in 2022.  Read on to learn more.

As a reminder, multidistrict litigations (“MDLs”) are a way of handling multiple civil actions at once for coordinated discovery and pretrial proceedings, and can be formed when separate actions in different federal district courts share a common question of fact.  28 U.S.C. Section 1407(a) provides that:

When civil actions involving one or more common questions of fact are pending in different districts, such actions may be transferred to any district for coordinated or consolidated pretrial proceedings.  Such transfers shall be made by the judicial panel on multidistrict litigation authorized by this section upon its determination that transfers for such proceedings will be for the convenience of parties and witnesses and will promote the just and efficient conduct of such actions . . . .

28 U.S.C. §1407(a).  On a motion filed by either party, those separate actions can be flagged to the JPML.  The JPML then decides whether the litigations should be consolidated and transferred into one federal court for consolidated pretrial proceedings.

Which brings us to T-Mobile.  Earlier this year, T-Mobile disclosed that it had been targeted in a cyberattack that resulted in the compromise of some current, former and prospective customers’ SSN, name, address, date of birth and driver’s license/ID information.  According to T-Mobile, “the breach did not expose any customer financial information, credit card information, debit or other payment information.”  Following T-Mobile’s disclosure of the data event, over 40 putative class actions were filed by Plaintiffs who alleged that their personal information had been improperly disclosed.  T-Mobile moved for consolidation of the cases.  The overwhelming majority of Plaintiffs did not oppose centralization.

The JPML’s Order agreed with arguments raised by T-Mobile in ordering centralization:

These putative class actions present common factual questions concerning an alleged data security breach of T-Mobile’s systems that was discovered in August 2021 and allegedly compromised the personal information of approximately 54 million current, former, and prospective customers of T-Mobile.  Common factual questions will include: T-Mobile’s data security practices and whether those practices met industry standards; how the malfeasants obtained access to T-Mobile’s system; the extent of the personal information affected by the breach; when T-Mobile knew or should have known of the breach; and T-Mobile’s investigation into the breach.

Order at 2.  Moreover, the JPML likewise agreed that “[c]entralization will eliminate duplicative discovery; prevent inconsistent pretrial rulings, including with respect to class certification; and conserve the resources of the parties, their counsel, and the judiciary.”

However, there was additional consideration as to what forum should be selected by the JPML as the transferee district.  The suggested transferee districts included: the Northern District of California, the Northern District of Georgia, the Western District of Missouri, the District of New Jersey, the Eastern District of New York, the Western District of Oklahoma, and the Western District of Washington.  Although some Plaintiffs had initially proposed all of the cases land in the Western District of Washington, T-Mobile opposed (citing a judge shortage).  In ultimately selecting the Western District of Missouri, the JPML noted that T-Mobile and several Plaintiffs supported selection of the District.  Additionally, the JPML also observed that the District had capacity to efficiently manage the litigation and was centrally located.

Following transfer of cases to the Missouri (many of which had been stayed pending a ruling from the JPML), they will be overseen by Judge Brian C. Wimes for pretrial proceedings.  For more on this, stay tuned.  CPW will be there to keep you in the loop.