In re Heartland Payment Systems: Data Breach Case

Administrator
Site Admin
Posts: 11757
Joined: Tue Jul 26, 2005 4:15 am

In re Heartland Payment Systems: Data Breach Case

Postby Administrator » Tue Oct 28, 2014 9:36 pm

In re Heartland Payment Systems, Inc. Customer Data Sec. Breach Litigation
851 F.Supp.2d 1040
S.D.Tex.,2012.
March 20, 2012


MEMORANDUM AND ORDER

LEE H. ROSENTHAL, District Judge.

This is a consumer class action certified under Federal Rule of Civil Procedure 23(b)(3) for settlement. The class is large—over one hundred million payment-card FN1 holders—and dispersed across the country. Despite a vigorous notice campaign, only eleven valid claims have been filed. Damages are almost entirely in the form of cy pres payments to third-party nonprofit organizations whose work is related to class interests. This opinion addresses settlement-class certification, settlement approval, and attorneys' fees. As part of determining a reasonable fee award, the court discounts the value of the cy pres payments to reflect the fact that the benefit to the class is indirect.


FN1. “Payment cards” refers to both credit and debit cards issued by issuer banks. See In re Heartland Payment Sys., Inc. Customer Data Security Breach Litig. ( “Heartland II” ), 834 F.Supp.2d 566, 574 & n. 4, 2011 WL 6012598, at *1 & n. 4 (S.D.Tex.2011).




In January 2009, Heartland Payment Systems, Inc. (“Heartland”) publicly disclosed that hackers had breached its computer systems and obtained confidential payment-card information for over one hundred million consumers. FN2 Lawsuits were filed in state and federal courts across the country. The Judicial Panel on Multidistrict Litigation transferred the federal cases to this court under 28 U.S.C. § 1407. (Docket Entry No. 1). Payment-card holders filed individual lawsuits and class actions, claiming that Heartland had negligently failed to protect their personal financial information from disclosure. Financial institutions that issued cards also sued Heartland, claiming that the data breach caused them to incur damages, including the costs of canceling and replacing payment cards.FN3 The cases proceeded on two tracks, one for the “Financial Institution Plaintiffs” and one for the “Consumer Plaintiffs.”


FN2. The parties estimate that the data breach affected 130 million payment-card accounts.




FN3. Some of these financial institutions also filed a class-action lawsuit against two acquirer banks, Heartland Bank (unrelated to Heartland) and KeyBank, that had hired Heartland to process their merchants' payment-card transactions. See In re Heartland Payment Sys., Inc. Customer Data Security Breach Litig. ( “Heartland I” ), MDL No. 2046, 2011 WL 1232352 (S.D.Tex. Mar. 31, 2011). That case recently was dismissed with prejudice. See In re Heartland Payment Sys., Inc. Customer Data Security Breach Litig. ( “Heartland III” ), MDL No. 2046, 2012 WL 896256, 2012 U.S. Dist. LEXIS 34067 (S.D.Tex. Mar. 14, 2012).




In December 2009, the Consumer Plaintiffs and Heartland reached a settlement agreement (“Agreement”). (Docket Entry No. 57). After a hearing, (Docket Entry No. 82), the court in April 2010 certified a nationwide settlement class and approved notice of the Agreement, (Docket Entry No. 85). After an extensive notice campaign, eleven valid claims for losses and one objection have been filed. The Consumer Plaintiffs have moved for final approval of the Agreement, for an award of attorneys' fees, and for incentive awards for certain plaintiffs. (Docket Entry No. *1048 107). The Consumer Plaintiffs filed a supporting memorandum. (Docket Entry No. 108). Heartland filed a memorandum supporting the settlement but taking no position on the fees or incentive awards. (Docket Entry No. 109). The court held a final fairness hearing. (Docket Entry No. 110).


Based on the memoranda in support of the proposed Agreement, the one objection, the parties' arguments at the preliminary and final fairness hearings, the remainder of the record, and the relevant law, this court: (1) reviews its preliminary certification of the settlement class; (2) approves the proposed settlement; (3) approves attorneys' fees in the amount of $606,192.50; (4) approves costs in the amount of $35,000; and (5) denies the proposed incentive awards. The reasons are explained in detail below.


I. The Litigation and Proposed Settlement Agreement

A. Background

Heartland is a payment-card processor. It contracts with businesses to process their Visa and MasterCard transactions. The Consumer Plaintiffs are payment-card holders. The factual background can be briefly summarized:


Beginning at least as early as December 2007, three hackers—an American, Albert Gonzalez, and two unknown Russians—infiltrated Heartland's computer systems. The hackers installed programs that allowed them to capture some of the payment-card information stored on the Heartland computer systems. In late October 2008, Visa alerted Heartland to suspicious account activity. Heartland, with Visa and MasterCard and others, investigated. Heartland discovered suspicious files in its systems on January 12, 2009. A day later, Heartland uncovered the program creating those files. That program provided the hackers with access to data on the systems. On January 20, Heartland publicly announced the data breach. The hackers obtained payment-card numbers and expiration dates for approximately 130 million accounts. For some of these accounts, the hackers also obtained cardholder names. They did not obtain any cardholder addresses, however, which meant that the stolen card information generally could be used only for in-person transactions.


Heartland II, 834 F.Supp.2d at 575, 2011 WL 6012598, at *2 (internal citations omitted).


The Consumer Plaintiffs' suits assert claims for negligence, breach of contract, various state statutory violations, and violations of the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (Docket Entry No. 3). Aside from motions relating to appointing class counsel, the only motions filed in the Consumer Plaintiffs track were unopposed motions for extensions of time to file the master complaint. (Docket Entry Nos. 31, 53). The master complaint was to be filed by December 18, 2009. (Docket Entry No. 55). On that date, and before the Consumer Plaintiffs had filed a master complaint, the parties submitted the proposed settlement. (Docket Entry No. 57). No formal discovery occurred. Instead, the parties engaged in what Heartland's counsel termed “confirmatory discovery.” Heartland gave counsel for the Consumer Plaintiffs over 4,000 pages relating to the data breach and allowed counsel to interview Heartland's Chief Technology Officer. (Docket Entry No. 111, at 9–10).


B. The Proposed Settlement Agreement

The proposed settlement binds “all Persons in the United States who had or have a payment card that was used in the United*1049 States between and including December 26, 2007 and December 31, 2008 (the ‘Settlement Class Period’), and who allege or may allege that they have suffered and of the Losses defined herein.” (Docket Entry No. 57, ¶ 1.20). The settlement excludes “Heartland and its officers and directors, and those Persons who timely and validly request exclusion from the Settlement Class.” ( Id.) By remaining in the class, each member gives up the right to bring any action “stemming from the Heartland Intrusion” against Heartland, KeyBank National Association, Heartland Bank, and any “Related Parties” FN4 of those three entities. ( See id., ¶¶ 1.16–.18).


FN4. The Agreement defines “Related Parties” as “an entity's past or present directors, officers, employees, principals, agents, attorneys, predecessors, successors, parents, subsidiaries, divisions and related or affiliated entities, and includes, without limitation, any Person related to such entity who is, was or could have been named as a defendant in any of the actions in the litigation.” (Docket Entry No. 57, ¶ 1.15).




Within ten days after preliminary court approval, Heartland had to deposit $1 million into an interest-bearing escrow account. That sum was to “be used to reimburse Settlement Class Members who are determined to have submitted Valid Claims[.]” ( Id., ¶ 2.1). If the valid claims exceeded $1 million, Heartland had to deposit into the account an additional $500,000; if that was exhausted, another $500,000; and finally an additional $400,000. ( Id., ¶ 2.1(a)). Heartland had to deposit at least $1 million and at most $2.4 million to fund the settlement. If any unpaid balance remained on the initial $1 million (and interest) after all valid claims were paid, that balance was to “be transferred to a non-profit organization(s) dedicated to the protection of consumers' privacy rights, with emphasis on advancing the implementation of end-to-end encryption of payment card authorization transactions or similar security enhancements.” ( Id., ¶ 2.1(b)).FN5


FN5. The Agreement provides that if all valid claims exceed $2.4 million, then each claim will be reduced proportionally. ( Id., ¶ 2.2(c)).




Under the Agreement, “[a] Valid Claim shall consist of only those ‘Losses' ... that a Settlement Class Member ... proves by a preponderance of the evidence (i.e., more likely than not to be true), to have directly and proximately resulted from information relative to an Eligible Payment Card Account of such Settlement Class Member having been stolen or placed at risk as a result of the Heartland Intrusion[.]” ( Id., ¶ 2.2). The Agreement defines four categories of “Losses”: (1) out-of-pocket expenses from card cancellations or replacements; (2) out-of-pocket expenses from unauthorized and unreimbursed account charges; (3) out-of-pocket expenses from identity theft; and (4) “a reasonable amount for time (calculated at $10 per hour up to five (5) hours)” spent on these three types of losses. ( Id., ¶ 2.2(b)). “Losses” specifically exclude “credit monitoring or insurance costs incurred by Settlement Class Members, attorneys' fees, attorneys' costs or attorneys' expenses incurred by Settlement Class Members, or losses resulting from any information having been stolen or placed at risk of being stolen from an entity other than from Heartland.” ( Id.).


The Agreement also creates a claims process. ( Id., ¶¶ 2.2(c)-(d)). Any claim must be submitted by August 1, 2011. ( Id., ¶ 2.2(c)). Reimbursement is capped at $175 for any valid claim not involving identity theft and at $10,000 for any valid identity-theft claims. Each household is limited to two valid claims. ( Id., ¶ 2.2(b)).


The Agreement requires Heartland to pay, “subject to Court approval,” up to $725,000 for attorneys' fees and up to *1050 $35,000 for attorneys' costs and expenses. ( Id., ¶ 7.2). It also requires Heartland to pay, again “subject to Court approval,” incentive awards of $200 to each Representative Consumer Plaintiff and $100 to all other Named Plaintiffs. The Agreement includes the following disclaimer:


The Settling Parties did not discuss attorneys' fees, costs, and expenses, or incentive awards to Representative Consumer Plaintiffs and Named Plaintiffs, as provided for in ¶¶ 7.2 and 7.3, until after the substantive terms of the settlement had been agreed upon, other than that Heartland would pay reasonable attorneys' fees, costs, and expenses, and incentive awards to Representative Consumer Plaintiffs and named Plaintiffs as may be agreed to by Heartland and Co–Lead Settlement Class Counsel, and/or as ordered by the Court, or, in the event of no Agreement, then as ordered by the Court. Heartland and Co–Lead Settlement Class Counsel then negotiated and agreed [to these provisions.]


( Id., ¶ 7.1).


The Agreement explains how class members may object, ( id., ¶ 5.1), and how they may opt out of the class, ( id., ¶¶ 4.1–.2).


C. The Record

After the first fairness hearing, (Docket Entry No. 82), the court preliminarily certified the settlement class and approved class notice. (Docket Entry No. 85). According to Cameron Anzari, the Director of Notice for Hilsoft Notifications, the court-appointed company tasked with helping write the notices and designing and carrying out the notice campaign, the notices “reached at least 81.4% of potential Settlement Class Members an estimated 2.5 times through a combination of notice placements in newspaper supplements, consumer magazines and on selected websites.” (Docket Entry No. 106, ¶ 6(a)).


One class member, Michael Kostka, filed a pro se objection. He appears to suggest that the data breach did not actually harm most consumers in the class, making the settlement unfair to Heartland. (Docket Entry No. 100).


The Consumer Plaintiffs moved for final court approval of the settlement, fees, costs and expenses, and incentive awards. (Docket Entry No. 107). Under Federal Rule of Civil Procedure 23(e), this court held a final fairness hearing on the Agreement on December 13, 2010. (Docket Entry No. 110). Heartland advised that as of December 9, class members had filed 290 claims. Heartland estimated that perhaps 11 of those claims were valid. (Docket Entry No. 111, at 6). Counsel for the Consumer Plaintiffs did not disagree with this estimate.FN6 Almost all of the $1 million Heartland committed to deposit in the settlement fund would be transferred to the designated nonprofit organizations under the Agreement's cy pres provision. ( Id., at 4–5, 17). The parties had agreed to divide the cy pres funds evenly among three nonprofit organizations: Smart Card Alliance, which promotes the use of chip-and-pin technology FN7 in payment cards; the Secure POS Vendor Alliance, which promotes the implementation of end-to-end encryption and other security measures for payment cards; and the Financial Services Information Sharing Analysis Center, which notifies financial institutions *1051 about data intrusions and how to prevent them. ( Id., at 17–22).


FN6. Neither Heartland nor the Consumer Plaintiffs have updated the court on any additional claims, valid or otherwise, filed since the final fairness hearing.




FN7. According to Heartland, chip-and-pin technology is “used in every country in the world except for the United States, China and India” and “has been shown to dramatically decrease credit card fraud.” (Docket Entry No. 111, at 18).




After the final fairness hearing, the Consumer Plaintiffs filed detailed reports showing their attorneys' time, costs, and expenses for this case. (Docket Entry No. 113). Heartland filed an affidavit explaining its previous contributions to the three organizations proposed as recipients of the cy pres payments. (Docket Entry No. 114). This affidavit also explained that any cy pres funds paid to these organizations would be in addition to Heartland's normal annual contributions to them. ( Id., ¶ 4).


Class certification, settlement approval, and the fee and incentive awards are each analyzed below.


II. Class Certification

The Consumer Plaintiffs previously moved to certify a settlement class. (Docket Entry No. 75). The proposed class consisted of:


all persons in the United States who had or have a payment card that was used in the United States between and including December 26, 2007 and December 31, 2008 (the “Settlement Class Period”), and who allege or may allege that they have suffered any of the Losses defined herein. Excluded from the definition of Settlement Class are Heartland and its officers and directors, and those Persons who timely and validly request exclusion from the Settlement Class.


(Docket Entry No. 75, ¶ 7 (quoting Docket Entry No. 57, ¶ 1.20)). After the preliminary fairness hearing, this court certified the class, noting that the evidence received at the final fairness hearing still had to be considered. (Docket Entry No. 85, ¶ 4). Reviewing the certification on the basis of all the parties' submissions and the final fairness hearing is appropriate.


[1] Headnote Citing References Class certification requires a “rigorous analysis of Rule 23 prerequisites.” Madison v. Chalmette Ref., L.L.C., 637 F.3d 551, 554 (5th Cir.2011) (internal quotation marks omitted) (citing Gen. Tel. Co. v. Falcon, 457 U.S. 147, 161, 102 S.Ct. 2364, 72 L.Ed.2d 740 (1982)). The rigor required does not diminish in the settlement-class context. See Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 620, 117 S.Ct. 2231, 138 L.Ed.2d 689 (1997). A district court may not “substitut[e] the fairness inquiry of Rule 23(e) for the certification requirements of Rule 23(a) and (b).” Thomas v. Albright, 139 F.3d 227, 235 (D.C.Cir.1998) (discussing Amchem ). “[T]he party seeking certification [ ] bears the burden of establishing that the requirements of Rule 23 have been met.” Madison, 637 F.3d at 554–55 (internal quotation marks omitted). But “[t]he fact that a settlement has been reached is, of course, relevant.” Smith v. Sprint Commc'ns. Co., 387 F.3d 612, 614 (7th Cir.2004). A court need not determine under Rule 23(b)(3)(D) whether the proposed settlement class action would be manageable for trial. Amchem, 521 U.S. at 620, 117 S.Ct. 2231.


The class-certification analysis may require consideration of the suit's underlying merits. Wal–Mart Stores, Inc. v. Dukes, ––– U.S. ––––, 131 S.Ct. 2541, 2551–52, 180 L.Ed.2d 374 (2011).FN8 A merits inquiry must be “limited to those aspects relevant to making the certification decision on an informed basis.” Sullivan v. DB Invs., Inc., 667 F.3d 273, 305 (3d Cir.2011) (en banc) (quoting Fed. R. Civ. P. 23 Committee Notes (2003)); see also *1052 Taylor v. United Parcel Serv., Inc., 554 F.3d 510, 520 (5th Cir.2008) (discussing the “limited inquiry” into the merits).


FN8. See also Ellis v. Costco Wholesale Corp., 657 F.3d 970, 981 (9th Cir.2011) (“More importantly, it is not correct to say that a district court may consider the merits to the extent that they overlap with class certification; rather, a district court must consider the merits if they overlap with the Rule 23(a) requirements.”).




The Fifth Circuit has indicated that the preponderance standard applies to the Rule 23 determination. See Alaska Elec. Pension Fund v. Flowserve Corp., 572 F.3d 221, 228–29 (5th Cir.2009) (per curiam). The Second and Third Circuits require the party seeking class certification to satisfy each Rule 23 requirement by a preponderance of the evidence. See Novella v. Westchester Cnty., 661 F.3d 128, 148–49 (2d Cir.2011) (citing In re Initial Pub. Offerings Securities Litig., 471 F.3d 24, 41 (2d Cir.2006)); Gates v. Rohm & Haas Co., 655 F.3d 255, 262 (3d Cir.2011) (citing In re Hydrogen Peroxide Antitrust Litig., 552 F.3d 305, 320 (3d Cir.2008)). Other circuits state the standard less clearly. See, e.g., DG ex rel. Stricklin v. Devaughn, 594 F.3d 1188, 1194 (10th Cir.2010) (“The party seeking class certification bears the burden of proving Rule 23's requirements are satisfied.”). In this case, the Consumer Plaintiffs have met their burden of establishing the Rule 23 requirements by a preponderance of the evidence.


A. Rule 23(a)

Any proposed class must meet four requirements:


(1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law or fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class.


Fed. R. Civ. P. 23(a). These requirements “effectively limit the class claims to those fairly encompassed by the named plaintiff's claims.” Dukes, 131 S.Ct. at 2550 (internal quotation marks omitted).



1. Numerosity

The proposed class encompasses at least one hundred million individuals, spread throughout the United States. The numerosity requirement is satisfied.



2. Commonality

Under previous Fifth Circuit precedent, commonality required “one common question of law or fact” to the class. James v. City of Dallas, Tex., 254 F.3d 551, 570 (5th Cir.2001). In Wal–Mart Stores v. Dukes, the Supreme Court held that the mere “raising of common ‘questions' of law or fact” is no longer sufficient. 131 S.Ct. at 2551 (quoting Richard A. Nagareda, Class Certification in the Age of Aggregate Proof, 84 N.Y.U. L. Rev. 97, 132 (2009)). The Dukes Court explained that commonality requires classwide proceedings to have the ability “to generate common answers apt to drive the resolution of the litigation.” Id. (quoting Nagareda, Class Certification, 84 N.Y.U. L. Rev. 97, 132 (emphasis in original)); see also American Law Institute, Principles of the Law of Aggregate Litigation § 2.02 cmt. a (2010) [“Aggregate Litigation”] (stating that “courts should consider whether aggregate treatment of a common issue by way of a class action will materially advance the resolution of multiple civil claims by addressing the core of the dispute in a manner superior to other realistic procedural alternatives such that aggregate treatment would generate significant judicial efficiencies”).


Dukes does not require that all questions of law and fact be common, Ellis, 657 F.3d at 981, or that each class member have “suffered a violation of the same provision of law,” Dukes, 131 S.Ct. at 2551. Instead, “[t]heir claims must depend upon a common contention .... That common contention, moreover, must be of such a nature that it is capable of classwide resolution—which means that determination of *1053 its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke.” Id. Commonality “is informed by the defendant's conduct as to all class members and any resulting injuries common to all class members [.]” Sullivan, 667 F.3d at 297. “The focus in the settlement context should be on the conduct (or misconduct) of the defendant and the injury suffered as a consequence.” Id. at 335 (Scirica, J., concurring).


Applying Dukes, two recent circuit cases have found commonality satisfied. In Sullivan v. DB Investments, plaintiffs filed class actions alleging that De Beers, “the dominant participant in the wholesale market for gem-quality diamonds throughout much of the twentieth century,” had “exploited its market dominance to artificially inflate the prices of rough diamonds.” Id. at 286 (majority opinion). These class-action lawsuits alleged that De Beers's conduct violated state and federal antitrust law and state consumer-protection statutes, and constituted unjust enrichment, unfair business practices, and false advertising under state law. The suits were transferred under MDL for pretrial management. The plaintiffs fell into two categories: those who bought directly from De Beers or a De Beers competitor, and those who purchased diamonds from a direct purchaser (such as consumers). De Beers reached settlements with both the direct- and indirect-purchasers classes. Id. at 286–88. The district court, over substantial objections, certified the nationwide classes for settlement and approved the settlement. Id. at 290–91. On appeal, the Third Circuit reversed based on the fact that some of the states precluded any recovery for indirect purchasers, who nonetheless would recover under the settlement. The class successfully sought en banc rehearing. The main question before the en banc court was whether these state-law variations precluded finding predominance. A subsidiary issue was whether the proposed classes could demonstrate commonality. The en banc court addressed commonality and predominance together because, under Third Circuit precedent, “the Rule 23(a) commonality requirement [is] incorporated into the more stringent Rule 23(b)(3) predominance requirement[.]” Id. at 297 (internal quotation marks omitted). The court found both. The classes shared common questions of fact: whether De Beers engaged in anticompetitive activity, and whether that activity resulted in artificially inflated diamond prices. “These allegations are unaffected by the particularized conduct of individual class members, as proof of liability and liability itself would depend entirely upon De Beers's allegedly anticompetitive activities.” Id. at 300. The classes also shared common questions of law: whether De Beers's anticompetitive activity violated federal and state antitrust law. Id. at 300 & n. 23. “Evidence for this legal question would entail generalized common proof as to the implementation of De Beers's conspiracy, the form of the conspiracy, and the duration and extent of the conspiracy.” Id. at 300 (internal quotation marks and alteration omitted). These questions, according to the en banc court, satisfied the Dukes mandate that the common questions result in common answers. “[T]he answers to questions about De Beers's alleged misconduct and the harm it caused would be common as to all of the class members, and would thus inform the resolution of the litigation if it were not being settled.” Id. at 299–300.


In Ross v. RBS Citizens, N.A., 667 F.3d 900 (7th Cir.2012), a proposed class of over 1,000 current and former employees of Charter One, which operated over 100 banks in Illinois, alleged that the bank maintained an unofficial policy of denying overtime pay to its employees. The class asserted violations of the Fair Labor Standards Act and the Illinois Minimum Wage Law. Id. at 902–03. The district court *1054 certified the class for trial. Id. at 903. In finding that the class had demonstrated commonality, the Seventh Circuit distinguished Dukes because Ross involved a central, if unofficial, policy of denying employees' overtime pay. “This unofficial policy is the common answer that potentially drives the resolution of this litigation.” Id. (citing Dukes, 131 S.Ct. at 2551); see also McReynolds v. Merrill Lynch, Pierce, Fenner & Smith, Inc., 672 F.3d 482, 489–91 (7th Cir.2012) (holding that commonality was satisfied by the questions of whether Merrill Lynch's companywide “teaming” and account-distribution policies violated Title VII's prohibition on disparate-impact employment discrimination and distinguishing these policies from the policy of conferring discretion on each store's manager at issue in Dukes ).


[2] Headnote Citing References This case is more similar to Sullivan, Ross, and McReynolds than to Dukes. The common factual question in this case is what actions Heartland took before, during, and after the data breach to safeguard the Consumer Plaintiffs' financial information. As in Sullivan, “the answers to questions about [Heartland]'s alleged misconduct and the harm it caused would be common as to all of the class members, and would thus inform the resolution of the litigation if it were not being settled.” 667 F.3d at 299–300; see also Ross, 667 F.3d at 908 (“To satisfy the commonality element, it is enough for plaintiffs to present just one common claim.”). Questions of law common to all class members include whether Heartland's actions violated the Fair Credit Reporting Act.FN9 Answering the factual and legal questions about Heartland's conduct will assist in reaching classwide resolution. Commonality is satisfied under the Dukes standard.


FN9. Whether this claim, or any of the others, has any merit is not the question at this stage of the litigation. See Sullivan, 667 F.3d at 308 (“[T]he Rule 23 inquiry does not, and should not, involve a Rule 12(b)(6) inquiry.”).





3. Typicality

This element of Rule 23(a) “requires that the named representatives' claims be typical of those of the class.” Langbecker v. Elec. Data Sys. Corp., 476 F.3d 299, 314 (5th Cir.2007). Typicality, according to the Fifth Circuit,


does not require a complete identity of claims. Rather, the critical inquiry is whether the class representative's claims have the same essential characteristics of those of the putative class. If the claims arise from a similar course of conduct and share the same legal theory, factual differences will not defeat typicality.


James, 254 F.3d at 571 (quoting 5 James Wm. Moore et al., Moore's Federal Practice ¶ 23.24[4] (3d ed. 2000)).


[3] Headnote Citing References The representative plaintiffs' Fair Credit Reporting Act claim is typical of the class claim. Whether Heartland's conduct violated the Act is common throughout the class. Because this claim revolves around Heartland's conduct, as opposed to the characteristics of a particular class member's claim, no individualized proof will be necessary to determine Heartland's liability under the Act.


The state-law claims also meet the typicality requirement. Although the parties did not present information about the applicable laws of the fifty states and the District of Columbia, presumably variations exist among them. District courts are divided as to when variations in state law in a multistate class action defeat typicality.FN10 In Stirman, the Fifth Circuit *1055 held that significant variations in state law may preclude a finding of typicality. “Given the differences among the state laws, it cannot be said that [the class representative]'s claims are ‘typical’ of the [multistate] class as it is currently defined[.]” Stirman v. Exxon Corp., 280 F.3d 554, 562 (5th Cir.2002). The variations in Stirman were similar to those in Sullivan: certain states did not recognize the claim that the class representatives asserted. See id. Such claim-dispositive variations are readily distinguishable from such differences as dissimilarities in specific claim elements that must be proven at trial, or differences in burdens of proof. As in Overka, the state-law claims that the Consumer Plaintiffs assert in this case—negligence, breach of contract, and violations of state consumer-protection laws—“are recognized in some form in all jurisdictions and therefore available for all [class members.]” 265 F.R.D. at 18–19. Despite possible state-by-state variations in the elements of these claims, they arise from a single course of conduct by Heartland and a single set of legal theories. James, 254 F.3d at 571; see also Norwood v. Raytheon Co., 237 F.R.D. 581, 588 (W.D.Tex.2006) (finding typicality met because “general causation and general negligence do not depend on the nature of individual class members' claims”).


FN10. Compare, e.g., In re Panacryl Sutures Prods. Liab. Cases, 263 F.R.D. 312, 322 (E.D.N.C.2009) (concluding that typicality was not satisfied when the “Plaintiffs have not shown that the prospective class representatives' claims will take into account the substantive laws [of multiple states] governing every class members”); In re Vioxx Prods. Liab. Litig., 239 F.R.D. 450, 460 (E.D.La.2006) (“The applicability of multiple substantive laws also precludes a finding of typicality.”); with, e.g., Overka v. Am. Airlines, Inc., 265 F.R.D. 14, 18–19 (D.Mass.2010) (finding typicality despite variations in state law because the state-law claims “are recognized in some form in all jurisdictions and therefore available for all [class members]”); Chemi v. Champion Mortg., No. 2:05–cv–1238 (WHW), 2009 WL 1470429, at *7 (D.N.J. May 26, 2009) (similar).




The typicality requirement of Rule 23(a) is satisfied.



4. Adequate Representation

[4] Headnote Citing References[5] Headnote Citing References[6] Headnote Citing References[7] Headnote Citing References[8] Headnote Citing References “To meet Rule 23 requirements [for adequate representation], the court must find that class representatives, their counsel, and the relationship between the two are adequate to protect the interests of absent class members.” Unger v. Amedisys Inc., 401 F.3d 316, 321 (5th Cir.2005). Counsel must be both competent and zealous in representing class interests. See, e.g., Feder v. Elec. Data Sys. Corp., 429 F.3d 125, 130 (5th Cir.2005). Class representatives “must satisfy the court that they, and not counsel, are directing the litigation. To do this, class representatives must show themselves sufficiently informed about the litigation to manage the litigation effort.” Unger, 401 F.3d at 321. Finally, “the Rule 23 adequacy inquiry also uncovers conflicts of interest between the named plaintiffs and the class they seek to represent.” Langbecker, 476 F.3d at 314 (internal quotation marks omitted); accord Amchem, 521 U.S. at 625, 117 S.Ct. 2231. “[I]ntraclass conflicts may negate adequacy under Rule 23(a)(4).” Langbecker, 476 F.3d at 315. According to the Third Circuit, adequacy of representation is the most important single factor in determining whether to certify a settlement class. See In re Prudential Ins. Co. Am. Sales Practice Litig. Agent Actions, 148 F.3d 283, 308 (3d Cir.1998) (“Indeed, the key to Amchem appears to be the careful inquiry into adequacy of representatives.”).


[9] Headnote Citing References The dual requirements of class counsel's competence and zeal are satisfied here. The three co-lead class counsel—Ben Barnow, Lance Harke, and Burton Finkelstein—each have extensive experience representing consumers, and other plaintiff classes, in class-action litigation. ( See Docket Entry No. 9, Ex. A). Barnow and Finkelstein, in particular, also have *1056 experience representing consumer classes in similar data-breach cases. ( See id.) The liaison counsel for the class, Harold Gold, also has significant experience serving as plaintiffs' counsel in class-action and multidistrict litigation. ( See id., Ex. B). Class counsel have been vigorous in representing the class, as demonstrated by their successful negotiation of a settlement with Heartland, which initially was reluctant to settle. ( See Docket Entry No. 87, at 27–28).


[10] Headnote Citing References[11] Headnote Citing References[12] Headnote Citing References Analyzing adequacy of the class representatives focuses on whether there are intraclass conflicts between the class representatives and those they seek to represent. See Langbecker, 476 F.3d at 314. A class representative must “possess the same interest and suffer the same injury as the class members.” Amchem, 521 U.S. at 625–26, 117 S.Ct. 2231 (internal quotation marks omitted). The class representatives have the same interests, and assert the same type of injury, as the members they seek to represent. Neither Heartland nor any objector has raised any fundamental intraclass conflict, and the record discloses none. The definition of compensable “Losses” in the Agreement reduces differences in damages among class members and between the representatives and absent members.


Adequacy also implicates the class representatives' involvement in the litigation. In Unger, a securities class action, the Fifth Circuit stated that adequate representation requires the class representatives to “show themselves sufficiently informed about the litigation to manage the effort,” given that they—not class counsel—must “direct[ ] the litigation.” 401 F.3d at 321. The Unger court cited Berger v. Compaq Computer Corp., 257 F.3d 475, 482 (5th Cir.2001), another securities class action. The Ninth Circuit has limited the so-called Berger requirement to securities cases. See In re Cavanaugh, 306 F.3d 726, 736–37 (9th Cir.2002); see also 1 William B. Rubenstein et al., Newberg on Class Actions § 3.52 & n. 15 (5th ed. 2011); 29A Edward K. Esping et al., Federal Procedure, Lawyers' Edition § 70:374 (2012). The Fifth Circuit has not similarly limited Berger. FN11 In another securities case, the Fifth Circuit interpreted Berger as “identif[ying] a generic standard for the adequacy requirement [.]” Feder, 429 F.3d at 129 (internal quotation marks omitted). The Eleventh Circuit agrees that this is a “generic standard.” See London v. Wal–Mart Stores, Inc., 340 F.3d 1246, 1254 n. 3 (11th Cir.2003).


FN11. In Berger, the plaintiffs petitioned for rehearing, arguing that Berger had “created an additional, independent requirement for the adequacy standard for class certification under Federal Rule of Civil Procedure 23 by reading the provisions of the Private Securities Litigation Reform Act of 1995 (‘PSLRA’) into rule 23(a)(4).” Berger v. Compaq Computer Corp., 279 F.3d 313, 313 (5th Cir.2002) (per curiam). In denying the petition, the panel responded: “This we have not done, nor have we changed the law of this circuit for conducting a rule 23(a)(4) adequacy inquiry.” Id.




[13] Headnote Citing References Nonetheless, Berger 's “generic standard” has not been applied in the Fifth Circuit outside the securities context. Although some district courts in the circuit have extended it beyond the securities cases, see Ogden v. AmeriCredit Corp., 225 F.R.D. 529, 532 n. 2 (N.D.Tex.2005) (discussing the Berger requirement's applicability outside the securities context and citing cases), courts have not extended the Berger requirement to a negative-value consumer class action such as this case.FN12 *1057 Courts outside this circuit do not demand Berger ' s knowledge-and-direction requirement for consumer class actions such as this suit, instead focusing on the more traditional aspects of adequacy: ensuring no intraclass conflicts and class counsel's adequacy.FN13 “Class counsel owe a fiduciary obligation of particular significance to their clients when the class members are consumers, who ordinarily lack both the monetary stake and the sophistication in legal and commercial matters that would motivate and enable them to monitor the efforts of class counsel on their behalf.” Creative Montessori Learning Ctrs. v. Ashford Gear LLC, 662 F.3d 913, 917 (7th Cir.2011) (Posner, J.); see also generally In re Cmty. Bank of N. Va., 622 F.3d 275, 292 (3d Cir.2010); Pelt v. Utah, 539 F.3d 1271, 1288 (10th Cir.2008).


FN12. See generally Jay Tidmarsh, Rethinking Adequacy of Representation, 87 Tex. L. Rev. 1137, 1167–68 (2009) (defining negative-value suits).


There are recent district-court cases in the Fifth Circuit that have applied Berger outside of the securities context. See Braud v. Transp. Servs. of Ill., Civ. A. Nos. 05–1898, 06–891, 05–1977, 05–5557, 2009 WL 2208524, at *10 (E.D.La. July 23, 2009) (environmental-torts class action); In re FEMA Trailer Formaldehyde Prods. Liab. Litig., No. MDL 071873, 2008 WL 5423488, at *11 (E.D.La. Dec. 29, 2008) (mass-torts class action). None is a negative-value consumer class action.

FN13. See, e.g., In re Pet Food Prods. Liab. Litig., 629 F.3d 333, 343–48 (3d Cir.2010) (appeal of adequacy determination focusing on intraclass conflicts); In re Pharm. Indus. Average Wholesale Price Litig., 588 F.3d 24, 36–37 & n. 12 (1st Cir.2009) (appeal focusing on class counsel's alleged conflict of interest); In re Gen. Motors Corp. Pick–Up Truck Fuel Tank Prods. Liab. Litig., 55 F.3d 768, 800–01 (3d Cir.1995) (looking only to intraclass conflicts and adequacy of class counsel to determine whether adequacy requirement met); In re M3 Power Razor Sys. Mktg. & Sales Practice Litig., 270 F.R.D. 45, 55 (D.Mass.2010) (adequacy satisfied because no intraclass conflicts existed and class counsel could adequately represent the class). One treatise explains the basis for this approach in small-claim consumer cases:
[I]n small claims cases [class representatives] have so little at stake that it would be irrational for them to take more than a tangential interest, while in all cases, including larger claim cases, class representatives generally lack the legal acumen to make key decisions about complex class action litigation, much less to monitor savvy class counsel. It has long been understood that class counsel control class actions, perhaps even selecting the class representatives themselves, thereby reversing, not inscribing, the standard attorney/client relationship. Put simply, class action attorneys are the real principals and the class representative/clients their agents.



1 Rubenstein et al., Newberg on Class Actions § 3.52 (Internal footnotes omitted).

As is true in many consumer-class actions comprised of negative-value individual claims, no single class member here has a sufficient stake to be closely involved in the litigation. See Creative Montessori, 662 F.3d at 917. Given the minimal individual stakes, Heartland's general denial of wrongdoing, and the complexities of crafting a class-action settlement, individual class members cannot plausibly be expected to have significant involvement. Far more important to the determination of adequacy than the submission of perfunctory declarations or brief deposition testimony are whether class counsel can adequately represent the class (yes), and whether any intraclass conflicts make the class representatives inadequate representatives of the class (no). Given the nature of this case, the record as to class counsel, and the absence of intraclass conflicts, there is no basis to find inadequate representation merely because the Consumer Plaintiffs have not submitted evidence on the class representatives' involvement in the litigation and the settlement.


B. Rule 23(b)(3)

In addition to satisfying the Rule 23(a) requirements, “[t]he proposed class must also satisfy the requirements of Rule 23(b)(1), (2), or (3).” In re Wilborn, 609 F.3d 748, 755 (5th Cir.2010). Under (b)(3), the Consumer Plaintiffs must establish that “questions of law or fact common to class members predominate over any questions*1058 affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” Fed. R. Civ. P. 23(b)(3).



1. Predominance

“The Rule 23(b)(3) predominance inquiry tests whether proposed classes are sufficiently cohesive to warrant adjudication by representation.” Amchem, 521 U.S. at 623, 117 S.Ct. 2231; cf. Aggregate Litigation § 3.06 cmt. a (“So long as there is sufficient commonality to establish that the class is generally cohesive, the propriety of a settlement need not depend on satisfaction of a ‘predominance’ requirement.”). The Fifth Circuit recently compared this inquiry to the commonality question:


The question of predominance is more demanding than the Rule 23(a) requirement of commonality. It requires the court to assess how the matter will be tried on the merits, which entails identifying the substantive issues that will control the outcome, assessing which issues will predominate, and then determining whether the issues are common to the class.


Wilborn, 609 F.3d at 755 (internal quotation marks, footnotes, and citation omitted).


[14] Headnote Citing References A threshold issue is whether variations in state law “swamp any common issues and defeat predominance.” Cole v. Gen. Motors Corp., 484 F.3d 717, 724 (5th Cir.2007) (internal quotation marks omitted). A district court's “[f]ailure to engage in an analysis of state law variations is grounds for decertification.” Id.; cf. Hanlon v. Chrysler Corp., 150 F.3d 1011, 1022 (9th Cir.1998) (“Variations in state law do not necessarily preclude a 23(b)(3) action, but class counsel should be prepared to demonstrate the commonality of substantive law applicable to all class members.” (citing Phillips Petroleum Co. v. Shutts, 472 U.S. 797, 821–23, 105 S.Ct. 2965, 86 L.Ed.2d 628 (1985))). “[V]ariations in state law do not necessarily defeat predominance[.]” Sullivan, 667 F.3d at 297. In Sullivan, the question before the en banc Third Circuit was whether variations in state law that kept class members in certain states from recovering on the class claims defeated predominance. The original panel held that the case could not be certified for settlement because such variations in the applicable law meant that the claim did “not give rise to a legal right to recovery in all of the jurisdictions implicated by a nationwide class.” Sullivan v. DB Invs., Inc., 613 F.3d 134, 151 (3d Cir.2010). On rehearing, the en banc court explained that predominance was nonetheless satisfied. The fact that the Sullivan class was certified for settlement, rather than litigation, was “a particularly important point[.]” 667 F.3d at 303. The en banc majority found that those objecting to the predominance conclusion “seem to conflate the predicate predominance analysis for certification of a settlement class with that required for certification of a litigation class, relying exclusively upon cases implicating the manageability obstacles inherent in class litigation.” Id.


One of the cases cited was the Fifth Circuit's decision in Cole, a nationwide class action arising from General Motors's voluntary recall of certain models due to airbag defects. Three affected owners sued the auto manufacturer for breach of express and implied warranties and sought to represent everyone in the nation who owned a recalled model. 484 F.3d at 718–20. General Motors argued that the state-law variations on reliance and recovery for a latent defect defeated predominance. Id. at 725. The Fifth Circuit agreed that the class could not be certified for the purpose of litigation:


[M]any of the variations in state law raise the potential for the application of multiple and diverse legal standards and *1059 a related need for multiple jury instructions. For some issues, variations in state law also multiply the individualized factual determinations that the court would be required to undertake in individualized hearings.


Id. at 726. The Fifth Circuit decertified the class. The en banc court in Sullivan emphasized that because the certification was for settlement only, unlike in Cole, “the concern for manageability that is a central tenet of a litigation class is removed from the equation.” 667 F.3d at 302. The Sullivan court continued:


Because we are presented with a settlement class certification, “we are not as concerned with formulating some prediction as to how [variances in state law] would play out at trial, for the proposal is that there be no trial.” [ In re ] Ins. Broker. [ Antitrust Litig.], 579 F.3d [241] at 269 [ (3d Cir.2009) ] (internal citations & quotations omitted).... Accordingly, ... state law variations are largely “irrelevant to certification of a settlement class,” [ In re ] Warfarin [ Sodium Antitrust Litig.], 391 F.3d [516] at 529 [ (3d Cir.2004) ].


Id. at 303–04 (internal footnotes omitted). The court conceded that there may be some cases in which “variations in state laws are so significant so as to defeat commonality and predominance even in a settlement class action [.]” Id. at 304 n. 30 (internal quotation marks omitted). But when “the several common questions of law or fact aris[e] from a single central issue—namely, De Beers's alleged anticompetitive conduct and the resulting injury caused to each class member”—common issues clearly predominated over individual issues. Id. (internal quotation marks omitted).


[15] Headnote Citing References The present case is more like Sullivan than Cole, but the certification issue is much easier here than it was in Sullivan. Like Sullivan, this class is certified for settlement. Unlike Sullivan, in which numerous members objected, this proposed settlement drew only one objector. Also unlike Sullivan, any state-law variations here do not approach the level of precluding the ability of class members in certain states even to state a claim. Instead, any variations that might be present are well within the range of those affecting only trial manageability. When “[c]onfronted with a request for settlement-only class certification, a district court need not inquire whether the case, if tried, would present intractable management problems”—such as the need to present differing proof state-by-state or for the court to formulate differing jury instructions state-by-state—“for the proposal is that there be no trial.” Amchem, 521 U.S. at 620, 117 S.Ct. 2231.


As in Sullivan, this case presents several common questions of law and fact arising from a central issue: Heartland's conduct before, during, and following the data breach, and the resulting injury to each class member from that conduct. Given the settlement posture of this case and the Fair Credit Reporting Act claim, the common questions predominate over individual issues.



2. Superiority

Superiority examines whether a class action is a better vehicle for resolving a case than other possible methods, such as individual litigation or consolidation. The Rule lists four nonexhaustive factors relevant to superiority:


(A) the class members' interest in individually controlling the prosecution or defense of separate actions;



(B) the extent and nature of any litigation concerning the controversy already begun by or against class members;



(C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and



*1060 (D) the likely difficulties in managing a class action.


Fed. R. Civ. P. 23(b)(3). Under Amchem, this fourth factor may be disregarded in a proposed settlement-only class. 521 U.S. at 620, 117 S.Ct. 2231.


[16] Headnote Citing References[17] Headnote Citing References The predominance and superiority inquiries are closely related. See Sacred Heart Health Sys., Inc. v. Humana Military Healthcare Servs., Inc., 601 F.3d 1159, 1184 (11th Cir.2010). “The most compelling rationale for finding superiority in a class action” is “the existence of a negative value suit[.]” Castano v. Am. Tobacco Co., 84 F.3d 734, 748 (5th Cir.1996). The finding that common issues of law and fact predominate over individual issues, and the fact that this suit is a consumer class action comprised of negative-value suits, are important. Superiority is satisfied.


C. Conclusion as to Rule 23 Requirements

The proposed class meets the Rule 23 requirements for certification as a settlement-only class action. The motion for class certification, for the purpose of settlement, is granted.


III. Settlement Review

Federal Rule of Civil Procedure 23(e) requires court approval of a class settlement and establishes certain procedures:


(1) The court must direct notice in a reasonable manner to all class members who would be bound by the proposal.



(2) If the proposal would bind class members, the court may approve it only after a hearing and on finding that it is fair, reasonable, and adequate.



(3) The parties seeking approval must file a statement identifying any agreement made in connection with the proposal.



(4) If the class action was previously certified under Rule 23(b)(3), the court may refuse to approve a settlement unless it affords a new opportunity to request exclusion to individual class members who had an earlier opportunity to request exclusion but did not do so.



(5) Any class member may object to the proposal if it requires court approval under this subdivision (e); the objection may be withdrawn only with the court's approval.


Fed. R. Civ. P. 23(e). The court addresses each of these five requirements, with the (e)(2) fairness requirement discussed last.


A. Notice

[18] Headnote Citing References[19] Headnote Citing References “There are no rigid rules to determine whether a settlement notice satisfies constitutional or Rule 23(e) requirements[.]” Wal–Mart Stores, Inc. v. Visa U.S.A., Inc., 396 F.3d 96, 114 (2d Cir.2005). Instead, “a settlement notice need only satisfy the broad reasonableness standards imposed by due process.” In re Katrina Canal Breaches Litig., 628 F.3d 185, 197 (5th Cir.2010) (internal quotation marks omitted). Due process is satisfied if the notice provides class members with the “information reasonably necessary for them to make a decision whether to object to the settlement.” Id.; see also Wal–Mart Stores, 396 F.3d at 114 (explaining that “the settlement notice must fairly apprise the prospective members of the class of the terms of the proposed settlement and of the options that are open to them in connection with the proceedings” (internal quotation marks omitted)); Aggregate Litigation § 3.04(a) (“The purpose of a notice of a proposed class settlement is to set forth the major contours of the proposal and to inform class members of their right to attend the fairness hearing and to lodge written objections by a prescribed date should they so desire.”).


In moving for preliminary approval of the settlement, the Consumer Plaintiffs submitted proposed summary and detailed notices. (Docket Entry No. 76, Ex. 4). *1061 They also submitted the affidavit of Cameron Azari, the Director of Noticing for Hilsoft Notifications, a company that specializes in class-action notices with extensive experience in court-directed notice plans, (Docket Entry No. 76, Azari Aff.); Hilsoft's curriculum vitae, (Docket Entry No. 76, Ex. 1); Hilsoft's summary of the notice plan, (Docket Entry No. 76, Ex. 2); and a list of newspapers in which the notice would appear, ( id., Attach. B). After a preliminary fairness hearing, (Docket Entry No. 82), the court approved the proposed notice and notice plan as “the best notice practicable under the circumstances[.]” (Docket Entry No. 85, ¶ 12). Individual notice could not be provided through reasonable efforts. Heartland did not have the names and addresses of those affected by the data breach and could not reasonably request this information for 130 million accounts from the issuer banks. (Docket Entry No. 87, at 31–32). Consistent with prevailing standards, the court ordered the “Summary Notice” form to reach a minimum of 80 percent of the proposed class. (Docket Entry No. 85, ¶ 11).


[20] Headnote Citing References The notice that has been given clearly complies with Rule 23(e)(1)' s reasonableness requirement. The plan proposed by Hilsoft Notifications, ( see Docket Entry No. 76, Ex. 2), included summary notices placed in the two most popular Sunday newspaper supplements, Parade and USA Weekend, as well as in four popular national magazines; Internet advertisements on 24/7 Real Media, Yahoo.com, and MSN.com; and a press release submitted to nearly 4,500 major U.S. press outlets. ( Id., at 6).FN14 Each of these published notices directed potential class members to “an easy to remember domain name (www. hpscardholder settlement. com) where Settlement Class Members can obtain information and documents about the settlement, including the Detailed Notice, Claim Forms, and Settlement Agreement, as well as other documents and information deemed necessary.” ( Id.). Hilsoft Notifications analyzed the notice plan after its implementation and conservatively estimated that notice reached 81.4 percent of the class members. (Docket Entry No. 106, ¶ 32).


FN14. See Mirfasihi v. Fleet Mortg. Corp., 356 F.3d 781, 786 (7th Cir.2004) (Posner, J.) (explaining that, “[w]hen individual notice is infeasible, notice by publication in a newspaper of national circulation (here USA Weekend, a magazine that is included in hundreds of Sunday newspapers) is an acceptable substitute,” but also noting that, in this age of digital communications, newspaper notice should be supplemented by Internet notice).




Both the summary notice and the detailed notice provided the information reasonably necessary for the presumptive class members to determine whether to object to the proposed settlement. See Katrina Canal Breaches, 628 F.3d at 197. Both the summary notice and the detailed notice “were written in easy-to-understand plain English.” In re Black Farmers Discrimination Litig., 856 F.Supp.2d 1, 29, 2011 WL 5117058, at *23 (D.D.C.2011); accord Aggregate Litigation § 3.04(c).FN15 The notice provided “satisf[ies] the broad *1062 reasonableness standards imposed by due process” and Rule 23. Katrina Canal Breaches, 628 F.3d at 197 (internal quotation marks omitted).


FN15. The summary notice defined the class; explained what constituted “qualifying losses” and “identity-theft-related charges”; explained how to make a valid claim for such losses and charges; explained the recovery limits for such losses and charges; disclosed the requests for attorneys' fees and incentive awards; discussed when a hearing on approving the settlement would be, in which any class member could speak; and directed class members to the website (or to a toll-free phone number) where they could obtain or request further information about the settlement, including how to opt out or object. See Aggregate Litigation § 3.04(c). The detailed notice provided the same categories of information in a way that was more specific but still understandable. The detailed notice was subdivided and formatted to make it easy for a class member to get more information on a desired topic. The sections are: Basic Information, Who Is in the Settlement, The Settlement Benefits—What You Get If You Qualify, How to Get Benefits—Submitting a Claim Form If You Qualify, Excluding Yourself from the Settlement, The Lawyers Representing You, Objecting to the Settlement, The Court's Fairness Hearing, If You Do Nothing, and Getting More Information. (Docket Entry No. 76, Ex. 2, Attach. A).




B. Side Agreements

Rule 23(e) requires “[t]he parties seeking approval [to] file a statement identifying any Agreement made in connection with the proposal.” Fed. R. Civ. P. 23(e)(3). This requirement does not concern disclosure of the basic settlement terms; “[i]t aims instead at related undertakings that, although seemingly separate, may have influenced the terms of the settlement by trading away possible advantages for the class in return for advantages for others.” Id. Committee Notes (2003). “The spirit of [formerly numbered] Rule 23(e)(2) is to compel identification of any agreement or understanding,” written or oral, “that might have affected the interests of class members by altering what they may be receiving or foregoing.” Manual for Complex Litigation (Fourth) § 21.631 (2004) [“Manual”].


Aside from the general settlement terms, Heartland has agreed to pay class counsel up to $725,000 and $35,000 in attorneys' fees and costs, respectively; and to pay $200 and $100 to each representative plaintiff and named plaintiff, respectively, in incentive awards. (Docket Entry No. 57, ¶¶ 7.2–.3). The parties have stated that they did not discuss the specific amounts of attorneys' fees and costs and incentive awards “until after the substantive terms of the settlement had been agreed upon, other than that Heartland would pay” such reasonable fees, costs, and awards. ( Id., ¶ 7.1). All the amounts are subject to court review and approval. ( See id., ¶¶ 7.1–.3).


C. An Additional Opt–Out Opportunity

A certifying court may refuse to approve a settlement unless it provides an additional opportunity for class members to opt out. See Fed. R. Civ. P. 23(e)(4); Tardiff v. Knox Cnty., 567 F.Supp.2d 201, 209 (D.Me.2008). The 2003 amendments to the Federal Rules explain:


Rule 23(e)(3) [now (e)(4) ] authorizes the court to refuse to approve a settlement unless the settlement affords a new opportunity to elect exclusion in a case that settles after a certification decision if the earlier opportunity to elect exclusion provided with the certification notice has expired by the time of the settlement notice. A decision to remain in the class is likely to be more carefully considered and is better informed when settlement terms are known.


Fed. R. Civ. P. 23(e)(4) Committee Notes (2003). Rule 23(e)(4) comes into play when the opt-out opportunity expired before the members received notice of a proposed settlement. It is inapplicable here.


D. Objections

Class members must be provided an opportunity to object to the proposed settlement. Fed. R. Civ. P. 23(e)(5). The order preliminarily approving the settlement outlined the process for objecting. (Docket Entry No. 85, ¶ 19). Both the summary notice and detailed notice informed class members of their right to object. (Docket Entry No. 76, Ex. 2). Only one person objected. It appears that he believes that *1063 the settlement is unfair to Heartland because the breach actually did not harm most of the class members. (Docket Entry No. 100). The fact that only one objection was filed is itself significant.


E. Fair, Reasonable, and Adequate

Finally, “the court may approve [the proposed settlement] only after a hearing and on finding that it is fair, reasonable, and adequate.” Fed. R. Civ. P. 23(e)(2). This court held a final fairness hearing on December 13, 2010. (Docket Entry No. 110). The lone objector informed the court that he did not intend to appear. (Docket Entry No. 100, at 2).


[21] Headnote Citing References The Fifth Circuit lists six factors that a district court must consider in determining the fairness, reasonableness, and adequacy of a proposed settlement:


(1) evidence that the settlement was obtained by fraud or collusion; (2) the complexity, expense, and likely duration of the litigation; (3) the stage of the litigation and available discovery; (4) the probability of plaintiffs' prevailing on the merits; (5) the range of possible recovery and certainty of damages; and (6) the opinions of class counsel, class representatives, and absent class members.


All Plaintiffs v. All Defendants, 645 F.3d 329, 334 (5th Cir.2011) (internal quotation marks omitted).FN16 These six factors are known as the “ Reed factors,” after Reed v. General Motors Corp., 703 F.2d 170 (5th Cir.1983). See id. at 172. “A ‘presumption of fairness, adequacy, and reasonableness may attach to a class settlement reached in arm's-length negotiations between experienced, capable counsel after meaningful discovery.’ ” Wal–Mart Stores, 396 F.3d at 116 (quoting Manual for Complex Litigation, Third § 30.42 (1995)); accord Nat'l Ass'n of Chain Drug Stores v. New England Carpenters Health Benefits Fund, 582 F.3d 30, 44 (1st Cir.2009); Klein v. O'Neal, Inc., 705 F.Supp.2d 632, 650 (N.D.Tex.2010) ( “When considering the Reed factors, the court should keep in mind the strong presumption in favor of finding a settlement fair.” (internal quotation marks and alteration omitted)). This presumption notwithstanding, the settlement proponents bear the burden of demonstrating the settlement's fairness. See Katrina Canal Breaches, 628 F.3d at 196.


FN16. Other circuits use similar multifactor tests in determining a proposed settlement's fairness. See, e.g., Sullivan, 667 F.3d at 319–20 (nine-factor test); In re Bluetooth Headset Prods. Liab. Litig., 654 F.3d 935, 946 (9th Cir.2011) (eight-factor test).




[22] Headnote Citing References “A proposed settlement need not obtain the largest conceivable recovery for the class to be worthy of approval; it must simply be fair and adequate considering all the relevant circumstances.” Klein, 705 F.Supp.2d at 649. At the same time, “a proposed settlement in which the class receives an insubstantial payment while the fees requested by counsel are substantial could raise fairness concerns.” Aggregate Litigation § 3.05 cmt. b.


The Reed factors are examined below.



1. Evidence of Fraud or Collusion

[23] Headnote Citing References[24] Headnote Citing References “The Court may presume that no fraud or collusion occurred between counsel, in the absence of any evidence to the contrary.” Klein, 705 F.Supp.2d at 651 (quoting Liger v. New Orleans Hornets NBA Ltd. P'ship, Civ. A. No. 05–1969, 2009 WL 2856246, at *3 (E.D.La. Aug. 28, 2009)). There has been no suggestion of any fraud or collusion. Nor does the record support such a finding. See DeHoyos v. Allstate Corp., 240 F.R.D. 269, 287 (W.D.Tex.2007) (“[T]here are no allegations or indications of fraud or collusion.”). Counsel for Heartland has described the arm's-length negotiations that resulted in *1064 this settlement. ( See Docket Entry No. 87, at 22, 27–28; Docket Entry No. 111, at 6). The initial negotiations occurred over approximately one-and-a-half months, resulting in a memorandum of understanding outlining the proposed settlement. (Docket Entry No. 87, at 27–28). Negotiations continued for another two months. (Docket Entry No. 111, at 9). Given these representations, the lack of evidence showing any fraud or collusion, and Heartland's initial position that it would not settle, this factor supports a finding that the settlement is fair, reasonable, and adequate.


“It is common practice today for class counsel to negotiate a specific fee award after they have successfully negotiated the class's recovery.” Turner v. Murphy Oil USA, Inc., 472 F.Supp.2d 830, 844 (E.D.La.2007) (citing cases). “Because the parties have not agreed to an amount or even a range of attorneys' fees, there is no threat of the issue explicitly tainting the fairness of settlement bargaining.” Id. at 845; see also In re Combustion, Inc., 968 F.Supp. 1116, 1127 (W.D.La.1997) (“Further, testimony was presented that the matter of attorneys' fees was not negotiated in conjunction with the settlement agreements but left for separate determination by the Court.”).


Here, as in Turner, the parties negotiated and agreed to the proposed settlement before reaching the issue of attorneys' fees. Their agreement on attorneys' fees is subject to court review and approval. This factor supports approval of the settlement.



2. Complexity, Expense, and Duration of Litigation

[25] Headnote Citing References “When the prospect of ongoing litigation threatens to impose high costs of time and money on the parties, the reasonableness of approving a mutually-agreeable settlement is strengthened.” Klein, 705 F.Supp.2d at 651 (citing Ayers v. Thompson, 358 F.3d 356, 369 (5th Cir.2004)). Although this case was settled less than four months after this court ordered a master complaint filed, (Docket Entry No. 21), and before dispositive motions, Heartland repeatedly denied its liability and planned to file a motion to dismiss. Likely motions would have raised choice-of-law issues and required resolving somewhat novel questions of state law. Litigating this case to trial would be time consuming, and “[i]nevitable appeals would likely prolong the litigation, and any recovery by class members, for years.” Rodriguez v. West Pub'g Corp., 563 F.3d 948, 966 (9th Cir.2009); see also Wal–Mart Stores, 396 F.3d at 118. This second factor supports approving the settlement.



3. The Stage of Litigation and the Available Discovery

[26] Headnote Citing References Under the third Reed factor, the key issue is whether “the parties and the district court possess ample information with which to evaluate the merits of the competing positions.” Ayers, 358 F.3d at 369. “A settlement can be approved under this factor even if the parties have not conducted much formal discovery.” Klein, 705 F.Supp.2d at 653 (citing, for example, Cotton v. Hinton, 559 F.2d 1326, 1332 (5th Cir.1977)); see also Union Asset Mgmt. Holding A.G. v. Dell, Inc., 669 F.3d 632, 639 (5th Cir.2012) (agreeing with district court's conclusion that “formal discovery is not a prerequisite to approving a settlement as reasonable”). The “[s]ufficiency of information does not depend on the amount of formal discovery which has been taken because other sources of information may be available to show the settlement may be approved even when little or no formal discovery has been completed.” San Antonio Hispanic Police Officers' Org., Inc. v. City of San Antonio, 188 F.R.D. 433, 459 (W.D.Tex.1999). “The Court should consider all information which has been available to all parties.” DeHoyos, 240 F.R.D. at 292.


*1065 The parties engaged in what Heartland's counsel termed “confirmatory discovery”: Heartland shared with counsel for the Consumer Plaintiffs over 4,000 pages about the breach and allowed an interview of its Chief Technology Officer. (Docket Entry No. 111, at 9–10). Class counsel drew on their previous experience in similar data-breach class-action litigation. (Docket Entry No. 87, at 44). The parties have shown that they possessed sufficient information to gauge the strengths and weaknesses of the claims and defenses. Class counsel were able to determine the settlement's adequacy in relation to the probability of success on the merits were this litigation to continue. The court is well aware of the parties' positions in this case, the legal issues, and the risks to the Consumer Plaintiffs should litigation continue. See Stott v. Capital Fin. Servs., Inc., 277 F.R.D. 316, 344 (N.D.Tex.2011). This factor favors approval of the proposed settlement.



4. The Probability of Success on the Merits

[27] Headnote Citing References[28] Headnote Citing References The probability of success on the merits is the most important Reed factor. Smith v. Crystian, 91 Fed.Appx. 952, 954 n. 3 (5th Cir.2004) (per curiam) (citing Parker v. Anderson, 667 F.2d 1204, 1209 (5th Cir.1982)); accord, e.g., Poplar Creek Dev. Co. v. Chesapeake Appalachia, L.L.C., 636 F.3d 235, 245 (6th Cir.2011). “In evaluating the likelihood of success, the Court must compare the terms of the settlement with the rewards the class would have been likely to receive following a successful trial.” DeHoyos, 240 F.R.D. at 287 (citing Reed, 703 F.2d at 172); see also Poplar Creek, 636 F.3d at 245 (“The likelihood of success, in turn, provides a gauge from which the benefits of the settlement must be measured.” (internal quotation marks omitted)). At the same time, a district court “must not try the case in the settlement hearings because the very purpose of the compromise is to avoid the delay and expense of such a trial.” Reed, 703 F.2d at 172 (internal quotation marks and alteration omitted). This factor favors approval of the settlement when the class's likelihood of success on the merits is questionable. See In re Corrugated Container Antitrust Litig., 659 F.2d 1322, 1326–27 (5th Cir.1981) (affirming district court's finding that this factor favored approving the settlement when the class faced major obstacles in establishing proof of liability and damages); DeHoyos, 240 F.R.D. at 290 (“Because the laws of numerous states may be relevant to individual class member claims, plaintiffs would apparently face a further significant challenge to certifying the class outside the settlement context.”); Combustion, 968 F.Supp. at 1128 (“On the other hand, Plaintiffs will have very serious legal and evidentiary hurdles to meet in order to get their case to the jury.”).


[29] Headnote Citing References In this case, it is uncertain whether the Consumer Plaintiffs could succeed at trial, let alone reach it. Heartland's counsel explained that they were planning to move to dismiss or, failing that, for summary judgment when counsel for the Consumer Plaintiffs “dragged us, perhaps kicking and screaming, to a settlement[.]” (Docket Entry No. 87, at 46). Heartland's dispositive motions would have raised legal issues difficult for the Consumer Plaintiffs to overcome. For example, the Consumer Plaintiffs assert a cause of action for breach of contract, but they were not parties to those contracts. These allegedly breached contracts were between Heartland and merchants whose goods and services the consumers bought using payment cards. The Consumer Plaintiffs would have to show that they were third-party beneficiaries to those contracts. See generally Heartland II, 834 F.Supp.2d at 577–81, 2011 WL 6012598, at *5–8 (dismissing the Financial Institution Plaintiffs' similar breach-of-contract claim). The Consumer *1066 Plaintiffs also allege negligence. The Consumer Plaintiffs would have to establish that Heartland owed them a duty of care that it breached by failing to exercise reasonable care in protecting its data from a determined and sophisticated hacker. Even assuming a duty of care, a factfinder could have determined that Heartland's security measures were reasonable, given current technology and industry standards.


A similar problem arises with respect to the Consumer Plaintiffs' Fair Credit Reporting Act claim. One of the Act's requirements is that “[a]ny person who maintains or otherwise possesses consumer information for a business purpose must properly dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.” 16 C.F.R. § 682.3(a) (emphasis added). This regulation provides examples of “reasonable measures,” including “[i]mplementing and monitoring compliance with policies and procedures that protect against unauthorized or unintentional disposal of consumer information.” Id. § 682.3(b)(4). A factfinder could conclude that Heartland had implemented reasonable policies and procedures to protect against data breaches. In sum, the Consumer Plaintiffs face numerous legal obstacles in establishing liability on the merits of their claims.


Class certification for litigation also presented uncertainties. The Consumer Plaintiffs asserted claims under the laws of the fifty states and the District of Columbia. Absent settlement, the state-law variations would have to be analyzed carefully to be sure they did not make trial unmanageable. This would present “a further significant challenge to certifying the class.” DeHoyos, 240 F.R.D. at 290 (citing Castano, 84 F.3d at 741).


Against these risks are the concrete benefits that the proposed settlement provides the Consumer Plaintiffs. For those class members with valid claims—whether for fraudulent charges, identity theft, or lost time—this settlement allows them to recover without the risks or delays of continued litigation. The amounts likely will not be significantly less than the amounts they would recover were this case to proceed to trial. Because of the class's sheer size, a claims process similar to the one called for in the proposed settlement would be required. That process would result in class members with valid claims recovering either the same or slightly more than the amount they would get under the settlement. But the settlement provides an efficient and certain result that outweighs slightly higher recovery, accompanied by significant risks of no recovery whatsoever and a certainty of delay.FN17 The proposed settlement's cy pres provision confers an indirect benefit on the vast majority of the class members—those who have suffered no personal damages from the data breach or who simply did not file any claim and thus would otherwise recover nothing. In sum, this factor strongly supports settlement approval.


FN17. See, e.g., Stott, 277 F.R.D. at 345 (explaining that approval of the proposed settlement “would avoid those costs and difficulties” and risks associated with motions practice, trial, and appeal and that “approving the settlement at this stage would provide an immediate and automatic benefit to the class” (internal quotation marks omitted)); Vaughn v. Am. Honda Motor Co., 627 F.Supp.2d 738, 746 (E.D.Tex.2007) ( “Review of the circumstances in this case demonstrates that the monetary benefit and the extensions of the warranty and lease periods far outweigh the plaintiffs' uncertain prospects of success were the case fully litigated.”); In re Enron Corp. Securities, Derivative & “ERISA” Litig. ( “Enron I” ), 228 F.R.D. 541, 566 (S.D.Tex.2005) (“The settlement at this point would save great expense and would give the Plaintiffs hard cash, a bird in the hand.”).





*1067 5. The Range of Possible Recovery and Certainty of Damages

[30] Headnote Citing References[31] Headnote Citing References This factor requires the district court to “establish the range of possible damages that could be recovered at trial and, then, by evaluating the likelihood of prevailing at trial and other relevant factors, determine whether the settlement is pegged at a point in the range that is fair to the plaintiff settlors.” Maher v. Zapata Corp., 714 F.2d 436, 460 (5th Cir.1983) (internal quotation marks omitted) (quoting In re Corrugated Container Antitrust Litig., 643 F.2d 195, 213 (5th Cir.1981)). The district court's consideration of this factor “can take into account the challenges to recovery at trial that could preclude the class from collecting altogether, or from only obtaining a small amount.” Klein, 705 F.Supp.2d at 656. The question is not whether the parties have reached “exactly the remedy they would have asked the Court to enter absent the settlement,” but instead “whether the settlement's terms fall within a reasonable range of recovery, given the likelihood of the plaintiffs' success on the merits.” Id. (internal quotation marks omitted).


A district court's failure or inability to establish the range of possible recovery is not necessarily error. In Maher, the parties did not “provide the court with an express estimate of the range of monetary recovery should plaintiffs prevail at trial.” 714 F.2d at 460. Instead, the parties “provided the district court with their arguments and positions respecting the merits of the claims being asserted and compromised, the risks of litigation, and the benefits of the compromise.” Id. Under such circumstances, and given the district court's otherwise “sufficient” analysis of the proposed settlement's fairness, the Fifth Circuit refused to overturn the settlement because the district court had not given an estimate. Id. at 461; accord San Antonio Hispanic Police Officers' Org., 188 F.R.D. at 460.


In this case, estimating the range of possible recovery—in particular, the upper band of recovery—is difficult. As the analysis of the fourth Reed factor (probability of success on the merits) demonstrates, the lower band of the Consumer Plaintiffs' range of recovery is zero: a nationwide or multistate class perhaps could not be certified under Rule 23, or a judge or jury could conclude that Heartland was not liable. Although neither the Consumer Plaintiffs nor Heartland provided this court with an estimate of the maximum amount of class recovery, the upper band is likely to be far less than what the proposed settlement provides. As of the final fairness hearing, fewer than 300 class members had filed a claim. Only 11 were valid. (Docket Entry No. 111, at 6). Given that the Consumer Plaintiffs' claims require each class member to prove individual damages, even if a trial resulted in a liability finding, the damages exposure is not properly measured by taking some number and multiplying it by the number of class members because there were so few claims filed, even after the extensive notice campaign.


The cy pres provision is essentially the damage award. Because no cy pres payments are to be made until class members had ample opportunity to file claims, the cy pres provision did not divert funds that class members otherwise were entitled to recover. The cy pres provision will indirectly benefit not just the class members, but all payment-card holders. See DeHoyos, 240 F.R.D. at 290 (“The undisputed record reveals the settlement will not only provide significant benefits to members of the plaintiffs' class, but to policyholders throughout the country as well.”).FN18 Based *1068 on the very small number of claims filed after an extensive settlement notice campaign, the upper band of recovery after trial likely would be much smaller, and almost certainly no higher, than the upper amount offered in the settlement. This factor favors approving the settlement.


FN18. The American Law Institute's Principles of Aggregate Litigation summarizes the law on cy pres provisions:
[M]any courts allow a settlement that directs funds to a third party when funds are left over after all individual claims have been satisfied. Subject to a narrow exception in subsection (c), this Section approves of that type of cy pres only when it is not feasible to make further distributions to class members and the third party's interests approximate those of the class members.



Aggregate Litigation § 3.07 cmt. a. Subsection (c) states that the court should consider “the criteria set forth in subsections (a) and (b).” Id. § 3.07(c). One criteria listed in subsection (b) that the court can consider is whether “other specific reasons exist that would make such further distributions [to participating class members] impossible or unfair.” Id. § 3.07(b). In this case, it clearly is impractical to distribute the $1 million to absent class members not filing claims. It also is clearly inappropriate to divide $1 million equally among the very few class members—as few as 11—who have filed valid claims. That would provide them a huge windfall. Allowing those class members with valid claims to receive the amount of their valid claim and then spreading any remaining unclaimed funds between the three nonprofit organizations that focus on improving payment-card security seems a reasonable, and fair, approach.


6. The Opinions of Class Counsel, Class Representatives, and Absent Class Members about the Settlement

[32] Headnote Citing References[33] Headnote Citing References “The endorsement of class counsel is entitled to deference, especially in light of class counsel's significant experience in complex civil litigation and their lengthy opportunity to evaluate the merits of the claims.” DeHoyos, 240 F.R.D. at 292; see also Stott, 277 F.R.D. at 346 (“As class counsel tends to be the most familiar with the intricacies of a class action lawsuit and settlement, ‘the trial court is entitled to rely upon the judgment of experienced counsel for the parties.’ ” (quoting Cotton, 559 F.2d at 1330)). But a court should not blindly defer to class counsel's opinion. “Rather, the Court must give class counsel's recommendations appropriate weight in light of all the factors surrounding the settlement.” Turner, 472 F.Supp.2d at 852.


Class counsel have enthusiastically endorsed the settlement. One of the co-lead class counsel has called the settlement “excellent” because “it maximizes what could have been obtained for the consumers, and it delivers a real remedy.” (Docket Entry No. 111, at 42). Class counsel are experienced not just in class-action litigation generally but in data-breach class-action litigation specifically. Their opinion is consistent with the results of analyzing the proposed settlement's fairness under the other Reed factors.


Class counsel have not provided separate evidence on the opinions of the class representatives or members, but of the millions of absent class members, only one has objected. “Receipt of few or no objections ‘can be viewed as indicative of the adequacy of the settlement.’ ” Enron I, 228 F.R.D. at 567 (quoting 4 Herbert B. Newberg, Newberg on Class Actions § 1141 (4th ed. 2002)); accord, e.g., Sullivan, 667 F.3d at 321. This is particularly true when there has been an energetic notice campaign. DeHoyos, 240 F.R.D. at 293 (citing cases). Heartland does not dispute the estimate that approximately 81 % of the class received notice of the proposed settlement. ( See Docket Entry No. 106, ¶ 6(a)). Only one class member objected and did so not on the basis that the settlement is unfair to the class members, but instead on the basis that the settlement is unfair to Heartland because the data breach did not cause consumers harm. *1069 (Docket Entry No. 100). This last Reed factor also favors approving the proposed settlement.



7. Result of the Reed Analysis

All six Reed factors favor approving the proposed settlement. The court concludes that the proposed settlement is fair, reasonable, and adequate under Rule 23(e). The terms are approved.


IV. Attorneys' Fees, Costs, and Incentive Payments

[34] Headnote Citing References Rule 23(h) authorizes a district court to “award reasonable attorney's fees and nontaxable costs that are authorized by law or by the parties' agreement.” Fed. R. Civ. P. 23(h). Courts, including in the Fifth Circuit, “have encouraged litigants to resolve fee issues by agreement, if possible.” DeHoyos, 240 F.R.D. at 322 (citing cases, including Johnson v. Ga. Highway Express, Inc., 488 F.2d 714, 720 (5th Cir.1974)). But “a district court is not bound by the agreement of the parties as to the amount of attorneys' fees.” Strong v. BellSouth Telecomms., Inc., 137 F.3d 844, 849 (5th Cir.1998) (internal quotation marks omitted). A court must carefully review a proposed fee award to ensure reasonableness. See id. Such scrutiny is necessary to “guard[ ] against the public perception that attorneys exploit the class action device to obtain large fees at the expense of the class.” In re High Sulfur Content Gasoline Prods. Liab. Litig., 517 F.3d 220, 228 (5th Cir.2008) (internal quotation marks omitted).


One district court in this circuit has suggested that a presumption of reasonableness applies when a requested fee award is independent from the class-recovery fund and the parties did not negotiate the fee until after they agreed on other terms. See DeHoyos, 240 F.R.D. at 322–23. For this proposition, DeHoyos cited two cases: McBean v. City of New York, 233 F.R.D. 377, 392 (S.D.N.Y.2006), and In re First Capital Holdings Corp. Fin. Prods. Securities Litig., MDL No. 901, 1992 WL 226321, at *4 (C.D.Cal. June 10, 1992). No Fifth Circuit case, however, supports a presumption of reasonableness for a fee award, even if the award was agreed to after the settlement terms were negotiated and is to be paid separate from the class recovery. In Strong v. BellSouth Telecommunications, the Fifth Circuit expressly rejected class counsel's contention “that the district court's responsibility to address attorneys' fees is circumscribed when the parties agree to the amount of fees[.]” 137 F.3d at 849. BellSouth had agreed to a settlement in which it would deposit up to $64 million into a common fund and agreed to pay $6 million to class counsel for fees and costs. The district court, however, awarded $4.5 million in fees. Id. at 847–48. On appeal, the Fifth Circuit stated that


a “district court is not bound by the Agreement of the parties as to the amount of attorney' fees.” Piambino [ v. Bailey ], 610 F.2d [1306] at 1328 [ (5th Cir.1980) ]; Foster v. Boise–Cascade, Inc., 577 F.2d 335, 336 (5th Cir.1978). The court must scrutinize the agreed-to fees under the standards set forth in Johnson v. Georgia Highway Express, 488 F.2d 714 (5th Cir.1974), and not merely “ratify a pre-arranged compact.” Piambino, 610 F.2d at 1328 (holding that by summarily approving attorneys' fees presented in an unopposed settlement agreement, the district court “abdicated its responsibility to assess the reasonableness of the attorneys' fees proposed under a settlement of a class action, and its approval of the settlement must be reversed on this ground alone”).



That the defendant will pay the attorneys' fees from its own funds likewise does not limit the court's obligation to review the reasonableness of the agreed-to fees. Restricting the court's *1070 discretion to a perfunctory review in such a circumstance would disregard the economic reality that a settling defendant is concerned only with its total liability. See In re GM Trucks, 55 F.3d at 819–20 (requiring “a thorough judicial review of fee applications ... in all class action settlements” because “ ‘a defendant is interested only in disposing of the total claim asserted against it’ ” and “ ‘the allocation between the class payment and the attorneys' fees is of little or no interest to the defense’ ”) (quoting Prandini v. National Tea Co., 557 F.2d 1015, 1020 (3rd Cir.1977)). Because the defendant's adversarial role with regard to the attorneys' fees is thus diminished, the court must strive to minimize the conflict of interest between the class and its attorney inherent in such an arrangement. See Foster [ v. Boise–Cascade, Inc.], 420 F.Supp. [674] at 687–88 [ (S.D.Tex.1976) ]; see also Weinberger v. Great Northern Nekoosa Corp., 925 F.2d 518, 524 (1st Cir.1991) (explaining that when fees are paid from the defendant's own funds, a conflict results from “the danger that the lawyers might urge a class settlement at a low figure or on a less-than-optimal basis in exchange for red-carpet treatment on fees”); Court Awarded Attorney Fees, Report of the Third Circuit Task Force, 108 F.R.D. 237, 266 (1985) (“Even if the plaintiff's attorney does not consciously or explicitly bargain for a higher fee at the expense of the beneficiaries, it is very likely that this situation has indirect or subliminal effects on the negotiations. And, in any event, there is an appearance of a conflict of interest.”)



The court's review of the attorneys' fees component of a settlement agreement is thus an essential part of its role as guardian of the interests of class members. To properly fulfill its Rule 23(e) duty, the district court must not cursorily approve the attorney's fees provision of a class settlement or delegate that duty to the parties. Even when the district court finds the settlement agreement to be untainted by collusion, fraud, and other irregularities, the court must thoroughly review the attorneys' fees agreed to by the parties in the proposed settlement agreement.


Id. at 849–50.


In this case, class counsel have moved for $725,000 in fees and $35,000 in costs. (Docket Entry No. 107, ¶ 6). Heartland agreed to pay up to these amounts. (Docket Entry No. 57, ¶ 7.2). Class counsel has explained that they arrived at these amounts using a lodestar analysis, cross-checked by the Johnson factors. (Docket Entry No. 107, ¶ 6). According to the most recent fees-and-costs reports, class counsel billed over 1,960 hours on this case. Multiplied by the various hourly rates charged by class counsel, their lodestar fees exceeded $866,000 and actual costs totaled over $43,000. (Docket Entry No. 113, Ex. 2). The requested award of $725,000 results from a 0.837 negative multiplier. (Docket Entry No. 108, at 20).FN19 Class counsel's analysis of the Johnson factors, however, is inconsistent with any negative adjustment. In any event, class counsel's fee request assumes that the value of the settlement to the Consumer Plaintiffs exceeds $4.85 million. (Docket Entry No. 107, ¶ 5). The value was discussed at length during the final fairness hearing. ( See generally Docket Entry No. 111).


FN19. The court has slightly modified class counsel's calculation to account for the most recent fees-and-costs report, which postdated its motion for a fee award and supporting memorandum by one month.




*1071 With this background, this court carefully reviews the proposed fee award for reasonableness.


A. Methodology

[35] Headnote Citing References[36] Headnote Citing References In common-fund cases-in which class counsel is compensated from the general fund used to pay class members' damages and claims FN20-district courts generally award attorneys' fees using one of two methods:


FN20. See, e.g., Victor v. Argent Classic Convertible Arbitrage Fund L.P., 623 F.3d 82, 86 (2d Cir.2010) (“It is well established that the common fund doctrine permits attorneys whose work created a common fund for the benefit of a group of plaintiffs to receive reasonable attorneys' fees from the fund.”); In re Cendant Corp. Securities Litig. ( “Cendant II” ), 404 F.3d 173, 187 (3d Cir.2005) (“The [common-fund] doctrine provides that a private plaintiff, or plaintiff's attorney, whose efforts create, discover, increase, or preserve a fund to which others also have a claim, is entitled to recover from the fund the costs of his litigation, including attorneys' fees.” (internal quotation marks omitted)); Brian T. Fitzpatrick, Do Class Action Lawyers Make Too Little?, 158 U. Pa. L. Rev. 2043, 2051 (2010) (“In most cases, [class counsel's] fee awards came from proceeds that would otherwise go to class members. These cases are often called ‘common fund’ cases, and class counsel are compensated from the fund on the theory that it would be unjust to enrich the class without also rewarding the counsel that created the class's enrichment.”). As with any fee award under Rule 23(h), class counsel must petition the court to receive a fee award directly from that fund.




(1) the percentage method, in which the court awards fees as a reasonable percentage of the common fund; or (2) the lodestar method, in which the court computes fees by multiplying the number of hours reasonably expended on the litigation by a reasonable hourly rate and, in its discretion, applying an upward or downward multiplier.
Dell, 669 F.3d at 642–43. Under the lodestar method as applied in this circuit, the upward or downward adjustment is based on the court's review of the factors set out in Johnson v. Georgia Highway Express, 488 F.2d at 717–19. The twelve Johnson factors are:

(1) the time and labor required; (2) the novelty and difficulty of the issues; (3) the skill required to perform the legal service adequately; (4) the preclusion of other employment by the attorney because he accepted the case; (5) the customary fee for similar work in the community; (6) whether the fee is fixed or contingent; (7) time limitations imposed by the client or the circumstances; (8) the amount involved and the results obtained; (9) the experience, reputation, and ability of the attorneys; (10) the undesirability of the case; (11) the nature and length of the professional relationship with the client; and (12) awards in similar cases.


Dell, 669 F.3d at 642 n. 25. “The Johnson factors are intended to ensure ‘a reasonable fee.’ ” Id. (quoting Johnson ).FN21 In Dell, the Fifth Circuit confirmed that district*1072 courts have discretion to determine the proper fee award in common-fund cases by using either the percentage or lodestar methods, cross-checked with the Johnson factors. Id. at 642–44.

FN21. The Johnson multifactor test and its variations in other circuits, see, e.g., Goldberger v. Integrated Res., Inc., 209 F.3d 43, 50 (2d Cir.2000) (six factors), have been criticized as “highly indeterminate.” Fitzpatrick, Do Class Action Lawyers Make Too Little?, supra, at 2046. The Tenth Circuit reads the Supreme Court's recent decision in Perdue v. Kenny A. ex rel. Winn, 559 U.S. 542, 130 S.Ct. 1662, 176 L.Ed.2d 494 (2010), as “appear[ing] to significantly marginalize the twelve-factor Johnson analysis, which it discount[ed] as just ‘[o]ne possible method’ that ‘gave very little actual guidance’ and, due to its ‘series of sometimes subjective factors[,] ... produced disparate results.’ ” Anchondo v. Anderson, Crenshaw & Assocs., L.L.C., 616 F.3d 1098, 1104 (10th Cir.2010) (quoting Perdue, 130 S.Ct. at 1671–72). Notwithstanding these criticisms, however, this court is bound by Fifth Circuit precedent to apply the twelve Johnson factors, whether the lodestar or percentage method is employed. See Dell, 669 F.3d at 642–44.




Having two funds—one for the claimants, one for the attorneys—is a well-recognized variant of a common-fund arrangement. “A variant on the traditional common-fund case occurs frequently in mass tort litigation—in both class actions and large consolidations—where a separate fund to pay attorney fees is created as a part of the settlement.” Manual § 14.11. Such an arrangement is sometimes called a “constructive common fund.” FN22 “Several courts have embraced the constructive common fund approach, warning that ‘private arrangements to structure artificially separate fee and settlement arrangements' should not enable parties to circumvent the 25% benchmark requirement on ‘what is in economic reality a common fund situation.’ ” Bluetooth Headset, 654 F.3d at 943 (quoting In re Gen. Motors, 55 F.3d at 821). Courts recognize this approach even if they do not use the common-fund label. For example, in Johnston v. Comerica Mortgage Corp., 83 F.3d 241, 246 (8th Cir.1996), the Eighth Circuit stated:


FN22. See, e.g., Bluetooth Headset, 654 F.3d at 943; Gen. Motors, 55 F.3d at 820; Radosti v. Envision EMI, LLC, 760 F.Supp.2d 73, 77 (D.D.C.2011); In re Excess Value Ins. Coverage Litig., 598 F.Supp.2d 380, 382 n. 2 (S.D.N.Y.2005); Tiana S. Mykkeltvedt, Note, Common Benefit and Class Actions: Eliminating Artificial Barriers to Attorney Fee Awards, 36 Ga. L. Rev. 1149, 1170 (2002).




The district court concluded that because the attorney fees were to be paid by the defendants separate and apart from the settlement funds, the fees did not come from a “common fund” belonging to the plaintiffs, and thus the percentage of the benefit approach was inappropriate. We disagree. Although under the terms of each settlement agreement, attorney fees technically derive from the defendant rather than out of the class' recovery, in essence the entire settlement amount comes from the same source. The award to the class and the agreement on attorney fees represent a package deal. Even if the fees are paid directly to the attorneys, those fees are still best viewed as an aspect of the class' recovery.
Johnston, 83 F.3d at 245–46 (citing In re Gen. Motors ).FN23 “If an agreement is reached on the amount of a settlement fund and a separate amount for attorney fees and expenses, .... the sum of the two amounts ordinarily should be treated as a settlement fund for the benefit of the class, with the agreed-on fee amount constituting the upper limit on the fees that can be awarded to counsel.” Manual § 21.7.FN24


FN23. See also Brian Wolfman & Alan B. Morrison, Representing the Unrepresented in Class Actions Seeking Monetary Relief, 71 N.Y. U. L. Rev. 439, 504 (1996) (noting that even when fees are negotiated after agreement is reached on payment to the class and that negotiation results in the defendant paying fees separately from the fund created for class recovery, the defendant “has made at least a mental calculation of the total amount to be paid and then simply allocated a portion to the class and the rest to the plaintiff's attorneys' fees,” and similarly arguing in favor of viewing “direct payments of fees from the defendant to the plaintiffs' lawyers as payments into the common fund”).




FN24. See also Gen. Motors, 55 F.3d at 820 (noting that “the potential for conflict between the class and its counsel is not limited to situations meeting the strict definitions of a common fund,” and that courts must continue to ensure that the fees are reasonable, in part to avoid the risk that class counsel may agree to a class settlement “in exchange for red-carpet treatment for fees[.]”) (quoting Weinberger v. Great N. Nekoosa Corp., 925 F.2d 518, 524 (1st Cir.1991)).




Many courts and commentators have concluded that the best approach is to use *1073 the percentage method in a common-fund or variant case with the lodestar method as a cross-check. This approach is particularly appropriate when the value of the judgment or settlement is uncertain.FN25 In this case, the percentage method, cross-checked by the lodestar method, is the appropriate method for scrutinizing the proposed attorneys' fees award under Rule 23(h). The fact that a minuscule amount of the settlement fund was actually distributed to class members, and the vast majority instead paid to three nonprofit organizations for efforts to improve data security and privacy protection, makes the value of the benefit the class received uncertain. That uncertainty makes it appropriate to use the lodestar method as a cross-check. Using the percentage method, cross-checked by the lodestar method, reduces the risk that the amount of the fee award either overcompensates counsel in relation to the class benefits obtained or undercompensates counsel for their work. Under either method, a fee award is reasonable only if it is proportionate to the actual value created for, and received by, the class. See Fed. R. Civ. P. 23(h) Committee Notes (2003) (“One fundamental focus is the result actually achieved for class members, a basic consideration in any case in which fees are sought on the basis of a benefit achieved for class members.”).FN26


FN25. See Aggregate Litigation § 3.13(b); see also Victor, 623 F.3d at 88 (2d Cir.); In re AT & T Corp., 455 F.3d 160, 164 (3d Cir.2006); Staton v. Boeing Co., 327 F.3d 938, 974 (9th Cir.2003); Physicians of Winter Haven LLC v. Steris Corp., No. 1:10 CV 264, 2012 WL 406966, at *3 (N.D.Ohio Feb. 6, 2012) (explaining that “the best approach would be to employ both the lodestar and percentage of the fund methodologies so as to cross-check the results obtained by each and thereby ensure a more accurate and well-reasoned award”); Altier v. Worley Catastrophe Response, LLC, Civ. A. Nos. 11–241, 11–242, 2012 WL 161824, at *21 (E.D.La. Jan. 18, 2012) (using percentage method to cross-check “the Fifth Circuit's apparently preferred lodestar method”); In re Wachovia Corp. ERISA Litig., Civ. No. 3:09cv262, 2011 WL 5037183, at *3 (W.D.N.C. Oct. 24, 2011) (“Even where the percentage method is used, however, the lodestar calculation may still be applied as a ‘cross-check’ in the determination of a reasonable percentage.” (citing Manual § 14.121)); Eisenberg & Miller I, supra, at 32 (explaining courts' adoption of cross-checking the percentage method against the lodestar method).


There are cases in which courts should use the lodestar method rather than the percentage-of-fund approach. The lodestar is most appropriate in cases with a statutory provision for fee-shifting. In Perdue v. Kenny A. ex rel. Winn, 559 U.S. 542, 130 S.Ct. 1662, 176 L.Ed.2d 494 (2010), “the Supreme Court recently extolled [the lodestar method's] virtues and reaffirmed its dominant role in federal fee-shifting cases.” Pickett v. Sheridan Health Care Ctr., 664 F.3d 632, 641 (7th Cir.2011) (citing Perdue, 130 S.Ct. at 1672); see also, e.g., Sullivan, 667 F.3d at 330; Bluetooth Headset, 654 F.3d at 941; Spooner v. EEN, Inc., 644 F.3d 62, 67 n. 3 (1st Cir.2011); Aggregate Litigation § 3.13(c). And if a court specifically concludes that the percentage method would be unfair or inapplicable based on the specific facts and circumstances, such as when the percentage method would significantly undercompensate class counsel, the lodestar method may be appropriate. See Sullivan, 667 F.3d at 330; see also Jeter v. Astrue, 622 F.3d 371, 378–79 (5th Cir.2010) (recognizing, in the social-security context, that using the lodestar method may undercompensate counsel); Aggregate Litigation § 3.13(c).

FN26. See Manual § 21.71 (“Compensating counsel for the actual benefits conferred on the class members is the basis for awarding attorney fees.”); Aggregate Litigation § 3.13(a) (“Attorneys' fees in class actions, whether by litigated judgment or by settlement, should be based on both the actual value of the judgment or settlement to the class and the value of cy pres awards[.]”); see also Keene v. Coldwater Creek, Inc., No. C 07–05324 WHA, 2009 WL 1833992, at *2, *3 (N.D.Cal. June 23, 2009) (rejecting requested fee award as “far out of proportion to the actual benefit conferred on the class” and explaining that “[a] key consideration should be reasonableness in light of the benefits actually conferred”); Sloop v. Ameritech Corp., No. EV 95–128–C H/L, 2003 WL 21989997, at *4 (S.D.Ind. Aug. 23, 2003) (stating the court's “concern[ ] with the proportion between the net benefits to the class and the fee for class counsel as an important factor in considering the reasonableness of any fee award, especially where class counsel have attempted to support their fee request based on the benefits to the class”); Duhaime v. John Hancock Mut. Life Ins. Co., 989 F.Supp. 375, 380 (D.Mass.1997) (approving fee award in a manner that “will help ensure that the fee award is proportionate to the actual value created for the class”). Cf. In re Philip Servs. Corp. Securities Litig., No. 98 Civ. 835(AKH), 2007 WL 959299, at *3 (S.D.N.Y. Mar. 28, 2007) (explaining that a lodestar positive multiplier is appropriate “as long as it does not exceed a proper proportion in relation to the total benefit produced to the class for whose benefits the services were rendered”); cf. also Int'l Precious Metals Corp. v. Waters, 530 U.S. 1223, 120 S.Ct. 2237, 147 L.Ed.2d 265 (2000) (O'Connor, J., concurring in denial of certiorari) (noting “several troubling consequences” in cases approving attorneys' fees where there lacks “some rational connection between the fee award and the amount of the actual distribution to the class”).




*1074 This approach is consistent with the statements in another federal district court's opinion in a similar case. In In re TJX Companies Retail Security Breach Litigation, 584 F.Supp.2d 395 (D.Mass.2008), consumers filed a nationwide class action after the same hackers in this case breached TJX Companies's computer systems and obtained access to 45 million payment-card accounts' information.FN27 Some of the class counsel in that litigation were the same as the co-lead class counsel in this case. The parties reached a settlement agreement, under which TJX Companies agreed to reimburse consumers for valid claims. Although caps were placed on certain categories of claims, the parties did not place an overall cap on the settlement. Id. at 400–01. Class counsel used the lodestar method to reach their proposed fee award of $6.5 million. The district court was greatly troubled by this award because it was disproportionately large in relation to the very small “value actually transferred to class members[.]” Id. at 409. Calling “the class action vehicle [ ] broken[,]” the court emphasized that “tying the award of attorneys' fees to claims made by class members is one step that judges can take toward repair.” Id. at 406. The court nevertheless approved the fee request for two main reasons: first, the court valued the potential benefits of the settlement at $177 million, which could be used as a guidepost for measuring attorneys' fees; and second, the court “did not give class counsel any indication prior to the Fairness Hearing that its award of attorneys' fees might be made with reference to this criterion.” Id. at 409. The court concluded with a cautionary note to class counsel: “In the future, however, plaintiffs' counsel can expect that this Court, when confronted with reversionary common fund or claims-made settlements, will award attorneys' fees by reference to the value of benefits actually put in the hands of the class members.” Id. at 410 (emphasis in original).


FN27. See generally James Verini, The Great Cyberheist, N.Y. Times (Magazine), Nov. 14, 2010, at MM44.




In this case, class counsel had the benefit of the warning issued in the TJX Companies settlement. Counsel also had the benefit of the guidance provided by the cases and authorities cited above. In this case, unlike TJX Companies, class counsel were put on notice at the preliminary fairness hearing that the court was very concerned about the lack of “direct benefits” to class members under the proposed settlement. (Docket Entry No. 87, at 56). This court also noted that “the amount of fees ... does not depend for its justification as reasonable entirely on the amount of money made either available or distributed directly, but also on the amount of *1075 work that the lawyers actually did and the reasonableness of those hours and hourly charges as well.” ( Id.) These statements are consistent with using the percentage-of-fund approach, with a lodestar cross-check, to determine the reasonableness of the fee award sought, tied appropriately to the value of the benefits actually provided to the class.


B. The Percentage Method

“The first step under the [percentage] method requires determining the actual monetary value conferred to the class members by the settlement.” Bussie v. Allamerica Fin. Corp., No. Civ. A. 97–40204–NMG, 1999 WL 342042, at *2 (D.Mass. May 19, 1999). The court then sets the benchmark percentage to be applied to this value. After setting the benchmark, the district court in In re Dell Inc., No. A–06–CA–726–SS, 2010 WL 2371834 (W.D.Tex. June 11, 2010), applied the Johnson factors to determine whether a positive or negative adjustment of the benchmark was warranted. Id. at *13. Affirming Dell, the Fifth Circuit approved of the district court's application of this “blended percentage method” or “hybrid percentage method.” FN28 669 F.3d at 642–44.


FN28. Other courts also use the blended method. See Vizcaino v. Microsoft Corp., 290 F.3d 1043, 1048 (9th Cir.2002); In re Vioxx Prods. Liab. Litig., 760 F.Supp.2d 640, 651–52 (E.D.La.2010) (citing cases within Fifth Circuit applying blended percentage method); Klein, 705 F.Supp.2d at 674–75 (N.D.Tex.); Ramah Navajo Chapter v. Norton, 250 F.Supp.2d 1303, 1316 (D.N.M.2002); cf. Faught v. Am. Home Shield Corp., 668 F.3d 1233, 1242 (11th Cir.2011) (explaining that the Johnson factors must be applied “[w]here the requested fee exceeds 25%”).





1. Valuing the Settlement

“In cases involving a claims procedure or a distribution of benefits over time, the court should not base the attorney fee award on the amount of money set aside to satisfy potential claims. Rather, the fee awards should be based only on the benefits actually delivered.” Manual § 21.71. Class counsel's valuation of the benefits as exceeding $4.85 million includes:


the reimbursement of Losses suffered by Settlement Class Members in connection with the Heartland Intrusion [$2.4 million], the anticipated costs of notice [$1.5 million], the anticipated costs of the dispute resolution process provided for resolving contested Settlement Class Member claims [$270,000], and the attorneys' fees [$725,000], costs[ ] and expenses [$35,000], and incentive awards being paid for by Heartland [$200 and $100 per qualified class representative].


(Docket Entry No. 107, ¶ 5). The court discusses each component below.



a. Reimbursement of Losses

Class counsel values this component at $2.4 million. Heartland deposited $1 million in escrow for reimbursing claimants. Although Heartland agreed that it would deposit up to an additional $1.4 million into the fund (for a total of $2.4 million) if needed to pay the class claims, that proved wholly unnecessary. (Docket Entry No. 57, ¶ 2.1(a)). As of December 2010, class members had filed 11 valid claims for out-of-pocket expenses resulting from the breach. (Docket Entry No. 111, at 6). Neither counsel indicated that any of these claims were identity-theft-related. Assuming that each of these claims received the maximum amount for out-of-pocket expenses ($175), that would amount to a total cash payment to class members of $1,925. ( See Docket Entry No. 57, ¶ 2.2(b)).


The deadline for filing claims, August 2011, has long passed. ( See id., ¶ 2.2(c)). Since the final fairness hearing held in December 2010, neither party has submitted information about any other valid *1076 claims submitted or paid. Although $2.4 million was the maximum amount of direct benefits that the class could receive, the class received a negligible fraction of that amount in direct benefits. Heartland will pay approximately $998,075—$1 million less the amount paid directly to class members who submitted valid claims, conservatively estimated to be $1,925—to the three organizations under cy pres. ( See Docket Entry No. 111, at 16–17).


The record is clear that $2.4 million was never distributed to the class, directly or indirectly. Heartland deposited $1 million, and the Agreement capped its liability at that amount if the claims did not exceed it. That distinguishes this case from TJX Companies, in which the parties agreed to no cap on the possible settlement amount.


The answer to the first step is clear: the total amount Heartland made available to the class is $1 million. It is also clear that only $1,925 of the $1 million has gone directly to the class members. The issue is the value of the benefit conferred by the cy pres award of $998,075 paid to third-party organizations.



b. The Propriety and Value of the Cy Pres Payment

The cy pres payment is proper because the recipients “reasonably approximate [the interests] being pursued by the class.” Aggregate Litigation § 3.07(c); see also, e.g., Nachshin v. AOL, LLC, 663 F.3d 1034, 1036 (9th Cir.2011) ( “ Cy pres distributions must account for the nature of the plaintiffs' lawsuit, the objectives of the underlying statutes, and the interests of the silent class members, including their geographic diversity.”); Klier v. Elf Atochem N. Am., Inc., 658 F.3d 468, 474–75 (5th Cir.2011) (explaining that “a cy pres distribution is designed to be a way for the court to put any unclaimed settlement funds to their next best compensation use, e.g., for the aggregate, indirect, prospective benefit of the class” in the class-action context only when it is infeasible to make further distributions to the class (internal quotation marks omitted)). Cy pres distributions have been criticized for “violating the ideal that litigation is meant to compensate individuals who were harmed.” FN29 Judge Posner, writing for a panel of the Seventh Circuit, has questioned whether such payments in fact benefit class members: “There is no indirect benefit to the class from the defendants giving the money to someone else. In such a case the ‘cy pres' remedy ... is purely punitive.” Mirfasihi, 356 F.3d at 784.


FN29. Alexandra D. Lahav, Two Views of the Class Action, 79 Fordham L. Rev. 1939, 1957 (2011); Martin H. Redish, Peter Julian, & Samantha Zyontz, Cy Pres Relief and the Pathologies of the Modern Class Action: A Normative and Empirical Analysis, 62 Fla. L. Rev. 617, 620–21 (2010).




[37] Headnote Citing References Despite these criticisms, there is ample precedent for cy pres relief here. Under Klier, the Fifth Circuit confirmed that cy pres awards in class actions might be appropriate under two circumstances: first, it must be infeasible to distribute further proceeds from the settlement fund directly to class members; and second, “the unclaimed funds should be distributed for a purpose as near as possible to the legitimate objectives underlying the lawsuit, the interests of class members, and the interests of those similarly situated.” 658 F.3d at 474–75 (quoting In re Airline Ticket Comm'n Antitrust Litig., 307 F.3d 679, 682 (8th Cir.2002)). Both circumstances are present here. First, “it is not possible to put those funds to their very best use: benefitting the class members directly,” id. at 475, because the vast majority of class members did not file claims, whether from lack of interest or the absence of losses. The Agreement is organized so cy pres relief is triggered only *1077 after class members have ample opportunity to file claims. Cy pres is the only way to avoid having the unclaimed funds—$998,075—revert to Heartland, escheat to the government, or provide a huge windfall to the few who filed valid claims. Second, the organizations class counsel selected to receive the cy pres distribution reasonably approximate the interests pursued by the class. These organizations work to create more secure payment-card technology that will help prevent data breaches, and work to help financial institutions minimize the consequences if such breaches occur. The underlying basis of this class action is that Heartland should have had better policies, procedures, and technological measures to prevent this data breach. The interests of class members, and other similarly situated payment-card holders, are served by distributing the unclaimed funds to these organizations.


Finding the cy pres provision appropriate does not determine its value for the purpose of calculating attorneys' fees. The class benefit conferred by cy pres payments is indirect and attenuated. That makes it inappropriate to value cy pres on a dollar-for-dollar basis. “[B]ecause cy pres payments ... only indirectly benefit the class, the court need not give such payments the same full value for purposes of setting attorneys' fees as would be given to direct recoveries by the class.” Aggregate Litigation § 3.13 cmt. a; see also Fed. R. Civ. P. 23(h) Committee Notes (“Settlements involving nonmonetary provisions for class members also deserve careful scrutiny to ensure that these provisions have actual value to the class.”). Even when, as here, there is a valid relationship between the class interests and the recipients of cy pres funds, those funds do not provide a direct benefit to class members and should not be valued as equal to direct payments to the class members. Discounting the amount of the cy pres payment in determining its value to the class is consistent with the nature of the indirect benefit cy pres provides to the class.FN30


FN30. Some courts appear to have valued cy pres payments the same way as money paid directly to class members, on a dollar-for-dollar basis. See Harris v. Vector Mktg. Corp., No. C–08–5198 EMC, 2012 WL 381202, at *5 (N.D.Cal. Feb. 6, 2012); McKinnie v. JP Morgan Chase Bank, N.A., 678 F.Supp.2d 806, 816 (E.D.Wis.2009); Parker v. Time Warner Entm't Co., 631 F.Supp.2d 242, 269 (E.D.N.Y.2009). None of these courts, however, explained the reason for that valuation.




[38] Headnote Citing References The question is how much to discount the $998,075 cy pres payment for the purpose of determining attorneys' fees. After careful consideration, the court has concluded that discounting the payment by 50% best values the benefit conferred on the class. Although the cy pres award will assist the three organizations in working on improved payment-card security, whether, when, and how much improvement will result are all speculative. Although the cy pres award is appropriate, the indirect, speculative, and deferred nature of the benefit strongly support valuing that benefit at one-half of the payment amount.


The benefit conferred on the class by the cy pres payment is valued at $499,037.50. Added to the $1,925 paid directly to class members for valid claims, the value conferred on class members by the $1 million fund the Agreement creates amounts to $500,962.50.



c. Notice Costs

[39] Headnote Citing References Class counsel includes the approximately $1.5 million cost of implementing the notice program in valuing the settlement. When a (b)(3) class action is certified for trial rather than settlement, the plaintiffs normally bear the notice costs. See *1078 Eisen v. Carlisle & Jacquelin, 417 U.S. 156, 178–79, 94 S.Ct. 2140, 40 L.Ed.2d 732 (1974).FN31 When a (b)(3) class action is certified for settlement, “[t]he defendant, as the party with the greatest interest in obtaining a res judicata effect for the settlement decree, should normally bear the costs of settlement notice.” 4 Rubenstein et al., Newberg on Class Actions § 11:53; see also Aggregate Litigation § 3.04 cmt. a (reporters' notes) (“defendants typically pay for the cost of notice as part of a class settlement”). Courts often include the costs of notice in valuing a class-action settlement.FN32


FN31. See also In re Mexico Money Transfer Litig., 267 F.3d 743, 746 (7th Cir.2001); Jones v. Diamond, 594 F.2d 997, 1022–23 (5th Cir.1979); 7AA Wright et al., Federal Practice and Procedure § 1788 (“it now is clear that all notice costs must be borne by the plaintiffs”).




FN32. See In re Ky. Grilled Chicken Coupon Mktg. & Sales Practices Litig., 280 F.R.D. 364, 385–86, 2011 WL 5599129, at *18 (N.D.Ill.2011); Schulte v. Fifth Third Bank, 805 F.Supp.2d 560, 569 & n. 8, 597 (N.D.Ill.2011); Hartless v. Clorox Co., 273 F.R.D. 630, 645 (S.D.Cal.2011); Sauby v. City of Fargo, No. 3:07–cv–10, 2009 WL 2168942, at *3 (D.N.D. July 16, 2009); see also Sobel v. Hertz Corp., No. 3:06–CV–00545–LRH–RAM, 2011 WL 2559565, at *13 (D.Nev. June 27, 2011) (stating that “the only components with any determinate ... value are the attorneys' fees, incentive payments and to some extent the costs of notice and administration”); Theodore Eisenberg & Geoffrey Miller, The Role of Opt–Outs and Objects in Class Action Litigation: Theoretical and Empirical Issues, 57 Vand. L. Rev.. 1529, 1544–45 (2004) (including “costs of notice or settlement administration paid by the defendant” in valuing the relief provided by a class-action settlement). The Ninth Circuit has held that “where the defendant pays the justifiable cost of notice to the class—but not, as here, an excessive cost—it is reasonable (although certainly not required) to include that cost in a putative common fund benefitting the plaintiffs for all purposes, including the calculation of attorneys' fees.” Staton, 327 F.3d at 975.




[40] Headnote Citing References The cost of notice here is $1.5 million. A nationwide notice campaign intended to reach 80% of a class of over 100 million individuals is expensive. ( See Docket Entry No. 85, ¶ 11). Including the notice costs in the value helps ensure that counsel work to make the notice effective and that such settlements are public and that damages are pursued. On the present record and under current law, it is appropriate to include the $1.5 million figure in valuing the settlement.



d. Claims–Processing Costs

Class counsel includes the approximate cost of administering the claims process—$270,000—in valuing the settlement. District courts routinely include such administrative costs in calculating attorneys' fees awards. See, e.g., Amunrud v. Sprint Commc'ns Co., No. CV 10–57–BLG–CSO, 2012 WL 443751, at *2 (D.Mont. Feb. 10, 2012); Gomez v. H & R Gunlund Ranches, Inc., No. CV F 10–1163 LJO MJS, 2011 WL 5884224, at *5 (E.D.Cal. Nov. 23, 2011); Ky. Grilled Chicken, 280 F.R.D. at 385–86, 2011 WL 5599129, at *18; Serrano v. Sterling Testing Sys., Inc., 711 F.Supp.2d 402, 419 (E.D.Pa.2010). The $270,000 cost is properly included in valuing the settlement.



e. Attorneys' Fees and Costs

[41] Headnote Citing References Class counsel asks for attorneys' fees and costs of $760,000—the maximum amount of attorneys' fees and costs Heartland agreed to pay. Because this settlement is a variation on a common fund, the fees and costs are properly included in the settlement valuation. See, e.g., Johnston, 83 F.3d at 245–46; Manual § 21.7. “The award to the class and the agreement on attorney fees [and costs] represent a package deal. Even if the fees are paid directly to the attorneys, those fees are still best viewed as an aspect of the class' recovery.” Johnston, 83 F.3d at 246 (citing Gen. Motors, 55 F.3d at 821); see also, e.g., *1079 Vista Healthplan, Inc. v. Warner Holdings Co. III, 246 F.R.D. 349, 364 (D.D.C.2007) (explaining that “because the attorneys' fees are borne by defendants and not plaintiffs, they represent a valuable part of the settlement”).FN33 Although only part of the fees and costs sought are approved, to be conservative, the requested figures are included in valuing the settlement.


FN33. “In those cases where the defendant makes the direct payment” of attorneys' fees as a part of the settlement, separate from the fund to be distributed to the class, the defendant “has made at least a mental calculation of the total amount to be paid and then simply allocated a portion to the class and the rest to the plaintiff's attorneys' fees.” Wolfman & Morrison, Representing the Unrepresented in Class Actions Seeking Monetary Relief, supra, at 504.





f. Incentive Awards

Class counsel also includes the $200 and $100 incentive awards to the representative and named plaintiffs in calculating the settlement benefits. As set out in more detail below, the record does not provide a basis for incentive awards. Despite Heartland's agreement, the proposed incentive payments are not included in valuing the benefits the class received from the settlement because there is no basis in the record for approving those payments.



g. The Benefit Provided by a “Sense of Security”

[42] Headnote Citing References During the final fairness hearing, class counsel argued that the settlement value should be enhanced to reflect a “sense of security” provided to the Consumer Plaintiffs.FN34 Counsel also characterized the settlement as providing what was in effect free credit monitoring for three-and-a-half years. (Docket Entry No. 111, at 41–42). Counsel, however, cited neither the “sense of security” value nor effective credit monitoring in calculating the $4.85 million settlement value. ( See Docket Entry No. 107, ¶ 5). Even had counsel done so, the record lacks any basis to increase the settlement's value based for either of these factors.


FN34. (Docket Entry No. 111, at 28; see also id., at 30 (the settlement provides “peace of mind”), 31 (the settlement “provide[s] comfort to people that may otherwise be restless”); id., at 41 (the settlement remedies a “feeling of insecurity”)).




The settlement provided no credit-monitoring services. The Agreement expressly excludes the costs of credit monitoring from what a class member may claim as a “Loss.” (Docket Entry No. 57, ¶ 2.2(b)). The Consumer Plaintiffs received an opportunity to make valid claims for defined losses resulting from stolen payment-card information. That is far different from credit monitoring that would include alerts notifying the Consumer Plaintiffs of any problem, to minimize the potential harm caused by the data breach. Heartland did not agree to provide three-and-a-half years of free credit monitoring to the roughly one hundred million consumers in this class. That would have cost Heartland approximately $62.79 billion.FN35


FN35. An example of credit monitoring is Experian's Credit Tracker Credit Monitoring Service, which costs $14.95 per month per individual. See Credit Monitoring, Experian, http:// www. experian. com/ consumer- products/ credit monitoring. html/(last visited Mar. 15, 2012). Even assuming a volume discount, actual credit monitoring for one hundred million people would be far more costly and a far different settlement than was achieved here. Moreover, the facts do not present any need for such monitoring.




There is no indication in the record that class members in fact received any “sense of security.” The evidence is that the extensive nationwide notice campaign provided class members an opportunity to file claims for defined “Losses.” Only 11 valid claims resulted. This paltry result suggests that the breach had a scant impact on the consumers whose data was compromised.*1080 The limited information the hackers obtained did not result in claims by those consumers in this case of identity theft or even of fraudulent payment-card transactions in any significant number. Neither a “sense of security” nor the value of credit monitoring is included in valuing the settlement.



h. Conclusion as to Valuation

The court values the settlement as follows:


• Direct Relief to Claimants: $1,925.00



• Indirect Relief to Class through Cy Pres: $499,037.50



• { Total Relief to Class: $500,962.50}



• Notice: $1,500,000.00



• Administrative Costs for Claims Process: $270,000.00



• Requested Attorneys' Fees and Costs: $760,000.00



• Total Value of Settlement: $3,030,962.50




2. Calculating the Benchmark

[43] Headnote Citing References The next step is to determine the appropriate percentage benchmark. “The ‘majority of common fund fee awards fall between 20% and 30% of the fund.’ ” Gooch v. Life Invs. Co. of Am., 672 F.3d 402, 426 (6th Cir.2012) (quoting Waters v. Int'l Precious Metals Corp., 190 F.3d 1291, 1294 (11th Cir.1999)); see also Manual § 14.121 (“Attorney fees awarded under the percentage method are often between 25% and 30% of the fund.”). The Ninth and Eleventh Circuit generally use a 25% benchmark for common-fund cases. E.g., Faught, 668 F.3d at 1243 (citing Camden I Condominium Ass'n, Inc. v. Dunkle, 946 F.2d 768, 774–75 (11th Cir.1991); In re Mercury Interactive Corp. Securities Litig., 618 F.3d 988, 992 n. 1 (9th Cir.2010)). The Second and Third Circuits caution district courts not to use a rigid benchmark but instead to consider the particular circumstances of each case based on factors similar to this circuit's Johnson factors. See Sullivan, 667 F.3d at 333; Goldberger, 209 F.3d at 51–52. A benchmark may be used as a starting point and then adjusted up or down under the Johnson factors, or those factors can be applied as part of deciding the benchmark.


District courts increasingly consider empirical studies analyzing class-action-settlement fee awards FN36 to set the appropriate percentage benchmark FN37 or to test the reasonableness*1081 of a given benchmark.FN38 “The tables included in the [Eisenberg and Miller] study are good indicators of what the market would pay for class counsel's services because the tables show what attorneys have been paid in similar cases, and thus what class counsel could have expected when they decided to invest their resources in this case.” Lawnmower Engine Horsepower, 733 F.Supp.2d at 1014 (citing Taubenfeld v. Aon Corp., 415 F.3d 597, 600 (7th Cir.2005) and Turner, 472 F.Supp.2d at 864 n. 30). Using these studies alleviates the concern that the number selected is arbitrary.


FN36. See Brian T. Fitzpatrick, An Empirical Study of Class Action Settlements and Their Fee Awards, 7 J. Empirical Legal Studies 811 (2010) [“Fitzpatrick”]; Theodore Eisenberg & Geoffrey Miller, Attorney Fees and Expenses in Class Action Settlements: 1993–2008, 7 J. Empirical Legal Studies 248 (2010) [“Eisenberg & Miller II”]; Theodore Eisenberg & Geoffrey P. Miller, Attorney Fees in Class Action Settlements: An Empirical Study, 1 J. Empirical Legal Studies 27 (2004) [“Eisenberg & Miller I”].




FN37. See Pavlik v. FDIC, No. 10 C 816, 2011 WL 5184445, at *4 (N.D.Ill. Nov. 1, 2011); In re AT & T Mobility Wireless Data Servs. Sales Tax Litig., 792 F.Supp.2d 1028, 1033 (N.D.Ill.2011); In re Lawnmower Engine Horsepower Mktg. & Sales Practices Litig., 733 F.Supp.2d 997, 1013–14 (E.D.Wis.2010); In re OCA, Inc. Securities & Derivative Litig., Civ. A. No. 05–2165, 2009 WL 512081, at *20 (E.D.La. Mar. 2, 2009); Turner, 472 F.Supp.2d at 862–63 & n. 28 (citing cases). Cf. In re Vioxx Prods. Liab. Litig., 760 F.Supp.2d 640, 652–53 (E.D.La.2010) (recognizing the usefulness of the empirical studies but determining that they were not helpful in that case given the unique nature of the Vioxx settlement). But cf. McDonough v. Toys “R” Us, Inc., 834 F.Supp.2d 329, 344, 2011 WL 6425116, at *12 (E.D.Pa.2011) (“The academy, however, is only one source of data, and lower medians do not preclude higher percentage awards for attorneys' fees.”); In re Cabletron Sys., Inc. Securities Litig., 239 F.R.D. 30, 37 n. 12 (D.N.H.2006) (explaining how uncritical reliance on the Eisenberg and Miller study can “lend itself to manipulation by counsel” because counsel can use the study's approach to request a fee award near the high end of one standard deviation above the mean).




FN38. See, e.g., In re MetLife Demutualization Litig., 689 F.Supp.2d 297, 359 (E.D.N.Y.2010); Loudermilk Servs., Inc. v. Marathon Petroleum Co., 623 F.Supp.2d 713, 723–24 (S.D.W.Va.2009).




The most recent empirical study by Professors Eisenberg and Miller examined data from nearly 700 common-fund settlements between 1993 and 2008. FN39 A study by Professor Fitzpatrick sampled data from nearly 700 common-fund settlements in 2006 and 2007.FN40 As in Turner, the “class recovery” is this court's previous valuation of the settlement: $3,200,635.25. See 472 F.Supp.2d at 864. This value falls into the third decile on the Eisenberg and Miller tables. For this decile, the mean fee percentage is 26.4%, with a standard-deviation percentage of 9.8%.FN41 Eisenberg and Miller propose that


FN39. Eisenberg & Miller II, supra, at 251.




FN40. Fitzpatrick, supra, at 817.




FN41. Eisenberg & Miller II, supra, at 265.




fee requests falling within one standard deviation above or below the mean should be viewed as generally reasonable and approved by the court unless reasons are shown to question the fee. Fee requests falling within one and two standard deviations above or below the mean should be viewed as potentially reasonable but in need of affirmative justification. Fee requests falling more than two standard deviations above or below the mean should be viewed as presumptively unreasonable; attorneys seeking fees above this amount should be required to come forward with compelling reasons to support their request. FN42


FN42. Eisenberg & Miller I, supra, at 74.



The $3.2 million value in this case falls into the fourth decile in the Fitzpatrick table—which correlates with a mean percentage of 26.0% and a standard-deviation percentage of 6.3%.FN43


FN43. Fitzpatrick, supra, at 839.




Both these studies also examined benchmarks for different types of class actions. For consumer class actions such as this case, Eisenberg and Miller found the mean percentage to be 25% FN44; Fitzpatrick found it to be 23.5%.FN45 Fitzpatrick also organized the data by circuit. The mean for the Fifth Circuit was 26.4%.FN46


FN44. Eisenberg & Miller II, supra, at 262




FN45. Fitzpatrick, supra, at 835.




FN46. Id. at 836.




Data from the Eisenberg and Miller as well as the Fitzpatrick studies allow this court to set a more accurate benchmark by averaging their tables. See In re Educ. Testing Serv. Praxis Principles of Learning & Teaching: Grades 7–12 Litig., 447 F.Supp.2d 612, 630 (E.D.La.2006) (setting the benchmark by averaging the mean fee percentages from two tables reported in Eisenberg & Miller I). Using the settlement value as the baseline, an average of the means from the second Eisenberg and Miller study and from the Fitzpatrick study results in a fee percentage of 26.2%. Averaging the means from the two studies *1082 for consumer class actions results in a fee percentage of 24.3%. Averaging those two fee percentages (26.2% and 24.3%) results in a fee percentage of 25.3%. That percentage approximately reflects the prevailing market rate that both class members and class counsel could have expected when initiating the litigation. See Lawnmower Engine Horsepower, 733 F.Supp.2d at 1014. It also is consistent with the mean fee percentage in the Fifth Circuit.


Using 25.3% as the benchmark, and before any positive or negative adjustment, the result is a fee award of $766,833.51. This award is approximately $30,000 greater than that requested by class counsel. Class counsel properly recognizes that a negative adjustment, using the Johnson factors, is appropriate to avoid a fee award that is disproportionately high in relation to the benefit the class received.



3. Applying the Johnson Factors to the Benchmark


a. The Time and Labor Required

Examining this factor under the lodestar method requires the court to determine the reasonableness of the hours billed by class counsel. As the Fifth Circuit has explained:


[P]laintiffs seeking attorney's fees are charged with the burden of showing the reasonableness of the hours billed and, therefore, are also charged with proving that they exercised billing judgment. Billing judgment requires documentation of the hours charged and of the hours written off as unproductive, excessive, or redundant. The proper remedy for omitting evidence of billing judgment does not include a denial of fees but, rather, a reduction of the award by a percentage intended to substitute for the exercise of billing judgment.


Saizan v. Delta Concrete Prods. Co., 448 F.3d 795, 799 (5th Cir.2006) (per curiam) (internal footnotes omitted). The lodestar calculation, before the Johnson cross-check, accounts for billing judgment. The percentage method, by contrast, does not account for billing judgment. Billing judgment is appropriately considered in the cross-check, looking at whether the time and labor spent were required. See Dell, 2010 WL 2371834, at *15 (considering “all time that is excessive, duplicative, or inadequately documented” with respect to this factor (internal quotation marks omitted)).


According to the most recent fees-and-costs report submitted to this court, class counsel spent over 1,960 hours on this case—which, at each attorney's and staff member's billing rate, equals approximately $866,000 in attorneys' fees. (Docket Entry No. 111, Ex. 2, at 5). Counsel state that they “have devoted a significant portion of their available time to the investigation, prosecution, and settlement of this case on behalf of the Settlement class [.]” (Docket Entry No. 108, at 20).


The fees-and-costs reports do not show that counsel “wrote off” time in a way that shows billing judgment.FN47 For example, one day's entry for one co-lead counsel shows billed time for a call from one attorney about an expert's review, followed by billed time for a call to another attorney about the same review, followed by billed time for a call to those two attorneys about the same review. (Docket Entry No. 113, Barnow & Assocs. Ex., at 24). Each lawyer billed all the time spent for each call. On the current record, the court cannot conclude that the time spent by multiple lawyers on multiple calls on the same subject—calls that at a minimum appear to be duplicative—was reasonably spent or that *1083 billing judgment was used. The billing summary is full of similar instances of time spent by multiple lawyers on the same subject, for vaguely summarized phone calls, emails, or “reviews.” ( Compare, e.g., Docket Entry No. 113, Finkelstein Thompson Ex., at 3; with Docket Entry No. 113, Barnow & Assocs. Ex., at 6–8). Billing judgment requires adequate documentation of the hours spent and work done. See, e.g., Walker v. U.S. Dep't of Hous. & Urban Dev., 99 F.3d 761, 769 (5th Cir.1996). The fees-and-costs reports provide no basis for this court to discern billing judgment. ( See, e.g., Docket Entry No. 113, Barnow & Assocs. Ex., at 6 (“Calls and emails re: status of litigation”); Finkelstein Thompson Ex., at 3, 5 (“Telecon w/co-counsel/FTL attys Barnow re review”; “Research class definition and notice issues”); Sheller Ex., at 1 (“E-mails and blogs re clients and phone call”)).


FN47. There is one exception, which is negligible: 11.2 hours spent by one attorney with Barnow and Associates. (Docket Entry No. 113, Ex. 2, at 1). Otherwise, all the time spent appears to have been included in the fee-award submission.




The court does not question the number of hours that class counsel spent. The issue is whether the time and labor were reasonable. Even recognizing that this case required confirmatory discovery, settlement negotiations, and class-action administration, the number of entries for similar work by different attorneys and the absence of any evidence of the exercise of billing judgment support a negative adjustment.



b. The Novelty and Difficulty of the Issues

Class counsel state that “[t]he issues presented by this litigation are novel and difficult” and that “liability, negligence, actual damages, and punitive damages created complex issues[.]” (Docket Entry No. 108, at 20). The case clearly presented risks of not succeeding. But none of these issues can be described as particularly novel for class counsel. Although data-breach litigation is itself relatively new, see generally Timothy H. Madden, Data Breach Class Action Litigation—A Tough Road for Plaintiffs, Boston Bar J., Fall 2011, at 27 (generally discussing data-breach litigation), class counsel previously litigated two very similar data-breach class actions: In re Countrywide Financial Corp. Customer Data Security Breach Litigation, No. 3:08–MD–01998, 2010 WL 3341200 (W.D.Ky. Aug. 23, 2010), and In re TJX Companies Retail Security Breach Litigation, 246 F.R.D. 389 (D.Mass.2007). And, most important, the early settlement in this case meant that counsel did not have to wrestle with the difficult issues that likely would have been presented had the litigation reached the dispositive-motions stage. This factor is at best neutral or supports some negative adjustment.



c. The Skill Required

“This factor is evidenced where ‘counsel performed diligently and skillfully, achieving a speedy and fair settlement, distinguished by the use of informal discovery and cooperative investigation to provide the information necessary to analyze the case and reach a resolution.’ ” King v. United SA Fed. Credit Union, 744 F.Supp.2d 607, 614 (W.D.Tex.2010) (quoting Di Giacomo v. Plains All Am. Pipeline, No. Civ. A. H–99–4137, H–99–4212, 2001 WL 34633373, at *12 (S.D.Tex. Dec. 19, 2001)). Another “highly important” aspect is “[t]he trial judge's expertise gained from past experience as a lawyer and [her] observation from the bench of lawyers at work[.]” In re Enron Corp. Securities, Derivative & “ERISA” Litig. ( “Enron II” ), 586 F.Supp.2d 732, 789 (S.D.Tex.2008) (quoting Johnson, 488 F.2d at 718).


In certifying the class and approving the settlement, the court has discussed the numerous obstacles facing this class action in litigation. Class counsel's skill and experience with prior similar litigation clearly helped achieve an earlier resolution of this case. But this case never proceeded to formal discovery, dispositive motions, or *1084 opposed class-certification motions. This factor is neutral.



d. Preclusion of Other Legal Employment

Class counsel explain at greater length how this factor favors approval of its fee request:


The efforts of Co–Lead Settlement Class Counsel in the management of this class action necessarily infringed upon the time and opportunity they would have had available to accept other employment. The reality of complex cases is that work is not easily shifted to other attorneys in a firm not familiar with the matter, with the result that substantially less time becomes available to Co–Lead Settlement Class Counsel to attend to other matters. Time devoted to this litigation and its resolution necessarily limited the time available for other litigation.


(Docket Entry No. 108, at 21). This statement, though logically true, is incomplete, for there is no information about the “other employment.” As the district judge noted in Dell, “[T]here is no evidence, such as an affidavit, cited to support this claim. There is no doubt that the attorneys did pass up other work in order to prosecute this case, but the Court cannot assume that legal work would have been more lucrative than this case without any evidence so indicating.” 2010 WL 2371834, at *17. The same is true here. Moreover, much of the work in this case took place during relatively short periods. This factor is neutral.



e. Customary Fees for Similar Work in The Community

In setting the 25.3% benchmark, the court already has discussed at length the empirical data supporting the reasonableness of that percentage. The court also has noted the Fitzpatrick study, which shows the mean fee percentage award in the Fifth Circuit to be 26.4%.FN48 According to class counsel, “[t]he customary contingency fee for representation of many contingency cases within the same geographic area, in much less complex cases than this class action, often ranges from 33 1/3% to 40% of the gross award plus costs[.]” (Docket Entry No. 108, at 21). Class counsel cite a 1995 study on attorney compensation by the State Bar of Texas and a 1992 Seventh Circuit opinion, In re Continental Illinois Securities Litigation, 962 F.2d 566. The empirical studies to which this court refers are much more recent; both were published in 2010. And these empirical studies are more focused on the type of fee and fee analysis at issue here. This factor supports the benchmark set by the court, not the higher benchmark that class counsel advocate.


FN48. Fitzpatrick, supra, at 836.





f. Counsels' Preexisting Fee Agreement

[44] Headnote Citing References “The fee quoted to the client or the percentage of the recovery agreed to is helpful in demonstrating the attorney's fee expectations when he accepted the case.” Forbush v. J.C. Penney Co., 98 F.3d 817, 824 (5th Cir.1996) (internal quotation marks omitted). District courts within this circuit have found upward adjustments appropriate if counsel took the case on a contingency basis. See, e.g., Klein, 705 F.Supp.2d at 678 (percentage); DeHoyos, 240 F.R.D. at 330 (lodestar). But merely taking a case on a contingency basis does not merit an upward adjustment if the benchmark reflects the market rate. See Dell, 2010 WL 2371834, at *17. Although class counsel took this case on a contingency-fee basis, (Docket Entry No. 108, at 22), the benchmark reflects the market rate. This factor is neutral.



*1085 g. Time Limitations Imposed by the Client or by Circumstances

According to class counsel, “[t]his case has required significant attention by Co–Lead Settlement Class Counsel. Frequently, issues requiring immediate attention arose, and such matters were attended to expeditiously and properly.” (Docket Entry No. 108, at 22). This statement is unsupported by record evidence. The record discloses no external time limitations or pressures outside of the complaint filing deadline, which was extended twice without Heartland's opposition. This factor supports a slight negative adjustment.



h. The Amount Involved and the Results Obtained

“The United States Supreme Court and the Fifth Circuit have held that the most critical factor in determining the reasonableness of a fee award is the degree of success obtained.” Enron II, 586 F.Supp.2d at 796 (internal quotation marks omitted) (citing Farrar v. Hobby, 506 U.S. 103, 114, 113 S.Ct. 566, 121 L.Ed.2d 494 (1992); Migis v. Pearle Vision, Inc., 135 F.3d 1041, 1047 (5th Cir.1998)). Class counsel contend that they “negotiated a monetary settlement that represents an excellent result for the Settlement Class,” listing the components to the settlement that class counsel valued at $4.85 million. (Docket Entry No. 108, at 21–22). This court has valued the settlement as worth over $3 million, but that includes $2 million in indirect and attenuated benefits to individual class members: $500,000 through the cy pres distribution and $1.5 million in notice costs. On the other hand, the settlement is a good result for the Consumer Plaintiffs given the legal and evidentiary hurdles litigation would have presented and given class members' lack of interest or losses. Through the settlement and its claims-administration process, those class members who legitimately suffered losses as a result of the data breach, whether due to fraudulent charges or identity theft, were provided with an efficient avenue for compensation. The cy pres payments will fund efforts toward better data protection, though the ultimate results are speculative. The results obtained are a neutral factor.



i. The Experience, Reputation, and Ability of the Attorneys

The extensive experience and fine reputation and ability of class counsel are clear and unquestioned. See, e.g., Dell, 2010 WL 2371834, at *18; Enron II, 586 F.Supp.2d at 797; DeHoyos, 240 F.R.D. at 331. At the same time, these attributes are to be expected: Rule 23(g) requires them of lawyers appointed as class counsel. See Fed. R. Civ. P. 23(g)(1)(A); Manual § 21.271; see also Aggregate Litigation § 1.05 cmt. g. This factor is neutral.



j. Undesirability of the Case

Class counsel explains at length why taking on this case was undesirable. The reasons are typical of consumer class-action lawsuits: the defendant is a large corporation with substantial resources, financial and otherwise, for a vigorous defense; and the legal and factual issues presented risks to recovery absent settlement. ( See Docket Entry No. 108, at 23). But there were a large number of lawyers who believed the case was attractive. Many lawyers filed numerous class-action and individual suits based on the data breach. ( See Docket Entry No. 3). This case was desirable from the standpoint of many plaintiffs' lawyers. See Dell, 2010 WL 2371834, at *19; Di Giacomo, 2001 WL 34633373, at *12. This factor is neutral.



k. The Relationship with the Clients

According to class counsel, all class members “were kept abreast of the developments in this litigation throughout its *1086 pendency and by way of the notice program, all as applicable and appropriate.” (Docket Entry No. 108, at 22). This factor, however, appears to address factors other than notice to absent class members. Given the absence of any record evidence showing other communications between class counsel and representative or named plaintiffs, or any class members, this factor supports a slight negative adjustment.



l. Awards in Similar Cases

“Courts often look at fees awarded in comparable cases to determine if the fee requested is reasonable.” DeHoyos, 240 F.R.D. at 333 (citing Johnson, 488 F.2d at 719 & n. 5). The empirical studies cited by the court provide helpful information. Specific cases also can be examined. Because class-action litigation involving data breaches is relatively new, there are few settlements to examine: three, to be precise. In one case, the court calculated fees using the percentage method, approving a requested fee award amounting to 7.7% of the fund. In re TD Ameritrade Account Holder Litig., Nos. C 07–2858 SBA, C 07–4903 SBA, 2011 WL 4079226, at *16 (N.D.Cal. Sep. 13, 2011). In the two other settlements, the courts calculated fees using the lodestar method. See Countrywide Fin. Corp., 2010 WL 3341200, at *9; TJX Cos., 584 F.Supp.2d at 408. Had these cases used the percentage method, the percentage would be lower than in this case. See Countrywide Fin. Corp., 2010 WL 3341200, at *9 (approving lodestar award of $3.5 million, but noting that had the court used the percentage method, the $3.5 million fee award would be 20% of the settlement's value); TJX Cos., 584 F.Supp.2d at 409–10 ($6.5 million (attorneys' fees awarded using lodestar) / $177 million (value of settlement) = 3.7%). The present benchmark of 25.3%, if unadjusted, would stand as the highest percentage recovery of any of the data-breach settlements to date. This factor supports a negative adjustment.



4. Adjustment of the Benchmark in Light of the Johnson Factors

The final step in applying the percentage method is to determine whether the benchmark—25.3%—should be adjusted in light of the Johnson factors. Four of the factors support a negative adjustment. Six support no adjustment. One supports either a negative adjustment or no adjustment. No factor favors a positive adjustment. After careful consideration, the court concludes that a negative adjustment of the benchmark, to 20%, is appropriate. A 5.3% negative adjustment accurately reflects the balance of the Johnson factors and results in a reasonable fee award to class counsel. The resulting fee award under the percentage method, with the Johnson-factors adjustment, is $606,192.50.FN49


FN49. This award reflects a 16.4% negative adjustment from class counsel's $725,000 fee request.




C. The Lodestar Cross–Check

[45] Headnote Citing References The lodestar cross-check is usually applied “to avoid windfall fees, i.e., to ‘ensure that the percentage approach does not lead to a fee that represents an extraordinary lodestar multiple.’ ” Enron II, 586 F.Supp.2d at 751 (quoting Cendant II, 404 F.3d at 188); accord, e.g., Eisenberg & Miller I, supra, at 39 (“The idea is that if the percentage fee grossly exceeds the lodestar amount, the attorney would be receiving a windfall, and the courts should adjust the fee downward to a more reasonable range.”). The purpose of the lodestar cross-check, however, is to verify the reasonableness of the award calculated under the percentage method, to avoid both over- and under-compensation.


*1087 Applying the lodestar method can be an extraordinarily time-consuming process for a district court tasked with carefully reviewing counsel's billing records. Those circuits approving the lodestar cross-check have made it clear that district courts need not scrutinize counsel's billing records with the thoroughness required were the lodestar method applied by itself. See In re Rite Aid Corp. Securities Litig., 396 F.3d 294, 306–07 (3d Cir.2005); Goldberger, 209 F.3d at 50.FN50 Before Dell was decided, one district court within this circuit conducted what perhaps can be called a detailed spot check of class counsel's billing records, in addition to relying on the summaries provided by class counsel. See Enron II, 586 F.Supp.2d at 753 (“The Fifth Circuit has never indicated that it would relax a lodestar calculation, so this Court has performed a detailed examination in spot checks of the records, though not exhaustive examination of each entry, relying also on the affidavits and declarations submitted by Class Counsel, and has used the Johnson factors endorsed by the Fifth Circuit.”). In this case, the court has reviewed the fees-and-costs reports that counsel submitted and has examined many of the pages thoroughly. It has not taken the extraordinary amount of time needed, however, for a thorough examination of all the time and billing records that counsel generated for purposes of a standalone lodestar analysis.


FN50. District courts following this approach in other circuits agree. See Kay Co. v. Equitable Prod. Co., 749 F.Supp.2d 455, 469–70 (S.D.W.Va.2010); Fernandez v. Victoria Secret Stores, LLC, No. CV 06–04149 MMM (SHx), 2008 WL 8150856, at *9 n. 35 (C.D.Cal. July 21, 2008); In re Tyco Int'l, Ltd. Multidistrict Litig., 535 F.Supp.2d 249, 270 (D.N.H.2007); Young v. Polo Retail, LLC, No. C–02–4546 VRW, 2007 WL 951821, at *6 (N.D.Cal. Mar. 28, 2007); Turner, 472 F.Supp.2d at 867; In re Royal Ahold N.V. Securities & ERISA Litig., 461 F.Supp.2d 383, 385 (D.Md.2006); In re Xcel Energy, Inc., Securities, Derivative & “ERISA” Litig., 364 F.Supp.2d 980, 999 (D.Minn.2005).




[46] Headnote Citing References The lodestar method requires the court to multiply the number of hours reasonably expended on the litigation by a reasonable hourly rate and to apply an upward or downward multiplier if necessary. Dell, 669 F.3d at 642–44. Under the most recent billing summary submitted, class counsel spent 1,963.60 hours on this action. (Docket Entry No. 113, Ex. 2, at 5). If this court had applied the lodestar as the primary method, as opposed to a cross-check, the number of hours reasonably spent would be reduced because the record does not adequately show billing judgment. Under Fifth Circuit precedent, “plaintiffs seeking attorney's fees are charged with the burden of showing the reasonableness of the hours billed and, therefore, are also charged with proving that they exercised billing judgment.” Saizan, 448 F.3d at 799. The lack of such evidence supports a 10% reduction in the number of hours used in a lodestar cross-check.


[47] Headnote Citing References[48] Headnote Citing References The hourly rates used are reasonable. “An attorney's requested hourly rate is prima facie reasonable when he requests that the lodestar be computed at his or her customary billing rate, the rate is within the range of prevailing market rates[,] and the rate is not contested.” Altier, 2012 WL 161824, at *22 (citing La. Power & Light Co. v. Kellstrom, 50 F.3d 319, 328 (5th Cir.1995)); see also High Sulfur Content, 517 F.3d at 228 (“The district court must first determine the reasonable number of hours expended on the litigation and the reasonable hourly rate for the participating attorney.” (emphasis added)). In this case, the rates ranged from as high as $825 per hour for one the colead class counsel to as low as $90 per hour for a paralegal. (Docket Entry No. 113, Ex. 2, at 1, 5). The mean hourly rate *1088 was $400.81.FN51 The hourly rates are within the “prevailing market rates for lawyers with comparable experience and expertise” in complex class-action litigation and thus are reasonable. Altier, 2012 WL 161824, at *22 (citing cases).


FN51. This figure excludes the entry for the Barnow and Associates attorney who was not charged for 11.2 hours of work. Were that entry to be added, the mean hourly rate would decrease to $395.86.




Multiplying the hours expended by class counsel (1,963.60) by each attorney's hourly rate results in total fees of $866,412.50. (Docket Entry No. 113, Ex. 2, at 5). Of course, the lodestar method does not take into account the settlement value to the class. Attorneys' fees of $866,412.50 would equal 28.9% of the settlement's approximately $3 million value. At face value, that figure does not appear unreasonable; in addition, it is within the standard deviation of both the Eisenberg and Miller and Fitzpatrick tables. But when the 28.9% percentage is compared to the value of the $1 million fund made available to the claimants—whether directly or through cy pres—attorneys' fees of $866,412.50 would far exceed that fund's value of $500,962.30. Class counsel, indeed, recognizes the unreasonable nature of this relationship in reducing the requested fee award in the settlement below the lodestar.


The $725,000 requested results from applying a 16.3% negative adjustment to the lodestar that counsel submitted. Two things stand out. First, most applications of the lodestar method result in a positive, not a negative, adjustment.FN52 Second, an adjustment is supposed to occur if the Johnson factors, on balance, support that result.FN53 Class counsel's approach—asking for a negative adjustment, but implicitly arguing for a positive adjustment under the Johnson factors—is inconsistent logically, with the record, and with the applicable law.


FN52. See Prudential Ins. Co., 148 F.3d at 341 (recognizing that “[m]ultiples ranging from one to four are frequently awarded in common fund cases when the lodestar method is applied” (quoting 4 Rubenstein et al., Newberg on Class Actions § 14:6)); Vaughn R. Walker & Ben Horwich, The Ethical Imperative of a Lodestar Cross–Check: Judicial Misgivings about “Reasonable Percentage” Fees in Common Fund Cases, 18 Geo. J. Legal Ethics 1453, 1472 (2005) (“In our informal review [of opinions evaluating a lodestar cross-check], the multipliers ranged from about 1.0 to over 5.0, with a substantial number of multipliers in the 3.0 to 4.0 range.”).




FN53. Cf. High Sulfur Content, 517 F.3d at 228 (“The district court may adjust the lodestar upward or downward after a review of the twelve factors set forth in Johnson.”); Saizan, 448 F.3d at 800 (“After calculating the lodestar, the court may decrease or enhance the amount based on the relative weights of the twelve factors set forth in Johnson.”).




This court applied the Johnson factors as part of the percentage method and concluded that the balance supports a negative adjustment. Although the analysis would differ slightly had the court applied the lodestar method and then the Johnson cross-check, see, e.g., Migis, 135 F.3d at 1047 (“Some of these [ Johnson ] factors are subsumed in the initial lodestar calculation and should not be double counted.”), the result would not be significantly different.


The record and law support reducing the lodestar by a negative multiplier to avoid a windfall to class counsel, given the value of the settlement obtained. The issue is the amount of the multiplier. Class counsel's requested award of $725,000, which amounts to 28.9% of the settlement value, is disproportionately high. Under the lodestar cross-check, reducing the number of hours reasonably expended and applying a negative multiplier of 0.95 to account for the Johnson factors results in a fee award of $635,527.14.FN54 That is reasonably*1089 close to the $606,192.50 figure calculated under the percentage method.


FN54. The record supports reducing the number of hours expended by 15% across the board to account for the absence of billing judgment and the lack of information provided, resulting in an approximate lodestar of $668,975.94. That amount is further reduced by the Johnson factors not subsumed within the lodestar analysis that support a negative adjustment: the absence of evidence of time limitations and relationship with clients, and, to some extent, the novelty and difficulty of the issues presented. Applying a 5% negative adjustment to that lodestar results in a fee award of $635,527.14.




The lodestar cross-check, in this case, has confirmed the reasonableness of the fee award using the percentage method. Class counsel is entitled to be compensated for its successful efforts in representing the Consumer Plaintiffs and in negotiating a settlement. That compensation, however, must be reasonable based on the value of that settlement to the class. Awarding fees of $606,192.50, calculated and adjusted under the percentage method and Johnson factors, and through the lodestar cross-check, is reasonable.


D. Costs

[49] Headnote Citing References[50] Headnote Citing References Class counsel request an award of $35,000 for the costs expended in this action. (Docket Entry No. 107, ¶ 6). “In addition to being entitled to reasonable attorneys' fees, class counsel in common fund cases are also entitled to reasonable litigation expenses from that fund.” Radosti, 760 F.Supp.2d at 79 (quoting Wells v. Allstate Ins. Co., 557 F.Supp.2d 1, 8 (D.D.C.2008)) (internal alteration omitted). In Radosti, the district court approved the costs requested because (1) class counsel provided the court documents showing the costs, (2) the court found the costs to be typical expenses, (3) no class member objected to the costs, and (4) the defendant did not object. Id. All four circumstances are present here. Class counsel have provided this court with documentation supporting the costs. The court has carefully reviewed those costs and finds them appropriate for a case of this nature. There are no objections. The costs requested are reasonable.


E. Incentive Awards

Finally, class counsel seek approval of incentive awards of $200 to the representative plaintiffs and $100 to the named plaintiffs. (Docket Entry No. 107, ¶ 6). During the preliminary fairness hearing, class counsel explained the rationale behind seeking these awards: “I am a believer in having people to come forward because they have time and expense and that there should be some reasonable incentive because they advanced society's interest in the truth of the matter in solving problems.” (Docket Entry No. 87, at 8).


[51] Headnote Citing References “Courts ‘commonly permit payments to class representatives above those received in settlement by class members generally.’ ” Turner, 472 F.Supp.2d at 870 (quoting Smith v. Tower Loan of Miss., Inc., 216 F.R.D. 338, 367–68 (S.D.Miss.2003)). That does not mean, however, that incentive awards are always merited. “In deciding whether an incentive award is warranted, courts look to: (1) ‘the actions the plaintiff has taken to protect the interests of the class'; (2) ‘the degree to which the class has benefitted from those actions'; and (3) ‘the amount of time and effort the plaintiff expended in pursuing the litigation.’ ” Ky. Grilled Chicken, 280 F.R.D. at 382–83, 2011 WL 5599129, at *15 (quoting Cook v. Niedert, 142 F.3d 1004, 1016 (7th Cir.1998)).FN55


FN55. Cf. Theodore Eisenberg & Geoffrey P. Miller, Incentive Awards to Class Action Plaintiffs: An Empirical Study, 53 UCLA L. Rev. 1303, 1310 (2006) (arguing that “incentive awards serve multiple goals”: compensating representative plaintiffs for costs and superior service to the class).




*1090 [52] Headnote Citing References The court agrees with class counsel's statement at the preliminary-fairness hearing about the purpose of incentive awards. They reward representative plaintiffs (and named plaintiffs) for their time and expenses spent advocating on behalf of the class. In this case, however, there is no evidence of such involvement, time, or expenses. For the court to approve the incentive awards—even if they are nominal, and even if the defendant does not object—there must be some evidence in the record demonstrating that the representative plaintiffs were involved. Absent such evidence, the court lacks an adequate basis to approve the incentive awards.


V. Conclusion

The Consumer Plaintiffs' motion for final approval of the settlement, for an award of attorneys' fees and costs, and for incentive awards, (Docket Entry No. 107), is granted in part and denied in part. The settlement class is certified. The proposed settlement is approved as fair, reasonable, and adequate. Attorneys' fees are awarded in the amount of $606,192.50. Costs are awarded in the amount of $35,000.00. Incentive awards to named and representative plaintiffs are denied.

851 F.Supp.2d 1040
David A. Szwak
Bodenheimer, Jones & Szwak, LLC
416 Travis Street, Suite 1404, Mid South Tower
Shreveport, Louisiana 71101
318-424-1400 / Fax 221-6555
President, Bossier Little League
Chairman, Consumer Protection Section, Louisiana State Bar Association

Administrator
Site Admin
Posts: 11757
Joined: Tue Jul 26, 2005 4:15 am

Re: In re Heartland Payment Systems: Data Breach Case

Postby Administrator » Wed Oct 29, 2014 6:59 am

In re Heartland Payment Systems, Inc. Customer Data Sec. Breach Litigation
834 F.Supp.2d 566
S.D.Tex.,2011


MEMORANDUM AND OPINION

LEE H. ROSENTHAL, District Judge.

In January 2009, Heartland Payment Systems, Inc. (“Heartland”) publicly disclosed that hackers had breached its computer systems and obtained access to confidential payment-card information for over one hundred million consumers. Consumers and financial institutions filed suits across the nation. The Judicial Panel on Multidistrict Litigation consolidated those cases before this court. The cases have proceeded on two tracks, one for the Consumer Plaintiffs and one for the Financial Institution Plaintiffs.


The Financial Institution Plaintiffs filed a master complaint asserting causes of action for breach of contract and implied contract, negligence and negligence per se, negligent and intentional misrepresentation, and violations of consumer-protection statutes in New Jersey and other states. (Docket Entry No. 32). Heartland moved to dismiss. (Docket Entry No. 39).FN1 After *574 this court dismissed claims filed by some of the Financial Institution Plaintiffs against the banks that contracted with Heartland, (Docket Entry No. 117), the parties supplemented their briefs. (Docket Entry Nos. 122, 124, 127, 131, 133–35).FN2 Based on the master complaint, the motion, the extensive briefing, and the relevant law, this court grants the motion to dismiss in part and denies it in part. The specific rulings are as follows:


FN1. The Financial Institution Plaintiffs responded, (Docket Entry No. 50); Heartland replied, (Docket Entry No. 56); the Financial Institution Plaintiffs surreplied, (Docket Entry No. 64); and Heartland supplemented its reply, (Docket Entry No. 69).




FN2. The Financial Institution Plaintiffs seek to proceed as a nationwide class or, alternatively, as nine state subclasses. (Docket Entry No. 32, ¶¶ 80–82). The issue of class certification is not yet before this court.




(1) The motion to dismiss is granted with prejudice and without leave to amend as to the claims for negligence and for violations of the New Jersey Consumer Fraud Act, the New York consumer protection law, and the Washington Consumer Protection Act.

(2) The motion to dismiss is granted without prejudice and with leave to amend as to the following claims: breach of contract; breach of implied contract; express misrepresentation; negligent misrepresentation based on nondisclosure; and violations of the California Unfair Competition Law, the Colorado Consumer Protection Act, the Illinois Consumer Fraud and Deceptive Business Practices Act, and the Texas Deceptive Trade Practices—Consumer Protection Act.



(3) The motion to dismiss is denied as to the claim brought under the Florida Deceptive and Unfair Trade Practices Act.


The reasons for these rulings are explained in detail below. The Financial Institution Plaintiffs must file an amended complaint no later than December 23, 2011. A status conference is set for January 13, 2012, at 8:30 a.m. in Courtroom 11–B.

I. Background FN3

FN3. The factual allegations, which, if nonconclusory, this court must take as true for purpose of the motion to dismiss, come from the master complaint. See Randall D. Wolcott, M.D., P.A. v. Sebelius, 635 F.3d 757, 763 (5th Cir.2011).




Every day, merchants swipe millions of customers' payment cards.FN4 In the seconds that pass between the swipe and approval (or disapproval), the transaction information goes from the point of sale, to an acquirer bank, across the credit-card network, to the issuer bank, and back. Acquirer banks contract with merchants to process their transactions, while issuer banks provide credit to consumers and issue payment cards. The acquirer bank receives the transaction information from the merchant and forwards it over the network to the issuer bank for approval. If the issuer bank approves the transaction, that bank sends money to cover the transaction to the acquirer bank. The acquirer bank then forwards payment to the merchant. A bank often acts as both an issuer and an acquirer. Banks frequently outsource the processing functions to companies specializing in that service.


FN4. The term “payment cards” refers to both credit and debit cards distributed by issuer banks.




Visa and MasterCard are two of the largest credit-card networks. They neither issue cards nor contract with merchants to process transactions. Instead, acquirer and issuer banks contract with *575 them for access to the Visa and MasterCard networks. Visa and MasterCard, like the other credit-card networks, impose extensive regulations on acquirer and issuer banks. Visa and MasterCard require the banks they contract with to impose these regulations on the merchants who submit transactions for processing and on the entities that process the transactions.


The Financial Institution Plaintiffs are nine banks suing as issuer banks. Heartland, the defendant, processes merchant transactions on behalf of two acquirer banks, Heartland Bank and KeyBank, N.A.FN5 (Docket Entry No. 42, Exs. 4, 5). Heartland's contracts with KeyBank and Heartland Bank required Heartland to comply with Visa and MasterCard network regulations. ( Id., Ex. 4, ¶ 1.1(f); Ex. 5, ¶ 1.1(f)). To the extent that the terms of Heartland's contracts with these and other banks differed from the Visa and MasterCard regulations, the regulations governed. ( Id., Ex. 4, ¶ 1.1(h); Ex. 5, ¶ 1.1(i)).


FN5. Five of the Financial Institution Plaintiffs sued Heartland Bank and KeyBank in the Southern District of Texas. That case also is part of the consolidated litigation. (Docket Entry No. 72).




Beginning at least as early as December 2007, three hackers—an American, Albert Gonzalez, and two unknown Russians—infiltrated Heartland's computer systems. (Docket Entry No. 32, ¶¶ 35, 63–64). The hackers installed programs that allowed them to capture some of the payment-card information stored on the Heartland computer systems. ( Id., ¶ 65). In late October 2008, Visa alerted Heartland to suspicious account activity. Heartland, with Visa and MasterCard and others, investigated. ( Id., ¶ 35). Heartland discovered suspicious files in its systems on January 12, 2009. A day later, Heartland uncovered the program creating those files. ( Id., ¶ 37). That program provided the hackers with access to data on the systems. ( Id., ¶¶ 41–42). On January 20, Heartland publicly announced the data breach. ( Id., ¶ 38). The hackers obtained payment-card numbers and expiration dates for approximately 130 million accounts. ( Id., ¶ 5). For some of these accounts, the hackers also obtained cardholder names. ( Id., ¶ 44). They did not obtain any cardholder addresses, however, which meant that the stolen card information generally could be used only for in-person transactions. ( Id., ¶ 70).


The Financial Institution Plaintiffs allege that this data breach resulted from Heartland's failure to follow industry security standards known as PCI–DSS. ( See id., ¶¶ 53–62). After the breach, the Financial Institution Plaintiffs incurred significant expenses replacing payment cards and reimbursing fraudulent transactions. ( Id., ¶ 78). The master complaint asserts ten causes of action:


(I) breach of Heartland's contracts with Heartland Bank, KeyBank, and its merchants, to which the Financial Institution Plaintiffs are third-party beneficiaries;


(II) negligence;


(III) breach of an implied contract to the Financial Institution Plaintiffs;


(IV) negligence per se;


(V) negligent misrepresentation;


(VI) intentional misrepresentation;


(VII) violations of the New Jersey Consumer Fraud Act; and


(VIII, IX, and X) violations of other states' consumer-protection laws.


The complaint seeks class certification.


Heartland has moved to dismiss the complaint in its entirety. (Docket Entry No. 39). Its arguments, and the Financial Institution Plaintiffs' responses, are addressed in detail below.


*576 II. Rule 12(b)(6)

A complaint may be dismissed when the plaintiff fails “to state a claim upon which relief can be granted.” Fed. R. Civ. P. 12(b)(6). In Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007), and Ashcroft v. Iqbal, 556 U.S. 662, 129 S.Ct. 1937, 1949–50, 173 L.Ed.2d 868 (2009), the Supreme Court confirmed that Rule 12(b)(6) must be read in conjunction with Rule 8(a), which requires “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A complaint must contain “enough facts to state a claim to relief that is plausible on its face” to withstand a Rule 12(b)(6) motion. Iqbal, 129 S.Ct. at 1949. “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. Facial plausibility “does not require ‘detailed factual allegations,’ but it demands more than an unadorned, the-defendant-unlawfully-harmed-me accusation.” Id. (quoting Twombly, 550 U.S. at 555, 127 S.Ct. 1955). Nor is facial plausibility “akin to a ‘probability requirement’ ”; rather, “it asks for more than a sheer possibility that a defendant has acted unlawfully.” Iqbal, 129 S.Ct. at 1949 (quoting Twombly, 550 U.S. at 556, 127 S.Ct. 1955). Facial plausibility requires “the plaintiff [to] plead [ ] factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 129 S.Ct. at 1949. “Where a complaint pleads facts that are ‘merely consistent with’ a defendant's liability, it ‘stops short of the line between possibility and plausibility of entitlement to relief.’ ” Id. (quoting Twombly, 550 U.S. at 557, 127 S.Ct. 1955).


[1] Headnote Citing References[2] Headnote Citing References When a plaintiff's complaint fails to state a claim, a district court generally should provide the plaintiff at least one chance to amend the complaint under Rule 15(a) before dismissing the action with prejudice. See Great Plains Trust Co. v. Morgan Stanley Dean Witter & Co., 313 F.3d 305, 329 (5th Cir.2002) (“district courts often afford plaintiffs at least one opportunity to cure pleading deficiencies before dismissing a case”); see also United States ex rel. Adrian v. Regents of the Univ. of Cal., 363 F.3d 398, 403 (5th Cir.2004) (“Leave to amend should be freely given, and outright refusal to grant leave to amend without a justification ... is considered an abuse of discretion.” (internal citation omitted)). “Denial of leave to amend may be warranted for undue delay, bad faith or dilatory motive on the part of the movant, repeated failure to cure deficiencies, undue prejudice to the opposing party, or futility of a proposed amendment.” United States ex rel. Steury v. Cardinal Health, Inc., 625 F.3d 262, 270 (5th Cir.2010) (emphasis added). A district court has broad discretion to dismiss a complaint without leave to amend “where the plaintiff has previously been granted leave to amend [to cure pleading deficiencies] and has subsequently failed to add the requisite particularity to its claims[.]” Zucco Partners, LLC v. Digimarc Corp., 552 F.3d 981, 1007 (9th Cir.2009); see also Carroll v. Fort James Corp., 470 F.3d 1171, 1175 (5th Cir.2006) (affirming a district court's dismissal for failure to state a claim without leave to amend after the court “instructed [the plaintiffs] to plead their fraud claim with greater particularity, but the amended complaint was still woefully inadequate”).


III. Analysis

A. The Contract and Implied Contract Claims

The master complaint asserts claims for breach of contract and breach of implied *577 contract. The Financial Institution Plaintiffs base these claims, “without limitation,” on Heartland's contracts with: (1) its merchants; (2) Heartland Bank and KeyBank; and (3) Visa and MasterCard. (Docket Entry No. 32, ¶ 95). They allege that the contracts create duties to safeguard payment-card information. ( Id., ¶ 96). The Financial Institution Plaintiffs assert that they are intended third-party beneficiaries of those contracts and that, “[u]nder the circumstances, recognition of a right to performance by [the Financial Institution Plaintiffs] is appropriate to effectuate the intentions of the parties to these contracts.” ( Id., ¶ 97). They contend that Heartland breached the contracts by “failing to adequately safeguard ... sensitive financial information” of their customers, resulting in the Financial Institution Plaintiffs' financial harm. ( Id., ¶ 98).


[3] Headnote Citing References Heartland notes that the master complaint does not precisely identify the allegedly breached contracts. Heartland submits what it contends to be the relevant contracts: its contracts with Heartland Bank and KeyBank and an “exemplar” of a contract with a merchant. (Docket Entry No. 40, at 35, 41; Docket Entry No. 42, Exs. 4–6). An affidavit from a Heartland attorney states that these were the only types of contracts in effect at the time of the data breach. ( See Docket Entry No. 41, ¶¶ 6–8).


[4] Headnote Citing References A court ordinarily may not go outside the pleadings in considering a motion to dismiss. Scanlan v. Tex. A & M Univ., 343 F.3d 533, 536 (5th Cir.2003). The Fifth Circuit “recognize[s] one limited exception” for documents attached to a motion to dismiss “that are referred to in the plaintiff's complaint and are central to the plaintiff's claim.” Id.; accord, e.g., Rodriguez v. Rutter, 310 Fed.Appx. 623, 626 (5th Cir.2009). The contracts on which Heartland relies meet this standard.



1. The Contracts with the Acquirer Banks

The Financial Institution Plaintiffs allege that Heartland's contracts with Heartland Bank and KeyBank required Heartland to take “appropriate steps to safeguard the sensitive financial information” of the Financial Institution Plaintiffs' customers. (Docket Entry No. 32, ¶ 96). The Financial Institution Plaintiffs assert that they are intended third-party beneficiaries to these contracts. ( Id., ¶ 97). Heartland disagrees. According to Heartland, the contracts do not show an intent primarily to benefit the Financial Institution Plaintiffs. Even if the contracts showed such an intent, Heartland argues, the Financial Institution Plaintiffs still cannot recover because they are not creditor or donee beneficiaries of the contracts. Heartland further contends that the incorporated Visa and MasterCard regulations preclude third-party claims. Finally, Heartland argues that even if the Financial Institution Plaintiffs are third-party beneficiaries of the contracts, the allegations are too conclusory to state a plausible breach of contract claim. ( See Docket Entry No. 40, at 37–39).



a. The Heartland Bank Contract

[5] Headnote Citing References[6] Headnote Citing References[7] Headnote Citing References Heartland's contract with Heartland Bank contains a choice-of-law provision specifying Missouri law. (Docket Entry No. 42, Ex. 4, ¶ 4.11). The parties do not dispute that Missouri law applies. Under Missouri law, “[o]nly parties to a contract and any third-party beneficiaries of a contract have standing to enforce that contract.” Verni v. Cleveland Chiropractic Coll., 212 S.W.3d 150, 153 (Mo.2007). Intended beneficiaries qualify as third-party beneficiaries, but incidental beneficiaries do not. See id. A third party is an intended*578 beneficiary only when “the contract clearly express[es] intent to benefit that party or an identifiable class of which the party is a member.” Id. (internal quotation marks omitted). Absent such express language, “there is a strong presumption ... that the parties contracted only to benefit only themselves.” Id. (internal quotation marks omitted).


In recent cases, the Missouri Supreme Court has held that a court must limit itself to examining the contract language in determining third-party beneficiary status. In Nitro Distributing, Inc. v. Dunn, 194 S.W.3d 339 (Mo.2006), the court explained that, “[t]o be bound as a third-party beneficiary, the terms of the contract must clearly express intent to benefit that party or an identifiable class of which the party is a member.” Id. at 345 (emphasis added). Looking only to the contract, and not to extrinsic evidence, the court concluded that the contract “expresse[d] no intent whatsoever to benefit” the asserted third parties. Id. In Netco, Inc. v. Dunn, 194 S.W.3d 353 (Mo.2006), decided on the same day, the state supreme court again limited its consideration to the contract language. See id. at 358. In that case, the defendant, an Amway distributor, argued that the plaintiff was bound to the Amway franchise contract as a third-party beneficiary because the plaintiff conceded that “it relied on and profited from [the] relationship, a relationship predicated on the Amway Rules of Conduct and [the defendant's] status as an Amway distributor[.]” Id. (internal quotation marks omitted). The court found this concession irrelevant, explaining that “the mere fact [of] a mutually beneficial relationship ... does not make [the plaintiff] a third-party beneficiary.” Id. The court once again considered only the contract language and found no express statement of intent to make the plaintiff a third-party beneficiary. See id.


The Missouri Supreme Court recently reaffirmed its narrow focus on contract language in determining third-party beneficiary status. In Verni v. Cleveland Chiropractic College, a student—upset with his college after it fired a favorite professor—argued that he was a third-party beneficiary of the professor's employment contract with the college. 212 S.W.3d at 152–53. The court quoted Nitro Distributing 's requirement that the contract clearly state the parties' intent to confer third-party beneficiary status. Id. at 153. The court emphasized its resolution of the issue “by examining the contract's language,” id., citing OFW Corporation v. City of Columbia, 893 S.W.2d 876, 879 (Mo.Ct.App.1995). In OFW, the Missouri Court of Appeals held that, “[i]n determining whether plaintiff was a third-party beneficiary to the contract, the question of intent is paramount and is to be gleaned from the four corners of the contract.” Id. (internal quotation marks and alterations omitted; emphasis added). The Verni court succinctly applied this rule to the professor's employment contract:


The contract is a one-page document providing that [the professor] would be a full-time faculty member ... for one year. The contract required him to be on campus a certain amount of time each week and outlined his teaching duties. In return, the contract provided ... salary and employment benefits. Although the contract might incidentally provide a benefit to ... students, it does not clearly express any intent that [the professor] was undertaking a duty to benefit [the plaintiff] or a class of students.


212 S.W.3d at 153. The court considered no extrinsic evidence. It concluded that the student was not entitled to third-party beneficiary status because the contract did not “directly and clearly express the intent *579 to benefit [the plaintiff] or any class of which [he] claims to be a member.” Id.


[8] Headnote Citing References[9] Headnote Citing References Under Missouri law, this court must look only to the contract terms in determining whether there was a direct and clear expression of intent to benefit the third party—in this case, the Financial Institution Plaintiffs. The contract between Heartland and Heartland Bank states:


[Heartland] will safeguard, and hold confidential from disclosure to unauthorized persons, all data relating to Bank business received by [Heartland] pursuant to this Agreement to the same extent that [Heartland] safeguards data relating to its own business[.]


(Docket Entry No. 42, Ex. 4, ¶ 4.3(b)). The contract contains an identical promise by Heartland Bank to Heartland. ( Id., ¶ 4.3(a)). This exchange of promises does not state an intent to benefit anyone other than the contracting parties. There is no clearly expressed intent to convey any enforceable right to the Financial Institution Plaintiffs or to any class to which they belong.


The contract refers to data relating to the business of the contracting parties, indicating an intent to protect the contracting parties' businesses from unauthorized disclosures. The Financial Institution Plaintiffs acknowledge that Heartland's failure to protect consumer payment-card data would harm Heartland's own business. ( See Docket Entry No. 32, ¶¶ 57–60). The Financial Institution Plaintiffs cite the contract's requirement that Heartland indemnify Heartland Bank's “affiliates[.]” (Docket Entry No 42, Ex. 4, ¶ 4.5(a)). But this indemnification clause does not show an intent primarily to benefit the Financial Institution Plaintiffs. The term “affiliate” means “[a] corporation that is related to another corporation by shareholdings or other means of control; a subsidiary, parent, or sibling corporation.” Black's Law Dictionary 63 (8th ed. 2004); see also Nitro Distrib., 194 S.W.3d at 349 (“courts will enforce contracts according to their plain meaning”). The Financial Institution Plaintiffs are not “affiliates” of Heartland Bank within the word's common meaning.


Heartland's motion to dismiss based on the Heartland Bank contract is granted with prejudice and without leave to amend because amendment would be futile. FN6 The Financial Institution Plaintiffs emphasize that they have not had a chance to conduct discovery into whether there are other contracts in this category with provisions expressly and directly stating an intent to make them third-party beneficiaries. (Docket Entry No. 50, at 42–43, 45). Leave to amend is granted only insofar as the Financial Institution Plaintiffs are able to plead plausibly that they are third-party beneficiaries to other contracts between Heartland and Heartland Bank.


FN6. The reasons for dismissing the Financial Institution Plaintiffs' breach of contract claim based on the KeyBank contract equally support dismissing the claim based on the Heartland Bank contract.





b. The KeyBank Contract

This court previously reviewed Ohio law on third-party beneficiaries in the related case against KeyBank and found the complaint insufficient to state a claim that the issuer banks were third-party beneficiaries to the contract between KeyBank and Heartland. The contract language itself did not show an intent to benefit third parties. Because Ohio law, unlike Missouri law, allows consideration of evidence beyond the contract terms to determine third-party beneficiary status, it was appropriate to grant the issuer banks leave *580 to amend. This court also found that the Financial Institution Plaintiffs had failed to identify any provision of the KeyBank contract that Heartland had breached. (Docket Entry No. 117, at 27–32). For essentially the same reasons set out in the March 31, 2011 memorandum and order, 2011 WL 1232352, the claims based on the KeyBank contract asserted by the Financial Institution Plaintiffs in this case must also be dismissed.


[10] Headnote Citing References Heartland advances an additional reason to dismiss in this case. The damages the Financial Institution Plaintiffs seek are consequential damages, which the KeyBank contract excludes absent a willful breach.FN7 (Docket Entry No. 40, at 40–41). The KeyBank contract states that “damages will be limited to general money damages in an amount not to exceed the actual damages of the party. In no case will the other party be responsible for special, incidental, consequential or exemplary damages, except for willful breach of this Agreement.” (Docket Entry No. 42, Ex. 5, ¶ 4.7). Damages-limitation clauses are generally enforceable under Ohio law. E.g., Skurka Aerospace, Inc. v. Eaton Aerospace, L.L.C., 781 F.Supp.2d 561, 571–72 (N.D.Ohio 2011); TLC Healthcare Servs., L.L.C. v. Enhanced Billing Servs., L.L.C., No. L–08–1121, 2008 WL 3878349, at *3 (Ohio Ct.App. Aug. 22, 2008); Morantz v. Ortiz, No. 07AP–597, 2008 WL 642630, at *7 (Ohio Ct.App. Mar. 11, 2008) (collecting cases).


FN7. Nearly identical language appears in the Heartland Bank contract. (Docket Entry No. 42, Ex. 4, ¶ 4.7).




[11] Headnote Citing References[12] Headnote Citing References When a contract limits recovery to direct damages, a plaintiff may recover only the difference between the amount paid and the value received. See Nat'l Mulch & Seed, Inc. v. Rexius Forest By–Products Inc., No. 2:02–cv–1288, 2007 WL 894833, at *6 n. 3 (S.D.Ohio Mar. 22, 2007); see also Wartsila NSD N. Am., Inc. v. Hill Int'l, Inc., 530 F.3d 269, 278 (3d Cir.2008) (limiting recovery for a breach in a service contract that excluded consequential damages to “the amount paid ... for [the] services, less the actual value, if any, of those services”); Reynolds Metals Co. v. Westinghouse Elec. Corp., 758 F.2d 1073, 1080 (5th Cir.1985) (same). The damages the Financial Institution Plaintiffs seek are not the difference between the contract price and the value of the payment-card services. Instead, the Financial Institution Plaintiffs seek the costs they incurred in covering fraudulent transactions and replacing payment cards after the hacker intrusion into the Heartland computer systems. These costs are consequential damages, available only if the contract breach is willful. The master complaint alleges insufficient facts to assert a willful breach. See, e.g., Said v. SBS Elecs., Inc., No. CV 08–3067(RJD)(JO), 2010 WL 1265186, at *8 (E.D.N.Y. Feb. 24, 2010) (dismissing a complaint containing conclusory allegations of willfulness), adopted as modified on other grounds in 2010 WL 1287080 (E.D.N.Y. Mar. 31, 2010).


The breach of contract allegations based on the KeyBank contract are dismissed, without prejudice and with leave to amend.



2. The Merchant Processing Agreements

Heartland argues that its Merchant Processing Agreements (“Agreements”), an exemplar of which it has produced, do not provide a basis for recovery for breach of contract. The Agreements provide that New Jersey law applies. (Docket Entry No. 42, Ex. 6, ¶ 14.12). The parties do not dispute the application of New Jersey law.


*581 Heartland contends that the Financial Institution Plaintiffs cannot state a claim for breach of contract because: (1) they are not intended third-party beneficiaries of the Agreements; (2) they have not sufficiently pleaded a breach of those Agreements; and (3) the Agreements do not allow recovery for consequential damages. (Docket Entry No. 40, at 41–44). The third contention is dispositive.


[13] Headnote Citing References[14] Headnote Citing References Under the Agreements, Heartland's “sole liability ... shall be to correct ... any data in which errors have been caused by [Heartland.]” (Docket Entry No. 42, Ex. 6, ¶ 8.5). The Agreements state that “Heartland shall have no other liability whatsoever to Merchant, and Merchant hereby expressly wa[i]ves any claim against [Heartland] for indirect, special, exemplary, incidental or consequential damages or lost profits or interest.” ( Id., ¶ 8.7). New Jersey generally enforces damages-limitation clauses between businesses. 66 VMD Assocs., LLC v. Melick–Tully & Assocs., P.C., No. L–6584–07, 2011 WL 3503160, at *3 (N.J.Super.Ct.App.Div. Aug. 11, 2011); Marbro, Inc. v. Borough of Tinton Falls, 297 N.J.Super. 411, 688 A.2d 159, 162 (N.J.Super.Ct. Law Div.1996); see also Jasphy v. Osinsky, 364 N.J.Super. 13, 834 A.2d 426, 431 (N.J.Super.Ct.App.Div.2003). The damages the Financial Institution Plaintiffs seek are consequential damages.


The Financial Institution Plaintiffs do not assert that the damages-limitation clauses are unenforceable. Instead, they contend that these clauses only limit a merchant's ability to recover for consequential damages. These clauses, they say, do not apply to their claim as third-party beneficiaries to the Agreements. This contention is unpersuasive. “It is black letter law that a third-party beneficiary is not entitled to any more rights than the actual contracting party.” Merchants Mut. Ins. Co. v. Monmouth Truck Equip., Inc., Civ. A. No. 06–cv–05395 (FLW), 2008 WL 65109, at *5 (D.N.J. Jan. 4, 2008) (citing, for example, United Steelworkers of Am. v. Rawson, 495 U.S. 362, 375, 110 S.Ct. 1904, 109 L.Ed.2d 362 (1990); and Allgor v. Travelers Ins. Co., 280 N.J.Super. 254, 654 A.2d 1375, 1379 (N.J.Super.Ct.App.Div.1995)). The Financial Institution Plaintiffs' breach of contract claim under the Agreements containing the damages-limitation clauses is dismissed, with prejudice. The Financial Institution Plaintiffs may assert a breach of contract claim based on the Agreements only insofar as they have a good-faith basis to believe that: (1) there are Agreements to which they are third-party beneficiaries; and (2) these Agreements do not contain damages-limitation clauses.



3. The Implied Contract Claim

[15] Headnote Citing References[16] Headnote Citing References Under New Jersey law, “[a]n implied-in-fact contract is a true contract arising from mutual agreement and intent to promise, but where the agreement and promise have not been verbally expressed.” S. Jersey Hosp., Inc. v. Corr. Med. Servs., Civ. No. 02–2619(JBS), 2005 WL 1410860, at *4 (D.N.J. June 15, 2005) (quoting In re Penn Cent., 831 F.2d 1221, 1228 (3d Cir.1987)). “[C]ontracts implied in fact are no different than express contracts, although they exhibit a different way or form of expressing assent than through statements or writings.” Wanaque Borough Sewerage Auth. v. Twp. of W. Milford, 144 N.J. 564, 677 A.2d 747, 752 (1996). Courts look to the parties' “word[s] and conduct in light of the surrounding circumstances.” Id. (citing Restatement (Second) of Contracts §§ 4 cmt. a, 5 cmt. a (1979)).


The Financial Institution Plaintiffs rely on In re Hannaford Brothers Co. Customer Data Security Breach Litigation, 613 F.Supp.2d 108 (D.Me.2009), aff'd in part, *582 rev'd in part sub nom. Anderson v. Hannaford Brothers Co., 659 F.3d 151 (1st Cir.2011). In Hannaford Brothers, customers used payment cards to pay for groceries. A third party breached the grocer's information-technology systems, gaining access to stored payment-card information. See 613 F.Supp.2d at 116. The customers filed a class-action lawsuit against the grocer for the unauthorized access to their payment-card information, claiming breach of implied contract. The district court first noted the existence of a direct contract relationship between the grocer and the customers: a contract to buy groceries. Id. at 118. Because that contract required payment, the court held that a customer's use of a payment card would allow a jury to


find certain other implied terms in the grocery purchase contract: for example, that the merchant will not use the card data for other people's purchases, will not sell or give the data to others (except in completing the payment process), and will take reasonable measures to protect the information (which might include meeting industry standards), on the basis that these are implied commitments that are “absolutely necessary to effectuate the contract,” and “indispensable to effectuate the intention of the parties.”


Id. at 119 (emphasis in original) (quoting Seashore Performing Arts Ctr., Inc. v. Town of Old Orchard Beach, 676 A.2d 482, 484–85 (Me.1996)). The court found that the customers had sufficiently stated a claim for breach of implied contract under Maine law. But the starting point for the court's analysis is the parties' direct contractual relationship. See Hannaford Brothers, 613 F.Supp.2d at 118. That is not true in the present case.FN8


FN8. The First Circuit recently affirmed the district court's conclusion regarding the implied-contract claim, but with little detail. See Hannaford Brothers, 659 F.3d at 158–59. This court continues to find the district court's “carefully reasoned” analysis persuasive. Id. at 155.




A case with facts more similar to those at issue here is Hammond v. The Bank of New York Mellon Corporation, No. 08 Civ. 6060(RMB)(RLE), 2010 WL 2643307 (S.D.N.Y. June 25, 2010). In Hammond, a company owned by the defendant lost computer-backup tapes that contained the payment-card data of 12.5 million individuals. Id. at *4. A class action against the defendant claimed breach of implied contract. The court emphasized that there was no direct relationship between the individuals whose data was released and the defendant. The court explained:


Rather, Plaintiffs had relationships (only) with institutional clients of Defendant, such as the Walt Disney Company .... Plaintiffs gave their personal data over to these entities, which, in turn, forwarded the data to Defendant (which stored the data on the tapes that ultimately were lost or stolen).


Id. at *9. Applying New York law, the court concluded that, absent evidence of “any direct dealings” between the individuals and the defendant, there was no basis to find the mutual assent necessary for an implied contract. Id. at *11.


[17] Headnote Citing References Unlike the plaintiffs in Hannaford Brothers, and like those in Hammond, the Financial Institution Plaintiffs do not allege a direct contract relationship with Heartland that would plausibly suggest the mutual assent necessary for an implied contract. The Financial Institution Plaintiffs' contracts are with Heartland's clients, not Heartland. The pleadings allege that the Financial Institution Plaintiffs have at most an indirect relationship with Heartland through Heartland's processing of *583 transactions made with payment cards that they issued. The implied contract claim is dismissed.FN9 The Financial Institution Plaintiffs may replead this claim, but only insofar as they have a good-faith basis to allege the existence of a direct contractual relationship between them and Heartland.


FN9. Heartland also argues that other elements of an implied contract claim are missing. This court need not address those arguments at this time.




B. The Negligence Claims


1. Negligence Per Se

The Financial Institution Plaintiffs have withdrawn their negligence per se claim based on Heartland's alleged failure to follow the security protocols set out in the Visa and MasterCard regulations. (Docket Entry No. 50, at 23 n. 14).



2. Negligence

The Financial Institution Plaintiffs allege that Heartland breached three duties: “a duty to exercise reasonable care in safeguarding and protecting [payment-card] information from being compromised and/or stolen,” (Docket Entry No. 32, ¶ 101); a seemingly related “duty to put into place internal policies and procedures designed to detect and prevent the unauthorized dissemination of [the Financial Institution Plaintiffs'] customers' private, non-public, sensitive financial information,” ( id., ¶ 103); and “a duty to timely disclose to [the Financial Institution Plaintiffs'] customers that the Data Breach had occurred and the private, non-public, sensitive financial information of [the Financial Institution Plaintiffs'] customers” may have been compromised, ( id., ¶ 102).


Suits by issuer banks against other participants in the credit-card processing chain are “of fairly recent vintage.” Rebecca Hatch Weston, Liability of Retailer and Its Affiliate Bank to Credit Card Issuer for Costs Arising out of Breach of Retailer's Computer Security, 51 A.L.R.6th 311, § 2 (2010) (noting that the first published decision appeared in 2005). Courts addressing such claims have generally found that the economic-loss doctrine prevents recovery. Id. at § 5; cf. Juliet M. Moringiello, Warranting Data Security, 5 Brook. J. Corp. Fin. & Com.. L. 63, 71 (2010) (calling the economic-loss doctrine a “major impediment[ ]” to consumer tort actions against payment-card processors). It is instructive to review the cases.


In Banknorth, N.A. v. BJ's Wholesale Club, Inc., 394 F.Supp.2d 283 (D.Me.2005), an issuer bank sued a retailer and an acquiring bank after the retailer's computer systems, which contained customers' payment-card information, were breached. Id. at 284. The issuer bank alleged that the retailer and acquiring bank negligently breached a duty “to safeguard cardholder information from thieves.” Id. at 286. The retailer and acquirer bank argued that the economic-loss doctrine barred recovery on this claim. Id. The court observed that, under Maine law, it was unclear how the doctrine applied outside the products liability context. Id. at 287. The court noted the “complex web of relationships involving numerous players governed by both individual contracts and exhaustive regulations promulgated by Visa and other card networks.” Id. The court reasoned that although there might be a duty of care among the members of the credit-card network, “this web of relationships may or may not render Plaintiff's negligence claim susceptible to the economic loss doctrine.” Id. Because the issuer bank's ability to recover would turn on the specific facts of each case, the court concluded that dismissal was inappropriate. Id.


*584 Another court applying Maine law reached the opposite conclusion. In a case raising the same claims, brought in Pennsylvania federal court, the court found that the economic-loss doctrine precluded liability for negligence. See Banknorth N.A. v. BJ's Wholesale Club, Inc., 442 F.Supp.2d 206, 211–14 (M.D.Pa.2006).FN10


FN10. The district court in Hannaford Brothers, see supra at 581–82, declined to dismiss the customers' negligence claim on similar grounds. 613 F.Supp.2d at 127–28. It thereafter certified the question whether customers' time spent canceling cards and otherwise dealing with data breaches was compensable. In re Hannaford Bros. Co. Customer Data Sec. Breach Litig., 660 F.Supp.2d 94, 99 (D.Me.2009). The Maine Supreme Judicial Court held that “[u]nless the plaintiffs' loss of time reflects a corresponding loss of earnings or earning opportunities, it is not a cognizable injury under Maine law of negligence.” In re Hannaford Bros. Co. Customer Data Sec. Breach Litig., 4 A.3d 492, 497 (Me.2010). The court did not reach the question whether the economic-loss doctrine barred relief. Id. at 498.




In In re TJX Companies Retail Security Breach Litigation, 564 F.3d 489 (1st Cir.2009), the First Circuit considered a negligence claim by issuer banks against a merchant and an acquirer bank for losses stemming from a data breach. Recognizing that “purely economic losses are unrecoverable [under Massachusetts law] in tort and strict liability actions in the absence of personal injury or property damage,” the court affirmed the district court's dismissal of the negligence claim. Id. at 498–99 (quoting Aldrich v. ADD Inc., 437 Mass. 213, 770 N.E.2d 447, 454 (2002)). The court rejected the issuer banks' argument that they suffered compensable property loss. Massachusetts law, the court emphasized, required physical property damage for a negligence claim. Id. at 498. The Massachusetts Supreme Judicial Court reached the same result in Cumis Insurance Society, Inc. v. BJ's Wholesale Club, Inc., 455 Mass. 458, 918 N.E.2d 36 (2009). The issuer banks' insurer attempted to avoid the economic-loss doctrine by arguing that “the plastic credit cards [were] tangible personal property and their damages included physical harm to the plastic cards that had to be canceled following the thefts.” Id. at 46. The court rejected this argument, noting that the relevant issue was not “whether the credit cards are tangible property, but rather the nature of the damages sought by the plaintiffs.” Id.


The Third Circuit reached the same conclusion under Pennsylvania law in Sovereign Bank v. BJ's Wholesale Club, Inc., 533 F.3d 162 (3d Cir.2008). In that case, an issuer bank sued a merchant after a data breach. The court reviewed Pennsylvania cases applying the economic-loss doctrine and dismissed the bank's negligence claim. Id. at 175–78. In rejecting the bank's argument that its loss of money was a loss of property, the court reasoned that accepting “the argument would totally eviscerate the economic loss doctrine because any economic loss would morph into the required loss of property and thereby furnish the damages required for a negligence claim.” Id. at 176.


The Iowa Supreme Court recently rejected a similar negligence claim under the economic-loss doctrine. In Annett Holdings, Inc. v. Kum & Go, L.C., 801 N.W.2d 499 (Iowa 2011), a trucking company's employee used a card issued by the company to make unauthorized purchases at a gas station. Id. at 501. FN11 The trucking company*585 sued the gas station. Id. at 502. The Iowa Supreme Court noted that although the trucking company and the gas station lacked privity of contract, the gas station had contracted with the company's credit-card network. “When parties enter into a chain of contracts, even if the two parties at issue have not actually entered into an agreement with each other, courts have applied the ‘contractual economic loss rule’ to bar tort claims for economic loss, on the theory that tort law should not supplant a consensual network of contracts.” Id. at 504; see also Robins Dry Dock & Repair Co. v. Flint, 275 U.S. 303, 308–09, 48 S.Ct. 134, 72 L.Ed. 290 (1927) (applying the economic-loss doctrine to a chain of contracts). The court pointed out that the trucking company would be “fully responsible” for fraudulent charges under its agreement with the network; that the company knew that the network contracted with service centers like the gas station; and that the network would reimburse those service centers, with the expectation that the company would reimburse the network under the terms of the agreement. Annett Holdings, 801 N.W.2d at 505. “It is difficult to see why a tort remedy is needed here,” the court concluded, because the trucking company “contracted to assume certain risks of financial loss and had the ability to minimize these risks.” Id. The court dismissed the negligence claim.


FN11. The credit-card network in Annett Holdings was Comdata, not Visa or MasterCard. Nonetheless, the rules governing the risk allocation for fraudulent charges appear to be similar in that the issuer bank, the trucking company, was required to bear the loss for fraudulent charges. See 801 N.W.2d at 501. The court considered Cumis, Sovereign Bank, and TJX as analogous cases, and found those opinions to support the court's decision. Id. at 502–03.




Heartland argues that this court must dismiss the negligence claim because Texas law does not allow tort claims for purely economic loss. See Memorial Hermann Healthcare Sys., Inc. v. Eurocopter Deutschland, GMBH, 524 F.3d 676, 678 (5th Cir.2008) (citing Hou–Tex, Inc. v. Landmark Graphics, 26 S.W.3d 103, 107 (Tex.App.-Houston [14th Dist.] 2000, no pet.)). The Financial Institution Plaintiffs do not dispute Heartland's characterization of Texas law. They instead contend that New Jersey law applies. Under New Jersey law, they state, a plaintiff may recover for economic losses resulting from negligence without physical or property injury. Heartland responds that even if New Jersey law applies, it owed no duty to the Financial Institution Plaintiffs to protect cardholder data and therefore cannot be liable for negligence. New Jersey law, however, would not recognize a duty owing by Heartland to the Financial Institution Plaintiffs to protect cardholder data. Even assuming that New Jersey law applies, the Financial Institution Plaintiffs' negligence claim must be dismissed.FN12


FN12. Whether Heartland owed a duty of care to individual cardholders is not at issue in this case.




[18] Headnote Citing References The elements of negligence under New Jersey law are (1) a duty of care, (2) a breach of that duty, (3) proximate cause, and (4) damages. Brunson v. Affinity Fed. Credit Union, 199 N.J. 381, 972 A.2d 1112, 1122–23 (2009); Polzo v. Cnty. of Essex, 196 N.J. 569, 960 A.2d 375, 384 (2008). “The New Jersey Supreme Court has long been a leader in expanding tort liability.” Hakimoglu v. Trump Taj Mahal Assocs., 70 F.3d 291, 295 (3d Cir.1995) (Becker, J., dissenting). In People Express Airlines, Inc. v. Consolidated Rail Corp., 100 N.J. 246, 495 A.2d 107 (1985), the New Jersey Supreme Court abandoned the rule that economic losses, unaccompanied by physical or property damage, are never compensable in tort. See id. at 114–15. In People Express, an airline sued various defendants for business-interruption damages after a volatile chemical caught fire in a rail yard adjacent to the Newark Airport. An evacuation of *586 a one-mile radius closed the airport's northern terminal for 12 hours. That terminal housed the airline's business operations. The evacuation forced the airline to cancel flights and prevented its employees from booking flights for customers. Id. at 108–09. The defendants moved for summary judgment that the economic-loss doctrine prohibited recovery for purely economic loss. The New Jersey Supreme Court concluded that the traditional reasons for prohibiting recovery for economic loss, including fears of unbounded liability and fraudulent claims, were unpersuasive. The court held that a duty generally exists “to take reasonable measures to avoid the risk of causing economic damages, aside from physical injury, to particular plaintiffs or plaintiffs comprising an identifiable class with respect to whom defendant knows or has reason to know are likely to suffer such damages from its conduct.” Id. at 116. Whether a duty exists depends in part on the foreseeability of such damages. “The more particular is the foreseeability that economic loss will be suffered by the plaintiff as the result of the defendant's negligence, the more just is it that liability be imposed and recovery allowed.” Id. The “class of plaintiffs must be particularly foreseeable in terms of the type of persons or entities comprising the class, the certainty or predictability of their presence, the approximate numbers of those in the class, as well as the type of economic expectations disrupted.” Id. The court recognized a “spectrum [of foreseeability] ranging from the general to the particular,” allowing a court to “limit otherwise boundless liability and define an identifiable class of plaintiffs that may recover.” Id. at 115, 116. In holding that the defendants owed a duty to the plaintiffs, the People Express court identified the close proximity of the north terminal to the accident; the “obvious nature” of the airline's presence and operations that made the asserted economic harm foreseeable; the rail company's knowledge of the chemical's volatility; and the existence of an emergency-response plan established with the participation of some of the defendants that called for evacuating the terminal. Id. at 118. Although the airline could seek its economic losses, an example of a class that could not seek such losses was drivers on a highway delayed by a negligently caused accident. The drivers may be a foreseeable class, the court acknowledged, but they were not an identifiable one. Rather, the presence of any particular driver—and therefore the economic injury of that driver—was merely “fortuitous.” Id. at 116.


[19] Headnote Citing References People Express recognizes that “a plaintiff [can] bring an action for purely economic losses, regardless of any accompanying physical harm or property damage, if the plaintiff [is] a member of an identifiable class that the defendant should have reasonably foreseen was likely to be injured by the defendant's conduct[.]” Carter Lincoln–Mercury, Inc., Leasing Div. v. EMAR Grp., Inc., 135 N.J. 182, 638 A.2d 1288, 1294 (1994). But People Express equally acknowledges that the foreseeability standard will not always adequately guide a court's evaluation of tort duties. In certain cases, “the courts will be required to draw upon notions of fairness, common sense and morality to fix the line limiting liability as a matter of public policy, rather than an uncritical application of particular foreseeability.” People Express, 495 A.2d at 116. The New Jersey Supreme Court has emphasized in decisions since People Express that the “[a]bility to foresee injury to a potential plaintiff does not in itself establish the existence of a duty [.]” Carter Lincoln–Mercury, 638 A.2d at 1294 (citing Goldberg v. Housing Auth. of City of Newark, 38 N.J. 578, 186 A.2d 291, 293 (1962)); see also *587 Clohesy v. Food Circus Supermarkets, Inc., 149 N.J. 496, 694 A.2d 1017, 1020 (1997) (“Foreseeability of harm alone is not dispositive of whether a duty exists.”). Rather, “[o]nce the foreseeability of an injured party is established, [a court] must decide whether considerations of fairness and policy warrant the imposition of a duty.” Carter Lincoln–Mercury, 638 A.2d at 1294.


[20] Headnote Citing References New Jersey has exhibited a “strong resistance to the usurpation of contract law by tort law[.]” Travelers Indem. Co. v. Dammann & Co., 594 F.3d 238, 248 (3d Cir.2010). “New Jersey courts have consistently held that contract law is better suited to resolve disputes where a plaintiff alleges direct and consequential losses that were within the contemplation of sophisticated business entities that could have been the subject of their negotiations.” Id.; see also Arcand v. Brother Int'l Corp., 673 F.Supp.2d 282, 308 (D.N.J.2009); (Docket Entry No. 117, at 40–43 (discussing cases)).FN13 The New Jersey cases repeatedly emphasize that respecting the parties' voluntary agreements to allocate risk best serves the public interest. See Spring Motors Distributors, Inc. v. Ford Motor Co., 98 N.J. 555, 489 A.2d 660, 671 (1985) (“As between commercial parties, [ ] the allocation of risks in accordance with their agreement better serves the public interest than an allocation achieved as a matter of policy without reference to that agreement.”). The decisions represent a “clear rejection of an approach that would allow tort law to substitute for contract law in cases involving sophisticated parties with equal bargaining power[.]” Travelers Indem., 594 F.3d at 251.FN14


FN13. One court applying New Jersey law has refused to apply the economic-loss doctrine to contracts for services, not goods. Consult Urban Renewal Dev. Corp. v. T.R. Arnold & Assocs., Inc., Civ. A. No. 06–1684(WJM), 2009 WL 1969083, at *4 (D.N.J. July 1, 2009) (“While some jurisdictions have chosen to extend the economic loss doctrine to services, there is no evidence to suggest that New Jersey law has done so.”). That holding appears to be against the weight of authority. Most courts have applied the economic-loss doctrine to contracts for services. As one commentator persuasively notes, refusing to apply the economic-loss doctrine to such contracts “seems to ignore the intent of the parties as expressed in the contract.” Dan. B. Dobbs, An Introduction to Non–Statutory Economic Loss Claims, 48 ariz. l. rev. 713, 727 (2006).




FN14. The New Jersey Supreme Court has made clear that “[p]erfect parity is not required for a finding of substantially equal bargaining power.” Alloway v. Gen. Marine Indus., L.P., 149 N.J. 620, 695 A.2d 264, 268 (1997).




This court previously concluded that, under New Jersey law, Heartland owed no duty to the issuer banks because “relationships among issuers, acquirers, and their contractors—such as Heartland Payment Systems—are governed by the Visa and MasterCard regulations,” not tort law. (Docket Entry No. 117, at 44). The court dismissed vicarious liability claims against an acquirer bank that hired Heartland to process payment-card transactions. In supplemental briefing following that order, the Financial Institution Plaintiffs argue that the economic-loss doctrine does not apply to them because Heartland, unlike the acquirer banks, is not a member of the Visa and MasterCard networks. (Docket Entry No. 124, at 1). The Financial Institution Plaintiffs note that no New Jersey case has applied the economic-loss doctrine to bar tort recovery absent a direct contractual relationship. The Financial Institution Plaintiffs cite Consult Urban, 2009 WL 1969083, in which a district court held that a series of contracts did not preclude recovery in tort. This argument and citation are unpersuasive. An issuer bank's decision to issue payment cards is, *588 of course, a voluntary choice.FN15 To participate, issuer banks must accept the Visa and MasterCard regulations. By participating in the Visa and MasterCard networks, the Financial Institution Plaintiffs entered into the web of contractual relationships that included not only issuer and acquirer banks but also third-party businesses, such as Heartland, that process transactions for network members. Heartland agreed to follow the Visa and MasterCard regulations. (Docket Entry No. 32, ¶ 96; Docket Entry No. 42, Ex. 4, ¶ 1.1(f) (requiring Heartland to “comply fully with all by-laws and regulations of Visa and MasterCard, including but not limited to, rules regarding independent sales organizations and member service providers”); id., Ex. 5, ¶ 1.1(f) (same)). The regulations specifically contemplate the possibility of a data breach. They specify procedures for issuer banks to make claims when such data breaches occur through private dispute-resolution systems. (Docket Entry No. 124, Exs. 1, 2); see also Sovereign Bank, 533 F.3d at 165 (describing the “comprehensive provisions for resolving disputes between Visa members,” which allowed Visa to decide disputes “in accordance with risk allocation judgments made by Visa”); Cumis Ins. Soc'y, Inc. v. BJ's Wholesale Club, No. 20051158J, 2008 WL 2345865, at *4 (Mass.Super. Ct. June 4, 2008) (noting that the Visa and MasterCard regulations “provide for an elaborate dispute resolution procedure and for fines for non-compliance”), aff'd, 455 Mass. 458, 918 N.E.2d 36 (2009).FN16 Although Heartland is not a direct member of the Visa and MasterCard networks, it was subject to the network regulations. The complaint highlights Visa's investigation into Heartland, alleging that Visa both found Heartland to be “in violation of the Visa operating regulations” and banned network members from using Heartland to process transactions for approximately one week. (Docket Entry No. 32, ¶ 57). Visa also “put Heartland on probationary status,” which “subjected Heartland to more-stringent security assessments, monitoring and reporting[.]” ( Id., ¶ 58). Visa and MasterCard fined Heartland Bank and KeyBank, the network members that had retained Heartland. The banks passed those fines to Heartland under their contracts with Heartland and the Visa and MasterCard networks, the network regulations, not tort law, are the appropriate means for the Financial Institution Plaintiffs to seek relief.


FN15. Richard A. Epstein & Thomas P. Brown, Cybersecurity in the Payment Card Industry, 75 U. Chi. L. Rev.. 203, 203 (2008) (“Using a payment card (as opposed to some other form of payment) rests on voluntary decisions by consumers and merchants, as well as the banks with which they interact.”).




FN16. Many commentators have written about the fairness and effectiveness of these rules. See Robert G. Ballen & Thomas A. Fox, The Role of Private Sector Payment Rules and a Proposed Approach for Evaluating Future Changes to Payments Law, 83 Chi.-Kent L. Rev. 937 (2008); Duncan B. Douglass, An Examination of the Fraud Liability Shift in Consumer Card–Based Payment Systems, Econ. Persp., Mar. 22, 2009, at 43, available at http:// www. chicagofed. org/ digitalassets/ publications/ economic_ perspectives/ 2009/ ep_ 1 qtr 2009_ part 7_ douglass. pdf; Epstein & Brown, supra; Edward J. Janger, Locating the Regulation of Data Privacy and Data Security, 5 Brook. J. Corp. Fin. & Com.. L. 97 (2010); Adam J. Levitin, Private Disordering? Payment Card Fraud Liability Rules, 5 Brook. J. Corp. Fin. & Com.. L. 1 (2010); Mark MacCarthy, Information Security Policy in the U.S. Retail Payments Industry, 2011 Stan. Tech. L. Rev. . 3; see also Levitin, supra, at 4 nn. 9 & 10 (collecting articles). As explained below, what is relevant here is that the Financial Institution Plaintiffs accepted those rules and issued payment cards.




Additionally, the damages the Financial Institution Plaintiffs seek—the costs of *589 covering fraudulent charges and of reissuing cards—are the kinds of damages ordinarily expected to flow from a data breach, damages that can be addressed in the parties' contractual arrangements. These damages are not the type of injuries for which tort law is appropriate. Arcand, 673 F.Supp.2d at 308; Kearney & Trecker Corp. v. Master Engraving Co., 107 N.J. 584, 527 A.2d 429, 437 (1987) (declining to impose a tort duty between businesses for damages that were not “highly unusual or unforeseeable” in the kind of transaction covered by the parties' contract, and quoting Chatlos Sys., Inc. v. Nat'l Cash Register Corp., 635 F.2d 1081, 1087 (3d Cir.1980)); see also Annett Holdings, 801 N.W.2d at 504–05 (holding that tort law should not displace the risks and responsibilities allocated through a system of contracts for payment cards).FN17


FN17. The Financial Institution Plaintiffs rely on the First Circuit's discussion in Hannaford Brothers regarding the foreseeability of the costs to replace payment cards following the data breach in that case. (Docket Entry No. 133, at 3–4 (quoting Hannaford Brothers, 659 F.3d at 164)). That such damages are foreseeable, though, further reinforces the conclusion that New Jersey law would not allow their recovery in tort law.




The New Jersey Supreme Court's recognition that an “allocation of risks in accordance with [a voluntary] agreement better serves the public interest than an allocation achieved as a matter of policy without reference to that agreement” also weighs against creating a tort duty between payment processors and issuer banks to protect payment-card information from unauthorized access. Spring Motors, 489 A.2d at 671. This result also is consistent with the approach of the federal government and most states, which generally have avoided regulating risk allocations in the payment-card industry except to cap consumers' liability. Federal legislation and regulations address consumer-protection concerns, not “further allocation of fraud liability after shifting responsibility from the cardholder to the card insurer.” Douglass, supra, at 45; see also Ballen & Fox, supra, at 939 (noting that federal regulations “do not generally address the interbank payment systems and the liabilities that flow into the interbank system”). The states' approaches are similar. Like most states, New Jersey regulates payment-card privacy. In particular, New Jersey regulates how merchants handle payment-card information and requires businesses holding personal information to notify the public when a data breach occurs. N.J. Stat. §§ 56:8–163; 56:11–17, –21, –24, –25, –42; see also Abraham Shaw, Data Breach: From Notification to Prevention Using PCI DSS, 43 Colum. J.L. & Soc. Probs. 517, 524 n. 36 (listing states with notification laws) (2010). Only Minnesota has statutorily shifted the risk of loss arising from a data breach between the businesses involved in the Visa and MasterCard networks. See Mark MacCarthy, What Payment Intermediaries Are Doing about Online Liability and Why It Matters, 25 Berkeley Tech. L.J. 1037, 1044 n. 25 (2010) (discussing Minn.Stat. § 325E.64, which “holds merchants liable for the costs associated with a breach when they failed to take specific precautions that are part of an industry data security standard”). The fact that New Jersey regulates data-security measures, but does not address risk allocation, weighs against imposing a common-law duty between these entities. See Hojnowski v. Vans Skate Park, 187 N.J. 323, 901 A.2d 381, 389 (2006) (concluding that a New Jersey statute conferring immunity from suit upon certain volunteers but not businesses weighed against recognizing a minor's waiver of liability against a business); *590 Hannaford Bros., 613 F.Supp.2d at 125 (observing that a Maine law requiring notification of a data breach “give[s the court] reason to be wary of creating any new state standards where the Maine Law Court has not already clearly provided a remedy”).


Relying on Dynalectric Company v. Westinghouse Electric Corporation, 803 F.Supp. 985 (D.N.J.1992), and Consult Urban, 2009 WL 1969083, the Financial Institution Plaintiffs argue that the economic-loss doctrine does not apply because the “Visa and MasterCard regulations do not and cannot provide the alternative means of redress requisite to the application of the economic loss doctrine under New Jersey law.” (Docket Entry No. 124, at 8 (emphasis omitted)). In Dynalectric, the plaintiff pursued tort claims against the defendant in federal court while simultaneously pursuing identical breach of contract claims against the defendant in arbitration. Applying New Jersey law, the district court concluded that “when a party has suffered economic loss because of the negligent actions of another, and the party has another means of redress against the alleged tortfeasor, that party may not assert the identical claims for identical damages under tort theories.” 803 F.Supp. at 991. The court refused to hear the tort claim because of the ongoing arbitration. Id. at 991, 993. The court did not address whether a tort duty would exist absent the other avenue of redress against the plaintiff. In Consult Urban, a contractor asserted a negligence claim against a company that a subcontractor had retained to inspect modular housing units for compliance with New Jersey law. 2009 WL 1969083, at *1. The court rejected the company's argument that it owed no duty, noting that the contractor “had no opportunity to negotiate the terms of the agreement or the amount of risk it would accept.” Id. at *4. Neither Dynalectric nor Consult Urban Renewal involved a comprehensive risk-allocation arrangement like the contracts and network regulations in this case. To the extent that the Visa and MasterCard regulations do not allow the Financial Institution Plaintiffs to recover damages directly from Heartland, New Jersey law disfavors a sophisticated business entity's efforts to use tort law “to obtain a better bargain than it made.” Spring Motors, 489 A.2d at 671.FN18


FN18. The Financial Institution Plaintiffs' reliance on the First Circuit's recent decision in Hannaford Brothers, 659 F.3d 151, is similarly unavailing. ( See Docket Entry No. 133, at 3–4). In Hannaford Brothers, the First Circuit allowed the plaintiffs, individual consumers, to seek mitigation damages—the costs to procure identity-theft insurance and of replacing payment cards—under theories of negligence and contract law. See id. at 164–67. In reaching its holding, however, the First Circuit applied Maine law. This case involves New Jersey law. For the reasons previously discussed, New Jersey law requires the Financial Institution Plaintiffs, which are sophisticated business entities, to seek relief through the Visa and MasterCard regulations, not tort law.




The negligence claim is dismissed with prejudice and without leave to amend because amendment would be futile.


C. The Misrepresentation Claims

The Financial Institution Plaintiffs allege fraud and negligent misrepresentation under New Jersey law. According to the complaint, numerous statements by Heartland—in S.E.C. filings; in analyst calls; on Heartland's logo; and on Heartland's web site, before and after the data breach—suggested that Heartland's security measures were better than they actually were. The complaint also faults Heartland for failing to disclose information about its security flaws. It additionally asserts that Heartland, by participating in the Visa and MasterCard networks, effectively represented*591 that it would follow the network security regulations. Heartland argues that, even assuming New Jersey law applies, the allegations are insufficient to state a claim. Heartland contends that the complaint does not allege the material falsity of the statements; that the Financial Institution Plaintiffs were neither intended recipients (as required for fraud) nor reasonably foreseeable recipients (as required for negligent misrepresentation) of those statements; that Heartland had no duty to disclose; that participation in the Visa and MasterCard networks is not an actionable misrepresentation; and that causation is insufficiently alleged. (Docket Entry No. 40, at 18–28).


[21] Headnote Citing References[22] Headnote Citing References Under New Jersey law, common-law fraud has five elements: “(1) a material misrepresentation of a presently existing or past fact; (2) knowledge or belief by the defendant of its falsity; (3) an intention that the other person rely on it; (4) reasonable reliance thereon by the other person; and (5) resulting damages.” Banco Popular N. Am. v. Gandi, 184 N.J. 161, 876 A.2d 253, 260 (2005) (quoting Gennari v. Weichert Co. Realtors, 148 N.J. 582, 691 A.2d 350, 367 (1997)). Negligent misrepresentation differs only in that it requires neither intent to deceive nor knowledge that the statement is false. See Kaufman v. i-Stat Corp., 165 N.J. 94, 754 A.2d 1188, 1195–96 (2000).


Federal Rule of Civil Procedure 9(b) applies to fraud allegations. Under the rule, “a party must state with particularity the circumstances constituting fraud or mistake. Malice, intent, knowledge, and other conditions of a person's mind may be alleged generally.” Fed. R. Civ. P. 9(b). “Put simply, Rule 9(b) requires ‘the who, what, when, where, and how’ to be laid out.” Shandong Yinguang Chem. Indus. Joint Stock Co. v. Potter, 607 F.3d 1029, 1032 (5th Cir.2010) (internal quotation marks omitted). The plaintiff “must specify the statements contended to be fraudulent, identify the speaker, state when and where the statements were made, and explain why the statements were fraudulent.” Southland Secs. Corp. v. INSpire Ins. Solutions, Inc., 365 F.3d 353, 362 (5th Cir.2004) (internal quotation marks omitted). At the same time, “Rule 9(b)'s ultimate meaning is context-specific, and thus there is no single construction of Rule 9(b) that applies in all contexts.” United States ex rel. Grubbs v. Kanneganti, 565 F.3d 180, 188 (5th Cir.2009) (internal quotation marks omitted).


The parties dispute whether the complaint's negligent misrepresentation allegations must comply with Rule 9(b). It is unnecessary to resolve this dispute, for the allegations of negligent misrepresentation fail to meet Rule 8's basic pleading standard.



1. Misrepresentation

[23] Headnote Citing References Heartland asserts that many of the alleged misrepresentations are not the kinds of statements that give rise to liability under either a fraud or negligence theory. New Jersey law distinguishes between factual misrepresentations and “puffery.” It is reasonable to rely on the first but not the second. E.g., Lieberson v. Johnson & Johnson Consumer Cos., 865F.Supp.2d 529, ––––, 2011 WL 4414214, at *7 (D.N.J.2011). “Advertising that amounts to ‘mere’ puffery is not actionable because no reasonable consumer relies on puffery. The distinguishing characteristics of puffery are vague, highly subjective claims as opposed to specific, detailed factual assertions.” Id. (quoting In re Toshiba Am. HD DVD Mktg. & Sales Practices Litig., Civ. No. 08–939(DRD), MDL No.1956, 2009 WL 2940081, at *10 (D.N.J. Sep. 11, 2009)). For example, the New Jersey Supreme Court held that Allstate Insurance's slogan, “You're in good hands with Allstate,”*592 was not an actionable misrepresentation. “However persuasive, [the slogan] is nothing more than puffery.” Rodio v. Smith, 123 N.J. 345, 587 A.2d 621, 623 (1991). By contrast, specific factual misrepresentations are actionable. In Gennari v. Weichert Company Realtors, for example, the New Jersey Supreme Court allowed homeowners' suits against a realtor who made “affirmative misrepresentations about the builder's experience and qualifications as well as the quality of his homes,” 691 A.2d at 366, such as that the builder “had built hundreds of homes,” id. at 357. Similarly, in Lieberson v. Johnson & Johnson Consumer Companies, a federal district court found actionable a defendant's representation of its products as “ ‘clinically proven’ to help babies sleep better” because stating that a product is “clinically proven” to achieve a result is “ ‘both specific and measurable.’ ” 865 F.Supp.2d at ––––, 2011 WL 4414214, at *7 (quoting Castrol Inc. v. Pennzoil Co., 987 F.2d 939, 946 (3d Cir.1993)).


[24] Headnote Citing References Certain statements alleged in the master complaint are not actionable misrepresentations, as a matter of law. To the extent that the Financial Institution Plaintiffs argue that Heartland's statements and conduct amounted to a guarantee of absolute data security, reliance on that statement would be unreasonable as a matter of law. Cf. Hannaford Bros., 613 F.Supp.2d at 119 (dismissing under Rule 12(b)(6) a claim for breach of implied contract to keep customer data completely safe because “in today's known world of sophisticated hackers, data theft, software glitches, and computer viruses, a jury could not reasonably find an implied merchant commitment against every intrusion under any circumstances whatsoever” (emphasis in original)). Heartland's slogans—“The Highest Standards” and “The Most Trusted Transactions”—are puffery on which the Financial Institution Plaintiffs could not reasonably rely. Similarly, the following statements relied on by the Financial Institution Plaintiffs are not actionable representations: that Heartland used “layers of state-of-the-art security, technology and techniques to safeguard sensitive credit and debit card account information”; that it used the “state-of-the-art [Heartland] Exchange”; and that its “success is the result of the combination of a superior long-term customer relationship sales model and the premier technology processing platform in the industry today.” (Docket Entry No. 32, ¶¶ 47, 48). See, e.g., Toshiba Am. HD DVD, 2009 WL 2940081, at *10 (“best of high-definition television and DVD” is not an actionable misrepresentation); Bubbles N' Bows, LLC v. Fey Pub'g Co., No. 06–5391(FLW), 2007 WL 2406980, at *9 (D.N.J. Aug. 20, 2007) (“high importance is placed on personal relationships”; “the success of this business always has and always will rely on the satisfaction of our clients”; “if the customer isn't smiling, fix it” are not actionable); N.J. Citizen Action v. Schering–Plough Corp., 367 N.J.Super. 8, 842 A.2d 174, 177 (N.J.Super.Ct.App.Div.2003) (“you ... can lead a normal nearly symptom-free life again” is not actionable (ellipsis in original)).FN19


FN19. See also, e.g., In re Aetna, Inc. Secs. Litig., 617 F.3d 272, 284 (3d Cir.2010) (“This is solid and balanced growth that is representative of our dedication to disciplined pricing[.]”); Alpine Bank v. Hubbell, 555 F.3d 1097, 1106–07 (10th Cir.2009) (“You concentrate on your dream [of buying or building a new home]. We'll take care of everything else.”); In re Ford Motor Co. Secs. Litig., 381 F.3d 563, 570–71 (6th Cir.2004) (e.g., “at Ford quality comes first”; “Ford has its best quality ever”; “Ford is a worldwide leader in automotive safety”; Ford has made “quality a top priority”); Corley v. Rosewood Care Ctr., Inc. of Peoria, 388 F.3d 990, 1008–09 (7th Cir.2004) (“high quality” services); Williams v. Aztar Ind. Gaming Corp., 351 F.3d 294, 299 & n. 5 (7th Cir.2003) (“Players Win!” and “the winning is big!”); In re Advanta Corp. Secs. Litig., 180 F.3d 525, 537–38 (3d Cir.1999) (“Our emphasis on gold cards—and targeting of better quality customers—helps us maintain an enviable credit quality profile.”); Shema Kolainu–Hear Our Voices v. Providersoft, LLC, 832 F.Supp.2d 194, 209, 2010 WL 2075921, at *12 (E.D.N.Y.2010) (“state of the art”; “great”; “foolproof”); In re Boston Sci. Corp. Secs. Litig., 490 F.Supp.2d 142, 162 (D.Mass.2007) ( “state-of-the-art quality systems” and “cutting edge”), rev'd on other grounds sub nom. Miss. Pub. Emps.' Ret. Sys. v. Boston Sci. Corp., 523 F.3d 75 (1st Cir.2008).




*593 [25] Headnote Citing References The master complaint also lists one alleged misrepresentation by Heartland after it publicly disclosed the data breach. According to the complaint:


Even after the Data Breach occurred, [Heartland] continued to provide ... assurances that it was adequately protecting the sensitive financial information with which it was entrusted. For example, the website that Heartland created in connection with its disclosure of the Data Breach claims that “Heartland is deeply committed to maintaining the security of cardholder data, and we will continue doing everything reasonably possible to achieve this objective.”


(Docket Entry No. 32, ¶ 50). Statements after the data breach was announced cannot form the basis of a misrepresentation claim because they could not have been material to the banks' and merchants' decisions to contract with Heartland. See, e.g., Prezant v. Jegou, L–819–07, 2010 WL 2556882, at *5 (N.J.Super.Ct.App.Div. June 23, 2010) (per curiam) (holding that a list of inflated antique-furniture values “could not have been material to the [ ] decision to purchase because the list was prepared after the transactions were complete”); Cole v. Laughrey Funeral Home, 376 N.J.Super. 135, 869 A.2d 457, 462–63 (N.J.Super.Ct.App.Div.2005) (alleged misrepresentations were not material because they “were all acts done after the contract for funeral services was entered into”).


[26] Headnote Citing References The master complaint also alleges representations about Heartland's information-sharing practices. The statements include that “we have limited our use of consumer information solely to providing services to other businesses and financial institutions,” and that “[w]e limit sharing of non-public personal information to that necessary to complete the transactions on behalf of the consumer and the merchant and to that permitted by federal and state laws.” (Docket Entry No. 32, ¶ 45). These are not statements about Heartland's data-security practices. Instead, these statements are promises that Heartland will not intentionally share consumers' personal information with others. The Financial Institution Plaintiffs have not alleged that Heartland intentionally shared information beyond the limits it stated.


[27] Headnote Citing References On the other hand, some alleged statements are factual representations that are sufficiently definite to support a claim for negligent misrepresentation. According to the master complaint, Heartland stated that “[w]e maintain current updates of network and operating system security releases and virus definitions, and have engaged a third party to regularly test our systems for vulnerability to unauthorized access.” Heartland also stated that “we encrypt the cardholder numbers that are stored in our databases using triple-DES protocols, which represent the highest commercially available standard for encryption.” ( Id., ¶ 45). These statements are factually concrete and verifiable. Similarly, Heartland's statement that its “Exchange has passed an independent verification process validating compliance with VISA requirements for data security” is *594 susceptible to proof. ( Id., ¶ 46). Either Heartland's Exchange passed the independent verification process, or it did not.


[28] Headnote Citing References Heartland argues that even assuming that some of the alleged misrepresentations are actionable, the master complaint insufficiently alleges reliance. The complaint's allegations of reliance are wholly conclusory. (Docket Entry No. 32, ¶¶ 125 (alleging that the Financial Institution Plaintiffs “justifiably relied”), 129 (alleging that they “reasonably relied”)). It is unclear, for example, if the issuer banks' reliance was through their joining, remaining in, or withdrawing from the Visa and MasterCard networks, or what relationship the statements have to any such actions. See, e.g., Cumis Ins. Soc'y, 918 N.E.2d at 49 (“Because the plaintiff credit unions have presented no evidence that any representations by the defendants induced them to become or remain issuers in the Visa and MasterCard system, or that they have withdrawn from or altered their participation in the system after becoming aware of the defendants' breach, the defendants' motions for summary judgment on the fraud claims were properly allowed.”).FN20 Because the complaint does not give sufficient notice of the Financial Institution Plaintiffs' misrepresentation claims either to determine their entitlement to relief or to allow Heartland to prepare its defense, the claims must be dismissed.FN21 See Fed. R. Civ. P. 8(a)(2).


FN20. Heartland also asserts that the misrepresentation claims should be dismissed because a misrepresentation made during the course of a contractual relationship generally is actionable only as a breach of contract. See, e.g., Capitalplus Equity, LLC v. Prismatic Dev. Corp., Civ. A. No. 07–321(WHW), 2008 WL 2783339, at *6 (D.N.J. July 16, 2008) (citing Gleason v. Norwest Mortg., Inc., 243 F.3d 130, 144 (3d Cir.2001)). The Financial Institution Plaintiffs respond that this rule does not apply without a direct contractual relationship. This argument is best addressed once the Financial Institution Plaintiffs clarify their misrepresentation theory.




FN21. The Financial Institution Plaintiffs assert that their complaint adequately pleads reliance, citing to In re Ford Motor Co. E–350 Van Products Liability Litigation (No. II), Civ. No. 03–4558(HAA), MDL No. 1687, 2008 WL 4126264 (D.N.J. Sep. 2, 2008). There, the district court found that the plaintiffs had adequately stated a claim where they asserted that the “Defendant's conduct constituted acts of ‘deception, fraud, false pretenses, false promises, misrepresentation and/or a knowing concealment, suppression, or omission of material facts with the intent that Plaintiffs ... would rely upon such concealment, suppression, or omission in connection with the sale, marketing, advertisement and subsequently performance of the E350 van.’ ” Id. at *18 (alteration and emphasis in original; quoting complaint). In Ford, however, the form of reliance did not affect the claim's viability. The facts of Ford made the nature of the reliance clearer than in this case. See id.




It is unnecessary to address the remaining arguments at this time. Dismissal is without prejudice and with leave to amend.



2. Implied Misrepresentation

The Financial Institution Plaintiffs allege that “by accepting and agreeing to process the credit cards and/or debit cards issued by [the Financial Institution Plaintiffs], Heartland impliedly agreed that it would adequately protect the sensitive information contained in these cards, as well as comply with applicable standards to safeguard data.” (Docket Entry No. 32, ¶ 52). The Financial Institution Plaintiffs allege that “Heartland knew that by virtue of their membership in the Visa and MasterCard Networks, [they] relied on Heartland to employ appropriate data security measures.” ( Id., ¶ 123). The Massachusetts Supreme Judicial Court rejected the same theory of negligent implied misrepresentation in litigation arising out of a similar data breach. In *595 Cumis Insurance Society v. BJ's Wholesale Club, an insurance company (acting on behalf of 69 issuer banks) and numerous issuer banks sued an acquirer bank and a retailer that allegedly retained payment-card information in a manner that violated the Visa and MasterCard regulations. Hackers obtained information for approximately 9.2 million credit cards from the retailer's database. The plaintiffs alleged both fraud and negligent misrepresentation, “based only on the requirements in the Visa and MasterCard operating regulations and the defendants' contracts with each other that require the defendants to abide by these regulations.” 918 N.E.2d at 48. The plaintiffs conceded that they had not seen the contracts between the defendants before the lawsuit. Id. The court dismissed the claims. It first explained that the plaintiffs had presented “no evidence or contention ... that the defendants never intended to perform their contractual obligations to comply with the operating regulations at the time they entered into the contracts.” Id. at 49.FN22 The court next rejected any suggestion that the plaintiffs could reasonably rely on an implied representation of compliance with the Visa and MasterCard regulations during each payment-card transaction. These regulations “explicitly provide for fines for breach of regulations such as storage of magnetic stripe data,” which in turn shows “that the system is designed with the expectation that breaches will occur.” Id. at 50. In fact, issuer banks, in insuring themselves against fraudulent charges through companies like Cumis, anticipated that breaches of the regulations might occur. Id. Additionally, the plaintiffs admitted that before the breach leading to their lawsuit, they had “received numerous and repeated alerts from Visa and MasterCard concerning specific instances of improper storage of magnetic stripe data,” a violation of the regulations. Id. The plaintiffs knew that data breaches could occur, notwithstanding the defendants' contractual obligation to follow the Visa and MasterCard regulations. Id.FN23


FN22. In reaching this conclusion, the court disapprovingly cited the plaintiff's attempt to “repackage” an unavailing breach of contract claim “under tort law.” Cumis Ins. Soc'y, 918 N.E.2d at 49.




FN23. Before the Massachusetts Supreme Judicial Court reached its decision, a Massachusetts federal district court found that the same theory stated a claim. In re TJX Cos. Retail Sec. Breach Litig., 524 F.Supp.2d 83, 92 (D.Mass.2007). The court relied in part on the Massachusetts Superior Court's initial denial of the motion to dismiss. Id. By the time the First Circuit considered the appeal, the Massachusetts Superior Court had granted summary judgment. The First Circuit stated that, had that decision been available to the district court, “the district court might well have granted the motion [to dismiss.]” TJX Cos., 564 F.3d at 495. The First Circuit thereafter explained, “[S]ummary judgment is the more common method of disposing of claims that are facially valid but prove (usually after discovery) to be unsupported by evidence. The present claim survives, but on life support.” Id.


The Financial Institution Plaintiffs argue that the TJX litigation weighs against dismissal. This court, however, agrees with the Massachusetts Supreme Judicial Court's resolution of that case's implied-misrepresentation claim. The Financial Institution Plaintiffs' implied misrepresentation claim therefore is not a claim that could be supported by evidence uncovered during discovery.

[29] Headnote Citing References The same reasons and reasoning require dismissal in this case. Under New Jersey law, it is unreasonable to rely on a representation when, as here, a financial arrangement exists to provide compensation if circumstances later prove that representation false. See Russell–Stanley Corp. v. Plant Indus., Inc., 250 N.J.Super. 478, 595 A.2d 534, 549 (N.J.Super.Ct. Ch. Div.1991) (describing as “completely untenable”*596 the plaintiff's claim that it relied on a land seller's statements about environmental damage when the sale contract created an escrow to fund environmental liability). Additionally, the Financial Institution Plaintiffs do not allege that Heartland never intended to follow the Visa and MasterCard regulations. They merely argue that it is premature to dismiss under Rule 12(b)(6). The master complaint, however, alleges no facts suggesting a plausible claim. Dismissal is appropriate, with prejudice, because amendment would be futile.



3. Nondisclosure

[30] Headnote Citing References[31] Headnote Citing References[32] Headnote Citing References For their third theory of misrepresentation, the Financial Institution Plaintiffs allege that Heartland failed to disclose weaknesses in its data security. “The deliberate suppression of a material fact is equivalent to a material misrepresentation if the party has a duty to disclose the fact.” Maertin v. Armstrong World Indus. Inc., 241 F.Supp.2d 434, 461 (D.N.J.2002) (citing N.J. Econ. Dev. Auth. v. Pavonia Rest., Inc., 319 N.J.Super. 435, 725 A.2d 1133, 1139 (N.J.Super.Ct.App.Div.1998)). “The concealed facts must be material facts[.]” Maertin, 241 F.Supp.2d at 461. A concealed, or undisclosed, fact is material if the plaintiff would not have entered the contract had he known that fact. See id. A duty may arise whenever “good faith and common decency require it.” Id. (quoting City Check Cashing, Inc. v. Mfrs. Hanover Trust, 166 N.J. 49, 764 A.2d 411, 417 (2001)). “There are three general types of transactions where the duty to disclose arises: (1) where a fiduciary relationship exists between the parties, (2) where the transaction itself calls for perfect good faith and full disclosure, or (3) where one party expressly reposes a trust and confidence in the other.” Maertin, 241 F.Supp.2d at 461 (internal quotation marks omitted). In addition, a party has a duty to disclose whenever necessary to correct a material misrepresentation. See id. at 462 (citing Strawn v. Canuso, 271 N.J.Super. 88, 638 A.2d 141, 149 (N.J.Super.Ct.App.Div.1994)). Whether a party has a duty to disclose is a question of law. Maertin, 241 F.Supp.2d at 461 (citing United Jersey Bank v. Kensey, 306 N.J.Super. 540, 704 A.2d 38, 43 (N.J.Super.Ct.App.Div.1997)).


[33] Headnote Citing References To the extent the Financial Institution Plaintiffs allege that Heartland had a duty to disclose corrective information unrelated to any material misrepresentation, the complaint alleges insufficient facts to find such a duty. There is no fiduciary relationship alleged. Businesses rarely owe each other fiduciary duties in arms-length business transactions. See City of Millville v. Rock, 683 F.Supp.2d 319, 330 (D.N.J.2010); Maksin Mgmt. Corp. v. Roy A. Rapp, Inc., No. L–4633–03, 2008 WL 3165465, at *8 (N.J.Super.Ct.App.Div. Aug. 8, 2008) (per curiam); Pavonia Rest., 725 A.2d at 1139; Berman v. Gurwicz, 189 N.J.Super. 89, 458 A.2d 1311, 1313–14 (N.J.Super.Ct. Ch. Div.1981). The Financial Institution Plaintiffs have not pleaded facts or presented argument demonstrating why their indirect relationship with Heartland, as one of many payment processors, presents an exception to the general rule.


Although the allegations supporting the duty to disclose are thin, the Financial Institution Plaintiffs' briefing clarifies that the basis of the alleged duty is that “Heartland held itself out to the [Financial Institution Plaintiffs] and the public at large as having adequate system security measures in place.” (Docket Entry No. 50, at 33). “Even where no duty to speak exists, one who elects to speak must tell the truth when it is apparent that another *597 may reasonably rely on the statements made.” Voilas v. Gen. Motors Corp., 170 F.3d 367, 378 (3d Cir.1999) (quoting Strawn, 638 A.2d at 149). Some of the statements identified in the complaint are verifiable factual statements that can give rise to a negligent misrepresentation claim. The Financial Institution Plaintiffs argue that if those statements were material misrepresentations, then Heartland had a duty to correct them. Because the claims based on those alleged misrepresentations have been dismissed, the failure to disclose claim based on the same alleged misrepresentations is also dismissed. The Financial Institution Plaintiffs may amend their negligent misrepresentation claim based on this nondisclosure theory, but only as to the failure to correct verifiable factual statements that are actionable misrepresentations and on which the Financial Institution Plaintiffs relied.


D. The Consumer–Protection Claims

The Financial Institution Plaintiffs allege violations of 23 states' consumer-protection laws.FN24 Heartland argues that the Financial Institution Plaintiffs lack standing to bring claims under the laws of states where neither they nor Heartland are located. (Docket Entry No. 56, at 15 n. 25). The Financial Institution Plaintiffs do not dispute this argument. The state-law claims at issue are those brought under the laws of California, Colorado, Florida, Illinois, New Jersey, New York, Texas, and Washington.


FN24. The Financial Institution Plaintiffs alleged violations under Arkansas, California, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Hawaii, Idaho, Illinois, Massachusetts, Minnesota, Missouri, Nebraska, Nevada, New Jersey, New Mexico, New York, North Dakota, Oklahoma, Rhode Island, Vermont, and Washington law. They withdrew their claims based on District of Columbia, Hawaii, Missouri, Oklahoma, and Rhode Island law. (Docket Entry No. 50, at 42 n. 31).




[34] Headnote Citing References Heartland argues that this court should consider only the claims under New Jersey law, and that the claims under the remaining states' laws should be dismissed. Heartland contends that multiple states' laws cannot apply to the same set of misrepresentations. It further asserts that the Financial Institution Plaintiffs should not be allowed to plead the application of different states' law so that they can strategically choose which law to apply after seeing which claims survive a motion to dismiss. These arguments are unpersuasive. Courts have applied multiple states' laws in consumer protection cases when choice-of-law rules require doing so. See In re Pharm. Indus. Average Wholesale Price Litig., 252 F.R.D. 83, 93–96 (D.Mass.2008) (considering the appropriate approach to certifying a consumer class action involving multiple states' laws). Even if only one state's law could apply, Rule 8 allows a plaintiff to “set out 2 or more statements of a claim ... alternatively[.]” Fed. R. Civ. P. 8(d)(2). The rule applies equally to contentions regarding the applicable law. See, e.g., Zabors v. Chatsworth Data Corp., 735 F.Supp.2d 1010, 1013–14 (N.D.Ill.2010); see also Levin v. Dalva Bros., Inc., 459 F.3d 68, 73 (1st Cir.2006) (explaining that there is no “definitive point by which a litigant must raise a choice-of-law argument”).


The cases on which Heartland relies to argue that only New Jersey law applies are distinguishable. In a separate Hannaford Brothers opinion, the district court had certified a question to the Maine Law Court based on the defendant's concession that Maine law applied. Judicial estoppel prevented the defendant from later arguing that a different state's law applied. MDL No. 2:08–MD–1954, 2009 WL 3824393, at *3 (D.Me. Nov. 16, 2009). *598 Similarly, in Lott v. Levitt, 556 F.3d 564 (7th Cir.2009), the Seventh Circuit held that the plaintiff had waived his argument that Virginia law applied after having “agreed with Defendants that Illinois law governs this dispute, made no separate choice-of-law analysis, and cited no Virginia cases.” Id. at 567 (internal quotation marks and alteration omitted). The cases do not stand for the proposition that the Financial Institution Plaintiffs, at this stage of the litigation, are limited to pleading the application of only one state's law.


Neither side has briefed the choice-of-law issue. This court will not conduct such an analysis before the parties have done so. The arguments about each state's law instead are analyzed below.



1. The New Jersey Consumer Fraud Act

[35] Headnote Citing References The parties focus primarily on the New Jersey Consumer Fraud Act (“NJCFA”), N.J. Stat. § 56:8–1 et seq. The NJCFA prohibits


[t]he act, use or employment by any person of any unconscionable commercial practice, deception, fraud, false pretense, false promise, misrepresentation, or the knowing, concealment, suppression, or omission of any material fact with intent that others rely upon such concealment, suppression or omission, in connection with the sale or advertisement of any merchandise or real estate, or with the subsequent performance of such person as aforesaid, whether or not any person has in fact been misled, deceived or damaged thereby, is declared to be an unlawful practice[.]


Id. § 56:8–2. The NJCFA creates a private right of action for “[a]ny person who suffers any ascertainable loss of moneys or property, real or personal, as a result of the use or employment by another person of any method, act, or practice” prohibited under the NJCFA. Id. § 56:8–19. Under the NJCFA, “merchandise” includes “any objects, wares, goods, commodities, services or anything offered, directly or indirectly to the public for sale[.]” Id. § 56:8–1(c). The NJCFA includes business entities in the definition of “person.” Id. § 56:8–1(d); see also Finderne Mgmt. Co. v. Barrett, 402 N.J.Super. 546, 955 A.2d 940, 954 (N.J.Super.Ct.App.Div.2008) (noting that “[u]nlawful practices ... can victimize business entities as well as individual consumers” (internal quotation marks omitted)). The three elements of an NJCFA claim are: “1) unlawful conduct by defendant; 2) an ascertainable loss by plaintiff; and 3) a causal relationship between the unlawful conduct and the ascertainable loss.” Bosland v. Warnock Dodge, Inc., 197 N.J. 543, 964 A.2d 741, 749 (2009); accord Lee v. Carter–Reed Co., 203 N.J. 496, 4 A.3d 561, 576 (2010).


“Because it is remedial legislation, the [NJ]CFA is construed liberally to accomplish its broad purpose of safeguarding the public.” Lee, 4 A.3d at 577 (internal quotation marks and alterations omitted). One early state case observed that “the entire thrust of the [NJCFA] is pointed to products and services sold to consumers in the popular sense.... The legislative language throughout the statute and the evils sought to be eliminated point to an intent to protect the consumer in the context of the ordinary meaning of that term in the market place.” Neveroski v. Blair, 141 N.J.Super. 365, 358 A.2d 473, 480 (N.J.Super.Ct.App.Div.1976) (per curiam), superseded by statute on other grounds as recognized in Lee v. First Union Nat. Bank, 199 N.J. 251, 971 A.2d 1054, 1059–60 (2009); accord Shogen v. Global Aggressive Growth Fund, Ltd., Civ. A. No. 04–5695(SRC), 2007 WL 1237829, at *7–8 (D.N.J. Apr. 26, 2007) (quoting Neveroski and citing *599 J & R Ice Cream Corp. v. Cal. Smoothie Licensing Corp., 31 F.3d 1259, 1272 (3d Cir.1994)). The NJCFA “does not cover every sale in the marketplace.” Papergraphics Int'l Inc. v. Correa, 389 N.J.Super. 8, 910 A.2d 625, 628 (N.J.Super.Ct.App.Div.2006) (citing cases). The New Jersey Supreme Court has emphasized that “the strongest case for relief ... is presented by the poor, the naive and the uneducated consumers[.]” Kugler v. Romain, 58 N.J. 522, 279 A.2d 640, 649 (1971).


State and federal courts have recognized that a business may sue under the NJCFA. J & R Ice Cream, 31 F.3d at 1273–74 (collecting cases). An early case analyzing whether a business could invoke the NJCFA was Hundred East Credit Corporation v. Eric Schuster Corporation, 212 N.J.Super. 350, 515 A.2d 246 (N.J.Super.Ct.App.Div.1986). The plaintiff business purchased computer peripherals to upgrade its computer. When that sale occurred, the defendant, the peripherals manufacturer, knew that the computers for which the peripherals were designed would be discontinued that year. Id. at 247. The manufacturer argued that the NJCFA did not apply to merchandise sales for use in business operations. The court first noted that the statutory language expressly encompassed business entities and defined “ ‘merchandise’ without regard to its intended use or the nature of the buyer.” Id. at 248. The court acknowledged that the NJCFA was concerned primarily with consumers, but pointed out that “a business entity can be, and frequently is, a consumer in the ordinary meaning of that term. Since a business entity is also a ‘person’ entitled to recover under the Act, there is no sound reason to deny it the protection of the Act.” Id. (internal citations omitted). The court acknowledged that the purpose of the NJCFA limited the Act's reach, but explained that in many cases a business needs protection from unfair practices just as much as an individual consumer:


Business entities, like individual consumers, cover a wide range. Some are poor, some wealthy; some are naive, some sophisticated; some are required to submit, some are able to dominate. Even the most world-wise business entity can be inexperienced and uninformed in a given consumer transaction. Unlawful practices thus can victimize business entities as well as individual consumers. It may well be, of course, that certain practices unlawful in a sale of personal goods to an individual consumer would not be held unlawful in a transaction between particular business entities; the Act largely permits the meaning of “unlawful practice” to be determined on a case-by-case basis.


Id. at 249. Subsequent state and federal courts have agreed that a case-by-case approach to NJCFA claims asserted by businesses is appropriate. Papergraphics, 910 A.2d at 628–29 (collecting cases).


Courts generally have limited NJCFA claims by businesses to “consumer oriented situations.” J & R Ice Cream, 31 F.3d at 1273 (citing cases); BOC Grp., Inc. v. Lummus Crest, Inc., 251 N.J.Super. 271, 597 A.2d 1109, 1112 (N.J.Super.Ct. Law Div.1990) (same). Under this approach, “it is the character of the transaction rather than the identity of the purchaser which determines if the [NJCFA] is applicable.” J & R Ice Cream, 31 F.3d at 1273; accord In re Schering–Plough Corp. Intron/Temodar Consumer Class Action, No. 2:06–cv–5774 (SRC), 2009 WL 2043604, at *31 (D.N.J. July 10, 2009) (quoting J & R Ice Cream); Marascio v. Campanella, 298 N.J.Super. 491, 689 A.2d 852, 857–58 (N.J.Super.Ct.App.Div.1997) (explaining that “the focus of the Act is on the nature of the goods and services being sold, and *600 not the nature of the buyer or the buyer's intended use of the goods or services”).


[36] Headnote Citing References Only a “bona fide consumer” may bring a claim under the NJCFA. Smith v. Trusted Universal Standards in Elec. Transactions, Inc., Civ. No. 09–4567 (RBK/KMW), 2010 WL 1799456, at *4 (D.N.J. May 4, 2010) (“The NJCFA only creates a cause of action for ‘bona fide consumers of a product.’ ” (quoting Grauer v. Norman Chevrolet Geo, 321 N.J.Super. 547, 729 A.2d 522, 524 (N.J.Super. Ct. Law Div.1998))); DIRECTV, Inc. v. Marino, No. Civ. 03–5606(GEB), 2005 WL 1367232, at *3 (D.N.J. June 8, 2005) (citing Grauer ). FN25 “The absence of a consumer transaction is fatal to a[n] NJCFA claim.” Smith, 2010 WL 1799456, at *4 (citing DIRECTV ). Business “competitors, direct or otherwise, suffering non-consumer like injuries [lack] standing to sue under the NJCFA.” Church & Dwight Co. v. SPD Swiss Precision Diagnostics, GmBH, Civ. A. No. 10–453, 2010 WL 5239238, at *10 (D.N.J. Dec. 16, 2010).FN26 Courts also have held that insurers and assignees lack standing to sue under the NJCFA. Standard Fire Ins. Co. v. MTU Detroit Diesel, Inc., Civ. A. No. 07–3827(GEB), 2009 WL 2568199, at *5 (D.N.J. Aug. 13, 2009) (insurer); Taylor v. Foulke Mgmt. Corp., No. L–1502–08, 2011 WL 10050, at *2 (N.J.Super.Ct.App.Div. Oct. 14, 2010) (per curiam) (assignee) (citing Levy v. Edmund Buick–Pontiac, Ltd., 270 N.J.Super. 563, 637 A.2d 600, 602 (N.J.Super.Ct. Law Div.1993)).


FN25. In some cases, courts have recognized that a party who was not a consumer of a company's merchandise nonetheless may recover under the NJCFA. See, e.g., Port Liberte Homeowners Ass'n, Inc. v. Sordoni Constr. Co., 393 N.J.Super. 492, 924 A.2d 592, 597–99 (N.J.Super.Ct.App.Div.2007) (allowing a condominium association to sue a construction company hired by a developer because of “[t]he unique [statutory] relationship between a condominium association and a developer”). The Financial Institution Plaintiffs, however, do not rely on this line of cases.




FN26. The Church & Dwight court acknowledged that some courts had stated in dicta and without analysis that a competitor had standing to bring an NJCFA claim. 2010 WL 5239238, at *10 (citing 800–JR Cigar, Inc. v. GoTo.com, Inc., 437 F.Supp.2d 273, 295–96 (D.N.J.2006) and Conte Bros. Automotive, Inc. v. Quaker State–Slick 50, Inc., 992 F.Supp. 709, 716 n. 12 (D.N.J.1998)). The court found those cases unpersuasive, pointing out that they relied on Feiler v. New Jersey Dental Association, 191 N.J.Super. 426, 467 A.2d 276 (N.J.Super.Ct.Ch.Div.1983), “which did not involve NJCFA claims.” Church & Dwight, 2010 WL 5239238, at *10.




[37] Headnote Citing References Courts uniformly have excluded wholesalers from the NJCFA's protection, because they themselves do not consume merchandise; rather, they pass merchandise along to consumers. See, e.g., Diamond Life Lighting MFG (HK) Ltd. v. Picasso Lighting, Inc., Civ. A. No. 10–161(PGS), 2010 WL 5186168, at *6 (D.N.J. Dec. 14, 2010) (wholesaler of lighting); City Check Cashing, Inc. v. Nat'l State Bank, 244 N.J.Super. 304, 582 A.2d 809, 811 (N.J.Super.Ct.App.Div.1990) (analogizing a check-cashing business's claim against a bank to a wholesaler and denying the claim); Arc Networks, Inc. v. Gold Phone Card Co., 333 N.J.Super. 587, 756 A.2d 636, 638–39 (N.J.Super.Ct. Law Div.2000) (reseller of bulk phone services in the form of phone cards) cf. Viking Yacht Co. v. Composites One LLC, 496 F.Supp.2d 462, 474–75 (D.N.J.2007) (holding that a boat manufacturer that used defective marine gel in its manufacturing process could sue under the NJCFA). Privity is not a requirement, so long as the plaintiff is a consumer of the merchandise. Gonzalez v. Wilshire Credit Corp., 411 N.J.Super. 582, 988 A.2d 567, 574 n. 9 (N.J.Super.Ct.App.Div.2010); *601 Marrone v. Greer & Polman Constr., Inc., 405 N.J.Super. 288, 964 A.2d 330, 335 (N.J.Super.Ct.App.Div.2009), abrogated on other grounds by Dean v. Barrett Homes, Inc., 204 N.J. 286, 8 A.3d 766 (2010); Katz v. Schachter, 251 N.J.Super. 467, 598 A.2d 923, 926 (N.J.Super.Ct.App.Div.1991); Perth Amboy Iron Works, Inc. v. Am. Home Assur. Co., 226 N.J.Super. 200, 543 A.2d 1020, 1026 (N.J.Super.Ct.App.Div.1988), aff'd, 118 N.J. 249, 571 A.2d 294 (1990); Neveroski, 358 A.2d at 479.


[38] Headnote Citing References[39] Headnote Citing References Even when a business is a consumer of merchandise, other factors may exclude it from NJCFA protection. The NJCFA applies only to “goods or services generally sold to the public at large.” Cetel v. Kirwan Fin. Grp., Inc., 460 F.3d 494, 514 (3d Cir.2006) (quoting Marascio, 689 A.2d at 857); see also Prof'l Cleaning & Innovative Bldg. Servs., Inc. v. Kennedy Funding Inc., 408 Fed.Appx. 566, 570 (3d Cir.2010) (per curiam) (describing this requirement as the “touchstone for the statute's applicability”). Businesses that have purchased yachts, computer peripherals, cranes, concrete, and commercial-renovation services have brought successful NJCFA claims. FN27 But courts have excluded sales of complex business franchises FN28 and custom services targeted to businesses. See Prof'l Cleaning, 408 Fed.Appx. at 570–71 (credit services offered by lender of last resort to distressed businesses); Cetel, 460 F.3d at 514–15 (tax shelters sold to businesses); BOC Grp., 597 A.2d at 1113–14 (research and development services). The presence of large transactions or sophisticated business plaintiffs is a factor weighing against the NJCFA's applicability. See Prof'l Cleaning, 408 Fed.Appx. at 571–72; Diamond Life Lighting, 2010 WL 5186168, at *5; Papergraphics, 910 A.2d at 629; BOC Grp., 597 A.2d at 1113–14.


FN27. Ford Motor Co. v. Edgewood Props., Inc., Civ. A. Nos. 06–1278, 06–4266, 2007 WL 4526594, at *21 (D.N.J. Dec. 18, 2007) (concrete); Naporano Iron & Metal Co. v. Am. Crane Corp., 79 F.Supp.2d 494, 509 (D.N.J.1999) (crane); Marascio, 689 A.2d at 856–57 (renovation services); Perth Amboy Iron Works, 543 A.2d at 1025 (yacht); Hundred E. Credit Corp., 515 A.2d at 248–49 (computer peripherals).




FN28. See also A.H. Meyers & Co. v. CNA Ins. Co., 88 Fed.Appx. 495, 499–500 (3d Cir.2004) (contract dispute between insurance agency and insurance underwriter); J & R Ice Cream, 31 F.3d at 1274 (sale of business franchise excluded from coverage). A panel of the New Jersey Appellate Division disagreed that the sale of a business franchise is per se excluded from the NJCFA's coverage, but agreed with the result in J & R Ice Cream because the case “involved a substantial and complex commercial transaction.” Kavky v. Herbalife Int'l of Am., 359 N.J.Super. 497, 820 A.2d 677, 679–80 (N.J.Super.Ct.App.Div.2003).




[40] Headnote Citing References The master complaint alleges that the Financial Institution Plaintiffs are “consumers in the marketplace for, inter alia, credit card and/or debit card transaction processing services, and have been injured in this capacity.” (Docket Entry No. 32, ¶ 133). The complaint describes representations and services offered to merchants and members of the Visa and MasterCard networks, including the Financial Institution Plaintiffs. The complaint does not, however, allege that the Financial Institution Plaintiffs purchased any services from Heartland. The Financial Institution Plaintiffs' relationship with Heartland exists only by virtue of their participation in the Visa and MasterCard networks. This relationship is far different from the direct, downstream relationship between a consumer of a good and its manufacturer or seller. Cf., e.g., Diamond Life Lighting, 2010 WL 5186168, at *6. As noted above, the Visa and MasterCard regulations explicitly contemplate the presence of third-party processors, and *602 there is no suggestion that the Financial Institution Plaintiffs had any control over who would perform those tasks. Cf. Messeka Sheet Metal Co. v. Hodder, 368 N.J.Super. 116, 845 A.2d 646, 655 (N.J.Super.Ct.App.Div.2004) (holding that a homeowner could not sue a subcontractor under the NJCFA because the homeowner “left it to the general contractor to make the choices as to who would perform” each task on the project).


Additionally, payment-card processing services are not offered to the general public. Instead, such services are provided by specific entities for members of the Visa and MasterCard networks. Heartland promises in its contracts to comply with the networks' regulations. These regulations significantly protect the Financial Institution Plaintiffs through loss-allocation rules and a cost-recovery process. In turn, issuer banks such as the Financial Institution Plaintiffs are required to maintain fraud-detection programs. These aspects of the Visa and MasterCard networks, along with the Financial Institution Plaintiffs' status as sophisticated financial institutions, set the Financial Institution Plaintiffs apart from the type of consumer protected under the NJCFA. The NJCFA claim is dismissed with prejudice and without leave to amend because amendment would be futile.FN29


FN29. In the alternative, the complaint conclusorily alleges that the Financial Institution Plaintiffs are commercial competitors of Heartland. More detailed factual allegations would be unavailing because business competitors lack standing under the NJCFA unless the parties have entered into a consumer-like transaction. See Church & Dwight Co., 2010 WL 5239238, at *10. For the reasons previously discussed, the transactions and relationships at issue here are between sophisticated businesses.





2. The California Unfair Competition Law

[41] Headnote Citing References The Financial Institution Plaintiffs allege that Heartland violated the California Unfair Competition Law, Cal. Bus. & Prof. Code § 17200 et seq. “A UCL plaintiff with standing is a person who ‘[1] has suffered injury in fact and [2] has lost money or property as a result of the unfair competition.’ ” Degelmann v. Advanced Med. Optics, Inc., 659 F.3d 835, 839 (9th Cir.2011) (quoting Cal. Bus. & Prof. Code § 17204). Through the phrase “as a result of,” the second element “requires a showing of a causal connection or reliance on the alleged misrepresentation.” Kwikset Corp. v. Superior Court, 51 Cal.4th 310, 120 Cal.Rptr.3d 741, 246 P.3d 877, 887 (2011) (quoting Hall v. Time, Inc., 158 Cal.App.4th 847, 70 Cal.Rptr.3d 466, 471–72 (2008)). In Kwikset, the California Supreme Court held that the plaintiffs had sufficiently pleaded standing by alleging that the “plaintiffs saw and relied on the [false] labels for their truth in purchasing Kwikset's locksets, and [the] plaintiffs would not have bought the locksets otherwise.” 120 Cal.Rptr.3d 741, 246 P.3d at 889. The Financial Institution Plaintiffs, by contrast, conclusorily assert reliance. As with the New Jersey misrepresentation claim, they do not explain the nature or form of their reliance. The claim is dismissed, without prejudice and with leave to amend.



3. The Colorado Consumer Protection Act

[42] Headnote Citing References The complaint alleges that Heartland violated the subsection of the Colorado Consumer Protection Act that prohibits, as a deceptive trade practice, “false or misleading statements of fact concerning the price of goods, services, or property or the reasons for, existence of, or amounts of price reductions.” Colo. Rev. Stat. § 6–1–105(1)( l ). As Heartland points out, there are no allegations in the complaint about *603 pricing. The Financial Institution Plaintiffs contend that Heartland selectively quotes from the Colorado Act, given that it contains “approximately 45 different categories of conduct that are considered deceptive trade practices.” (Docket Entry No. 64, at 14). The complaint, however, refers only to subsection (1)( l ). This claim is dismissed, without prejudice and with leave to amend.



4. The Florida Deceptive and Unfair Trade Practices Act

The Financial Institution Plaintiffs claim a violation of the Florida Deceptive and Unfair Trade Practices Act (“FDUTPA”), Fla. Stat. § 501.201 et seq. Heartland argues that this claim must be dismissed because only consumers, as the word is traditionally used, may assert claims under the FDUTPA. The Financial Institution Plaintiffs respond that the Act's definition of “consumer” is broad enough to include them.


[43] Headnote Citing References The FDUTPA prohibits “[u]nfair methods of competition, unconscionable acts or practices, and unfair or deceptive acts or practices in the conduct of any trade or commerce[.]” Id. § 501.204(1). The Act's purpose is “[t]o protect the consuming public and legitimate business enterprises from those who engage in unfair methods of competition, or unconscionable, deceptive, or unfair acts or practices in the conduct of any trade or commerce.” Id. § 501.202(2). A practice is unfair if it “offends established public policy” or is “immoral, unethical, oppressive, unscrupulous, or substantially injurious to consumers.” PNR, Inc. v. Beacon Prop. Mgmt., Inc., 842 So.2d 773, 777 (Fla.2003) (internal quotation marks omitted). Courts are to construe the FDUTPA liberally. Fla. Stat. § 501.202.


Before 2001, the FDUTPA allowed “a consumer who has suffered a loss as a result of a violation” of the FDUTPA to bring a cause of action. Am. Honda Motor Co. v. Motorcycle Info. Network, Inc., 390 F.Supp.2d 1170, 1176 (M.D.Fla.2005) (quoting Fla. Stat. § 501.211(2) (2000)) (emphasis in original). The Florida Legislature amended § 501.211(2) to replace “consumer” with “person” in 2001. Id.; see also Fla. Stat. § 501.211(2) (“a person who has suffered a loss as a result of a violation”). Since that amendment, courts have disagreed as to whether nonconsumers may bring a private action under the FDUTPA. See, e.g., Intercoastal Realty, Inc. v. Tracy, 706 F.Supp.2d 1325, 1334–35 (S.D.Fla.2010). Heartland relies on Kertesz v. Net Transactions, Ltd., 635 F.Supp.2d 1339 (S.D.Fla.2009), in which a Florida federal district court held that the amendment did not broaden the FDUTPA's private right of action. Id. at 1350. The court concluded that the Florida Legislature intended this amendment “to clarify that businesses, just like individuals, could obtain monetary damages in FDUTPA cases,” but that only consumers could bring a private cause of action under the Act. Id. at 1349. Another Florida federal district court reached the opposite conclusion, holding that nonconsumers could sue under the FDUTPA. Kelly v. Palmer, Reifler, & Assocs., P.A., 681 F.Supp.2d 1356, 1373–74 (S.D.Fla.2010). The Kelly court explained:


[I]n 2001, the Legislature made two changes to FDUTPA that are relevant to the issue before us. As noted, the Legislature replaced the word “consumer” with “person.” (The term “person,” the Committee Staff noted, “is understood to include a business.” See Senate Staff Analysis[, CS/SB 208, Mar. 22, 2001,] at 6.) The Legislature also amended the definition of “consumer” in § 501.203(7) to add “business” and “any commercial entity, however denominated.”*604 See Laws of Fla. Ch. 2001–39 § 1 (amending § 501.203(7) as described). So at the same time the Legislature expanded the definition of “consumer,” it replaced the term “consumer” with “person” in the section providing for monetary remedies for a violation of the statute. To us, this evinces an intent to expand the applicability of the remedies provision to more than just consumers. If the purpose had been to assure that businesses could avail themselves of the remedies under § 501.211(2), given “inconsistent court interpretations” in which “remedies available to individual consumers have not always been available to business consumers,” see Senate Staff Analysis at 4, that purpose could have been accomplished by the change to the definition of “consumer” (in § 501.203(7)), such that the term “consumer” did not have to be replaced with “person” in § 501.211(2). Thus a non-consumer (like a competitor, either individually or through a corporate form) could seek relief under the statute so long as the trade or commerce element of the statute was satisfied.


Id. at 1373 n. 9; cf. Hetrick v. Ideal Image Dev. Corp., 372 Fed.Appx. 985, 990 (11th Cir.2010) (per curiam) (allowing individuals who “formed and funded a corporation on the basis of misrepresentations” to proceed with an FDUTPA claim because standing under the Act “is available to any person who was subject to an unfair or deceptive trade practice”).


[44] Headnote Citing References The question is a close one. The Act's purpose is “[t]o protect the consuming public and legitimate business enterprises.” Fla. Stat. § 501.202(2) (emphasis added). It is unclear if the word “consuming” applies to only “public” or also to “legitimate business enterprises.” The more natural reading is that this clause lists two independent groups that the Act seeks to protect: first, “the consuming public,” and second, “legitimate business enterprises.” See Akzo Nobel Coatings, Inc. v. Auto Paint & Supply of Lakeland, Inc., No. 8:09–cv–2453–T–30TBM, 2011 WL 5597364, at *3 (M.D.Fla. Nov. 17, 2011) (holding that “whether or not an individual non-consumer plaintiff has standing [under the Act], a legitimate business enterprise does” (emphasis in original)); Tracy, 706 F.Supp.2d at 1335 (allowing a claim by a “legitimate business enterprise” without regard to whether the business was a consumer); Kertesz, 635 F.Supp.2d at 1349 (emphasizing only the word “consuming”). Limiting the private right of action to consumers also overlooks that even after the FDUTPA was amended to replace the word “consumer” with “person” in § 501.211(2), the Act continues to include a definition for “consumer,” id. § 501.203(7), and to use that word in other provisions. For example, the Florida state attorney or Department of Legal Affairs may bring “[a]n action on behalf of one or more consumers ... for the actual damages caused by an act or practice in violation” of the FDUTPA. Id. § 501.207(c). The Florida Legislature's use of the word “person” in creating a private right of action suggests a broader reach than the word “consumer.” See Fla. Dep't of Revenue v. Cent. Dade Malpractice Trust Fund, 673 So.2d 899, 901 (Fla.Dist.Ct.App.1996) (noting that “legislative intent may be discerned from the Legislature's election to use different words to convey different meanings within a statute”) (citing Dep't of Prof'l Regulation v. Durrani, 455 So.2d 515, 518 (Fla.Dist.Ct.App.1984)).


The motion to dismiss the FDUTPA claim on the basis of lack of standing is denied.



5. The Illinois Consumer Fraud and Deceptive Business Practices Act

[45] Headnote Citing References Heartland argues that the Financial Institution Plaintiffs' claim under the *605 Illinois Consumer Fraud and Deceptive Business Practices Act, 815 Ill. Comp. Stat.. § 505/1 et seq. , must be dismissed because the master complaint neither “relate[s] to consumer protection issues” nor alleges reliance. (Docket Entry No. 56, at 15–16). The Illinois statute prohibits “[u]nfair methods of competition and unfair or deceptive acts or practices, including but not limited to the use or employment of any deception, fraud, false pretense, false promise, misrepresentation or the concealment, suppression or omission of any material fact, with intent that others rely upon the concealment, suppression or omission of such material fact[.]” 815 Ill. Comp. Stat.. § 505/2. There are four elements of a claim under the Illinois Act: (1) a deceptive act or practice; (2) the intent that the plaintiff rely on the deception; (3) the deception occurred in the course of conduct involving trade or commerce; and (4) the deceptive act proximately caused the plaintiff's injury. Cozzi Iron & Metal, Inc. v. U.S. Office Equipment, Inc., 250 F.3d 570, 575–76 (7th Cir.2001) (citing Connick v. Suzuki Motor Co., 174 Ill.2d 482, 221 Ill.Dec. 389, 675 N.E.2d 584, 593 (1996)). “[A] statutory consumer fraud claim must be pled with specificity[.]” Avery v. State Farm Mut. Auto. Ins. Co., 216 Ill.2d 100, 296 Ill.Dec. 448, 835 N.E.2d 801, 843 (2005).


[46] Headnote Citing References The master complaint does not adequately allege that Heartland intended the Financial Institution Plaintiffs to rely on any of its statements. The alleged misstatements in the S.E.C. filings, analyst calls, and the Merchant's Bill of Rights were not directed to issuer banks. Because issuers have no direct dealings with payment-card processors, it is implausible that Heartland intended statements in documents not directed to the Financial Institution Plaintiffs to be relied on by them or by any issuer banks. The master complaint conclusorily alleges reliance, insufficient to state a claim.


Heartland correctly states that under Illinois law, nonconsumers must show that “the complained-of conduct implicates consumer protection concerns.” Speakers of Sport, Inc. v. ProServ, Inc., 178 F.3d 862, 868 (7th Cir.1999) (internal quotation marks omitted); accord, e.g., Gen. Ins. Co. of Am. v. Clark Mali Corp., No. 08 C 2787, 2010 WL 1286076, at *6 (N.D.Ill. Mar. 30, 2010). In light of the sparse briefing on this issue, this court declines to address it at this time. The Illinois claim is dismissed, but without prejudice and with leave to amend.



6. The New York Consumer–Protection Law

The Financial Institution Plaintiffs allege violations of New York's consumer-protection statute, which prohibits “[d]eceptive acts or practices in the conduct of any business, trade or commerce or in the furnishing of any service [.]” N.Y. Gen. Bus. Law § 349(a). “Generally, claims under the statute are available to an individual consumer who falls victim to misrepresentations made by a seller of consumer goods through false or misleading advertising.” Eaves v. Designs for Fin., Inc., 785 F.Supp.2d 229, 265 (S.D.N.Y.2011) (quoting Small v. Lorillard Tobacco Co., 94 N.Y.2d 43, 698 N.Y.S.2d 615, 720 N.E.2d 892, 897 (1999)); accord, e.g., Waverly Props., LLC v. KMG Waverly, LLC, 824 F.Supp.2d 547, 566–67, 2011 WL 4472284, at *18 (S.D.N.Y.2011). “Courts have repeatedly held that a consumer, for § 349 purposes, is one who purchases goods and services for personal, family or household use.” Eaves, 785 F.Supp.2d at 265 (quoting Exxonmobil Inter–America, Inc. v. Advanced Info. Eng'g Servs., Inc., 328 F.Supp.2d 443, 448 (S.D.N.Y.2004) (internal alteration omitted)).


*606 [47] Headnote Citing References[48] Headnote Citing References[49] Headnote Citing References[50] Headnote Citing References “To maintain a cause of action under § 349, a plaintiff must show: (1) that the defendant's conduct is ‘consumer-oriented,’; (2) that the defendant is engaged in a ‘deceptive act or practice’; and (3) that the plaintiff was injured by this practice.” Wilson v. Nw. Mut. Ins. Co., 625 F.3d 54, 64 (2d Cir.2010) (citing Oswego Laborers' Local 214 Pension Fund. v. Marine Midland Bank, N.A., 85 N.Y.2d 20, 623 N.Y.S.2d 529, 647 N.E.2d 741, 744 (1995)). Consumer-oriented conduct is defined as “acts or practices [that] have a broader impact on consumers at large. Private contract disputes, unique to the parties ... would not fall within the ambit of the statute[.]” Oswego, 623 N.Y.S.2d 529, 647 N.E.2d at 744; see also, e.g., N.Y. Workers' Comp. Bd. v. 26–28 Maple Avenue, Inc., 80 A.D.3d 1135, 915 N.Y.S.2d 744, 745 (2011) (defining consumer-oriented conduct as “an act having the potential to affect the public at large, as distinguished from merely a private contractual dispute” (internal quotation marks omitted)). “When more complex claims are asserted under [N.Y. Gen. Bus. Law] § 349, courts have looked to the identity of the parties, their sophistication and experience, and the contract type and amount to determine whether the statute applies.” Wells Fargo Bank Nw., N.A. v. Am. Gen. Life Ins. Co., Civ. A. No. 10–1327(FLW), 2011 WL 1899338, at *6 (D.N.J. May 19, 2011); see also Exxonmobil Inter–America, 328 F.Supp.2d at 449 (explaining that “transactions involving complex arrangements, knowledgeable and experienced parties and large sums of money are different in kind and degree from those that confront the average consumer who requires the protection of a statute against fraudulent practices” (internal quotation marks and alteration omitted)). As one New York federal district court has explained, “While the ‘consumer-orient[ed] act’ prong does not preclude the application of § 349 to disputes between businesses per se, it does severely limit it. Contracts to provide commodities that are available only to businesses do not fall within the parameters of § 349.” Exxonmobil Inter–America, 328 F.Supp.2d at 449 (citing Cruz v. NYNEX Info. Res., 263 A.D.2d 285, 703 N.Y.S.2d 103, 107 (2000)). When the parties are “both sophisticated contracting entities with equal bargaining power, and the contract between them was for a business-only commodity, not a common consumer good,” § 349 is inapplicable. Exxonmobil Inter–America, 328 F.Supp.2d at 450. The act “was designed to protect ‘the little guy’ from false advertising, pyramid schemes, bait-and-switch sales tactics, and other mischievous machinations by swindlers and scallywags.” Id. (citing generally Teller v. Bill Hayes, Ltd., 213 A.D.2d 141, 630 N.Y.S.2d 769 (1995)). If the product or service is not “for ‘personal, family or household use’ and the deceptive conduct alleged by Plaintiffs was not directed at non-business consumers,” the claim does not fall within § 349. Eaves, 785 F.Supp.2d at 266 (citing cases).


[51] Headnote Citing References Even assuming that the Financial Institution Plaintiffs had adequately pleaded that Heartland engaged in deceptive practices and that those practices injured them, the Financial Institution Plaintiffs are not “consumers.” Nor is the conduct “consumer-oriented” under § 349. The Financial Institution Plaintiffs are far removed from an individual “who purchases goods and services for personal, family or household use,” the paradigmatic § 349 plaintiff. Id. at 265 (quoting Exxonmobil Inter–America, 328 F.Supp.2d at 448 (internal alteration omitted)). To the extent that the Financial Institution Plaintiffs even “purchase” a service from Heartland—questionable, given the nature of *607 their relationship with Heartland FN30—their purchase is solely for commercial use and not personal, family or household use.


FN30. See supra at 601–02.




Moreover, Heartland's allegedly deceptive representations—whether made in S.E.C. filings, to acquiring banks, or to merchants—do not qualify as “consumer-oriented conduct,” as required to state a claim under § 349. Heartland made statements to acquiring banks and merchants about card-processing services. Such services are neither marketed nor offered to consumers, but only to specific types of commercial entities. Even assuming that the Financial Institution Plaintiffs can plausibly plead that they were injured by statements not directed toward them, the deceptive conduct they allege was not directed at “non-business consumers.” Eaves, 785 F.Supp.2d at 266.FN31 The Financial Institution Plaintiffs' New York claim is dismissed, with prejudice because amendment would be futile.


FN31. The reasons discussing why the Financial Institution Plaintiffs' claim under Washington law does not affect the “public interest,” as under that law, also show why their New York claim does not involve consumer-oriented conduct. See infra at 608–09.





7. The Texas Deceptive Trade Practices—Consumer Protection Act

[52] Headnote Citing References The complaint alleges violations of the Texas Deceptive Trade Practices–Consumer Protection Act (“TDTPA”), Tex. Bus. & Com. Code § 17.41 et seq. Heartland argues that the master complaint fails to state a claim because it does not allege: (1) that Lone Star National Bank, the only Texas plaintiff, has less than $25 million in assets, see id. § 17.45(4) (excluding business entities with more than $25 million in assets from the term “Consumer”); (2) misrepresentations made “ in connection with the [Financial Institution Plaintiffs'] transaction in goods or services,” Amstadt v. U.S. Brass Corp., 919 S.W.2d 644, 650 (Tex.1996) (emphasis in original); and (3) that the Financial Institution Plaintiffs relied on a misrepresentation. (Docket Entry No. 56, at 16).


Like the misrepresentation claim, the TDTPA claim must be dismissed because the conclusory allegation of reliance is insufficient under Rule 8. See, e.g., Rice v. Metro. Life Ins. Co., 324 S.W.3d 660, 676 (Tex.App.-Fort Worth 2010, no pet.) (explaining that reliance is a required element of a TDTPA claim). This claim is dismissed, without prejudice and with leave to amend. FN32


FN32. Had the Financial Institution Plaintiffs adequately pleaded reliance, Heartland's reliance on Amstadt would be an insufficient basis to dismiss. In Amstadt, a group of homeowners sued their homebuilder and three manufacturing companies after discovering that their plumbing systems were defective. Among other claims, they asserted violations of the TDTPA. 919 S.W.2d at 647–48. The Texas Supreme Court acknowledged that a claim under the Act did not require privity of contract. But, the court continued, a “defendant's deceptive trade act or practice is not actionable under the DTPA unless it was committed in connection with the plaintiff's transaction in goods or services.” Id. at 650 (emphasis in original). The court then explained that none of the manufacturers made any representations, directly or indirectly, to the homeowners. Any alleged misrepresentations were not in connection with the home sales. Put differently, the misrepresentations played no role in the homeowners' purchase of the home. See id. at 650–52. The court explained that approving liability without such a connection would “shift[ ] the focus of a DTPA claim from whether the defendant committed a deceptive act to whether a product that was sold caused an injury.” Id. at 650. Here, by contrast, the Financial Institution Plaintiffs allege that Heartland made the alleged misrepresentations to them.





*608 8. The Washington Consumer Protection Act

[53] Headnote Citing References The complaint alleges that Heartland violated Washington's Consumer Protection Act, Wash. Rev.CodeE § 19.86.010 et seq. “To prevail in a private CPA claim, the plaintiff must prove (1) an unfair or deceptive act or practice, (2) occurring in trade or commerce, (3) affecting the public interest, (4) injury to a person's business or property, and (5) causation.” Panag v. Farmers Ins. Co. of Wash., 166 Wash.2d 27, 204 P.3d 885, 889 (2009); see also Segal Co. (E. States), Inc. v. Amazon.Com, 280 F.Supp.2d 1229, 1232 (W.D.Wash.2003) (citing Hangman Ridge Training Stables, Inc. v. Safeco Title Ins. Co., 105 Wash.2d 778, 719 P.2d 531, 535 (1986)).FN33


FN33. A private claim may also be based on a per se violation of the statute. Panag, 204 P.3d at 890 n. 3. That theory is not at issue in this case.




[54] Headnote Citing References Heartland argues that the complaint insufficiently alleges an effect on the public interest. When a case involves a private dispute, as opposed to an ordinary consumer transaction, the plaintiff must show “a likelihood that additional persons have been or will be injured in the same fashion.” A.G. & Design Assocs., LLC v. Trainman Lantern Co., No. C07–5158RBL, 2009 WL 230083, at *6 (W.D.Wash. Jan. 30, 2009) (citing Goodyear Tire & Rubber Co. v. Whiteman Tire, Inc., 86 Wash.App. 732, 935 P.2d 628, 635 (1997)). “It is the likelihood that additional plaintiffs have been or will be injured in exactly the same fashion that changes a factual pattern from a private dispute to one that affects the public interest.” Michael v. Mosquera–Lacy, 165 Wash.2d 595, 200 P.3d 695, 700 (2009) (internal quotation marks and alteration omitted). The conduct must have “the capacity to deceive a substantial portion of the public.” Columbia Physical Therapy, Inc. v. Benton Franklin Orthopedic Assocs., P.L.L.C., 168 Wash.2d 421, 228 P.3d 1260, 1270 (2010) (internal quotations marks and emphasis omitted). “Where the complaint involves essentially a private dispute such as the provision of professional services,” courts consider four nonexclusive factors:


(1) Were the alleged acts committed in the course of defendant's business? (2) Did defendant advertise to the public in general? (3) Did defendant actively solicit this particular plaintiff, indicating potential solicitation of others? (4) Did plaintiff and defendant occupy unequal bargaining positions?


Stephens v. Omni Ins. Co., 138 Wash.App. 151, 159 P.3d 10, 24 (2007) (quoting Hangman Ridge, 719 P.2d at 538); accord, e.g., Hambleton Bros. Lumber Co. v. Balkin Enters., Inc., 397 F.3d 1217, 1234 (9th Cir.2005). Courts have dismissed cases under the public-interest element under Rule 12(b)(6). See, e.g., Swartz v. KPMG, LLC, 401 F.Supp.2d 1146, 1150, 1153–54 (W.D.Wash.2004), aff'd in part, rev'd in part, 476 F.3d 756 (9th Cir.2007).


[55] Headnote Citing References The master complaint fails to allege sufficient facts suggesting that the Financial Institution Plaintiffs' claim affects the public interest. The only group likely to be injured in the same fashion—incurring expenses for replacement cards and fraudulent transactions—consists of other issuer banks. Such a group is both too small and too specialized to constitute a substantial portion of the public. See Swartz, 401 F.Supp.2d at 1153–54 (W.D.Wash.2004) (“The number of consumers who could conceivably find themselves in plaintiff's circumstances—looking for a tax savings on millions of dollars of capital gains—is extremely small and unable to qualify as a ‘substantial portion of the public’ under any reasonable definition of that term.”); Goodyear Tire & Rubber Co., 935 P.2d at 635 (finding that a company's*609 representations to its dealers “had no deceptive capacity affecting the public in general”); see also Columbia Physical Therapy, 228 P.3d at 1270 (holding that the complained-of conduct must have “the capacity to deceive a substantial portion of the public” (quoting Hangman Ridge, 719 P.2d at 535)). The Financial Institution Plaintiffs and other issuer banks have “sufficient sophistication to remove them from the class of bargainers subject to exploitation.” Segal Co., 280 F.Supp.2d at 1234 n. 5 (quoting Pac. Nw. Life Ins. Co. v. Turnbull, 51 Wash.App. 692, 754 P.2d 1262, 1269 (1988)); see also Fleetwood v. Stanley Steemer Int'l, Inc., 725 F.Supp.2d 1258, 1276 (E.D.Wash.2010) (explaining that “parties with ‘a history of business experience’ cannot claim a CPA violation because they are ‘not representative of bargainers who are subject to exploitation and unable to protect themselves' ” (quoting Hangman Ridge, 719 P.2d at 540 (alteration omitted))); Swartz, 401 F.Supp.2d at 1154 (noting, in the context of tax products, that, “as a (very small) group, the extremely wealthy [multimillionaires] are neither unsophisticated nor easily subject to chicanery”); Hangman Ridge, 719 P.2d at 540 (noting that the plaintiffs were “not representative of bargainers subject to exploitation and unable to protect themselves”).


The master complaint vaguely alleges that Heartland intended its statements to lull the public into believing that its data security was better than it actually was. That allegation is insufficient to show that a dispute between sophisticated banks that issue payment cards and the company hired by other banks to process payments for merchants affects the public interest. FN34 The WCPA claim is dismissed, with prejudice and without leave to amend because amendment would be futile.


FN34. The reasons the Financial Institution Plaintiffs' New York claim does not concern “consumer-oriented conduct” within the meaning of that statute also support the conclusion that their Washington claim does not affect the “public interest” under Washington law. See supra at 608–09.




IV. Conclusion

Heartland's motion to dismiss, (Docket Entry No. 39), is granted in part and denied in part. All claims except that under the FDUTPA are dismissed. Leave to amend is granted only as to the following claims: breach of contract and implied contract (both under the limited circumstances described above); express misrepresentation; negligent misrepresentation based on nondisclosure; and violations of the California Unfair Competition Law, the Colorado Consumer Protection Act, the Illinois Consumer Fraud and Deceptive Business Practices Act, and the Texas Deceptive Trade Practices—Consumer Protection Act.


The Financial Institution Plaintiffs must amend their master complaint by December 23, 2011. A status conference is set for January 13, 2012, at 8:30 a.m. in Courtroom 11–B.

834 F.Supp.2d 566
David A. Szwak
Bodenheimer, Jones & Szwak, LLC
416 Travis Street, Suite 1404, Mid South Tower
Shreveport, Louisiana 71101
318-424-1400 / Fax 221-6555
President, Bossier Little League
Chairman, Consumer Protection Section, Louisiana State Bar Association

Administrator
Site Admin
Posts: 11757
Joined: Tue Jul 26, 2005 4:15 am

Re: In re Heartland Payment Systems: Data Breach Case

Postby Administrator » Wed Oct 29, 2014 9:27 am

In re Heartland Payment Systems, Inc. Customer Data Sec. Breach Litigation
Not Reported in F.Supp.2d, 2011 WL 1232352
S.D.Tex.,2011.
March 31, 2011


MEMORANDUM AND ORDER

LEE H. ROSENTHAL, District Judge.

*1 This case arises out of a criminal intrusion into the database of Heartland Payment Systems, which processes credit-card transactions.FN1 In January 2009, Heartland Payment Systems discovered that a hacker had penetrated its database and accessed millions of credit-card numbers. The Judicial Panel on Multidistrict Litigation (“JPML”) consolidated lawsuits arising out of the breach before this court. The lawsuits are divided into two tracks: one for consumers whose credit-card numbers were accessed and one for the financial institutions that issued the cards. There are two complaints on the financial institution track. One complaint is filed by a number of financial institutions FN2 and names Heartland Payment Systems as the defendant.FN3 The second complaint names Heartland Bank and KeyBank as the defendants. These two banks hired Heartland Payment Systems to process credit-card transactions for merchants that accepted Visa and MasterCard credit cards. Five of the financial institutions that sued Heartland Payment Systems—Lone Star National Bank, PBC Credit Union, O Bee Credit Union, Seaboard Federal Credit Union, and Pennsylvania State Employees Credit Union (the “Financial Institution Plaintiffs”)—assert causes of action against Heartland Bank and KeyBank for breach of contract, breach of fiduciary duty, and negligence, principally based on these defendants' alleged failure to monitor the security of the Heartland Payment Systems database. This Memorandum and Order addresses the Financial Institution Plaintiffs' claims against Heartland Bank and KeyBank.


FN1. The intrusion involved debit- and credit-card information. The difference between the two is irrelevant in this litigation. For simplicity, the this court uses “credit card” to refer to both.




FN2. The plaintiffs in the case against Heartland Payment Systems are Amalgamated Bank, Matadors Community Credit Union, Lone Star National Bank, N.A., Elevations Credit Union, First Bankers Trust Co ., N.A., PBC Credit Union, O Bee Credit Union, Seaboard Federal Credit Union, and Pennsylvania State Employees Credit Union.




FN3. Heartland Payment Systems has moved to dismiss the complaint against it. This Memorandum and Order does not address that motion; it will be addressed in a separate Memorandum and Order.




Heartland Bank has moved to dismiss under Rule 12(b)(6) for failure to state a claim on which relief can be granted and under Rule 12(b)(2) for lack of personal jurisdiction. (Docket Entry No. 26).FN4 KeyBank has moved to dismiss under Rule 12(b)(6). (Docket Entry No. 28). The Financial Institution Plaintiffs have responded, (Docket Entry No. 36), and Heartland Bank and KeyBank have replied, (Docket Entry Nos. 39, 40). Based on the record; the motions, response, and replies; and the relevant law, this court grants Heartland Bank's motion to dismiss under Rule 12(b)(2) but concludes that transfer, not dismissal, is the appropriate remedy. This court also grants KeyBank's motion to dismiss under Rule 12(b) (6), with leave to amend as to some, but not all, of the claims. A status conference is set for April 18, 2011, at 8:45 a.m.


FN4. All citations to the record in this opinion are to the docket in Civ. A. No. H–10–171.




The reasons for these rulings are explained below.


I. Background

In January 2010, a major breach of the Heartland Payment Systems database was discovered. Albert Gonzalez and fellow hackers obtained millions of credit-card numbers from the database before Heartland Payment Systems detected and fixed the security problem. Gonzalez was later convicted and is currently serving a prison sentence.


The Financial Institution Plaintiffs are credit-card issuers. They allege that the data breach caused them to incur expenses in the form of fraudulent charges from the stolen credit-card numbers and of the costs to cancel and reissue credit cards. The two defendant banks, Heartland Bank and KeyBank, hired Heartland Payment Systems to process credit-card transactions for merchants that accepted Visa and MasterCard credit cards.


*2 The Visa and MasterCard networks are similar. Issuer banks, such as the Financial Institution Plaintiffs, issue credit cards to consumers. Acquirer banks, such as Heartland Bank and KeyBank, process payments for the merchants who make credit-card sales. When a consumer makes a credit-card purchase, the merchant swipes the card, sending a message to the acquirer bank. The acquirer bank then contacts the issuer bank to determine whether sufficient credit exists in the account. If so, the issuer bank clears the transaction, relays the message to the acquirer bank, which notifies the merchant. On a daily basis, the issuer bank forwards payment to the acquirer bank, which deposits the payment into the merchant's account.


Under Visa and MasterCard network regulations, only an FDIC-regulated financial institution may be an issuer or acquirer bank. (Docket Entry No. 1, ¶ 88). These banks are referred to as “members.” A member may act in both issuer and acquirer roles, issuing credit to consumers and processing payments for merchants. Acquirer banks may outsource some of the processing functions to other companies. ( Id.). The Visa and MasterCard regulations require acquirer banks that enter into contracts with companies to handle processing functions to include the relevant network regulations in those contracts. ( Id., ¶ 27). The regulations, along with FDIC guidance, include security measures to protect the confidentiality of consumers' financial data. ( Id.). The Visa and MasterCard regulations also include procedures for issuer banks to claim damages resulting from a data breach and to resolve disputes relating to such a claim.


Visa's “Account Data Compromise Recovery” process allows Visa to determine the money involved in an event compromising an account, collect from the responsible member, and reimburse members who have incurred losses as a result of the event. (Docket Entry No. 28, Ex. B, ¶ 4. 1.A). A member may invoke this process if the breach occurs after an event “involving non-compliance with the Payment Card Industry Data Security Standard.” ( Id.). The regulations set out conditions that Visa members must meet to be reimbursed and detail the process that Visa and its members must follow after a data breach. The regulations state that “[r]eimbursement and collection amounts as determined by Visa U.S.A. are final and not subject to any appeal or other challenge.” ( Id., ¶ 4.1.H).


The MasterCard regulations provide for similar dispute-resolution procedures in the event of a data breach. ( Id., Ex. C). Paragraph 5.10.4, entitled “Account, Cardholder, and Transaction Data Security,” states that to recover costs from an unauthorized use of data, a member must show that a fraudulent transaction took place before MasterCard alerted an issuer to the data compromise and must show compliance with other procedures. ( Id.). The MasterCard member must show by “clear and convincing evidence” that the damages sought “resulted from” a rule violation. ( Id.).


*3 Heartland Bank and KeyBank contracted with Heartland Payment Systems to process Visa and MasterCard credit-card transactions sent to them by participating merchants. (Docket Entry No. 25, Heartland Bank—Heartland Payment Systems Contract (Ex. A to Docket Entry No. 27); Docket Entry No. 29, KeyBank—Heartland Payment Systems Contract (Ex. A to Docket Entry No. 28)). Heartland Bank's contract with Heartland Payment Systems has an effective date of November 1, 2003; KeyBank's contract has an effective date of September 20, 2006. As required by the Visa and MasterCard regulations, each contract requires adherence to the networks' regulations. (Docket Entry No. 25, ¶ 1.1(f); Docket Entry No. 29, ¶ 1.1(f)). The contracts provide that “[i]n the event of any inconsistency between any provision of this Agreement and the by-laws and regulations of Visa and/or MasterCard, the by-laws and regulations of Visa or MasterCard in each instance shall be afforded precedence and shall apply.” (Docket Entry No. 25, ¶ 1.1(h); Docket Entry No. 29, ¶ 1.1(h)). The contracts contain a confidentiality provision and require each party to indemnify the other's “affiliates.” (Docket Entry No. 25, ¶¶ 4.3, 4.5; Docket Entry No. 29, ¶¶ 4.3, 4.5).


The Financial Institution Plaintiffs contend that Heartland Bank and KeyBank breached their duties under the contracts; breached their fiduciary duties as members of the Visa and MasterCard networks, which they characterize as joint ventures; and acted negligently by failing to ensure that Heartland Payment Systems complied with the Payment Card Industry Data Security Standards. The Financial Institution Plaintiffs also claim that Heartland Bank and KeyBank are vicariously liable for the negligence of Heartland Payment Systems.


KeyBank and Heartland Bank have moved to dismiss. Both defendants argue that the Financial Institution Plaintiffs have failed to state a claim on which relief may be granted, requiring dismissal under Rule 12(b)(6). Heartland Bank has also moved to dismiss under Rule 12(b)(2) for lack of personal jurisdiction. The motions are analyzed below.


II. Heartland Bank's Rule 12(b)(2) Motion

A. Personal Jurisdiction in an MDL Proceeding

Heartland Bank, a Missouri corporation with its principal place of business in Clayton, Missouri, (Docket Entry No. 1, ¶ 21), contends that it is not subject to personal jurisdiction in the Southern District of Texas. The jurisdictional reach of a federal district court is ordinarily limited by the long-arm statutes of the states in which they sit. Fed. R. Civ. P. 4(k)(1)(A); uBid, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 425 (7th Cir.2010). The long-arm statutes are, in turn, limited by federal constitutional limits. McFadin v. Gerber, 587 F.3d 753, 759 (5th Cir.2009). The Supreme Court observed long ago, however, that “Congress could provide for service of process anywhere in the United States.” Miss. Pub. Corp. v. Murphree, 326 U.S. 438, 431 (1946). “One such piece of legislation is 28 U.S.C. § 1407, the multidistrict litigation statute.” In re “Agent Orange” Prod. Liab. Litig., 818 F.2d 145, 163 (2d Cir.1985) (citing Murphree, 326 U.S. at 431). A transferee court's jurisdiction over a defendant depends on whether the transferor court had personal jurisdiction. Id.; accord In re Papst Licensing GMBH & Co. KG Litig., 602 F.Supp.2d 10, 14 (D.D.C.2009); In re Sterling & Foster Co. Secs. Litig., 222 F.Supp.2d 289, 300 (E.D.N.Y.2002).


*4 The personal jurisdiction issue presented here is unusual in an MDL case because this is a directly filed suit rather than one transferred as part of the MDL. The Financial Institution Plaintiffs sued Heartland Bank and KeyBank in this Texas court after the JPML consolidated the Heartland Payment Systems cases here, asserting federal diversity jurisdiction. The parties jointly moved to consolidate this suit with those transferred in by the JPML. “Direct filing into the MDL avoids the expense and delay associated with plaintiffs filing in local federal courts around the country after the creation of an MDL and waiting for the Panel to transfer these ‘tag-along’ actions to this district.” In re Vioxx Prods. Liab. Litig., 478 F.Supp.2d 897, 904 (E.D.La.2007). The JPML's rules expressly provide for joining direct filings with the MDL cases under a court's local rules without transferring through the JPML. J.P.M.L. R. 7.2(a). But direct filings may present jurisdictional, venue, or related issues. Id. at 904 & n. 2; In re Norplant Contraceptive Prods. Liab. Litig., 946 F.Supp. 3, 4 (E.D.Tex.1996) (discouraging parties from direct filing); 15 Charles Alan Wright, Arthur R. Miller & Edward H. Cooper, Federal Practice & Procedure § 3865 (3d ed.2007).FN5


FN5. Courts have expressed concern that selecting the forum by direct filing could present anomalous choice-of-law results. Vioxx, 478 F.Supp.2d at 904; In re Norplant Contraceptive Prods. Liab. Litig., 950 F.Supp. 779, 781 (E.D.Tex.1996) (criticizing the plaintiffs for “pursu[ing] a strategy of forum-shopping by directly filing cases which have absolutely no underlying connection to this district other than the fact that the cases have been consolidated here for pretrial management under § 1407”). There does not appear to be such an effect here, however. Under either the law of Texas, where the Financial Institution Plaintiffs filed this suit, or the law of Missouri, where Heartland Bank has its headquarters, the most significant relationship test from the Restatement (Second) Conflicts of Law applies to both tort and contract actions. See DTEX, LLC v. BBVA Bancomer, S.A., 508 F.3d 785, 802 (5th Cir.2007) (per curiam) (Texas law); Scheerer v. Hardee's Food Sys., Inc., 92 F.3d 702, 708 (8th Cir.1996) (Missouri law). Direct filing may also affect which circuit's law applies when there are conflicting interpretations of federal law. The Fifth Circuit appears to apply the interpretation binding on the transferor court. In In re Ford Motor Co., 591 F.3d 406 (5th Cir.2009), the Fifth Circuit issued a writ of mandamus directing the transferor court not to follow the decisions of the MDL transferee court because those decisions conflicted with Fifth Circuit precedent. The cases had originated in the Fifth Circuit and were transferred to an MDL proceeding in the Southern District of Indiana. Id. at 406 n. 15. The Fifth Circuit criticized the MDL transferee court for ignoring Fifth Circuit precedent in declining to dismiss on forum non conveniens grounds. Id. The Fifth Circuit reasoned that a § 1407 transfer “accomplishes but a change of courtrooms” and that the transferor court's circuit precedent applied. Other courts follow a different approach under § 1407. Id. In In re Korean Airlines Disaster of Sept. 1, 1983, 829 F.2d 1171, 1174 (D.C.Cir.1987), the D.C. Circuit held that MDL transferee courts need not defer the interpretation prevailing in the transferor court's circuit. “Following this decision, the circuit and district courts have uniformly applied the law of the transferee circuit to issues of federal law.” In re Methyl Tertiary Butyl Ether (“ MTBE”) Prods. Liab. Litig., No. 1:00–1898, MDL 1358(SAS), M21–88, 2005 WL 106936, at *4 & n. 37 (S.D.N.Y. Jan. 18, 2005) (citing decisions of the Second, Fourth, Seventh, Eighth, Ninth, and Eleventh Circuits); see also In re Nazi Era Cases Against German Defendants Litig., 153 F. App'x 819, 823 n. 2 (3d Cir.2005) (citing Korean Air Lines, 829 F.2d at 1176); In re Litig. Involving Alleged Loss of Cargo from Tug Atl. Seahorse, “Sea Barge 101” Between P.R. and Fla. in Dec. 1988, 772 F.Supp. 707, 711 (D.P.R.1991).




Alleged defects in personal jurisdiction are not unique to direct-filed cases in the MDL context. See, e.g., ClassicStar Mare Lease, 2008 WL 3077732, at *4 (dismissing a case transferred under § 1407 for lack of personal jurisdiction). In some cases, a defendant facilitates direct filing through a stipulation waiving personal jurisdiction for the pretrial proceedings under § 1407. In the Vioxx litigation, for example, the primary defendant, Merck & Co., Inc., agreed to allow all actions against it to be filed directly in the Eastern District of Louisiana, where the JPML had consolidated the cases under § 1407, subject to the stipulation that the court would transfer the cases under 28 U.S.C. § 1404(a) at the close of pretrial proceedings to a venue satisfying 28 U.S.C. § 1391. Vioxx, 478 F.Supp. at 904.


The parties attempted to reach a stipulation before jointly moving to consolidate this suit with those transferred by the JPML. As late as May 19, 2010, the Financial Institution Plaintiffs offered the following stipulation:


[C]ounsel for the Plaintiffs and Heartland Bank believe that ... the action against Heartland Bank is already included in the MDL 2046 proceedings. As a result, Heartland Bank has agreed to abandon the arguments made in its motion to dismiss with respect to this Court's purported lack of personal jurisdiction over Plaintiff's claims. This withdrawal is without prejudice to [Heartland Bank] arguing that this Court lacks personal jurisdiction over it for any trial proceedings. See 28 U.S.C. § 1407(a) (referring to the transfer of related cases to a single forum for coordinated or consolidated “pretrial proceedings”). In turn, Plaintiffs also reserve the right to argue that this Court has sufficient personal jurisdiction over Heartland Bank to permit it to preside over any subsequent trial proceedings.


*5 (Docket Entry No. 36 at 9–10 (alterations in original)). Heartland Bank refused the stipulation, apparently fearing that it would be insufficient to preserve the objection to personal jurisdiction after pretrial proceedings concluded. Heartland Bank explains:


As an alternative, Heartland Bank proposed that Plaintiffs stipulate that there is no personal jurisdiction over Heartland Bank in the direct action in this Court and the parties would then stipulate, and this Court would order, that the claims against Heartland Bank be treated as having been transferred to the United States District Court for the Eastern District of Missouri, which would have personal jurisdiction over Heartland Bank, and then returned to this Court as a ‘tag along’ action pursuant to MDL procedures, with this Court's clerk notifying the clerk in the Eastern District of Missouri and the clerk of the MDL Panel. Heartland Bank believes that such an approach would preserve its due process rights while at the same time minimizing any delay that would be caused by a circuitous transfer of claims against Heartland Bank.


(Docket Entry No. 39 at 3 n. 1). Unable to reach an agreement, Heartland Bank moved to dismiss under Rule 12(b)(2).


The Financial Institution Plaintiffs argue that Heartland Bank is properly sued in Texas. But even if Heartland Bank is not subject to personal jurisdiction in this court, they argue that the motion to dismiss is “pointless and clearly a delay tactic.” (Docket Entry No. 36 at 10). If this court dismisses for lack of personal jurisdiction, the Financial Institution Plaintiffs plan to refile in a court where Heartland Bank is subject to personal jurisdiction, then file a tag-along motion with the JPML, leading to a transfer to this court. The only result, they argue, would be delay. Heartland Bank maintains that it must be dismissed if it is not subject to personal jurisdiction in Texas.


Each argument is analyzed below.


B. The Legal Standard for Personal Jurisdiction

This court must determine whether it has personal jurisdiction over Heartland Bank before making any decision on the merits. See Sinochem Int ‘l Co. v. Malay. Int'l Shipping Corp., 549 U.S. 422, 430 (2007) (citing Steel Co. v. Citizens for Better Env't, 523 U .S. 83, 93–102 (1998)). A federal court sitting in diversity may exercise personal jurisdiction over a nonresident defendant if the long-arm statute of the forum state confers personal jurisdiction over that defendant and the exercise of such jurisdiction by the forum state is consistent with due process under the United States Constitution. Delgado v. Reef Resort, Ltd., 364 F.3d 642, 644 (5th Cir.2004). The Texas long-arm statute, Tex. Civ. Prac. & Rem.Code § 17.041–.045, confers jurisdiction to the limits of due process. Stroman Realty, Inc. v. Antt, 528 F.3d 382, 385 (5th Cir.2008); Religious Tech. Ctr. v. Liebreich, 339 F.3d 369, 373 (5th Cir.2003). Due process permits the exercise of personal jurisdiction over a nonresident defendant when the defendant has “minimum contacts” with the forum state and the exercise of jurisdiction over the defendant does not offend “traditional notions of fair play and substantial justice.” Johnston v. Multidata Sys. Int'l Corp., 523 F.3d 602, 609 (5th Cir.2008) (quoting Wilson v. Belin, 20 F.3d 644, 647 (5th Cir.1994)).


*6 The “minimum contacts” aspect of the analysis can be established through “contacts that give rise to ‘specific’ personal jurisdiction and those that give rise to ‘general’ personal jurisdiction.” Wilson, 20 F.3d at 647. A court may exercise specific jurisdiction when the nonresident defendant's contacts with the forum state arise from, or are directly related to, the cause of action. Gundle Lining Constr. Corp. v. Adams Cnty. Asphalt, Inc., 85 F.3d 201, 205 (5th Cir.1996) (citing Helicopteros Nacionales de Colom., S.A. v. Hall, 446 U.S. 408, 414 n. 8 (1984)); Religious Tech., 339 F.3d at 375; Quick Techs., Inc. v. Sage Grp. PLC, 313 F.3d 338, 344 (5th Cir.2002). To determine whether specific jurisdiction exists, a court must “examine the relationship among the defendant, the forum, and the litigation to determine whether maintaining the suit offends traditional notions of fair play and substantial justice.” Gundle Lining Constr., 85 F.3d at 205; see also Helicopteros Nacionales, 466 U.S. at 414 n. 8. Even a single contact can support specific jurisdiction if the defendant “purposefully avails itself of the privilege of conducting activities within the forum state, thus invoking the benefits and protections of its laws.” Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475 (1985). “The non-resident's ‘purposeful availment’ must be such that the defendant ‘should reasonably anticipate being haled into court’ in the forum state.” Ruston Gas Turbines, Inc. v. Donaldson Co., Inc., 9 F.3d 415, 419 (5th Cir.1993) (citing World–Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 297 (1980)). Specific jurisdiction requires a sufficient nexus between the nonresident defendant's contacts with the forum and the cause of action. Rittenhouse v. Mabry, 832 F.2d 1380, 1390 (5th Cir.1987). As part of the minimum contacts analysis, a court evaluates any contracts, the parties' “actual course of dealing,” and the parties' “prior negotiations and contemplated future consequences.” Rudzewicz, 471 U.S. at 479.


When the cause of action does not arise from or relate to the foreign defendant's purposeful conduct within the forum state, due process requires that the foreign defendant have engaged in continuous and systematic contacts with the forum state before a court may exercise general personal jurisdiction. Helicopteros Nacionales, 466 U.S. at 414–15; Bearry v. Beech Aircraft Corp., 818 F.2d 370, 374 (5th Cir.1987). The plaintiff must demonstrate contacts of a more extensive quality and nature between the forum state and the defendant than those needed to support specific jurisdiction. Dalton v. R & W Marine, 897 F.2d 1359, 1362 (5th Cir.1990). “To exercise general jurisdiction, the court must determine whether ‘the contacts are sufficiently systematic and continuous to support a reasonable exercise of jurisdiction.’ “ Holt Oil & Gas Corp. v. Harvey, 801 F.2d 773, 777 (5th Cir.1986) (quoting Stuart v. Spademan, 772 F.2d 1185, 1191 (5th Cir.1985) (additional citations omitted)). “The ‘continuous and systematic contacts test is a difficult one to meet, requiring extensive contacts between a defendant and a forum.’ “ Jackson v. Tanfoglio Giuseppe, S.R.L., 615 F.3d 579, 584 (5th Cir.2010) (quoting Johnston, 523 F.3d at 609). General jurisdiction may exist only if a corporate defendant has “a business presence in the forum state.” Id. (citing Access Telecom, Inc. v. MCI Telecomm. Corp., 197 F.3d 694, 717 (5th Cir.1999)) (emphasis in original).


*7 The Financial Institution Plaintiffs have the burden of showing personal jurisdiction over Heartland Bank. See Luv n' care, Ltd. v. Insta–Mix, Inc., 438 F.3d 465, 469 (5th Cir.2006) (citing Wyatt v. Kaplan, 686 F.2d 276, 280 (5th Cir.1982)); Wilson, 20 F.3d at 648. The court must accept as true a party's uncontroverted allegations and resolve any factual conflicts in favor of the party seeking to invoke the court's jurisdiction. Cent. Freight Lines Inc. v. APA Transp. Corp., 322 F.3d 376, 380 (5th Cir.2003); Stripling v. Jordan Prod. Co., LLC, 234 F.3d 863, 869 (5th Cir.2000); Alpine View Co. v. Atlas Copco AB, 205 F.3d 208, 215 (5th Cir.2000). The law, however, does not require the court to credit conclusory allegations, even if uncontroverted. Panda Brandywine Corp. v. Potomac Elec. Power Co., 253 F.3d 865, 869 (5th Cir.2001). When a court rules on a motion to dismiss for lack of personal jurisdiction without holding an evidentiary hearing, the party asserting jurisdiction must present facts sufficient to constitute a prima facie case of personal jurisdiction. See Cent. Freight Lines, 322 F.3d at 380; Brown v. Slenker, 220 F.3d 411, 417 (5th Cir.2000); Alpine View, 205 F.3d at 215. Proof by a preponderance of the evidence is not required. See Luv n' care, 438 F.3d at 469.


C. Analysis

a. Waiver

The Financial Institution Plaintiffs, relying on PaineWebber Inc. v. Chase Manhattan Private Bank (Switzerland), 260 F.3d 453 (5th Cir.2001), argue that Heartland Bank has waived its objection to personal jurisdiction by joining the motion to transfer the case to this court. Personal jurisdiction may be waived. Rudzewicz, 471 U.S. at 473 n. 14; Ins. Corp. of Ir., Ltd. v. Compagnie des Bauxites de Guinee, 456 U.S. 694, 703 (1982) (“Because the requirement of personal jurisdiction represents first of all an individual right, it can, like other such rights, be waived.”); PaineWebber, 260 F.3d at 461 (citing Rudzewicz, 471 U.S. at 473 n. 14). Whether a party has consented to a particular jurisdiction is a question of federal law. Haynsworth v. The Corporation, 121 F.3d 956, 962 (5th Cir.1997). A waiver occurs when a party demonstrates “express or implied consent to the personal jurisdiction to the court.” Rudzewicz, 471 U.S. at 473 n. 14 (quoting Ins. Corp. of Ir., 256 U.S. at 703).


PaineWebber does not support the Financial Institution Plaintiffs' position. In PaineWebber, the court noted that “a motion for transfer is fully consistent with an objection to personal jurisdiction, as a court may transfer a case even though it lacks personal jurisdiction.” 260 F.3d at 460 n. 7. A party may waive objections to personal jurisdiction by filing an action in the forum, asserting counterclaims for affirmative relief, or litigating extensively on the merits before making a jurisdictional objection. Id. at 460. None of those occurred here. Instead, the parties agreed to transfer the case to this court to be joined with the other cases arising out of the Heartland Payment Systems breach. Transferring to the MDL court is consistent with preserving the right to seek dismissal for lack of personal jurisdiction. See, e .g., ClassicStar Mare Lease, 2008 WL 3077732, at *4 (dismissing a case transferred under § 1407 for lack of personal jurisdiction). Heartland Bank timely filed its motion to dismiss under Rule 12(b) (2). There is no waiver.


b. Minimum Contacts

*8 Heartland Bank asserts that it cannot be subjected to personal jurisdiction in Texas. The Financial Institution Plaintiffs contend that Heartland Payment Systems functioned as Heartland Bank's agent by processing transactions in Texas and soliciting merchants to process transactions under the contract. In an affidavit, David P. Minton, Heartland Bank's president and chief executive officer, states that the company's offices are located in Missouri and Colorado with the principal office in Missouri; Heartland Bank has no branches, employees or business operations in Texas and owns no Texas property; neither Heartland Bank nor Heartland Payment Systems is a Texas corporation; the contract between Heartland Bank and Heartland Payment Systems was not negotiated in Texas or subject to Texas law; all services performed by Heartland Bank under the contract are performed in Missouri; and all Heartland Bank's accounts relevant to the contract are maintained in Missouri. (Docket Entry No. 27, Ex. A). The Financial Institution Plaintiffs do not controvert any of these facts. Instead, they argue that Heartland Bank is subject to personal jurisdiction in Texas because the Heartland Payment Systems processing center is located in this State. For support, the Financial Institution Plaintiffs cite their complaint against Heartland Payment Systems, not the complaint in this case. (Docket Entry No. 36 at 13).


The “minimum contacts” analysis focuses on purposeful availment of the forum state. The “fortuitous ‘unilateral activity’ of a third party” in a forum state does not subject a defendant to personal jurisdiction in that state. Johnston, 523 F.3d at 611 (quoting Helicopteros, 466 U.S. at 416–17). When a defendant contracts with a forum plaintiff, if “the forum plaintiff's decision to perform its contractual obligation within its own forum state is totally unilateral, it cannot be viewed as purposeful on the part of the nonresident.” Command–Aire Corp. v. Ontario Mech. Sales & Serv. Inc., 963 F.2d 90, 94 (5th Cir.1992); Dubea v. Simpson, Civ. A. No. 9:07–CV–63–TH JURY, 2009 WL 528258, at *4 n. 1 (E.D.Tex. Mar. 2, 2009). A review of Fifth Circuit decisions analyzing minimum contacts in breach-of-contract cases provides helpful guidance. Although minimum contacts analysis is “claim-specific,” Willow Bend, L.L. C. v. Downtown ABQ Partners, L.L. C., 612 F.3d 390, 393 (5th Cir.2010) (summary calendar), the contract cases are the most relevant, because the Financial Institution Plaintiffs' argument for personal jurisdiction focuses on the contractual relationship between Heartland Bank and Heartland Payment Systems and conduct that allegedly breached the contract. The Fifth Circuit has repeatedly held that merely contracting with a resident of the forum state is insufficient to subject the nonresident defendant to personal jurisdiction in that state. Other insufficient contacts include mailing payments to the forum state, engaging in communications related to the execution and performance of the contract in the forum state, and even sending representatives to the forum state.


*9 In Hydrokinetics, Inc. v. Alaska Mechanical, Inc., 700 F.2d 1026 (5th Cir.1983), the court held that personal jurisdiction was lacking over an Alaska corporation that agreed to purchase goods manufactured in Texas, agreed to pay for the goods in Texas, communicated extensively with the plaintiff before contracting, and sent representatives to Texas twice, once to inspect the manufacturing facilities and once to resolve a dispute relating to the contract. Id. at 1028–29. Although the plaintiff was to perform the contractual obligations in Texas, the defendant's contractual performance in Texas was limited to paying for the goods. Id. The defendant did not regularly engage in business outside Alaska and the agreement to purchase the goods was “initiated by and substantially negotiated with” one of the plaintiff's representatives in Alaska. Id. The court noted that the case involved a single transaction as opposed to a continuing relationship with the forum state. Id. The court also found it significant that the contract provided for the application of Alaska law and that the plaintiff delivered the products to the defendant outside Texas. Id. The facts that the defendant sent payments to Texas and that the parties communicated from their respective locations during contract negotiations did not weigh in favor of exercising jurisdiction in Texas. Id. The court concluded: “considering the totality of the facts of this case, the necessary inference of purposeful availment is not supported.” Id. at 1029–30.


In Stuart, the court determined that a Texas court did not have personal jurisdiction over an individual defendant who entered into a contract with a Texas resident, shipped goods into Texas for modification, sent letters and made telephone calls to the plaintiffs in Texas, received communications from the plaintiffs, agreed to a choice-of-law provision selecting Texas law, and mailed payments to Texas. 772 F.2d at 1192–1194. The court concluded that it was the quality of the forum-state contacts, not the number or timing, that was important to the minimum-contacts analysis. The nonresident defendant's contacts were not of a sufficient quality to show that the defendant purposefully availed itself of the benefits of conducting business in Texas. The choice-of-law provision was insufficient, standing alone or considered with the other contacts, to justify the exercise of personal jurisdiction over the defendant. Id. at 1196. The court concluded that the “provision contemplate [d] a choice of law not forum” and thus did not “evince [plaintiffs'] anticipation of being haled into a Texas court.” Id. at 1195.


In Gundle Lining Construction, 85 F.3d at 205, the court found personal jurisdiction based on the defendant's contract with the forum-state plaintiff, combined with the facts that the defendant mailed payments to the plaintiff in the forum state and engaged in communications with the plaintiff during the negotiation and performance of the contract. The key difference between Stuart and Gundle Lining Construction was a contract provision that allowed the plaintiff to file suit “to recover on the labor and materialman's bond” in any “State in which such labor was performed, services rendered, or materials furnished.” Id. at 206. The court acknowledged that although the provision was neither a choice-of-law nor a choice-of-forum clause, it “resemble[d] the latter.” Id. Because labor under the contract was performed in the forum state, the exercise of personal jurisdiction over the nonresident defendant was not unreasonable. Id.


*10 A few years after Gundle Lining Construction, the court found that, despite a choice-of-law provision in the parties' contract selecting the law of India, a Texas court could exercise personal jurisdiction over the Indian defendant who, as a result of “extensive negotiations,” entered into a contract with the plaintiff in Texas. Electrosource, Inc. v. Horizon Battery Techs., Ltd., 176 F.3d 870, 872 (5th Cir.1999). The defendant in Electrosource solicited the plaintiff's business in Texas, contemplated an ongoing relationship with the Texas plaintiff, corresponded extensively with the plaintiff in Texas, sent at least six different representatives to Texas on six separate visits related to the contract, and made contract payments to the plaintiff in Texas. Id. at 872. The plaintiff contracted to train the defendant's employees in Texas, to provide design assistance and advice to the defendant in Texas, and to monitor the defendant's product uniformity and quality control at least partially from Texas. Id. at 872–73. The court noted that the “actual course of dealing ... involved wide reaching contacts and contemplated future consequences with the forum state.” Id. The court summarized the defendant's significant contacts with the forum state:


[The defendant] sought out [the plaintiff] for a particular technology that had been developed in [the forum state], negotiated for its acquisition in [the forum state], entered into an agreement for the transfer of technology in [the forum state], and began the process of training, designing, and preparation in [the forum state] necessary to the transfer of technology.”


Id. at 873–74. The court distinguished Hydrokinetics, Inc. on the basis of the greater quantity and quality of the nonresident's contacts with the forum state. See id. at 873.


Similarly, in Central Freight Lines Inc. v. APA Transport Corp., 322 F.3d 376 (5th Cir.2003), the long-term nature of the agreement was important to the court's personal jurisdiction analysis. In that case, the nonresident defendant sent two representatives to the forum state for a preliminary meeting that ultimately led to negotiations and a long-term agreement under which the parties would use each other's services. Id. at 379, 382. The parties negotiated the contract via telephone and written communications. Id. at 382. The court found that because the contract contemplated a long-term relationship, the defendant's contacts with the forum state could not be “characterized as random, fortuitous, or attenuated.” Id. at 383 (internal quotation marks omitted). Rather, the court concluded that the nonresident defendant purposefully affiliated itself with a company based primarily in the forum state and with its customers primarily from the forum state. Id. at 382. Even though the nonresident defendant, a freight delivery company, did not pick up or deliver freight in the forum state, it “took purposeful and affirmative action by entering into the [agreement], providing [the plaintiff] with pricing and shipping information, and agreeing to accept shipments” from the forum state “that had the clearly foreseeable effect of causing business activity in the forum state.” Id. (internal quotation marks omitted).


*11 In Big Easy Energy, LLC v. Conglomerate Gas, Civ. A. No. 09–3231, 2010 WL 1038225 (E.D.La. Mar. 17, 2010), an energy company hired a New Orleans—based corporation, Big Easy Energy, to help it locate and purchase oil and gas properties in Texas. Big Easy conducted its search from its New Orleans office and held a meeting with an out-of-state employee of a company with some holdings in Texas in the office. Id. at *4. In declining to give weight to those contacts, the court noted that “[a]lthough Defendants could have reasonably anticipated that Plaintiff, as a Louisiana entity, would perform its obligations under the contract in Louisiana, Plaintiff has not alleged that the contract contemplated performance within Louisiana. Thus, Plaintiff's performance was not a purposeful contact by Defendants, and its weight in the personal jurisdiction calculation is necessarily diminished.” Id. (quotation and alteration omitted); see also St. Martin & Mahoney, A.P.L. C. v. Diversified Aircraft Holdings, Ltd., 934 F.Supp. 200, 205 (E.D.La.1996) (attributing no weight to the plaintiff's decision to sign a bill of sale in the forum).


In Southwest Offset, Inc. v. Hudco Publishing Co., Inc., the Texas court found personal jurisdiction over an Alabama publisher sued for breach of contract by a Texas printer. 622 F.2d 149, 152 (5th Cir.1980). The plaintiff's sales representative had solicited the defendant in Alabama to have the plaintiff print its telephone directories. After the initial order, the defendant placed eight orders in writing or over the phone with the plaintiff in Texas. The defendant sent some payments to the plaintiff's office in Texas. No one associated with the defendant ever visited Texas. Printing the directories involved the efforts of both parties: the defendant in Alabama prepared camera-ready copy, which it sent to the plaintiff in Texas; the plaintiff then prepared proofs, which were sent back to Alabama for the defendant's approval; the defendant returned the corrected proofs to the plaintiff in Texas; the plaintiff printed the phone books and sent them to defendant F.O.B. Dallas. Id. at 150. The court noted that Texas was “probably the place of most of the contracts, since all except the first of [the defendant's] offers to print were accepted by [plaintiff] in Texas.” Id. at 152. The court emphasized that the Alabama defendant was “no mere passive customer” of the Texas plaintiff because the defendant was actively engaged in the preparation of each separate order and sending the copies to Texas was a “necessary part of [its] contract performance.” Id. The nature of the orders for printing showed that the defendant's contacts with Texas were not “single and fortuitous,” but rather repetitive and sustained. Id.


Similarly, in Duke Energy International, L.L.C. v. Napoli, –––F.Supp.2d ––––, 2010 WL 3749298 (S.D.Tex. Sept. 21, 2010),FN6 the court focused on the defendants' long-term relationship with the forum. In that case, an energy company sued nonforum for inducing its employees to breach their fiduciary duties by purchasing a power plant and selling it to the energy company at an inflated price. Id. at *1. The company created to purchase the power plant, Artale, had its principal place of business in Houston. Id. at *15. The court distinguished Stuart, noting that the defendants “ongoing relationships” with Artale and that the defendants specifically targeted the plaintiff, a Houston-based company, as the buyer for the plant. The defendants specifically targeted the energy company's Houston insiders to usurp the corporate opportunity and resell the plant to the energy company. Id.


FN6. Like this case, Duke Energy was not a breach of contract case, but the claims centered on contractual relationships.




*12 The Fifth Circuit reached the opposite conclusion in Moncrief Oil International Inc. v. OAO Gazprom, 481 F.3d 309 (5th Cir.2007). The court distinguished cases finding personal jurisdiction when a defendant contracted with “a plaintiff that only existed within the forum state, and [the] defendant actively engaged in the various activities taking place therein.” Id. at 313. In Moncrief, by contrast, the plaintiff was headquartered in Texas but had locations internationally, and the defendant was not actively engaged in any of the plaintiff's activities in Texas. The plaintiff, a Texas corporation, filed suit in Texas against several Russia—based defendants for breach of contract. The contract was negotiated and executed in Russia and provided for arbitration in Russia, under Russian law. The plaintiff argued that the Russian defendants had established minimum contacts with Texas by: contracting with the plaintiff with knowledge that the plaintiff was a Texas resident; acknowledging and approving of the plaintiff's substantial contract performance in Texas; and sending an executive to visit Texas in furtherance of that performance. The plaintiff cited Central Freight Lines to argue that personal jurisdiction existed over the Russian defendants because it was reasonably foreseeable to them that the Texas plaintiff would perform a material part of the contractual obligations in Texas and thereby cause business activity in Texas. The court rejected the plaintiff's argument. Id. In addition to the facts that the plaintiff had locations internationally, and the defendants were not actively engaged in any of the plaintiff's activities in Texas, “[t]he contract was silent as to location” and there was “no indication that the location of the performance mattered” or that the defendants had contracted with the plaintiff because of its Texas headquarters. Id.


Heartland Payment Systems is not a Texas company and does not exist “only within the forum state.” Heartland Payment Systems is headquartered in New Jersey. The present case did involve long-term contract performance. But, as in Moncrief, there is no basis to conclude that Heartland Bank engaged in a purposeful or affirmative act that would subject it to jurisdiction in Texas. Unlike the cases finding personal jurisdiction, there is no evidence that Heartland Bank was actively engaged in the plaintiff's contractual performance in the forum state.


The contract with Heartland Payment Systems illustrates Heartland Bank's indifference toward Texas. The contract contemplates two categories of services: payment processing and customer solicitation. The contract does not state where the payment processing will take place. Nor is there any indication in the contract that Heartland Bank has any right to take an active role in payment processing. The contract sets out rules, primarily by subjecting Heartland Payment Systems to the Visa and MasterCard regulations, but there is no right to direct compliance. ( See Docket Entry No. 25, ¶¶ 1.1(e)—(f), 1.1(h)). The contract permits Heartland Bank or a designee to “conduct an inspection or audit of HPS records and materials relative to its Program and HPS' accounting or auditing procedures regarding its program. “If [Heartland] Bank ... reasonably concludes that it is exposed to undue financial risk or exposure based on the internal controls and security procedures of HPS,” Heartland Bank's only recourse is to provide written notice of its dissatisfaction. ( Id., ¶ 4.6). That notice must be provided to the New Jersey headquarters, not to the processing center. ( Id., ¶ 4.8). Heartland Payment Systems then must remedy the problem. ( Id., ¶ 4.6). If they cannot agree on an appropriate remedy, termination, not intervention, is the result. ( Id.).


*13 By contrast, the contract contemplates active involvement with the sales operations based out of the New Jersey Heartland Payment Systems headquarters. Heartland Payment Systems represented in the contract that it maintained a sales office in Princeton and had sales representatives throughout the United States, but there was no representation regarding the Texas processing center. ( Id., ¶ 1.1(g)). Heartland Bank is entitled to “written notice of any sales locations or any changes in the location of the current sales office,” but no information on the processing center. Heartland Bank has the right to reject any merchant applicant, at which point Heartland Payment Systems must “promptly terminate” the merchant. ( Id., ¶¶ 1.2(c)—(d), 1.3). The paragraph requiring Heartland Payment Systems to pay any taxes Heartland Bank incurred under the contract specifically mentions New Jersey and Missouri, but not Texas. ( Id., ¶ 4. 10). Missouri law governs the contract. ( Id., ¶ 4.11). The Texas aspect of the Heartland Payment Systems—Heartland Bank relationship does not support specific jurisdiction in Texas.


The Financial Institution Plaintiffs also argue that Heartland Bank is subject to jurisdiction in Texas because of its participation in the Visa and MasterCard networks. The Fifth Circuit rejected a similar argument in Choice Healthcare, Inc. v. Kaiser Foundation Health Plan of Colorado, 615 F.3d 364 (5th Cir.2010). In that case a Louisiana healthcare provider sued a Colorado insurer. The provider contended that the insurer was subject to specific jurisdiction in Louisiana based on the insurer's membership in a national network, one of whose benefits was discounted care in the forum. The Fifth Circuit concluded, based on a prior unpublished opinion, the membership in the network was purposeful availment of the network, not of Louisiana. Id. at 371. The district court in the previous case had reasoned that the contract was not with any forum entity, but with the national organization. Id. (citing St. Luke's Episcopal Hosp. v. La. Health Serv. & Indem. Co., Civ. A. No.2009 WL 47125, at *9 (S.D.Tex. Jan. 6, 2009)).


The Choice Healthcare court relied in part on a case similar to this case, Resolution Trust Corp. v. First of America Bank, 796 F.Supp. 1333 (C.D.Cal.1992). The defendant was a Michigan bank with no California contacts, but it participated in a nationwide fund clearinghouse system that facilitated wire transfers for the bank's customers in states where the bank had no presence. Id. at 1334. The plaintiff, a California member of the system, wired money to the Michigan bank. When it discovered it had transferred too much money, the California bank attempted to debit the Michigan bank account. The Michigan bank refused. The California bank contended that the Michigan bank's membership in the association subjected it to personal jurisdiction in California. Id. at 1337. The court disagreed. “[T]he defendant Michigan bank did not contract with any California entity. Both banks simply belong to a clearinghouse service. This does not establish a California contract, a contract between the parties, a substantial connection to California purposeful availment of California.” Id. Memberships in the Visa and MasterCard networks does not subject Heartland Bank to personal jurisdiction in Texas.


*14 Nor is there a basis for finding general jurisdiction over Heartland Bank. As noted, the general jurisdiction standard is a “difficult one to meet, requiring extensive contacts between a defendant and a forum.” Jackson, 615 F.3d at 584 (quoting Johnston, 523 F.3d at 609). The Financial Institution Plaintiffs have not showed that Heartland Bank has “a business presence in” Texas. Jackson, 615 F.3d at 579 (emphasis in original); see also Wiedman v. Citywide Banks, No. 08–3548, 2009 WL 117873, at *1 (E.D.Pa. Jan. 15, 2009) (rejecting the argument that a Colorado bank offering “national ... merchant credit card services” was subject to general jurisdiction in Pennsylvania when the record contained no evidence that the services brought the bank into contact with Pennsylvania). Heartland Bank's offices are located in Missouri and Colorado only. It has no business presence in Texas.


Unlike cases transferred under § 1407, which requires such cases to be remanded to the transferee court, see In re W. States Wholesale Natural Gas Antitrust Litig., MDL No. 1566, 2010 WL 2539728, at *6 (D. Nev. June 4, 2010) (citing Lexecon Inc. v. Milberg Weiss Bershad Hynes & Lerach, 523 U.S. 26, 28 (1998)), this case may be transferred to cure the jurisdictional defect, see Sinochem, 549 U.S. at 430 (citing Goldlawr, Inc. v. Heiman, 369 U.S. 463, 466 (1962)). A court has discretion to transfer even if no party requests it. Horton v. Cockrell, 71 F .3d 877, 1995 WL 725375, at *4 (5th Cir.1995) (per curiam) (unpublished) (citing Mills v. Beech Aircraft Corp., 886 F.2d 758, 761 (5th Cir.1989); 14D WRIGHT, MILLER & COOPER § 3827 (“If venue is proper for some defendants but improper for others, the district court has wide discretion,” including to sever the case and “transfer the severed portion of the case for those defendants for whom venue is improper.”). Transfer is consistent with the efficiency concerns raised by the Financial Institution Plaintiffs. The topics addressed at the status conference set for April 18 will include whether and where to transfer the case against Heartland Bank. See Self v. M & M Chem. Co., 177 F.3d 977, 1999 WL 199576, at *4 (5th Cir. Mar. 17, 1999) (per curiam) (unpublished) (recommending supplemental briefing to determine an appropriate transfer venue).


III. KeyBank's Motion to Dismiss under Rule 12(b)(6)

A. Rule 12(b)(6)

A complaint may be dismissed under Rule 12(b)(6) for “failure to state a claim upon which relief can be granted.” Fed. R. Civ. P. 12(b)(6). In Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007), and Ashcroft v. Iqbal, ––– U.S. ––––, 129 S.Ct. 1937 (2009), the Supreme Court confirmed that Rule 12(b)(6) must be read in conjunction with Rule 8(a), which requires “a short and plain statement of the claim showing that the pleader is entitled to relief.” To withstand a Rule 12(b)(6) motion, a complaint must contain “enough facts to state a claim to relief that is plausible on its face.” Twombly, 550 U.S. at 570; see also Elsensohn v. St. Tammany Parish Sheriff's Office, 530 F.3d 368, 372 (5th Cir.2008) (quoting Twombly, 550 U.S. at 570). The Court explained that “the pleading standard Rule 8 announces does not require ‘detailed factual allegations,’ but it demands more than an unadorned, the-defendant-unlawfully-harmed-me accusation.” Iqbal, 129 S.Ct. at 1949 (citing Twombly, 550 U.S. at 555).


*15 A court generally cannot consider documents that are not attached to the pleadings when ruling on a motion to dismiss. A court can consider documents supplied by the defendant in a motion to dismiss “if they are referred to in the plaintiff's complaint and are central to her claim.” Collins v. Morgan Stanley Dean Witter, 224 F.3d 496, 499 (5th Cir.2000) (quoting Venture Assocs. Corp. v. Zenith Data Sys. Corp., 987 F.2d 429, 431 (7th Cir.1993); see also Branch v. Tunnell, 14 F.3d 449, 453–54 (9th Cir.1994); Field v. Trump, 850 F.2d 938, 949 (2d Cir.1988); Sheppard v. Tex. Dep't of Transp., 158 F.R.D. 592, 595 (E.D.Tex.1994). These documents “merely assist[ ] the plaintiff in establishing the basis of the suit, and the court in making the elementary determination of whether a claim has been stated.” Id.


In addition to the complaint, this Memorandum and Order relies on three documents: KeyBank's November 1, 2003 contract with Heartland Payment Systems, (Docket Entry No. 29), and the Visa and MasterCard regulations, (Docket Entry No. 27, Exs. B, C (excerpts)). The Financial Institution Plaintiffs' contract claim is based on KeyBank's contract with Heartland Payment Systems. The complaint alleges that the Financial Institution Plaintiffs are “intended third-party beneficiaries of contracts entered into between Defendants and various entities,” including “the MPA's between Defendants and Heartland [Payment Systems].” (Docket Entry No. 1, ¶ 118). The complaint repeatedly refers to the Visa and MasterCard regulations. ( See, e.g., id., ¶¶ 42, 42–54). The regulations are the foundation of the Financial Institution Plaintiffs' claim for breach of fiduciary duty, ( id., ¶ 124 (“By virtue of their membership in the Visa and MasterCard Associations, the operating rules and regulations of such Associations and the applicable law and regulations, Defendants ... and Plaintiffs ... were (and continue to be) in confidential, special, and fiduciary relationships with each other ....”)). These documents are properly considered in ruling on the motion to dismiss.


When a plaintiff's complaint fails to state a claim, the court should generally give the plaintiff at least one chance to amend the complaint under Rule 15(a) before dismissing the action with prejudice. See Great Plains Trust Co. v. Morgan Stanley Dean Witter & Co., 313 F.3d 305, 329 (5th Cir.2002) (“[D]istrict courts often afford plaintiffs at least one opportunity to cure pleading deficiencies before dismissing a case, unless it is clear that the defects are incurable or the plaintiffs advise the court that they are unwilling or unable to amend in a manner that will avoid dismissal.”); see also United States ex rel. Adrian v. Regents of the Univ. of Cal., 363 F.3d 398, 403 (5th Cir.2004) (“Leave to amend should be freely given, and outright refusal to grant leave to amend without a justification ... is considered an abuse of discretion.” (internal citation omitted)). However, a plaintiff should be denied leave to amend a complaint if the court determines that a “proposed amendment ... clearly is frivolous [and] advanc[es] a claim or defense that is legally insufficient on its face.” 6 Charles Alan Wright, Arthur R. Miller & Mary Kay Kane, Federal Practice & Procedure § 1487 (3d ed.2007); see also Ayers v. Johnson, 247 F. App'x 534, 535 (5th Cir.2007) (unpublished) (per curiam) (“ ‘[A] district court acts within its discretion when dismissing a motion to amend that is frivolous or futile.’ “ (quoting Martin's Herend Imports, Inc. v. Diamond & Gem Trading U.S. of Am. Co., 195 F.3d 765, 771 (5th Cir.1999))).


B. The Breach of Contract Claim

*16 The Financial Institution Plaintiffs allege that the criminal intrusion into the Heartland Payment Systems database resulted from KeyBank's breach of its November 1, 2003 contract with Heartland Payment Systems. The Financial Institution Plaintiffs contend that they are third-party beneficiaries of the contract. They point out that the contract has no provision precluding third-party suits and argue that the context shows that they were intended beneficiaries of the contract.


The parties agree that Ohio law applies to KeyBank's contract. Ohio follows the test for third-party beneficiaries set out in the Restatement (Second) of Contracts. See TRINOVA Corp. v. Pilkington Bros., P.L.C., 638 N.E.2d 572, 576–77 (Ohio 1994); Hill v. Sonitrol of Sw. Ohio, Inc., 521 N.E.2d 780, 784 (Ohio 1988). Under section 302(1)(b), “[u]nless otherwise agreed between promisor and promisee, a beneficiary, a beneficiary of a promise is an intended beneficiary if recognition of a right to performance in the beneficiary is appropriate to effectuate the intention of the parties and ... the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance.” As the First Circuit has observed in the context of an appeal from a Rule 12(b)(6) dismissal, the Restatement standard is “relatively hospitable to claims by those purporting to be third-party beneficiaries.' “ In re TJX Cos. Retail Sec. Breach Litig., 564 F.3d 489, 499 (1st Cir.2009).


Some Ohio courts have suggested that only the contract language is relevant to determining whether a party is an intended third-party beneficiary. See In re Nat'l Century Fin. Enters., Inc., No. 08–4216, 2010 WL 1976639, at *7 (6th Cir. May 18, 2010) (“Ohio courts look to the language of the contract to determine if a party is a direct or incidental beneficiary.”); Joest Vibratech, Inc. v. N. Star Steel Co., 109 F.Supp.2d 746, 749 (N.D.Ohio 2000) (“In order to be an intended beneficiary, the ‘clear terms of the contract’ must show that the parties entered the contract for the benefit of the third party.” (quoting Hill, 521 N.E.2d at 783)). This view appears overly restrictive. Under section 302(1)(b), “[u]nless otherwise agreed between promisor and promisee, a beneficiary, a beneficiary of a promise is an intended beneficiary if recognition of a right to performance in the beneficiary is appropriate to effectuate the intention of the parties and ... the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance.” The Reporter's Notes explain that a “court in determining the parties' intention should consider the circumstances surrounding the transaction as well as the actual language of the contract.” Restatement (Second) of Contracts § 302, Reporter's Notes, cmt. a; see also Melvin A. Eisenberg, Third–Party Beneficiaries, 92 Colum. L.Rev. 1358, 1389–90 (1992) (noting that the Restatement (Second) of Contracts rejects formal limits on the evidence relevant to determining intent).


*17 The Ohio Supreme Court has explicitly recognized that the “circumstances surrounding the promise” are relevant to determining whether a third party was an intended beneficiary of a contact. Anderson v. Olmsted Util. Equip., Inc., 573 N.E.2d 626, 130 n. 1 (Ohio 1988). In Anderson, the plaintiffs were two city employees injured when the arm of a “cherry picker” truck broke. The court had to determine whether the employees were third-party beneficiaries of the city's contract to repair the equipment. The court looked to the contract terms and to extrinsic evidence of the city's intent. The court first observed that the contract recited the city's intent to have the “equipment rebuilt to 100% Holan specifications and safety.” Id. at 631. The court also relied on testimony. The court noted that “when questioned at trial concerning the inspection and rebuilding of the aerial device, Charles Burgess, the superintendent of the city's light department, testified that the purpose of rebuilding the aerial device was for safety of linemen who were to use the truck.” Id. at 631–32. The court found that the plaintiff was a third-party beneficiary of the repair contract. The Ohio Supreme Court has not overruled Anderson.


Courts interpreting the Restatement have enforced explicit statements in a contract that no third-party rights are created. See, e.g., Maghie & Savage, Inc. v. P.J. Dick Inc., No. 08APP–487, 2009 WL 1263965, at *11 (Ohio App. May 5, 2009) (citing cases). Courts have followed this approach in litigation related to data breaches similar to the events giving rise to this suit. TJX Cos., 564 F.3d at 499; Pa. State Employees Credit Union v. Fifth Third Bank, 398 F.Supp.2d 317, 324 (M.D.Pa.2005); Cumis Ins. Co. v. BJ's Wholesale Club, Inc., 918 N.E.2d 36, 466–69 (Mass.2009). In those cases, the contracts explicitly addressed third-party rights. Language included in the contracts stated that they were “for the benefit of, and may be enforced by, [the parties] and their respective successors and permitted transferees and assignees, and [ ] not for the benefit of, and may not be enforced by, any third party.” Cumis, 918 N.E.2d at 43–44. KeyBank's contract contains no similar language limiting or precluding third-party rights.


KeyBank argues that the Financial Institution Plaintiffs cannot sue on their contract with Heartland Payment Systems because that contract incorporates the Visa and MasterCard regulations disclaiming third-party rights. The contract requires Heartland Payment Systems to “comply fully with all by-laws and regulations of Visa and MasterCard.” (Docket Entry No. 29, ¶ 1.1(f)). To the extent that the regulations and the contract conflict, the regulations control. ( Id., ¶ 1.1(h)).


The Visa regulations provide in relevant part as follows:


The Visa U.S.A. Inc. Operating Regulations apply only to financial institutions conducting Card issuing and Merchant acquiring activities within the U.S.A. Region as Members of Visa U.S .A. Inc., and their Agents. As such, the Operating Regulations govern the relationship between Visa U.S.A. Inc. and its Members and their Agents. The Operating Regulations do not constitute a third-party beneficiary contract as to any entity or person, nor do they constitute a contract, promise or representation, or confer any rights, privileges, or claims of any kind to any third parties.


*18 (Docket Entry No. 28, Ex. B, ¶ 1.2C). The MasterCard regulations state that MasterCard “has the sole right in its discretion to interpret and enforce the Standards.” ( Id., Ex. C, ¶ 3. 1). The quoted provision of the Visa regulations expressly forbids third-party suits. The MasterCard regulations forbid third party suits because MasterCard has the “sole” right to enforce the regulations. Courts in other data breach litigation have reached the same result. TJX Cos., 564 F.3d at 499; In re TJX Cos. Retail Sec. Breach Litig., 524 F.Supp.2d 83 (D.Mass.2007), aff'd 546 F.3d 489 (1st Cir.2009); PSECU, 398 F.Supp.2d at 323–26. By incorporating the regulations into its contract with Heartland Payment Systems and making the regulations control to the extent that they conflict with any other provision of the contract, KeyBank made clear that no third party could assert third-party beneficiary status under the regulations and no third party could sue based on noncompliance with the regulations. The Visa and MasterCard regulations that limit third-party beneficiary status or third-party suits to enforce the regulations do not preclude a third party from invoking other duties in the KeyBank contract with Heartland Payment Systems. The contract, however, does not provide the duties that the Financial Institution Plaintiffs allege that KeyBank breached.


The contractual duties that the Financial Institution Plaintiffs invoke are the duties “expressly and/or require[d]” to “monitor, audit, oversee and confirm” the adequacy of Heartland Payment Systems security measures. (Docket Entry No. 1, ¶ 119). The Financial Institution Plaintiffs rely on the confidentiality provision and the references to affiliates. The confidentiality provision states:


4.3 Confidentiality

(a) KeyBank will safeguard, and hold confidential from disclosure to unauthorized persons, all data relating to the Plan submitted to KeyBank pursuant to this Agreement to the same extent that KeyBank safeguards data relating to its own business, unless such data is otherwise available to the public or is already in KeyBank possession and was rightfully obtained by it from others, or unless required by law or regulation, or by Visa or MasterCard. In such case, KeyBank will bear no responsibility for disclosures thereof or with respect thereto, whether inadvertent or otherwise. Nothing contained herein will preclude KeyBank participation in Visa and/or MasterCard fraud and/or counterfeit deterrent procedures.

(b) HPS will safeguard, and hold confidential from disclosure to unauthorized persons, all data relating to KeyBank business received by HPS pursuant to this Agreement to the same extent that HPS safeguards data relating to its own business, unless such data is otherwise available to the public or is already in HPS possession and was rightfully obtained by it from others, or unless required by law or regulation.


(Docket Entry No. 29, Ex. 29, ¶ 4.3). The contract casts the confidentiality promises as mutual promises between KeyBank and Heartland Payment Systems. KeyBank is required to protect data it receives under the contract “to the same extent that KeyBank safeguards data relating to its own business.” Even if the complaint alleged that KeyBank ordinarily monitors contractors' privacy practices to a greater extent than it monitored such practices at Heartland Payment Systems, the complaint contains no allegation that KeyBank had received the credit card information allegedly breached. The complaint alleges that KeyBank hired Heartland Payment Systems to solicit merchants and to process transactions. The complaint does not allege that the credit card data that was improperly accessed had come into KeyBank's possession.

*19 The Financial Institution Plaintiffs point to the requirement that KeyBank indemnify the Heartland Payment Systems “affiliates.” The contract requires KeyBank to “indemnify, protect and hold harmless HPS and its ... affiliates.” ( Id., ¶ 4.3). “The words used in a contract are to be given their plain and ordinary meaning.” Ohio Gov't Risk Mgmt. Plan v. Harrison, 874 N.E.2d 1155, 1161 (Ohio 2007) (citing Gomolka v. State Auto. Mut. Ins. Co., 436 N.E.2d 21347, 1351 (1980)). The ordinary meaning of the term “affiliate” in this context is a “corporation that is related to another corporation by shareholdings or other means of control” or “a subsidiary, parent, or sibling corporation.” See Black's Law Dictionary 63 (8th ed.2004). The only alleged relationship the Financial Institution Plaintiffs have to Heartland Payment Systems is through the Visa and MasterCard networks. The complaint alleges no facts suggesting that an affiliate relationship between Heartland Payment Systems and the Financial Institution Plaintiffs.


The Financial Institution Plaintiffs' breach of contract claim is dismissed. Because no prior amendment has been filed, and because there is no basis to find futility as a matter of law, it is appropriate to grant leave to amend.


D. The Breach of Fiduciary Duty Claim

The Financial Institution Plaintiffs allege that KeyBank breached its fiduciary duties. The Plaintiffs argue that the Visa and MasterCard networks are joint ventures whose members owe fiduciary duties to each other. The parties agree that whether the Visa network is a joint venture must be evaluated under New York law. The parties dispute whether New York or New Jersey law applies to the MasterCard network. But under either state's law, the allegations that the networks are joint ventures that created fiduciary duties on KeyBank are insufficient.


Under New York law, a joint venture exists when:


(1) two or more persons enter into an agreement for profit; (2) the parties intend to be associated as joint venturers; (3) each of the venturers contributes something of value to the venture, such as property, skill, knowledge or effort; (4) each co-venturer has some degree of control over the venture; and (5) the co-venturers agree to some division of profit and loss allocation.


Cosy Goose Hellas v. CosyGoose USA, Ltd., 581 F.Supp.2d 606, 620 (S.D.N.Y.2008); see also Dinaco Inc. v. Time Warner, Inc., 346 F.3d 64, 67–68 (2d Cir.2003); Itel Containers Int'l Corp. v. Atlanttrafik Express Serv. Ltd., 909 F.2d 698, 701 (2d Cir.1989). “The absence of any one element is ‘fatal to the establishment of a joint venture.’ “ Kidz Cloz, Inc. v. Officially for Kids, Inc,, 320 F.Supp.2d 164, 171 (S.D.N.Y.2004) (quoting Zeising v. Kelly, 152 F.Supp.2d 335, 347–48 (S.D.N.Y.2001)).


Both sides have cited antitrust cases considering whether Visa network members are joint venturers. For the purpose of antitrust law, “[j]oint ventures and other cooperative agreements are ... not usually unlawful, at least not as price-fixing schemes, where the agreement on price is necessary to market the product at all.” Broad. Music, Inc. v. Columbia Broad. Sys., Inc., 441 U.S. 1, 23 (1979). But a relationship of cooperation that is “not technically a ‘joint venture’ “ may satisfy this rule. See Nat'l Bancard Corp. v. VISA U.S.A., Inc., 779 F.2d 592, 601 (11th Cir.1996). For example, the National Bancard court observed that members of the Visa network “neither share profits and losses nor commingle management functions” and that “[e]ach member ... competes actively against other members in a variety of ways.” Id. at 601 n. 16 (citing Nat'l Bancard Corp. v. VISA U.S.A., Inc., 596 F.Supp. 1231, 1253 (S.D.Fla.1986)). The court in Visa U.S.A., Inc. v. First Data Corp., No. C 02–01786 JSW, 2006 WL 516662 (N.D.Cal. Mar. 2, 2006), concluded that the Visa network was not a joint venture even for the purpose of an antitrust single-entity analysis. The court noted that although the members owed duties to the Visa organization, they had no fiduciary duties to each other. Id. at *3. The court also pointed out that there was no network-wide sharing of profits and losses because the “profits and losses ... do not end up under the same corporate mattress.” Id. at *4. And like the National Bancard court, the First Data court observed that members of the Visa network competed with each other. Id. at *4 n. 2 (citing cases reaching the same conclusion).


*20 The Financial Institution Plaintiffs do not distinguish these cases. Under these cases, the complaint does not allege a joint venture with corresponding fiduciary obligations. There is no allegation that Visa or MasterCard members share profits or losses; “co-venturers [must] agree, either expressly or impliedly, to share liability for the possible obligations, debts, and losses of the joint venture itself.” Cosy Goose Hellas, 581 F.Supp.2d at 622; Kidz Cloz, 320 F.Supp.2d at 171–72, 175 (summarizing case law and holding that the absence of a discussion of sharing losses resulted in the absence of an “indispensable” element of a joint venture); Weinreich v. Sandhaus, No. 83 CIV. 3966(CES), 1989 WL 130641 at *4 (S.D.N.Y. July 24, 1989) (“the sharing of liability for the actions of one another in the conduct of a partnership or joint venture goes to the core of the fiduciary obligations established by such a relationship.”).


The Financial Institution Plaintiffs rely on the following allegation in their complaint:


In a Visa or MasterCard Payment Card purchase, the merchant actually receives approximately 98% of the price of the good or service sold. The remaining 2%, known as a “merchant discount,” is the fee paid to the merchant's Acquirer bank for providing the Payment Card processing services. The Acquirer, in turn, splits the fee with the Payment Card issuer which receives approximately 1.4% of the purchase price. The Issuer receives the majority of the fee because it owns the consumer's account and assumes the risk of nonpayment. The 1.4% of the fee paid to the Issuer is called the “interchange fee.”


(Docket Entry No. 1, ¶ 34). Even if this allegation is broadly read to include a sharing of profits, it cannot be read to include a sharing of losses. Indeed, the complaint goes on to suggest that the members of the Visa and MasterCard networks bear no risk of shared loss. “The Visa and MasterCard Associations are supported primarily by service and transaction fees paid by their members (such as Plaintiffs and Defendants). Visa and MasterCard set their fees to cover the costs involved in providing the basic infrastructure to the members, but do not charge license fees or royalties to their members.” ( Id., ¶ 35). The complaint specifies that it is the issuers who bear the risk of cardholders' nonpayment and the acquirer banks who bear the risk of charge-backs. ( Id., ¶¶ 34, 42).


The Financial Institution Plaintiffs contend that New Jersey law is more lenient, requiring only profit sharing for a joint venture to exist. The defendants argue that New Jersey law does not apply. Even if New Jersey law applies, however, the complaint's allegations are insufficient. Numerous courts interpreting New Jersey law have required sharing losses as well as profits. Kocher v. UC Overlook Dev., LLC, No. L–1828–07, 2010 WL 1655906, at *9 (N.J.Super.Ct.App.Div. Apr. 22, 2010); Ginsberg v. Bistricer, No. C–113–98, 2007 WL 987169, at *11 (N.J.Super.App.Div. Apr. 4, 2007); Am. Fire & Cas. Ins. Co. v. Manzo, 788 A.2d 925, 929 (N.J.Super.App.Div.2002); Fliegel v. Sheeran, 640 A.2d 852, 854 (N.J.Super.App.Div.1994); Kozlowski v. Kozlowski, 395 A.2d 913, 917 (N.J.Super.Ct. Ch. Div.1978); Wittner v. Metzger, 178 A.2d 671, 675 (N.J.Super.App.Div.1962). In Grober v. Kahn, the New Jersey Supreme Court found that an agreement to hold property jointly was not a joint venture in part because the parties did not agree to share losses. 219 A.2d 601, 608 (N.J.1966).


*21 The Financial Institution Plaintiffs rely on National State Bank of Newark v. Terminal Construction Corp., 217 F.Supp. 341 (D .N.J.1963). The court quoted Wittner, cited above, in defining a joint venture as a “special combination of two or more persons where in some specific venture a profit is jointly sought without any actual partnership or corporate designation.” 217 F.Supp. at 351–52 (quoting Wittner, 178 A.2d at 674–76). In the same sentence, however, the court noted the requirement that “the parties agree to share profits and losses.” Id. (quoting Wittner, 178 A.2d at 674–76). New Jersey law requires that joint venturers share losses as well as profits. The Financial Institution Plaintiffs have not alleged shared losses.FN7


FN7. KeyBank also argues that the economic loss rule prevents recovery on the breach of fiduciary duty claim. Several court have held that the economic loss rule does not apply to claims for breach of fiduciary duty. See, e.g., In re Gosnell Dev. Corp. of Ariz., 331 F. App'x 440, 441–42 (9th Cir.2009) (per curiam) (unpublished) (explaining that physical harm is “neither required nor expected” to flow from a breach of fiduciary and that the duty exists in areas where “bargaining and risk allocation” are insufficient safeguards); Bohler–Uddeholm Am., Inc. v. Ellwood Grp ., Inc., 247 F.3d 79, 104 n. 11 (3d Cir.2001) (concluding that the economic-loss rule “does not quite fit” a fiduciary duty claim); United Int'l Holdings, Inc. v. Wharf (Holdings) Ltd., 210 F.3d 1207, 1226–27 (10th Cir.2000) (reasoning that the “fiduciary duty claim arose not from the contract but from the parties' status as joint venturers”); Invo Fla., Inc. v. Somerset Venturer, Inc., 751 So.2d 1263, 1266–67 (Fla.Dist.Ct.App.2000) (explaining that the economic-loss rule, developed in the context of products liability, was never intended to displace well-established torts, such as breach of fiduciary duty); Town of Alma v. AZCO Constr., Inc., 10 P.3d 1256, 1262–63 (Colo.2000) (“[S]ome torts are expressly designed to remedy pure economic loss....”). Courts in New Jersey have recognized that “breach of the fiduciary's duty normally generates only economic loss.” See, e.g., Bondi v. Citigroup, Inc., No. BER–L10902–04, 2005 WL 975856, at * 18 (N.J.Super. Ct. Law Div. Feb. 28, 2005). Courts in New York have agreed. See, e.g., Guilderland Reins. Co v. Gold, 642 N.Y.S.2d 99, 99–100 (N.Y.App.Div.1996) (reversing dismissal of a fiduciary duty claim on economic-loss grounds); The Limited, Inc. v. McCrory Corp., 169 A.2d 605, 607–08 (N.Y.App.Div.1991) (“[T]he ‘economic loss' rule does not extend to prohibiting a suit by a party in privity for pecuniary losses suffered as a result of breach of a duty independent of the contract.”). KeyBank's reliance on an Ohio case that held with little analysis that the economic-loss rule barred a fiduciary duty claim, see OC Prop. Mgmt., L.L.C. v. Gerner & Kerans Co., No. 90736, 2008 WL 4263563, at *2 (Ohio App. Sept. 18, 2008), is not persuasive.




The Financial Institution Plaintiffs' fiduciary duty claim is dismissed. Because the complaint has not been previously amended, and because the record does not permit the conclusion that, as a matter of law, any amendment would be futile, the dismissal is with leave to amend.


E. The Negligence Claim

The Financial Institution Plaintiffs allege that KeyBank negligently failed to ensure that the Heartland Payment Systems security procedures were sufficient to protect the financial data it received. The defendants argue that the economic loss rule prevents the Financial Institution Plaintiffs from recovering on a negligence claim. Under the laws of Ohio and Texas, which, according KeyBank, are the only two jurisdictions whose law could apply, economic losses with no personal or property injury do not give rise to a duty in tort. Instead, when the economic loss is to the subject of a contract itself, the action sounds in contract, not in tort. See Memorial Hermann Healthcare Sys., Inc. v. Eurocopter Deutschland, GMBH, 524 F.3d 676, 678 (5th Cir.2008) (summary calendar) (citing Hou–Tex, Inc. v. Landmark Graphics, 26 S.W.3d 103, 107 (Tex.App.-Houston [14th Dist.] 2000, no pet.); Sagraves v. Lab One, Inc., 316 F. App'x 366, 369 (6th Cir.2008) (unpublished) (citing Chemtrol Adhesives, Inc. v. Am. Mfrs. Mut. Ins. Co., 537 N.E.2d 624, 630–31 (Ohio 1989)). The defendants note that courts examining claims arising from data breaches have held that the economic loss rule bars tort damages arising from such breaches. TJX Cos., 564 F.3d 498–99; Sovereign Bank v. BJ's Wholesale Club, Inc., 533 F.3d 162, 179–80 (3d Cir.2008); Cumis, 918 N.E.2d at 469–71; PSECU, 398 F.Supp.2d at 326.


The Financial Institution Plaintiffs do not dispute that Texas and Ohio law preclude tort recovery for economic losses. Instead, the Financial Institution Plaintiffs contend that New Jersey law should apply, because the Heartland Payment Systems headquarters is in Princeton, New Jersey. “The New Jersey Supreme Court has long been a leader in expanding tort liability.” Hakimoglu v. Trump Taj Mahal Assocs., 70 F.3d 291, 295 (3d Cir.1995). Unlike Ohio and Texas, New Jersey allows tort recovery for economic losses under some circumstances. Paramount Aviation Corp. v. Agusta, 288 F.3d 67, 76–77 (3d Cir.2002) (citing People Express Airlines, Inc. v. Consolidated Rail Corp., 495 A.2d 107, 116 (N.J.1985)). The Financial Institution Plaintiffs contend that it is inappropriate to resolve a choice-of-law issue in the context of a motion to dismiss because the determination of which law applies involves the fact-intensive question of which state has the most significant relationship to this case. The Financial Institution Plaintiffs urge this court either to refuse to entertain the motion to dismiss because deciding the choice-of-law issue is premature, see, e.g., In re K–Dur Antitrust Litig., 338 F.Supp.2d 517, 541 (D.N.J.2004) (declining to settle substantive issues at class certification when the choice of law was unclear), or to consider the motion under New Jersey law, see, e.g., Nakell v. Liner Yankelevitz Sunshine & Regenstreif, LLP, 394 F.Supp.2d 762, 768 (M.D.N.C.2005). The defendants respond that the complaint allegations are insufficient to state a claim under New Jersey law, both because the facts alleged do not suggest that New Jersey law could apply, see Berry v. Indianapolis Life Ins. Co., 608 F.Supp.2d 785, 800 n. 16 (N.D.Tex.2009) (dismissing a complaint containing insufficient facts determine which law should apply under Rule 12(b)(6)) (citing Enigma Holdings v. Gemplus Int'l, S.A., No. 3:05–cv01168–B, 2006 WL 2859369, at *7 (N.D.Tex. Oct. 6, 2006)), and because New Jersey does not recognize a tort duty in the circumstances presented by this case.


*22 Under Texas choice-of-law rules, it is unnecessary to choose which state's law applies if there is no conflict between them. Sonat Exploration Co. v. Cudd Pressure Control, Inc., 271 S.W.3d 228, 231 (Tex.2008). As explained below, the economic loss rule applies in this case under New Jersey law, the same result that would be reached under Texas and Ohio law. There is no need to settle the choice-of-law issue.


New Jersey does not prevent tort recovery for purely economic losses in every case. In People Express Airlines, Inc. v. Consolidated Rail Corp., the New Jersey Supreme Court held that there was a duty “to take reasonable measures to avoid the risk of causing economic damages, aside from physical injury, to particular plaintiffs or plaintiffs comprising an identifiable class with respect to whom defendant knows or has reason to know are likely to suffer such damages from its conduct” under the facts of that case. 495 A.2d at 116. Whether the duty exists depends in part on the foreseeability of such damages to a particular plaintiff or class of plaintiffs. “The more particular is the foreseeability that economic loss will be suffered by the plaintiff as the result of the defendant's negligence, the more just is it that liability be imposed and recovery allowed.” Id. To be an “identifiable class,” the “class of plaintiffs must be particularly foreseeable in terms of the type of persons or entities comprising the class, the certainty or predictability of their presence, the approximate numbers of those in the class, as well as the type of economic expectations disrupted.” The test recognizes a “spectrum [of foreseeability] ranging from the general to the particular,” id. at 115, allowing a court to “limit otherwise boundless liability and define an identifiable class of plaintiffs that may recover. Id.


In People Express, the plaintiff airline sued the rail company for business-interruption damages after a volatile chemical caught fire in a rail yard adjacent to the airport in Newark, New Jersey. Id. at 108. An evacuation of a one-mile radius closed the airport's northern terminal for twelve hours. Id. The northern terminal housed the airline's business operations. Id. During the evacuation, the airline had to cancel flights and its employees were unable to book flights for customers. Id. The court identified the proximity of the north terminal to the accident; the “obvious nature” of People Express's presence and operations that made economic harm foreseeable; evidence that the defendants knew of the chemical's volatility, and an emergency response plan established with the input of some of the defendants that called for evacuation of the terminal. Id. at 118. The court distinguished drivers on a nearby highway whom the fire delayed. The drivers were a foreseeable, but not an identifiable, class. The presence of any particular driver—and therefore of injury of that driver—was merely fortuitous. Id. at 116.


*23 At the pleading stage, the Financial Institution Plaintiffs' allegations satisfy the People Express foreseeability test. The complaint sets forth, in significant detail, the contractual relationships that hold together the Visa and MasterCard networks. The financial institutions participating are identifiable, and the kinds of damages alleged—stemming primarily from card replacement and charging off fraudulent transactions—are straightforward. The complaint also suggests that the defendants should have been aware of the possibility of a “hacker.” Previous similar breaches of other systems were highly publicized. (Docket Entry No. 1, ¶ 67). Meeting the foreseeability test under People Express is necessary but not sufficient under New Jersey Law. See, e.g., Carvalho v. Toll Bros. & Developers, 675 A.2d 209, 573 (N.J.1996); Carter Lincoln–Mercury, Inc., Leasing Div. v. EMAR Grp., Inc., 638 A.2d 1288, 1294 (N.J.1994).


“New Jersey courts have consistently held that contract law is better suited to resolve disputes where a plaintiff alleges direct and consequential losses that were within the contemplation of sophisticated business entities that could have been the subject of their negotiations.” Travelers Indem. Co. v. Dammann & Co., 594 F.3d 238, 248 (3d Cir.2010). Many of these cases have arisen in the context of tort claims for defective products resulting in economic losses, not faulty provision of services resulting in such losses. Contracts for the sale of goods, unlike contracts for services, are subject to New Jersey's enactment of the Uniform Commercial Code. See N.J. STAT. § 12A:2–102 (“Unless the context otherwise requires, this Chapter applies only to transactions in goods ....”). In two decisions refusing to allow common-law tort actions, one before People Express and one after, the New Jersey Supreme Court held that the legislatively enacted U.C.C. provided a “comprehensive system for determining the rights and duties of buyers and sellers with respect to contracts for the sale of goods” and displaced tort remedies for economic losses from defective products. Spring Motors Distribs., Inc. v. Ford Motor Co., 489 A.2d 660, 665 (1985); see also Alloway v. Gen. Marine Indus., 695 A.2d 264, 267–68 (1997). As the Third Circuit observed, “Spring Motors and Alloway reflect a deference to legislative will where the legislature has provided a comprehensive scheme controlling the relationship between the parties and, more specifically, a recognition of the allocation of risk against the background of the rights and remedies provided by the U.C.C.” Dammann, 594 F.3d at 248 (quoting Paramount, 288 F.3d at 73).


In the services context, “relationships created by contract can give rise to affirmative duties imposed by law.” Saltiel v. GSI Consultants, Inc., 788 A.2d 268, 277 (N.J.2002). Doctors and lawyers, for example, owe common-law duties of care to their clients, regardless of the terms of their contracts. Id. at 280. Spring Motors and Alloway make clear, however, that it is inappropriate to create tort duties between sophisticated businesses that allocate risks through contract. Spring Motors rejected strict liability in sales alongside the U.C.C. in part because “considerations that give rise to strict liability do not obtain between commercial parties with comparable bargaining power” and observed that a “commercial buyer ... may be better situated than the manufacturer to factor into its price the risk of economic loss caused by the purchase of a defective product.” 489 A.2d at 670–71. “[B]etween commercial parties, ... allocation of risks in accordance with their agreement better serves the public interest than an allocation achieved as a matter of policy without reference to that agreement.” Id. When the parties agree to how risk should be allocated, “society has an interest in seeing that the agreement is fulfilled.” Id. at 668; see also id. at 670 (noting the importance of “the relative bargaining power of the parties and the allocation of the loss to the better risk-bearer in a modern marketing system”); accord Alloway, 695 A.2d at 268. The Third Circuit concluded that the New Jersey cases represented a “clear rejection of an approach that would allow tort law in cases involving sophisticated parties with equal bargaining power.” Dammann, 594 F.3d at 251; see also In re Merritt Logan, Inc., 901 F.2d 349, 362 (3d Cir.1990) ( “People Express simply does not address or concern the rule established in Spring Motors.” ).


*24 Numerous courts have held that the economic loss doctrine applies to preclude tort suits for such losses resulting from contracts for services under New Jersey law. “While the [economic loss doctrine] has been predominantly applied in connection with transactions for goods, it has also been found, in New Jersey, to apply to contracts for services.” Titan Stone, Tile & Masonry, Inc. v. Hunt Constr. Grp., Inc., Civ. A. No. 05–cv–3362 (GEB), 2007 WL 174710, at *4 (D.N.J. Jan. 22, 2007) (citations omitted); accord State Capital Title & Abstract Co. v. Pappas Bus. Servs., LLC, 646 F.Supp.2d 668, 767–678 (D.N.J.2009) (dismissing claims against a title search company under Rule 12(b)(6)); CapitalPlus Equity, LLC v. Prismatic Dev. Corp., Civ. A. No. 07–321(WHW), 2008 WL 2783339, at *6 (D.N.J. July 16, 2008) (“Contrary to plaintiff's contention, the economic loss doctrine has been applied not only in products liability cases, but also in actions arising out of contracts for services ....”); Bracco Diagnostics Inc. v. Bergen Brunswig Drug Co., 226 F.Supp.2d 557, 562–65 (D.N.J.2002) (dismissing fraud claims arising out of the performance of a contract under Rule 12(b)(6) and distinguishing cases involving fraudulent inducement); Dynalectric Co. v. Westinghouse Elec. Corp., 803 F.Supp. 985, 991–93 (D.N.J.1992) (distinguishing People Express); Healthcare Servs., Inc. v. Nat'l Prescription Adm'rs, Inc., 867 F.Supp. 1223, 1229 (E.D.Pa.1994) (refusing to allow negligence claim for damages arising out of negligent claims processing). People Express addresses situations in which the parties have no contractual relationship, whereas Spring Motors generally controls when the relationship arise out of contract. See Healthcare Servs., 867 F.Supp. at 1229.


The Financial Institution plaintiffs contend that it is premature to determine whether a duty exists under New Jersey law, because the existence of a duty depends on the specific facts at issue. See Wang v. Allstate Ins. Co., 592 A.2d 527, 534, (N.J.1991) (“Of course, the legal determination of the existence of a duty may differ, depending on the facts of he case.”); J.S. v. R.T.H., 693 A.2d 1191, 1193 (N.J.Super.Ct.App.Div.1997) (“The facts of a case inform the court in determining whether a duty exists.”). But when it is clear that the economic loss rule prevents recovery based on the alleged facts, a court should dismiss the case. See Dammann, 594 F.3d at 259 (affirming the district court's denial of leave to amend as futile); State Capital Title, 646 F.Supp.2d at 677–78, 682 (dismissing under Rule 12(b)(6) based on the economic loss rule); Titan Stone, 2007 WL 174710, at *6 (same); Bracco Diagnostics, 226 F.Supp.2d at 562–65 (same).


In this suit, the Financial Institution Plaintiffs are trying to do precisely what New Jersey law precludes. Issuers, such as the Financial Institution Plaintiffs, and acquirers, such as KeyBank, are bound through their contracts with Visa and MasterCard. The networks have their own rules and regulations, including rules requiring acquirer banks that contract out their duties to impose the network regulations on the contractors. When KeyBank hired Heartland Payment Systems to find customers and process transactions, it bound the company to those regulations. The Visa and MasterCard regulations provide dispute-resolution and compensation rules when data breaches result in losses to issuers. The contractual obligations and compensation system, not tort law, are the Financial Institution Plaintiffs' only means of seeking compensation for economic losses.FN8


FN8. This conclusion is consistent with the Third Circuit's application of New Jersey law. In Dammann, the court explained that when making an Erie guess, the court should “opt for the interpretation that restricts liability, rather than expands it, until the Supreme Court of New Jersey decides differently.” 594 F.3d at 253 (quoting Werwinski v. Ford Motor Co., 286 F.3d 661, 680 (3d Cir.2002)) (brackets omitted); see also id. at 253 n. 10 (observing that the approach is appropriate “in any case in which a federal court sits in diversity”). “To the extent our conclusion enlarges the scope of contract liability at the expense of tort liability,” the court noted, “we believe that approach to be consonant with New Jersey law.” Id. at 253.




*25 The negligence claims is dismissed with prejudice and without leave to amend because amendment would be futile under the applicable law.


F. Vicarious Liability

The Financial Institution Plaintiffs claim that the KeyBank is vicariously liable for the negligence of Heartland Payment Systems. The relationships among issuers, acquirers, and their contractors—such as Heartland Payment Systems—are governed by the Visa and MasterCard regulations. Heartland Payment Systems owed no tort duty to prevent the Financial Institution Plaintiffs' economic losses. The claim for vicarious liability for a breach of that duty fails. See, e.g., Flannery v. Mid Penn Bank, No. 1:CV–08–0685, 2008 WL 5113437, at *7 & n. 6 (M.D.Pa. Dec. 3, 2008); City of Southaven v. Datamatic, Ltd., No. 2:07–cv–58, 2008 WL: 3200706, at *1 (N.D.Miss. Aug. 6, 2008); Anastasi Bros. Corp. v. Mass. Convention Ctr. Auth., No. 890867B, 1993 WL 818553, at *3 (Mass.Super.Ct. Nov. 1, 1993); cf. McFadden v. Turner, 388 A.2d 244, 246 (N.J.Super.Ct.App.Div.1978) (stating that claim and issue preclusion prevents a plaintiff from suing the principal for vicarious liability after suing the agent on the primary duty and losing).


IV. Conclusion

Heartland Bank's motion to dismiss for lack of personal jurisdiction is granted. KeyBank's motion to dismiss for failure to state a claim under Rule 12(b)(6) is granted, with prejudice as to the negligence claim and without prejudice as to the remaining claims. A status conference is set for April 18, 2011, at 8:45 a.m.


S.D.Tex.,2011.
In re Heartland Payment Systems, Inc. Customer Data Sec. Breach Litigation
Not Reported in F.Supp.2d, 2011 WL 1232352 (S.D.Tex.)
David A. Szwak
Bodenheimer, Jones & Szwak, LLC
416 Travis Street, Suite 1404, Mid South Tower
Shreveport, Louisiana 71101
318-424-1400 / Fax 221-6555
President, Bossier Little League
Chairman, Consumer Protection Section, Louisiana State Bar Association


Return to “Standing and Statutes of Limitations”

Who is online

Users browsing this forum: No registered users and 1 guest