FOLLOW US

An attorney for objectors to a settlement between a class of current and former California Pizza Kitchen employees and the restaurant chain over a data breach told a Ninth Circuit panel on Monday that the district court did not properly scrutinize the deal or allegations of collusion between the parties.

The objectors' attorney, Theodore Walter Maya of Ahdoot & Wolfson PC, told the panel that the deal is worth far less than the $3.7 million valuation assigned by California Pizza Kitchen and the settling plaintiffs.

Problems with the settlement include exorbitant attorney fees for the class counsel, and that U.S. District Judge David O. Carter's orders approving the deal did not address the collusion allegations raised by the objectors even though the judge said on the record that he was troubled by them, Maya argued.

Judge Carter "never explained in the final order and judgment or in any of the transcripts why we shouldn't be concerned by these signs of collusion," Maya said.

Maya appeared to find at least one judge receptive to some of his arguments, as U.S. Circuit Judge Daniel P. Collins said several times that Judge Carter's approval of the settlement looked like a "rubber stamp," and that despite raising concerns during the proceedings about collusion, he never explained away those concerns in the written record.

"It's a complete rubber stamp," Judge Collins told counsel for the class. "He just took out the general formula, slapped it in the order, and we have no idea what he did with all that stuff that he developed over two days, he just didn't tell us."

"He made a great record, and the ruling is a cipher," Judge Collins added.

California Pizza Kitchen, or CPK, notified those affected by the breach in November 2022, after determining a month earlier that Social Security numbers and other information may have been stolen, the company said in a disclosure to the Maine attorney general's office. The company first discovered "suspicious activity" on its network on Sept. 15, prompting an investigation into the scope of the incident, it told Maine authorities.

Four lawsuits connected to the attack, which affected about 100,000 of CPK's current and former employees, were consolidated and included allegations that CPK was negligent in allowing the breach to happen and broke an implied contract with current and former employees to adequately protect their personal data.

The plaintiffs and CPK asked the court in May 2022 to approve a deal that they said had "a conservative value" of more than $3.7 million if even 2% of the class were to seek reimbursement for "ordinary" expenses of up to $1,000, and up to $5,000 for "extraordinary expenses." The group of objectors argued to Judge Carter that it was a "rotten deal" that appeared to be reached through collusion and ignored the potential of the claims under California's Consumer Privacy Act, which they valued at $77 million.