DNA and genomics testing company 23AndMe has agreed to pay $30 million to settle a massive class action lawsuit over a data breach.
However, at the same time plaintiffs have asked the court to sign off on the deal, 23AndMe has filed a related motion of its own, asking a San Francisco federal judge to simultaneously slap a hold on an untold number of parallel "mass arbitration" actions launched by other plaintiffs seeking to sidestep the settlement and secure a payday of their own, which the company said endangers its financial stability.
On Sept. 12, attorneys representing a class of potentially 6 million 23AndMe customers filed documents in San Francisco federal court, asking a judge to sign off on their deal to end the data breach class action.
Edward M. Chen
| cand.uscourts.gov
Under the deal, 23AndMe has agreed to pay a total of $30 million to resolve the claims.
Lawyers representing the plaintiffs could receive up to 25% of that settlement fund, or as much as $7.5 million, according to a memorandum presented by plaintiffs in support of the deal. The final fee number would be determined by the judge.
Attorneys signing the settlement documents include Gayle M. Blatt, of Casey Gerry Schenk Franca Villa Blatt & Penfield, of San Diego; Cari Campen Laufenberg, of Keller Rohrback, of Seattle; and Norman E. Siegel, of Stueve Siegel Hanson, of Kansas City, Missouri, all of whom have been designated as interim co-lead counsel on the case.
According to the settlement documents, eligible class members will receive a share of $20 million remaining after the payment of attorney fees and other settlement and litigation costs. The memorandum in support of the settlement indicates the funds will be used to pay for "a unique and robust" identify theft and monitoring plan for all members of the class.
Other class members could receive payments of $100, if they had their health information exposed in the data breach at the heart of the litigation, or if they reside in the states of California, Illinois, Alaska or Oregon, which all have state genetic privacy laws which could require the payment of cash statutory damages.
Some class members could also be eligible for payments of up to $10,000 "for losses incurred as the direct result of the security incident," such as losses suffered because of ID theft, because of a need to install "physical security or monitoring systems," and for "professional mental health treatment."
Plaintiffs and 23AndMe have said they hope the settlement can resolve a blizzard of lawsuits filed in courts throughout the U.S. in the wake of a data breach at 23AndMe, which was announced in October 2023.
According to lawsuits, that data breach exposed personal information for millions of people who have used 23AndMe's services to test for genetic health markers or to help trace their ethnic ancestry.
The lawsuit asserts a number of those alleged victims of the data breach also had their personal genetic and health information exposed in the hack.
Federal courts consolidated the individual and various class action lawsuits in the Northern District of California in March to allow the claims to be resolved collectively.
However, according to a motion filed by 23AndMe on Sept. 13, as the consolidated action moved toward settlement this summer, other plaintiffs moved to file their own lawsuits in state court or to file a mound of arbitration claims against the company, citing the terms of its user agreement.
In recent years, such tactics, known as "mass arbitration," have been used by plaintiffs lawyers typically to sidestep defenses mounted by defendant companies, who have successfully argued that arbitration clauses in employment contracts or user agreements can be used to block plaintiffs from suing in court. Instead, the legal claims would be decided on by arbitrators on an individual basis.
However, in "mass arbitration," plaintiffs bring hundreds or even thousands of nearly identical individual claims, forcing the company to pay potentially millions of dollars in arbitration fees, in addition to any damages awarded by arbitrators.
Companies have cried foul over those tactics and have asked a judge to disallow the filings or absolve them of the need to pay the fees.
In the 23AndMe litigation, the company has asked U.S. District Judge Edward M. Chen to issue an injunction blocking any more parallel state court or arbitration claims from being filed against the company over the data breach while the judge weighs whether to approve the settlement.
In the filing, 23AndMe's attorneys confirm the company is in a "precarious" financial situation. As in the documents filed by plaintiffs in support of the settlement, 23AndMe said the settlement was intended to allow it to resolve the claims without financially destroying the company in the process.
Without the injunction, 23AndMe warned that it may be unable to also pay the $30 million data breach settlement.
"... It is plain that counsel driving the mass arbitration filings against 23AndMe - which includes at least one firm that is also counsel of record for a named plaintiff in this (litigation) - does not intend to initiate arbitration to benefit the Settlement Class," 23AndMe wrote in their filing.
"Indeed, these mass arbitrations were filed directly in response to learning that the (litigation) was on the verge of being, or had been, settled. These arbitrations are intended to and would undermine the Settlement Agreement by threatening 23AndMe with filing fees that will nearly eclipse the Qualified Settlement Fund.
"In light of 23AndMe's financial condition, it is in the interests of the Settlement Class and 23AndMe to enjoin those proceedings unless and until Settlement Class Members have received notice of the Settlement and individually decided whether to exercise their right to opt out."
23AndMe is represented by attorney Rebekah S. Guyon, of Greenberg Traurig LLP, of Los Angeles.