IN RE TD AMERITRADE ACCOUNTHOLDER LITIGATION

VAUGHN WALKER, District Judge

This is a proposed class action against TD Ameritrade for a security breach that exposed TD Ameritrade accountholder private information to "spammers" and rendered the same information vulnerable to others. Doc #60 at 1-6. TD Ameritrade and plaintiffs Brad Zigler and Joel Griffiths (collectively the "Parties") seek approval pursuant to FRCP 23(e) of a settlement and notice to the purported class.

Plaintiffs moved for preliminary approval of the class action settlement on May 30, 2008. Doc #53. On June 13, 2008, the court denied approval for several reasons. These included the failure of the parties to establish facts necessary for the court to evaluate the settlement and the attorney fee request (Doc #61 at 2-3) and objections voiced by Matthew Elvey, one of the class representatives. At a hearing the previous day, Elvey had expressed numerous "reservations" about the settlement (Doc #61 at 3).

On August 29, 2008, attorney Mark Chavez entered his appearance on behalf of Elvey. Doc #71. Subsequently, Elvey submitted a memorandum opposing preliminary approval of the settlement. Doc #73. Elvey argued that the proposed settlement inadequately compensated the plaintiffs for their injuries related to the security breach and mischaracterized the nature of the risks associated with the breach. Id at 6.

At a hearing on October 6, 2008, the court granted attorney Gregory Beck's application to represent Elvey on a pro hac vice basis (Doc #83) and then asked both Chavez and Beck if they would be willing to represent the entire class in an effort to seek a more favorable settlement or to go to trial. Doc #87 at 4-5. Both attorneys declined to do this. Id. Chavez and Beck, instead, offered to assist the Parties in achieving adequate notice to the class. Id at 30.

TD Ameritrade submitted the proposed settlement terms and the proposed notice to be given to the class on October 20, 2008. Doc #86. In return for the class dropping its claims against TD Ameritrade, TD Ameritrade offered to (1) post a warning on its website "regarding stock spam"; (2) "continue to retain independent experts" to test TD Ameritrade's security vulnerabilities; (3) continue "account seeding" to determine whether unauthorized persons have acquired customer email addresses, (4) provide each settlement class member with a unique identifier number that can be used to obtain a one-year subscription to an anti-virus, anti-spam internet security product; (5) retain a company to perform one analysis to determine whether any incidents of organized misuse of personal information had occurred involving data in the TD Ameritrade database (four such analysis had already been performed) and to inform settlement class members whose personal information is discovered to be the subject of organized misuse; (6) donate $55,000 to specified cyber-security projects; and (7) pay claims administration and notice expenses for the settlement. Doc #86-6, Exh 5 at 9-12.

On November 13, 2008, the Texas Attorney General submitted objections to the proposed settlement. Attachment 1. The Texas Attorney General noted that approximately 415,089 Texans were included in the proposed settlement class and described four objections to the proposed settlement: (1) the proposed settlement agreement offered "no meaningful relief to the class members"; (2) the award of proposed fees to class counsel was excessive; (3) the proposed settlement failed to address the harm of identity theft adequately; and (4) the proposed release was too broad. The Texas Attorney General contended that the settlement was essentially worthless because the "warning" to be placed on the TD Ameritrade website would largely go unseen by consumers most vulnerable to stock spam, the security measures TD Ameritrade agreed to conduct should have been conducted by "any reputable company" anyway and the coupon for security software was of little value because similar software was largely available to most Internet users for free or at low cost. Attachment 1 at 2. Furthermore, the Texas Attorney General noted that the class members were to receive no monetary recovery while the proposed attorney fee award for class counsel was substantial — $1.87 million. Id at 2. The proposed settlement agreement, according to the Texas Attorney General, did not address adequately the potential harm to class members from identity theft. Id at 3. The Texas Attorney General further argued that the settlement agreement should make clear that the individuals who engaged in the unauthorized access are not "Released Parties" and "Releasing Parties" should be amended to make clear that government entities such as the Texas Attorney General has not released any claims to relief related to this security breach. Id at 3-4.

On December 5, 2008, the Texas Attorney General informed the court that it was "engaged in a promising dialogue about its concerns with counsel for the plaintiffs and the class." Doc #88-2 at 1. According to a supplemental filing by counsel for the plaintiffs, the Parties held a series of discussions with the Texas Attorney General's Office over four months addressing the objections to the proposed settlement outlined above. Doc #90 at 2.

Then on March 2, 2009, the Texas Attorney General notified the court that the Parties proposed a list of amendments to the proposed settlement agreement and notice to address the Texas Attorney General's concerns. Doc #90-2, Exh A at 2-3. These amendments included the following: In the Settlement Agreement:

Broadening the carve-out for identity theft-related claims in the "Released Claims" section to ensure that Settlement Class Members are able to pursue future claims that arise due to identity theft;

Removing the language that purports to release claims that may be brought by a governmental entity and explicitly stating that such claims are not released;

Excluding persons who participated in the security breach or assisted those who did from the definition of "Released Parties" and "Third Party Beneficiaries," thereby preventing them from receiving any benefit or protection from the Settlement Agreement;

Ensuring that the opportunity for the Settlement Class Members to take advantage of the Trend Micro Internet Security Products granted under the Settlement Agreement is extended until January 1, 2010;

Including a definition of the term "organized misuse," in order to make the Settlement Agreement more understandable, on its face, to a Settlement Class Member;

Amending the section regarding the "Voluntary Identity Theft Benefits" that TD Ameritrade may extend to Identified Class Members to: (1) eliminate confusion between that process and claims that may be brought in court, and (2) avoid the unintended release of such claims;

Under the Voluntary Identity Theft Benefits program, expanding the window of time for an Identified Class Member to respond to TD Ameritrade regarding the Member's intention to seek such benefits from 30 days to 90 days;

Under the Voluntary Identity Theft Benefits program, clarifying that an Identified Class Member's right to file suit against TD Ameritrade for identity-theft related harm is preserved up until the point that the Identified Class Member submits a claim in a binding arbitration process; and

TD Ameritrade agreeing to provide all Settlement Class Members, not just Identified Class Members, with dedicated customer support for relating [sic] to the benefits provided under the Settlement Agreement and questions concerning spam and identity theft for a full twelve months.

In the Notice and related correspondence:

Providing an explanation of the basis of the suit that includes the fact that TD Ameritrade's computer database suffered a data security breach and exposed the Class Members to the risk of identity theft (as opposed to an "unauthorized acquisition") so that Class Members have more information on which to base their decision to remain in the class, opt out, or object to the settlement.

Doc #90-2, Exh A at 2-3. The Texas Attorney General's Office withdrew its objections to the proposed settlement provided that the above amendments were implemented.

On March 19, the Parties submitted a supplemental statement with a revised proposed settlement agreement and forms of notice. Doc #90. The revised proposed settlement agreement and forms of notice incorporates the amendments urged by the Texas Attorney General as a condition for withdrawing the objections on behalf of the state of Texas. Doc 90, Exh B-E.

I

Federal Rule of Civil Procedure 23(e) requires court approval for the settlement of any class action. In order to be approved, a settlement must be "fundamentally fair, adequate and reasonable." Torrisi v Tucson Elec Power Co, 8 F3d 1370, 1375 (9th Cir 1993), quoting Class Plaintiffs v Seattle, 955 F2d 1268, 1276 (9th Cir 1992).

Class action settlement approval that takes place prior to the class certification stage requires "a higher standard of fairness." Hanlon, 150 F3d at 1026. The judge must conduct a "more probing inquiry" in order to protect the plaintiff class because there is a danger of collusion between class counsel and the defendant. See id. As Judge Friendly explained in the stockholder derivative class action context, "[o]nce a settlement is agreed, the attorneys for the plaintiff stockholders link arms with their former adversaries to defend joint handiwork."Alleghany Corp v Kirby, 333 F.2d 327, 347 (2d Cir 1964). Nevertheless, because a settlement seeks to avoid trial and wasteful litigation, "the court must not turn the settlement hearing `into a trial or rehearsal of the trial.'" Saylor v Lindsley, 456 F2d 896, 904 (2d Cir 1972) (Friendly, J).

The question currently before the court is whether this settlement should be preliminarily approved.

"[The] preliminary determination establishes an initial presumption of fairness * * *." In re General Motors Corp, 55 F3d 768, 784 (3d Cir 1995) (emphasis added). As noted in the Manual for Complex Litigation, Second, "[i]f the proposed settlement appears to be the product of serious, informed, non-collusive negotiations, has no obvious deficiencies, does not improperly grant preferential treatment to class representatives or segments of the class, and falls within the range of possible approval, then the court should direct that the notice be given to the class members of a formal fairness hearing * * *." Manual for Complex Litigation, Second § 30.44 (1985). In addition, "[t]he court may find that the settlement proposal contains some merit, is within the range of reasonableness required for a settlement offer, or is presumptively valid." Newberg on Class Actions § 11.25 (1992).

Schwartz v Dallas Cowboys Football Club, Ltd, 157 F Supp 2d 561, 570 n12 (ED Pa 2001). In other words, preliminary approval of a settlement has both a procedural and a substantive component.

The court has some serious misgivings about this proposed settlement. The court is particularly concerned that TD Ameritrade has agreed to pay the class counsel $1.87 million (Doc #90-3, Exh B at 18) and yet the class itself will receive no monetary award. Additionally, it appears that, as both the Texas Attorney General and Elvey suggest in their objections to the proposed settlement, part of the consideration TD Ameritrade offers is merely a promise to conduct security measures that a responsible companyshould conduct anyway.

Nevertheless, in light of the amended agreement between the Parties and the withdrawal of objections by the Texas Attorney General, the court finds that the amended proposed settlement is "within the range of possible approval." Schwartz, 157 F Supp 2d at 570 n12. The Texas Attorney General injected the negotiations here with a needed dose of adversarial process. The Parties and the Texas Attorney General's Office engaged in a series of serious and informed discussions over four months that led to significant changes to the proposed settlement that satisfied both sides. Doc ##90 at 2, 90-2, Exh A at 2-3.

Moreover, the court expects that if there were a large disparity between the consideration obtained by the class in the revised settlement agreement and the expected benefit to the class from taking the case to trial, there would be no shortage of counsel willing to take up representation of the entire class in pursuit of a better result. At a hearing, the court asked both Chavez and Beck, attorneys for Elvey, if they were willing to represent the class and both declined. Doc #87 at 4-5. Elvey suggested at the same hearing that he was struggling to find alternative counsel willing to take the case. Id at 31-32. This lack of a willing successor counsel further supports the finding that this settlement is within the range of reasonableness.

The court next takes up the form of notice. Class members are entitled to the "best notice that is practicable under the circumstances." FRCP 23(c)(2)(B). The Parties propose the following notice plan:

(1) an individual e-mail summary form notice to any settlement class member whose e-mail address was provided to [TD Ameritrade]; (2) summary form notice by postcard (via United States mail) to settlement class members who did not provide e-mail addresses to [TD Ameritrade] or whose e-mail notices are returned as, or are otherwise known to be, undeliverable; and (3) publication of the summary form notice in one daily and one weekend issue of the USA Today. The summary form notice will include a toll free number and a dedicated website address that can be used to obtain a copy of a long form notice.

Doc #86 at 2-3. See Doc #90, Exhs C-E (presenting the proposed form of the e-mail, postcard and newspaper publication notice). The court finds that notice primarily by e-mail in addition to a newspaper publication is appropriate in this case, where the class includes over six million members.

With regard to the content of the proposed notice, the Texas Attorney General agreed to withdraw its objections as each form of notice was amended to explain that the basis of the lawsuit includes a data security breach that exposes the class to the risk of identity theft. Doc #90-2, Exh A at 3. The proposed e-mail, postcard and newspaper publication have all been amended to include the following: "The Complaint seeks monetary and injunctive relief for any alleged injuries arising from the data breach, including alleged receipt of spam and identity theft, if it were to occur." Doc ##90-4, Exh C at 2, 90-5, Exh D at 3, 90-6, Exh E at 2. As a consequence, the amended proposed form of notice provides class members with more information on which to base their decision to remain in the class, opt out or object to the settlement. Accordingly, the court APPROVES the proposed form of notice, as to both form and content.

In sum, the court GRANTS the Parties' motion for preliminary approval of the proposed settlement and provisional certification of the settlement class and APPROVES the forms and manner of notice described in the revised proposed settlement agreement and forms of notice. Doc #90, Exhs B-E. The class is defined as all persons who are or were accountholders or prospective accountholders of TD Ameritrade and who provided physical or e-mail addresses to TD Ameritrade on or before September 14, 2007. The court confirms KamberEdelson, LLC and Parisi Havens LLP as class counsel, Scott A Kamber and Ethan Preston of KamberEdelson, LLC as lead counsel and Joel Griffiths, Gadgetwiz, Inc and Brad Zigler as class representatives.

Additionally, the court ORDERS the following schedule for further proceedings: Date Event On or before May 14, 2009 Publication in USA Today July 9, 2009 Deadline to postmark objections or opt out Deadline for filing briefing in August 20, 2009 support of final approval of settlement September 10, 2009 Hearing on final approval of settlement

At the final approval hearing on September 10, 2009, at 2:30 pm, the court will determine: (1) whether the revised proposed settlement agreement and forms of notice should be approved as fair, reasonable and adequate; (2) the merits of objections, if any, made to the settlement or any of its terms; (3) the amount of litigation costs, expenses and attorney fees, if any, that should be awarded to class counsel and (4) other matters related to the settlement.

IT IS SO ORDERED.

Attachment 1 ATTORNEY GENERAL OF TEXAS GREG ABBOTT November 13, 2008 The Honorable Chief Judge Vaughn R. Walker VIA CMRRR# 7180 6780 7890 0000 5998 United States District Court For the Northern District of California San Francisco Division 450 Golden Gate Avenue San Francisco, CA 94102 RE: Case No. 3:07-cv-02852-VRW; In re TD Ameritrade Accountholder Litigation (N.D. Cal. — San Francisco) Dear Judge Walker:

Pursuant to the Class Action Fairness Act (CAFA), the State of Texas wishes to object to the proposed Class Action Settlement Agreement in the above-captioned case. Approximately 415,089 Texans are included in the Settlement Class and stand to be affected by the proposed settlement. The State has several concerns about the proposed settlement, which are discussed in detail below.

The Proposed Settlement Agreement Provides No Meaningful Relief to the Class Members

First, the settlement will confer minimal, if any, value to Class Members. The proposed Settlement Agreement will result in zero monetary recovery for the class. Rather, under the terms of the settlement, Defendant has agreed to:

1. Post a warning at its Web site about stock spam;

2. Engage in limited penetration testing and email account seeding;

3. Provide class members with the equivalent of a coupon for a one-year subscription (or renewal) for one of two types of anti-virus, anti-spam internet security products (Trend Micro Internet Security Pro for PCs and Intego Internet Security Barrier XS for Macs); and

4. Potentially provide a limited subgroup labeled "Identified Class Members" with the option of requesting direct compensation for costs incurred as a result of identity theft, which Defendant will consider paying.

On its face, the Settlement Agreement purports to provide at least some relief to class members, but, in fact, the sum of the components provide little or no value to class members. For example, the type of "warning" regarding stock spam that Defendant proposes to include on its Web site is already widely available on numerous other Web sites. And except for four weeks out of the year, the information will be wholly buried in "The Security Center" portion of Defendant's Web site, which is unlikely to be visited by the type of consumers most vulnerable to stock spams.

Further, the penetration testing and account seeding measures are security practices in which any reputable company should engage, even if not the subject of litigation resulting from a security breach. In fact, even absent the present litigation and proposed settlement, Defendant is required by law to adopt policies and procedures reasonably designed to ensure the security and confidentiality of customer records and information and to protect against any anticipated threats or hazards to the security or integrity of customer records and information. Such policies should include the very types of measures which Defendant is "agreeing" to carry out pursuant to the settlement.

The coupon for security software is also likely of little value to consumers. As noted in the objection of Plaintiff Matthew Elvey, the security software (or its equivalent) is often available through retail promotions at little or no cost. Moreover, the vast majority of Internet users have access to free subscriptions to similar security software through their Internet Service Provider. Therefore, it is unlikely that any significant portion of the class will realize any value from the coupon for security software.

The Lack of Meaningful Relief to the Class Members Is Particularly Inappropriate Where Class Counsel Stands To Receive $1.87 Million in Attorneys' Fees

The dearth of actual benefit to the class members is especially troubling when the relief granted to class members (zero monetary recovery) is compared to the proposed attorneys' fee award for class counsel ($1.87 million). CAFA calls for heightened judicial scrutiny in circumstances where counsel is awarded large fees and class members are left with coupons or other awards of little or no value; in fact, CAFA was enacted, in part, to address this sort of disparity in recovery.

The Proposed Settlement Agreement Does Not Adequately Address the Potential Harm to the Class Members From Identity Theft

The relief afforded to Class Members who are identity theft victims is vague and, as written, the proposed Settlement Agreement unfairly limits the ability of class members to qualify. For example, only claims determined to be the result of "organized misuse" by ID Analytics (retained by Defendant) are eligible, but the phrase "organized misuse" is not defined.

Defendant has agreed to extend the opportunity for such Class Members to submit claims for costs incurred as a result of identity theft directly to Defendant. However, this submission must be within 30 days of notification of possible misuse by Defendant. (This time limit appears to assume that the Class Members at issue will be able to discover and confirm that their identity has been stolen and also incur any related damages . . . all within 30 days.)

Regrettably, even if a Class Member is able to satisfy the conditions above, compensation of one's damages is far from guaranteed — in fact, not even promised. Defendant has agreed only to provide "dedicated customer support assistance" (also not defined) and to consider "all relevant facts and circumstances" in determining an "appropriate" settlement offer. In short, Defendant would enjoy complete and unfettered discretion to determine what a "reasonable" amount an identity theft victim is entitled to for his or her damages, and the victim's only avenue for disputing the outcome is binding arbitration.

The Proposed Release Is Unduly Broad

The State is also concerned about the overly broad release in the proposed Settlement Agreement. The definition of "Released Parties" should be amended to clarify that the entities or individuals who engaged in the unauthorized access ("Defendant Does" in Plaintiff's First Amended Complaint) are not "Released Parties," even if such individuals or entities would otherwise fall within the expansive definition of the group. Nor should they be considered "third party beneficiaries" of the Settlement Agreement.

Moreover, one provision purports to release future claims that may be brought by a "government entity." Similarly, the definition of Releasing Parties includes not only Class Members, but his or her "representative of any kind," which could be interpreted to include Attorneys General and other law enforcement officers or regulators who are authorized to bring claims on behalf of consumers. The Texas Attorney General is not a party in this case, has causes of action that are separate and distinct from the causes of action available to class members, and has separate and distinct interests in bringing claims, even when seeking relief on behalf of individuals. Therefore, any settlement in this matter should not purport, claim, or attempt to bar future claims by a government entity.

For the reasons described above, the State of Texas is concerned about the fairness and propriety of the proposed Settlement Agreement in this case and, accordingly, objects. Sincerely, LESLI GATTIS GINN Assistant Attorney General Financial Litigation Division TEL: (512) 936-0538 FAX: (512) 477-2348 ALT FAX. (512) 480-8327 C. BRAD SCHUELKE Assistant Attorney General Section Chief, Internet Enforcement Consumer Protection Division TEL: (512) 463-1269 FAX: (512) 473 8301