Summary
The Judicial Panel on Multidistrict Litigation ordered centralization of actions arising from the PowerSchool customer data security breach. The Panel transferred the actions to the Southern District of California and assigned them to Judge Roger T. Benitez for coordinated or consolidated pretrial proceedings. The order identifies common factual questions concerning the breach, data security practices, notification, and related negligence, contract, and unjust enrichment claims.
Topics
Practice areas
Questions Presented
- Whether the related data-security-breach actions involve common questions of fact warranting centralization under 28 U.S.C. § 1407.
- Whether centralization would serve the convenience of the parties and witnesses and promote the just and efficient conduct of the litigation.
- Which federal district should serve as the transferee district for coordinated or consolidated pretrial proceedings.
Holdings
- Centralization was warranted because the actions involved common factual questions concerning the same PowerSchool cybersecurity incident, its security practices, and its notification practices.
- The Southern District of California was an appropriate transferee district for the litigation.
- Informal coordination was not the most efficient method for resolving the litigation.
Key quotations
“These actions share factual questions arising from a recent cybersecurity incident involving unauthorized access to PowerSchool’s Student Information System software, which schools use to store current and former students’ and staff members’ personal information.”
“Centralization will avoid the possibility of inconsistent pretrial rulings, particularly with respect to class certification.”
Factual background
The actions arise from unauthorized access to PowerSchool's Student Information System, which schools use to store personal information concerning current and former students and staff. Plaintiffs include students, students' guardians, and school staff seeking overlapping nationwide and statewide class actions. The actions assert substantially identical claims involving negligence, breach of contract, and unjust enrichment, with discovery expected to address the breach, PowerSchool's data-security practices, and notification of affected persons.
Procedural history
The Panel considered the parties' written submissions and held a hearing session. It determined that the actions shared common questions of fact arising from the same cybersecurity incident and ordered transfer to the Southern District of California, with the consent of that court, for coordinated or consolidated pretrial proceedings before Judge Roger T. Benitez.
Remand instructions
The actions listed on Schedule A were transferred to the Southern District of California and, with that court's consent, assigned to the Honorable Roger T. Benitez for coordinated or consolidated pretrial proceedings.