Dear Counsel:

This Letter Order memorializes the hearing held with the parties in the Consumer and Government Tracks on March 24, 2021.

I. Special Master’s Report & Recommendation Regarding a Forensic Examination of Plaintiffs’ Digital Devices

Plaintiffs objected to a discovery request by Marriott to conduct a forensic examination of the Bellwether Plaintiffs’ digital devices. The parties initially tried to find a compromise but failed to reach an agreement. The parties brought the dispute before Special Master Judge Facciola, who issued a Report and Recommendation, ECF No. 752, to adopt the Consumer Plaintiffs’ compromise protocol (that had been proposed but not agreed to by the parties), docketed at ECF No. 752-1 Ex. C, to be used for searches on the devices of all the Bellwether Plaintiffs. Consumer Plaintiffs filed an objection, ECF No. 757, and Marriott filed a response, ECF No. 760.

For the reasons discussed during the hearing, Special Master Judge Facciola’s Report and Recommendation, ECF No. 752, is adopted. In short, I find that the requested discovery is both relevant – at a minimum to the issue of causation – and the request is proportional. I also agreed with the parties that employer devices would not be subject to the search, but found that other devices, including cell phones, should be subject to the search for all the Bellwether Plaintiffs. The search should extend to devices in the Bellwether Plaintiffs’ possession at the time of the data breach to the present.

During the hearing, Counsel for the Consumer Plaintiffs stated that the forensic examination for all the Bellwether Plaintiffs could not be completed before the close of discovery, even under the modified schedule discussed below, and could take six to eight months. Counsel for Marriott suggested that a different discovery vendor may be able to complete the searches in time. While it is difficult to imagine that a properly staffed and competent forensic examiner would require the amount of time predicted by Plaintiffs’ Counsel, the parties are directed to work with Special Master Judge Facciola, as appropriate, to find a solution to this issue.

II. Special Master’s Order to Show Cause

On March 22, 2021, Special Master Judge Facciola issued an order for Consumer Plaintiffs to show cause in writing by March 26, 2021 why they should not be ordered to produce to Marriott:

Any communication from Marriott or Starwood after November 29, 2018, to you including but not limited to email, text-message, iMessage, or social media communications except for communications offering their services or advertising the availability of accommodations in hotels and otherwise promoting their services.

Any communication received by you in the period between July 1, 2014 and November 29, 2018 from any entity that (1) advised you that that entity or any other entity has suffered a breach of its cybersecurity which might affect you; (2) warned you that your password had been compromised; (3) urged or directed you to change your password; (4) warned you of the possibility that a malefactor had tried to subject you to a phishing or other attack or scheme, designed to have you produce or disclose to the malefactor your identity, your password, your credit card or any other information that identifies you or permits you to purchase goods and services.

ECF No. 761. During the hearing, Counsel for Consumer Plaintiffs stated that the Consumer Plaintiffs did not have a problem with the way that the discovery requests were worded in Judge Facciola’s order. On March 26, 2021, the Consumer Plaintiffs confirmed this view in a filing, stating that they intend to comply with the discovery requests as worded in the Special Master’s show cause order. ECF No. 767. Therefore, this issue is resolved.\

III. Consumer Track Schedule

The parties in the Consumer Track proposed a schedule for concluding fact discovery, class certification briefing, disclosing experts, and filing expert reports and challenges. ECF No. 759. The proposed schedule is acceptable, with two caveats discussed below.

First, the parties dispute whether disclosures to the Court of their class certification experts, their areas of expertise, and what standards they will apply, should be done ex parte. I understand from the parties’ status report regarding the proposed schedule, ECF No. 759, and from our discussion at the hearing, that the expert reports likely will focus on issues of liability, including an analysis of the attack and the standard of care for cybersecurity, and damages, including economic models. Based on this understanding, no disclosures to the Court, ex parte or otherwise, are required prior to the service of each party’s expert reports on the opposing party. At that time, the serving party should also provide a copy of the expert reports to the Special Master and the Court.

Second, the parties disagree whether Plaintiffs should be allowed to file rebuttal expert reports to Defendants’ expert reports. During the hearing, I explained that the resolution of this issue is deferred until after the Plaintiffs’ and Defendants’ expert reports have been filed. At that time, the Consumer Plaintiffs may request to file a rebuttal expert report and work with Special Master Judge Facciola in the first instance if Defendants disagree, and then with the Court if required.

Therefore, the following schedule applies in the Consumer Track.

IV. Government Track Schedule

As discussed during the hearing, the deadline to end fact discovery in the Government track is extended to the same deadline to end fact discovery in the Consumer Track: June 11, 2021. By June 18, 2021, Marriott should file a letter of 3 pages or less, single-spaced, excluding exhibits, outlining the proposed factual and legal basis of its motion for summary judgment or partial summary judgment. The Court will then hold a status conference with the parties to determine whether to proceed with some or all of the summary judgment briefing at that time, and if so, a schedule and page limits to do so.

V. Privilege Protocol for Consumer and Government Tracks

The parties in the Consumer and Government Tracks submitted a proposed protocol to Special Master Judge Facciola for handling privilege logs and privilege challenges. During the hearing, Special Master Judge Facciola and I expressed concern that the time allowed under the proposed protocol to brief any privilege challenges before the Special Master and for any objections filed before me would take too long. The parties are directed to work with Special Master Judge Facciola to revise the proposed privilege protocol with a more streamlined approach for dealing with privilege disputes.

* * *

Although informal, this is an Order of Court and will be docketed accordingly.

Sincerely,
/s/
Paul W. Grimm
United States District Judge