Summary
The Judicial Panel on Multidistrict Litigation ordered the centralization of 32 related federal actions concerning the PowerSchool customer data security breach, along with potential tag-along actions. The Panel selected the Southern District of California as the transferee district and assigned the coordinated or consolidated pretrial proceedings to Judge Roger T. Benitez. The order identifies common factual questions involving the breach, data-security practices, notification, and overlapping negligence, breach-of-contract, and unjust-enrichment claims.
Topics
Practice areas
Questions Presented
- Whether the actions share common questions of fact warranting centralization under 28 U.S.C. § 1407.
- Whether centralization in the Southern District of California would serve the convenience of the parties and witnesses and promote the just and efficient conduct of the litigation.
- Whether informal coordination or transfer under 28 U.S.C. § 1404 would be a more efficient alternative to § 1407 centralization.
Holdings
- Centralization was warranted because the actions involved common questions of fact concerning the same cybersecurity incident, PowerSchool's data-security practices, and its breach notifications.
- The Southern District of California was an appropriate transferee district for coordinated or consolidated pretrial proceedings.
- The Panel declined to rely on informal coordination because the record did not establish that it would be the most efficient method of resolving the litigation.
Key quotations
“On the basis of the papers filed and the hearing session held, we find that the actions listed on Schedule A involve common questions of fact, and that centralization in the Southern District of California will serve the convenience of the parties and witnesses and promote the just and efficient conduct of this litigation.” (at 1)
“IT IS THEREFORE ORDERED that actions listed on Schedule A are transferred to the Southern District of California and, with the consent of that court, assigned to the Honorable Roger T. Benitez for coordinated or consolidated pretrial proceedings.” (at 3)
Factual background
The actions arise from a cybersecurity incident involving unauthorized access to PowerSchool's Student Information System, which stores personal information of current and former students and school staff. Plaintiffs seek certification of overlapping nationwide and statewide classes and assert largely identical claims involving negligence, breach of contract, and unjust enrichment. Discovery will concern how and when the breach occurred, the adequacy of PowerSchool's security practices, and the timing and sufficiency of breach notifications.
Procedural history
The Panel considered the papers filed and held a hearing session concerning centralization of litigation arising from a cybersecurity incident involving PowerSchool's Student Information System. The Panel granted centralization, transferred the actions listed on Schedule A to the Southern District of California, and assigned them, with that court's consent, to Judge Roger T. Benitez for coordinated or consolidated pretrial proceedings.