Antitrust Law Daily Wrap Up, PRIVACY—NDIll: Class Action Against Monitoring Software Provider comScore Certified for Federal Statutory Claims, (Apr 5, 2013)

By Peter Reap, J.D., LL.M.

Both a class and subclass of similarly situated individuals who alleged that comScore, Inc. improperly obtained and used personal information from their computers after they downloaded and installed comScore’s software were certified to assert violations of three federal statutes by the federal district court in Chicago (Harris v. comScore, Inc., April 2, 2013, Holderman, J.). However, class certification was denied for an alleged unjust enrichment claim.

Background. Plaintiffs Mike Harris and Jeff Dunstan filed suit against comScore alleging, as individuals and on behalf of a class, violations of the Stored Communications Act (SCA), 18 U.S.C. § 2701(a)(1), (2) , the Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2511(1)(a), (d), and the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030(a)(2)(C). They also asserted a claim for common law unjust enrichment.

Before the court was plaintiffs’ motion for class certification, which requested certification of the following class and subclass:

Class: All individuals who have had, at any time since 2005, downloaded and installed comScore’s tracking software onto their computers via one of comScore’s third party bundling partners.
Subclass: All Class members not presented with a functional hyperlink to an end user license agreement before installing comScore’s software onto their computers.

comScore, Inc. collects data about the activities of consumers on the Internet, analyzes the data, and sells it to its clients. comScore gathers its data through a program called OSSProxy, which, if installed on a computer, constantly collects data about the activity on the computer and sends it back to comScore’s servers. The OSSProxy software collects a variety of information about a consumer’s computer, including the names of every file on the computer, information entered into a web browser, including passwords and other confidential information, and the contents of PDF files.

One primary way that comScore distributes OSSProxy is through cooperation with "bundlers" who provide free digital products to consumers on the internet. During the process of downloading the bundlers’ free software, the consumer has the opportunity to download OSSProxy.

During the installation of the free digital product, the consumer is presented with a short statement ("the Downloading Statement") regarding OSSProxy under one of several brand names, including "RelevantKnowledge, PremierOpinion, PermissionResearch, OpinionSquare, and MarketScore." In general, underneath that message, the consumer is offered a link to the "Privacy Statement and User License Agreement" (the "ULA") and two boxes reading "Accept" and "Decline."

Significantly, the ULA indicates that it is an agreement between the consumer and a "sponsor"—usually another company connected in some way with comScore—but, in most cases, also states that comScore will use the information collected. The plaintiffs allege that comScore has exceeded the scope of the consumer’s consent to monitoring in the ULA by, among other things: (1) failing to "make commercially viable efforts to purge" confidential information that it does collect from its database; (2) intercepting phone numbers, social security numbers, user names, passwords, bank account numbers, credit card numbers, and other demographic information; and (3) selling the data collected from the consumer’s computer.

Named plaintiffs Jeff Dunstan and Mike Harris each downloaded and installed OSSProxy onto their computers after downloading a free digital product offered by one of comScore’s bundlers.

Legal standard. Class certification under Rule 23 involves two steps. First, the plaintiff’s claim must satisfy the numerosity, commonality, typicality, and adequacy of representation requirements of Rule 23(a). In addition to the four explicit requirements listed in Rule 23(a), during the first step "[t]he plaintiff must also show that the class is indeed identifiable as a class," a requirement known as the "ascertainability" requirement.

At the second step, the claim must meet one of the conditions of Rule 23(b). Here, the plaintiffs are proceeding under Rule 23(b)(3), which provides that a class action may be maintained if "the court finds that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy."

Unjust enrichment. Unjust enrichment claims are generally unsuitable for class actions because they pose insurmountable choice-of-law problems, the court noted. The cause of those problems is that the law of unjust enrichment varies too much from state to state to be amenable to national or even to multistate class treatment.

That problem was present in this case because the proposed Class and Subclass are not limited by geography and likely include plaintiffs from all 50 states, and even some foreign countries, according to the court. The plaintiffs proposed no solution to allow the court to manage the variety of laws that may be applicable to the Class, other than to suggest that the court certify two subclasses under California and Illinois law. That solution was inadequate in light of the geographical diversity of the plaintiffs and the variation in applicable law, the court held. Thus, the class certification motion with respect to the unjust enrichment claims was denied.

Federal Statutory Claims

The other three claims relied on federal statutes that provide protection against the unauthorized interception of information from the plaintiffs’ computers.

Numerosity. Rule 23(a)(1)’s requirement that the class be "so numerous that joinder of all members is impracticable was plainly met here, the court ruled. Evidence showed that OSSProxy was installed on millions of computers between 2008 and 2011 and comScore did not dispute that the number of potential class members easily satisfied the numerosity requirement."

Commonality. The plaintiffs raised a variety of common questions that could be resolved on a classwide basis, according to the court. Most obviously, each Class member agreed to a form contract (made up of the ULA and the Downloading Statement), as has each Subclass member (the Downloading Statement only).

Thus, for example, the question of whether comScore was a party to the ULA and the Downloading Statement in light of the fact that it was not listed as a contracting party could be resolved consistently for the entire class. Similarly, the question of what rights comScore had under the ULA and the Downloading Statement as a third-party beneficiary to use the information OSSProxy collects was common to the entire class.

Each class member engaged in a substantively identical process to download OSSProxy, as did each Subclass member (aside from not being presented with a link to the ULA), the court observed. The scope of the plaintiffs’ consent here was determined by that identical process, the ULA, and the Downloading Statement, and was therefore common across the Class and Subclass, respectively. Another common issue was whether OSSProxy’s data collection violates the terms of the ULA and the Downloading Statement.

comScore was correct in pointing out that the question of whether OSSProxy’s data collection exceeds the scope of consent in certain respects could depend on the behavior of each individual plaintiff. But other potential violations of the scope of consent were common to all plaintiffs regardless of individual behavior, such as the allegation that OSSProxy collected the names of every file located on a user’s computer and the names of the 25 websites the user visited prior to downloading OSSProxy. Thus, the plaintiffs demonstrated ample issues common to the entire class to satisfy Rule 23(a)(2).

Typicality. A plaintiff’s claim was typical if it arose from the same event or practice or course of conduct that gave rise to the claims of other class members and his or her claims were based on the same legal theory.

Here, the plaintiffs asserted that both Dunstan and Harris downloaded the OSSProxy software onto their computers after downloading a free digital product from one of comScore’s bundling partners. Both used a substantively identical process to download OSSProxy, except that Harris was not presented with a functioning hyperlink to the ULA, while Dunstan was. According to the plaintiffs, Harris’s claims were thus typical of the Subclass, while Dunstan’s were typical of the Class.

In response, comScore provides a list of "unique problems" it believed arose in Harris’s and Dunstan’s cases, making them atypical. Most of those problems related to the issue of whether Harris and Dunstan actually downloaded the OSSProxy software, and all of comScore’s arguments were based on speculation, the court decided. ComScore provided no actual evidence showing that Harris and Dunstan did not download OSSProxy.

ComScore pointed to Dunstan’s and Harris’s testimony that they each had problems with their computers apart from the OSSProxy software (from viruses or age), and that OSSProxy thus did not cause any decline in the performance of Dunstan’s and Harris’s computers. That testimony was relevant, if at all, only to the question of damages, and does not significantly alter the typicality of Dunstan’s and Harris’s claims, the court stated.

Adequate representation. ComScore did not dispute that the adequacy requirement was met. In addition, the court was not aware that Harris and Dunstan have any conflicting interests, Harris and Dunstan vigorously participated in this case thus far, and class counsel were qualified to represent the class.

Ascertainability. The parties agreed that comScore possessed contact information, in the form of e-mail addresses, for some portion of the proposed Class and Subclass. That portion of the proposed Class and Subclass, at least, was readily ascertainable.

For the rest of the Class and Subclass, comScore asserted that the only way to determine class membership was to require each alleged class member to submit an individual affidavit, which comScore would be entitled to challenge. ComScore asserted that this process would be unwieldy.

Here, the bulk of the class membership would likely be determined by comScore’s records, making evaluation of any additional plaintiffs claiming membership by affidavit manageable, the court ruled. If further litigation revealed that the portion of the class asserting membership by affidavit was excessively large, the court could consider at that time whether to limit the class definition to only those whose downloading of OSSProxy was reflected in comScore’s records.

Predominance and superiority. Finally, the plaintiffs had to establish that "the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy," the court noted.

ComScore asserted that the statutes of limitations present individual issues that preclude class certification. The CFAA, SCA, and ECPA all have two-year statutes of limitations that did not begin to run until a plaintiff discovers the potential violation.

In practice, however, the statute of limitations issue was unlikely to present significant difficulties, the court determined. First, the issue only arose for plaintiffs who downloaded OSSProxy before August 23, 2009 (two years before this suit was filed). Second, comScore’s data collection was ongoing, so even among those plaintiffs, all those who still had OSSProxy installed on their computer (or who had it installed at any time after August 23, 2009) were within the limitations period. Third, it was unlikely that any of the remaining plaintiffs were sufficiently aware of OSSProxy’s operations to trigger the limitations period. The statute of limitations issue thus did not provide reason to deny class certification.

In addition, comScore asserted that the issue of whether each individual plaintiff suffered damage or loss from comScore’s actions precluded certification. That argument had no applicability to the ECPA or SCA claims, both of which provide for statutory damages. The CFAA was different, however, in that it granted a civil action only to "[a]ny person who suffers damage or loss."

However, the Seventh Circuit recently reiterated that individual factual damages issues did not provide a reason to deny class certification when the harm to each plaintiff was too small to justify resolving the suits individually. That rationale was applicable here as well, where it was far more efficient to resolve all of the common issues in a single proceeding, and then to hold individual hearings on damages if necessary, than it would be to litigate all of the common issues repeatedly in individual trials, according to the court. Thus, the requirements of Rule 23(b)(3) were met as well.

The case is No. 11 C 5807.

Attorneys: Jay Edelson for Jeff Dunstan. Andrew H. Schapiro (Quinn Emanuel Urquhart & Sullivan, LLP) for comScore, Inc.

Companies: comScore, Inc.

Cases: Privacy ConsumerProtection IllinoisNews