Banc of Am. Merch. Servs., LLC v. Arby's Rest. Grp., Inc.

2021 NCBC 41

Opinion

Banc of Am. Merch. Servs., LLC v. Arby’s Rest. Grp., Inc., 2021 NCBC 41.

STATE OF NORTH CAROLINA IN THE GENERAL COURT OF JUSTICE SUPERIOR COURT DIVISION

MECKLENBURG COUNTY 20 CVS 426

BANC OF AMERICA MERCHANT SERVICES, LLC,

Plaintiff and Counterclaim Defendant,

v.

ORDER AND OPINION

ARBY’S RESTAURANT GROUP, ON CROSS-MOTIONS FOR INC., SUMMARY JUDGMENT

Defendant, Counterclaim

Plaintiff, and Third-Party Plaintiff,

v.

VISA, INC.; and MASTERCARD INTERNATIONAL INC.,

Third-Party Defendants.

1. Arby’s Restaurant Group, Inc. operates a nationwide chain of fast-food restaurants. In 2017, it reported a data security breach that exposed the payment card data of many of its customers. Two payment card organizations—Visa, Inc. and Mastercard International Inc.—separately reviewed the incident and concluded that Arby’s had not complied with prevailing industry standards for data security. Arby’s disputed this at the time and continues to dispute it now. Nevertheless, Visa and Mastercard assessed nearly $20 million in penalties and fees. They did not impose these assessments on Arby’s, which has no direct relationship with either card organization. Instead, they imposed the assessments on Banc of America Merchant

Services, LLC (“BAMS”), the bank that sponsored Arby’s as a participating merchant in the payment card networks. 1 2. This case is about who bears ultimate responsibility for the assessments. After exhausting appeals before Visa and Mastercard, BAMS paid the assessments and then asked Arby’s for reimbursement. Arby’s refused; BAMS sued. In short, BAMS believes that it has a right to be indemnified for the assessments under its contract with Arby’s and that Arby’s breached the contract when it refused to pay. Arby’s denies that it has any duty to indemnify BAMS. It also contends that Visa and Mastercard never should have imposed the assessments in the first place and has asserted third-party claims against them.

3. Several motions are currently pending. Visa and Mastercard have each moved to dismiss the third-party claims asserted by Arby’s. A separate opinion, also issued today, addresses those motions.

4. Two other motions are the subject of this opinion. BAMS and Arby’s agreed to defer discovery in favor of early summary-judgment practice as to their claims and defenses against one another. BAMS seeks partial summary judgment; Arby’s contends that it is entitled to summary judgment across the board. For the following reasons, the Court DENIES both motions.

McGuireWoods LLP, by Jodie Herrmann Lawson, and Covington & Burling LLP, by Alexander A. Berengaut, for Plaintiff/Counterclaim Defendant Banc of America Merchant Services, LLC.

1 It would be more accurate to say that Visa and Mastercard imposed the fees on Bank of

America, N.A. (“BANA”), which is related to BAMS. The parties agree, though, that BANA has assigned its claims in this case to BAMS. To avoid unnecessarily complicating the facts, the Court refers to both, together, as BAMS throughout this opinion.

Smith, Anderson, Blount, Dorsett, Mitchell & Jernigan, L.L.P., by Christopher G. Smith, and Orrick, Herrington & Sutcliffe LLP, by Seth Harrington and Douglas H. Meal, for Defendant/Counterclaim Plaintiff/Third-Party Plaintiff Arby’s Restaurant Group, Inc.

Bradley Arant Boult Cummings LLP, by C. Bailey King, Jr. and Bridget V. Warren, and O’Melveny & Myers LLP, by Randall W. Edwards, Megan Havstad, and Eric Ormsby, for Third-Party Defendant Visa Inc.

Cozen O’Connor, by Tracy L. Eggleston, and Golenbock Eiseman Assor Bell & Peskoe LLP, by Martin S. Hyman and Matthew C. Daly, for Third-

Party Defendant Mastercard International, Inc. 2

Conrad, Judge.

I.

BACKGROUND

5. The Court does not make findings of fact when ruling on motions for summary judgment. The following background, drawn from the evidence submitted by the parties, is intended only to provide context for the Court’s analysis and ruling.

6. The issues presented require some understanding of the structure of payment card networks. At the center, of course, are the card organizations. Visa and Mastercard operate the networks that make debit and credit card transactions possible. (See Joint Stip. Suppl. Facts ¶ 1, ECF No. 32 [“Stip.”].) But neither the consumers who use credit and debit cards nor the merchants that accept them have a direct relationship with Visa or Mastercard. Rather, consumers and merchants participate in the networks through intermediaries. Consumers get payment cards from “issuers” (financial institutions that issue the cards), and merchants affiliate with “acquirers” (financial institutions that offer access to the networks). (See Stip.

2 After these motions were filed, the Court granted Ms. Warren, Ms. Lawson, and Ms.

Havstad leave to withdraw as counsel. (ECF Nos. 93, 131, 136.)

¶¶ 3–5.) Acquirers and issuers in turn have contracts with Visa, Mastercard, or both. (See Stip. ¶ 6.)

7. Acquirers and issuers play key roles, again as intermediaries, in processing card transactions. When a consumer presents a card for payment at the point of sale, the merchant transmits the card information to its acquirer. The acquirer then asks the relevant card organization and issuer to authorize the transaction. Assuming authorization is given, the consumer and the merchant complete the transaction, and the issuer pays the merchant sometime later. (See Stip. ¶ 6.)

8. Here, BAMS is an acquirer for Visa and Mastercard and has a contract with each. (See Stip. ¶¶ 7, 10.) Arby’s is one of BAMS’s affiliated merchants. The merchant agreement between Arby’s and BAMS dates to 2009; it is separate and distinct from BAMS’s contracts with Visa and Mastercard. (See Stip. ¶ 9.)

9. This case is about data security—specifically, the responsibilities of BAMS (as acquirer) and Arby’s (as merchant) to safeguard payment card data and to pay for losses resulting from a data breach. Visa and Mastercard publish extensive rules related to data security—and many other things—and incorporate them into contracts with acquirers, including BAMS. (See Stip. ¶ 10.) It is BAMS’s responsibility to ensure that its merchants meet industry standards for data security, formally called Payment Card Industry (“PCI”) Data Security Standards. (See Stip. ¶ 10.)

10. Each card organization also oversees programs designed to remedy losses from a security breach. These include Visa’s Account Information Security (“AIS”)

and Global Compromised Account Recovery (“GCAR”) programs and Mastercard’s Account Data Compromise (“ADC”) program. The details of each program are in the record (swelling to over a hundred pages), but a summary will suffice. (See App. Exs. D, E, G, K, O, ECF No. 33.1.)3 In short, if a merchant suffers a data security incident, Visa and Mastercard may impose assessments on BAMS using various criteria. BAMS has the right to appeal. Assuming the appeal is denied and payment is made, Visa and Mastercard then distribute the funds to participating issuers, ostensibly to compensate them for losses due to fraud and the need to issue replacement cards to consumers. (See App. Ex. O at 1; App. Ex. Q at 12.) The AIS program also takes into account reputational harm to Visa from the incident. (App. Ex. K at 11.) Neither card organization takes a position on whether BAMS can or should seek reimbursement from the merchant for assessments imposed through these programs. (See App. Ex. D §§ 1.10.4.1, 1.12.3.1; App. Ex. E §§ 10.1, 10.2.1; see also App. Ex. H at 1; App. Ex. P at 3.)

11. BAMS’s merchant agreement with Arby’s incorporates the card organization rules issued by Visa and Mastercard. Arby’s must comply with those rules and any applicable “existing and future” PCI Data Security Standards. (App. Ex. A § 13(A) [“Merchant Agrmt.”]; see also Merchant Agrmt. §§ 1, 7(A)(xi).) Section 13, which deals with information security, also requires Arby’s to “engage a certified forensic vendor acceptable to the Card Organizations” after any “suspected or confirmed” data breach. (Merchant Agrmt. § 13(D).)

3 All citations to appendix exhibits (“App. Exs.”) are located at ECF No. 33.1.

12. Two other provisions of the merchant agreement are especially relevant. Section 10(B) requires Arby’s (the “MERCHANT”) to pay certain fees imposed by Visa and Mastercard (the “Card Organizations”) on BAMS (the “BANK”). The section states in full as follows:

MERCHANT will pay to BANK all assessments, fines, penalties, fees, Card issuer reimbursements and similar charges imposed by Card Organizations on BANK (the ‘Card Organization Penalties’), directly related to MERCHANT’s Card transactions or based on MERCHANT’s actions or failure to act with respect to compliance with the Card Organization Rules or Merchant’s breach of Section 13 (Information Security), except to the extent that such amounts are due to BANK’s negligence or willful misconduct.

(Merchant Agrmt. § 10(B).) In addition, Section 21 requires Arby’s to indemnify BAMS against “all losses” that “result from or arise out of any breach” of the agreement. (Merchant Agrmt. § 21.)

13. In early 2017, BAMS disclosed a suspected data breach to Arby’s. (See Stip. ¶ 11.) Arby’s hired a forensic investigator. (See Stip. ¶ 12.) Not long after, Arby’s publicly announced that an “intruder” had installed malware “on the point-of-sale (POS) systems of certain restaurants” and, as a result, “may have been able to access data from payment cards used” between October 2016 and January 2017. (App. Ex. T at 1.) The stolen data “included the cardholder name and number” in some instances. (App. Ex. T at 1.) In its final report, the investigator concluded that Arby’s was not compliant with the PCI Data Security Standards. (See App. Ex. K at 1.)

14. Visa and Mastercard reviewed the incident and, ultimately, agreed with the investigator’s conclusions. (See App. Ex. K at 1; App. Ex. O at 2.) Each card organization then independently assessed fees against BAMS. Mastercard’s ADC assessment approached $4.5 million. Visa’s GCAR and AIS assessments together approached $16.5 million. (See Stip. ¶¶ 13, 17, 20.)

15. After notifying Arby’s of the assessments, BAMS submitted appeals asking Visa and Mastercard to reduce or rescind them. During the appeal process, Arby’s worked with BAMS to “prepare[ ] the appeal document[s]” and aimed to show that it had complied with the PCI Data Security Standards. (App. Ex. K at 1 n.1; see also App. Ex. I at 1; App. Ex. J at 1; App. Ex. L at 1–2; App. Ex. N at 1; App. Ex. Q at 15.) Visa ultimately upheld its assessments, but Mastercard agreed to reduce the ADC assessment. (See Stip. ¶¶ 14, 18, 21; App. Ex. L at 2; App. Ex. O at 1; App. Ex. S at 1.) The total bill, including appeal fees, exceeded $19 million. (See Stip. ¶ 23.)

16. Once the appeals were over, BAMS paid in full and then sought reimbursement from Arby’s under sections 10(B) and 21 of the merchant agreement. Arby’s refused, prompting this lawsuit. BAMS contends that it has a contractual right to be indemnified for the assessments imposed by Visa and Mastercard. It asserts claims for breach of the merchant agreement and for declaratory judgment. Arby’s argues in response that it has no duty to indemnify BAMS for the assessments under section 10(B) and section 21.

17. At the request of the parties, the Court agreed to delay discovery and to entertain early motions for summary judgment. (See Case Management Order at 4– 5, ECF No. 22.) BAMS has moved for partial summary judgment on its claim for breach of section 10(B) of the merchant agreement. (See ECF No. 30.) Arby’s has cross-moved for summary judgment on all claims asserted against it. (See ECF No.

34.) Although the onset of the COVID-19 pandemic delayed matters for a time, the motions are now fully briefed and ripe for disposition.

II.

LEGAL STANDARD

18. Summary judgment is appropriate “if the pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact and that any party is entitled to a judgment as a matter of law.” N.C. R. Civ. P. 56(c). In deciding a motion for summary judgment, the Court views the evidence in the light most favorable to the opposing party, taking its evidence as true and drawing inferences in its favor. See, e.g., Furr v. K-Mart Corp., 142 N.C. App. 325, 327 (2001).

19. The moving party “bears the initial burden of demonstrating the absence of a genuine issue of material fact.” Liberty Mut. Ins. Co. v. Pennington, 356 N.C. 571, 579 (2002). If the moving party carries this burden, the opposing party “may not rest upon the mere allegations or denials of his pleading,” N.C. R. Civ. P. 56(e), but must instead “come forward with specific facts establishing the presence of a genuine factual dispute for trial,” Liberty Mut. Ins. Co., 356 N.C. at 579. “An issue is ‘genuine’ if it can be proven by substantial evidence and a fact is ‘material’ if it would constitute or irrevocably establish any material element of a claim or a defense.” Lowe v. Bradford, 305 N.C. 366, 369 (1982) (quoting Bone Int’l, Inc. v. Brooks, 304 N.C. 371, 374–75 (1981)).

20. When a party requests offensive summary judgment on its own claims for relief, “a greater burden must be met.” Brooks v. Mount Airy Rainbow Farms Ctr.,

Inc., 48 N.C. App. 726, 728 (1980). The moving party “must show that there are no genuine issues of fact, that there are no gaps in his proof, that no inferences inconsistent with his recovery arise from the evidence, and that there is no standard that must be applied to the facts by the jury.” Parks Chevrolet, Inc. v. Watkins, 74 N.C. App. 719, 721 (1985). For that reason, it is “rarely . . . proper to enter summary judgment in favor of the party having the burden of proof.” Blackwell v. Massey, 69 N.C. App. 240, 243 (1984).

III.

ANALYSIS

21. The issues presented center on section 10(B) and section 21 of the merchant agreement. Each section requires Arby’s to indemnify BAMS for certain losses to third parties. The parties dispute the scope of any right to indemnification and whether Arby’s must indemnify BAMS for the assessments imposed by Visa and Mastercard after the data security incident in 2017.

22. BAMS seeks partial summary judgment, limited to its claim for breach of section 10(B). It contends that Arby’s is responsible for the assessments under the plain language of that provision. In opposition, Arby’s maintains that BAMS has misread section 10(B). In addition, in its own motion for summary judgment, Arby’s offers several arguments based on principles of indemnification law and other provisions of the merchant agreement. On these grounds, Arby’s contends that it is entitled to summary judgment on all claims or, at a minimum, that BAMS’s motion must be denied.

23. The Court begins with the parties’ competing interpretations of section 10(B). After that, the Court turns to each ground raised by Arby’s.

A. Section 10(B)

24. Section 10(B) states that Arby’s must pay “Card Organization Penalties” that are (1) “directly related to [its] Card transactions” or (2) “based on [its] actions or failure to act with respect to compliance with the Card Organization Rules or [its] breach of Section 13 (Information Security).” (Merchant Agrmt. § 10(B).) BAMS contends, and Arby’s disagrees, that the assessments imposed by Visa and Mastercard satisfy both conditions. They base their arguments on conflicting interpretations of the contract language.

25. The object of contract interpretation is to ascertain the parties’ intent at the time the contract was made. See, e.g., Lane v. Scarborough, 284 N.C. 407, 409–10 (1973). To do so, courts look to the words used by the parties. When the parties have defined a term, “that definition is to be used. If no definition is given, non-technical words are to be given their meaning in ordinary speech, unless the context clearly indicates another meaning was intended.” Singleton v. Haywood Elec. Membership Corp., 357 N.C. 623, 629 (2003) (quoting Gaston Cnty. Dyeing Mach. Co. v. Northfield Ins. Co., 351 N.C. 293, 299 (2000)). “Intent is derived not from a particular contractual term but from the contract as a whole.” State v. Philip Morris USA Inc., 359 N.C. 763, 773 (2005) (citation omitted).

26. “A contract that is plain and unambiguous on its face will be interpreted by the court as a matter of law.” Schenkel & Shultz, Inc. v. Hermon F. Fox & Assocs.,

P.C., 362 N.C. 269, 273 (2008) (citation omitted). The interpretation of an ambiguous contract depends on extrinsic evidence and is a question for the jury. See id. “An ambiguity exists in a contract when either the meaning of words or the effect of provisions is uncertain or capable of several reasonable interpretations.” Register v. White, 358 N.C. 691, 695 (2004) (citations omitted).

27. “Directly related to . . . Card transactions.” It goes without saying that the phrase “related to” is broad. BAMS defines the phrase to mean “to stand in some relation; to have bearing or concern; to pertain; refer; to bring into association with or connection with.” (BAMS Br. in Supp. 13, ECF No. 31 (quoting Morales v. Trans World Airlines, Inc., 504 U.S. 374, 383 (1992)).) Arby’s prefers “connected to, influenced by, or caused by something.” (Arby’s Opp’n 11, ECF No. 102 (quoting Related, Cambridge Dictionary, https://dictionary.cambridge.org/dictionary /english/related (last visited June 27, 2021)).) These are different ways of saying the same thing, and neither party has suggested that choosing one formulation over the other makes a difference.

28. The parties instead wrestle over the word “directly” and what it means for two things to be “directly related to” one another. BAMS interprets “directly” to mean “in unmistakable terms.” (BAMS Br. in Supp. 13 (emphasis omitted) (quoting State v. Jones, 267 N.C. App. 615, 624 (2019)).) Arby’s interprets it to mean “without anything else being involved or in between.” (Arby’s Opp’n 11 (quoting Directly, Cambridge Dictionary, https://dictionary.cambridge.org/dictionary/english/directly (last visited June 27, 2021)).)

29. Arby’s is correct. In ordinary usage, the word “directly” suggests closeness, immediacy, or adjacency between two things. A direct flight, for example, begins in one city and ends in another with no stops in between. In a baseball doubleheader, the second game follows directly after the first. Events (or things or places or actions) are directly related when nothing intervenes or comes between them. See Directly, Cambridge Dictionary, https://dictionary.cambridge.org/dictionary/english/directly (last visited June 27, 2021) (“without anything else being involved or in between”); see also Direct, Merriam-Webster Dictionary, https://www.merriam- webster.com/dictionary/direct (last visited June 27, 2021) (defining “direct” as “proceeding from one point to another in time or space without deviation or interruption,” “stemming immediately from a source,” and “marked by absence of an intervening agency, instrumentality, or influence”).

30. The interpretation urged by BAMS, on the other hand, is not reasonable. It is based on a definition of “directly” taken from two Court of Appeals decisions, neither of which is relevant, much less controlling. See Jones, 267 N.C. App. at 624– 26; State v. Powell, 253 N.C. App. 590, 599–605 (2017). The context in those cases— construction of a statute governing warrantless searches of probationers—was radically different. And the definition adopted by the Court of Appeals came from a dictionary published in 1966, which isn’t remotely contemporaneous with the merchant agreement. See Jones, 267 N.C. App. at 624–25; Powell, 253 N.C. App. at 600. It therefore has little interpretive value. See, e.g., Nat’l Union Fire Ins. Co. v. Beelman Truck Co., 203 F. Supp. 3d 312, 319 (S.D.N.Y. 2016) (“[C]ourts interpreting language by consulting dictionaries look for those contemporaneous to the writing at issue.”).

31. Thus, the contract language is unambiguous. In the context of section 10(B), card organization penalties are “directly related to” underlying card transactions if nothing intervenes or comes between them.

32. BAMS worries that this interpretation will render the contract language superfluous because no card organization penalties would ever directly relate to card transactions. (See BAMS Reply Br. 6–7, ECF No. 111.) As Arby’s observes, however, the card organizations impose many types of fines and fees. Some arise simply because a transaction has occurred. (See Arby’s Opp’n 14 n.11; see also App. Ex. B.) It stands to reason that fees of that sort are directly related to underlying card transactions. Although the language is narrower than BAMS would like, it is not superfluous.

33. Whether the assessments at issue are directly related to card transactions is a genuine issue of material fact. BAMS argues that the forensic investigator reviewed card transaction data 4 after the incident and that this data was the “key variable” used by Visa and Mastercard when calculating and imposing their assessments. (BAMS Br. in Supp. 15 (emphasis omitted).) But Arby’s has offered

4 It is noteworthy that BAMS focuses on card transaction data. A reasonable observer might wonder whether an assessment derived from card transaction data is directly related to the underlying transactions themselves—and whether the answer depends on the type of data involved. Because BAMS is seeking offensive summary judgment, it had the burden to show that there are no gaps in its proof or inferences inconsistent with its recovery. See Parks Chevrolet, 74 N.C. App. at 721. At no point in its briefs does BAMS tie its understanding of the phrase “Card transactions” to its evidence of associated data. It has not carried its burden, even under its own interpretation of the agreement.

evidence that the assessments resulted from a complex web of events: the malicious installation of malware by a criminal intruder, alleged violations of industry data security standards by Arby’s, remedial actions by issuers to address fraudulent charges, and discretionary decisions of the card organizations to impose penalties. (See Arby’s Opp’n 15.) A reasonable jury could conclude that there were intervening actions or events between the underlying card transactions and the assessments such that the relationship between the two is not direct.

34. “Based on” Compliance “with the Card Organization Rules.” The second half of section 10(B) requires Arby’s to pay assessments that are “based on” its “actions or failure to act with respect to compliance with the Card Organization Rules” or its “breach of Section 13” of the merchant agreement. (Merchant Agrmt. § 10(B).) BAMS calls this a “strict liability” provision. Its position is that Arby’s must pay the assessments at issue because Visa and Mastercard found that Arby’s did not comply with their rules and related industry standards. This is so, BAMS contends, whether the findings of noncompliance were correct or not. (See BAMS Br. in Supp. 16–19.)

35. Arby’s rejects that interpretation and argues that its obligation to reimburse BAMS, if any, extends only to assessments that are based on actual noncompliance. This means that BAMS must show that the findings of noncompliance by Visa and Mastercard were correct. Arby’s contends that BAMS has not done so and that the findings were erroneous. (See Arby’s Opp’n 19–21.)

36. The contract language is not as broad as BAMS suggests. The assessments that Arby’s agreed to pay are those based on its “actions or failure to act” or based on its “breach of Section 13.” Read most naturally, this language means that the obligation to pay an assessment depends on what Arby’s did or didn’t do. It would be awkward and unreasonable to read the language to mean that Arby’s is responsible for assessments erroneously based on actions that never happened or a nonexistent breach of the merchant agreement. Yet that is what BAMS advocates. Under BAMS’s interpretation, Arby’s would be responsible even if it fully complied with all card organization rules, industry standards, and the merchant agreement. That result would be inconsistent with the contract language and contrary to the reasonable expectation of the parties.

37. BAMS contends that the merchant agreement as a whole supports its position. (See BAMS Br. in Supp. 20–22.) Not so. For example, BAMS points to section 19(A), which requires Arby’s to fund a reserve account if it “is likely to be subject to Card Organization Penalties as defined in Section 10 (B).” (Merchant Agrmt. § 19(A).) But section 19(A) does not say which penalties Arby’s is responsible for paying.

38. Likewise, section 13(C) is no help. Under that provision, if Arby’s engages a third-party provider, the provider must register with the card organizations and comply with industry data security standards. Failure to comply might result in fines or assessments by the card organizations. If the provider doesn’t pay, then Arby’s must. (See Merchant Agrmt. § 13(C); see also App. Ex. B § 2.) This may mean that

Arby’s bears responsibility for noncompliance by its providers. It does not suggest that Arby’s must pay assessments erroneously made by the card organizations despite full compliance with their rules and the merchant agreement.

39. The same is true for section 10(A), which addresses “Card Organization Charges” listed in Schedules A and B to the agreement. Among other things, Arby’s must pay BAMS “all [c]hargebacks determined to be valid under Card Organization Rules.” (Merchant Agrmt. § 10(A).) BAMS argues that the “ ‘validity’ requirement in Section 10(A)” means that the parties “did not intend to impose a similar limitation on Arby’s payment obligations under Section 10(B).” (BAMS Br. in Supp. 19.) That ignores the surrounding context. The so-called validity requirement distinguishes chargebacks from other “Card Organization Charges” in section 10(A): Arby’s is responsible for “all authorizations” and “all Transaction Records submitted for processing,” but its responsibility as to chargebacks is limited to those “determined to be valid.” (Merchant Agrmt. § 10(A).) Simply put, the use of the word “valid” in section 10(A) has no bearing at all on section 10(B), nor does it speak to what it means for an assessment to be “based on” a failure to comply or a breach of contract by Arby’s.

40. In short, nothing in section 10(B) makes Arby’s responsible for assessments based on a perceived but unsubstantiated failure to comply with card organization rules. Accordingly, the Court concludes that section 10(B) is unambiguous and adopts the interpretation proposed by Arby’s. And because section 10(B) is unambiguous, the Court need not and does not consider BAMS’s extrinsic evidence concerning

“customary industry practice,” (BAMS Br. in Supp. 23). See, e.g., Ludlam v. Miller, 225 N.C. App. 350, 365 (2013).

41. As to whether Arby’s complied with the card organization rules or breached section 13, the facts are in dispute. BAMS has not argued or shown otherwise. Consequently, there are genuine issues of material fact concerning whether the assessments were “based on” a failure to comply with card organization rules or a breach of section 13 of the merchant agreement.

B. Defenses by Arby’s

42. Arby’s asserts three defenses that it contends require entry of summary judgment in its favor or, at a minimum, denial of BAMS’s motion. The Court addresses each in turn.

43. Voluntary Payment. Arby’s contends that it had no duty to indemnify BAMS because BAMS had no duty to pay the assessments by Visa and Mastercard in the first place. According to Arby’s, the assessments were unlawful contractual penalties, which BAMS could have and should have refused to pay. Maintaining that it had no duty to indemnify BAMS for voluntary payments to third parties, Arby’s seeks summary judgment as to the claims for breach of section 10(B) and section 21. (See Arby’s Br. in Supp. 16–26, ECF No. 35.)

44. BAMS responds that it was required to pay the assessments because they were the product of valid and enforceable liquidated damages provisions in its contracts with Visa and Mastercard. Even if not required to pay the assessments, BAMS insists that it did so in good faith, reasonably believing that it owed them.

Either way, BAMS contends, it was not a volunteer and has a right to be indemnified. (See BAMS Opp’n 16–26, ECF No. 103.)

45. These competing positions raise a threshold question about the appropriate standard to apply. Must BAMS prove that it was actually liable to Visa and Mastercard, as Arby’s contends? Or is BAMS correct that it must prove only that it paid the assessments in the good-faith belief that it was liable?

46. North Carolina follows the traditional common-law rule that indemnity “does not cover losses for which the indemnitee is not liable to a third person, and which he improperly pays.” N.W. Mut. Ins. Co. v. Hylton, 7 N.C. App. 244, 250 (1970) (citation and quotation marks omitted); see also City of Wilmington v. N.C. Nat. Gas Corp., 117 N.C. App. 244, 250 (1994). This follows from the fundamental nature of indemnity, which “is to make good and save another harmless from loss on some obligation which he has incurred or is about to incur to a third party.” New Amsterdam Cas. Co. v. Waller, 233 N.C. 536, 537 (1951). As a result, the party seeking indemnity usually must plead and prove that it was liable to the injured third party. See id. at 537–38; see also One Beacon Ins. Co. v. United Mech. Corp., 207 N.C. App. 483, 489–90 (2010).

47. But there are significant exceptions to this rule. If, for example, the indemnity claim is based on an express contract, the terms of the contract control and may depart from common-law rules. See, e.g., Old Republic Sur. Co. v. Reliable Hous., Inc., 2002 N.C. App. LEXIS 2524, at *5–8 (N.C. Ct. App. Dec. 3, 2002) (unpublished)

(“Strict indemnity provisions . . . are quite common and have been upheld repeatedly in North Carolina and a variety of other jurisdictions.”).

48. In addition, in most jurisdictions, “[w]hen an indemnitor has notice of the claim against it, the general rule is that the indemnitor will be bound by any reasonable good faith settlement the indemnitee might thereafter make.” Fidelity Nat’l Title Ins. Co. of N.Y. v. First N.Y. Title & Abstract Ltd., 269 A.D.2d 560, 561 (N.Y. App. Div. 2000) (citation and quotation marks omitted). The indemnitee need not show actual liability; it is enough to show potential liability. See id. at 561–62. 5 49. This approach furthers the public policy favoring settlements in civil litigation. As courts around the country have observed, requiring an indemnitee to show actual liability in every case would “remove most of the incentive to settle.” Valloric v. Dravo Corp., 178 W. Va. 14, 19 (1987). The indemnitee would face an unpalatable choice: litigate the underlying claim to final judgment “and then enforce the judgment against the indemnitor,” or settle the claim and begin the deeply uncomfortable task of trying to prove liability against itself. Id. To encourage settlement, the burden on the indemnitee “must not be too great.” Morrissette v. Sears, Roebuck & Co., 114 N.H. 384, 388 (1974).

5 See also, e.g., Chevron Oronite Co., L.L.C. v. Jacobs Field Servs. N. Am., Inc., 951 F.3d 219,

226 (5th Cir. 2020); CSX Transp., Inc. v. Crislip Motor Lodge, Inc., 1997 U.S. App. LEXIS 16796, at *7–8 (4th Cir. July 8, 1997) (unpublished); GAB Bus. Servs., Inc. v. Syndicate 627, 809 F.2d 755, 760 (11th Cir. 1987); Atl. Richfield Co. v. Interstate Oil Transp. Co., 784 F.2d 106, 112 (2d Cir. 1986); Mo. Pac. R.R. Co. v. Ark. Oak Flooring Co., 434 F.2d 575, 580 (8th Cir. 1970); MT Builders, L.L.C. v. Fisher Roofing Inc., 219 Ariz. 297, 308–09 (Ariz. Ct. App. 2008); Grand Trunk W. R.R., Inc. v. Auto Warehousing Co., 262 Mich. App. 345, 354–55 (2004); Stone Bldg. Co. v. Star Elec. Contractors, 796 So. 2d 1076, 1090 (Ala. 2000).

50. If the indemnitee fails to give reasonable notice, however, it is not entitled to this relaxed, potential-liability standard. Courts have resisted the notion that the “unilateral acts” of the indemnitee can “bind the indemnitor without notice and an opportunity to be heard.” GAB Bus. Servs., 809 F.2d at 760 (citing Jennings v. United States, 374 F.2d 983, 986 (4th Cir. 1967)). Without reasonable notice of the underlying claim, the indemnitor cannot protect its interests by taking over the defense, participating in settlement negotiations, or reviewing and approving the settlement. When the indemnitor has been kept in the dark, fairness demands that the indemnitee prove its actual liability for the underlying claim.

51. North Carolina courts follow similar principles. Consider, for example, the decision in Kirkpatrick & Associates, Inc. v. Wickes Corp., 53 N.C. App. 306 (1981). There, the indemnitor received notice of the underlying claim and was invited to assume the defense. When the indemnitor refused to do so, the indemnitee was “entitled to make a good faith settlement” of the underlying claim because “the law encourages settlements.” Id. at 311. The Court of Appeals rejected the argument that the settlement was “merely voluntary.” Id. at 310–11. Without requiring proof of actual liability, the Court presumed that the settlement was “fair and reasonable” and put the burden on the indemnitor to show “a lack of good faith.” Id. at 311.

52. The Court of Appeals reached a similar result in Bridgestone/Firestone, Inc. v. Ogden Plant Maintenance Co. of North Carolina, 144 N.C. App. 503 (2001). That case involved an underlying claim for wrongful death. Two defendants in the wrongful-death suit settled before trial. The third defendant settled during trial and then sued its former codefendants for contractual indemnification. The dispute over indemnification turned on whether this latter settlement was a voluntary payment. The Court of Appeals concluded that it was not because the indemnitee “was faced with the prospect of costly and protracted litigation as the only remaining defendant in” the underlying wrongful-death action. Id. at 509. This was true even without an “admission, finding or adjudication of negligence on the part of [the indemnitee] in the underlying action.” Id.

53. These binding appellate decisions are consistent with the standards applied in most jurisdictions. In sum, when an indemnitee seeks to be indemnified after a settlement with a third party, its burden depends on the notice given to the indemnitor. An indemnitor that receives adequate notice of the underlying third-party claim and an opportunity to be heard is bound by a reasonable, good-faith settlement of that claim so long as the indemnitee can show potential liability. If the indemnitor receives no notice or inadequate notice, the indemnitee may prevail only if it can show actual liability.

54. Arby’s did not argue or attempt to show that it lacked notice of the assessments or that it was deprived of an opportunity to be heard. Indeed, the evidence tends to show that it received both. BAMS notified Arby’s of the assessments shortly after they were made. (See Stip. ¶¶ 13, 14, 17, 18, 20, 21; App. Exs. W, Z.) In addition, Arby’s actively participated in the appeals process, working with BAMS to urge Visa and Mastercard to reduce or rescind the assessments. (See App. Ex. I at 1; App. Ex. J at 1; App. Ex. K at 1 n.1; App. Ex. L at 1–2.)

55. To be sure, it does not appear that BAMS formally tendered the defense to Arby’s at any point. Evidence of a formal tender would enhance the case for applying a potential-liability standard, but it isn’t necessarily required. Compare Kirkpatrick & Assocs., 53 N.C. App. at 311 (indemnitee tendered defense), with Bridgestone, 144 N.C. App. at 509 (no evidence that indemnitee tendered defense); see also, e.g., Chevron Oronite, 951 F.3d at 226 (“A formal tender isn’t required . . . .”); GAB Bus. Servs., 809 F.2d at 760 (same). Moreover, some evidence suggests that Arby’s received substantially similar protections. For example, through the appeal process, Arby’s and BAMS together convinced Mastercard to reduce its assessment by nearly $2 million. (App. Ex. O at 1.) And it was only after the card organizations denied the remaining appeals that BAMS acquiesced and paid the assessments. (See Stip. ¶¶ 15, 19, 22.)

56. Summary judgment is therefore not appropriate. Arby’s has not shown that BAMS must prove its actual liability for the assessments by Visa and Mastercard. Rather, viewed in a light most favorable to BAMS, the evidence tends to show that Arby’s had notice of the assessments and an opportunity to be heard, meaning that BAMS need only show its potential liability. Ample evidence suggests that BAMS was at least potentially liable for the assessments under its contracts with Visa and Mastercard. This is so whether or not the assessments are in fact unlawful penalties, which the Court need not decide for present purposes.

57. In its reply brief, Arby’s contends that it cannot be bound by BAMS’s good-faith settlement with the card organizations because the payment of the assessments was neither in good faith nor a settlement. (See Arby’s Reply Br. 12, ECF No. 113.) The Court disagrees. Intent is a classic question of fact, typically unsuited to summary judgment. See, e.g., Feibus & Co. v. Godley Constr. Co., 301 N.C. 294, 306 (1980). The undisputed facts do not show that BAMS acted in bad faith. And settlements of legal claims take many forms. Arby’s has not cited any case suggesting that tender and acceptance of payment in satisfaction of a claim is not considered a settlement for purposes of the case law discussed above.

58. The Court therefore concludes that Arby’s is not entitled to summary judgment on this ground. The Court further denies as moot its motion to file a supplemental brief on issues related to the enforceability of the assessments as liquidated damages. (See ECF No. 119.)

59. Limitation on Consequential Damages. Next, Arby’s points to the merchant agreement’s limitation on liability “for any indirect, incidental or consequential damages.” (Merchant Agrmt. § 21 (all caps omitted).) According to Arby’s, the assessments are consequential damages, and its failure to pay them was therefore not a breach of section 10(B). 6 (See Arby’s Br. in Supp. 10–14.)

60. In an action for breach of contract, “the damages recoverable are such as naturally flow from the breach, and such special or consequential damages as are reasonably presumed to have been within the contemplation of the parties at the time they made the contract, as the probable result of a breach of it.” Story v. Stokes, 178 N.C. 409, 413 (1919). “Consequential or special damages for breach of contract are

6 Arby’s acknowledges that the limitation on recovery of consequential damages does not apply to section 21.

those claimed to result as a secondary consequence of the defendant’s non-performance. They are distinguished from general damages, which are based on the value of the performance itself, not on the value of some consequence that performance may produce.” Pleasant Valley Promenade v. Lechmere, Inc., 120 N.C. App. 650, 671 (1995) (emphasis omitted) (quoting 3 Dan B. Dobbs, Dobbs Law of Remedies § 12.2(3) (1993)); see also Crescent Univ. City Venture, LLC v. AP Atl., Inc., 2019 NCBC LEXIS 46, at *45–48 (N.C. Super. Ct. Aug. 8, 2019).

61. Arby’s does not contend that BAMS is seeking to recover consequential damages from a breach of section 10(B). As Arby’s acknowledges, “amounts owed under Section 10(B) result in direct damages when Arby’s refuses to pay them . . . .” (Arby’s Reply Br. 4.) This is consistent with decisions holding that “a claim for contractual indemnity is a claim for direct damages, not consequential damages.” KaiserKane, Inc. v. N. Am. Roofing Servs., 2017 U.S. Dist. LEXIS 5740, at *11 (W.D.N.C. Jan. 13, 2017); see also Arrow Elecs., Inc. v. E.ON AG, 2006 U.S. Dist. LEXIS 107343, at *41 (C.D. Cal. Aug. 7, 2006) (describing “indemnity funds sought by” party as “general damages”).

62. Even so, Arby’s contends that the limitation on consequential damages is a complete defense to the claim for breach of section 10(B). Its theory is that “the Assessments are consequential damages from [its] alleged breach of” other provisions in the merchant agreement dealing with data security and compliance with card organization rules. (Arby’s Br. in Supp. 13.) On that basis, Arby’s contends that the limitation on consequential damages relieves it of responsibility for the assessments even if they otherwise fall within the language of section 10(B). (See Arby’s Reply Br. 3, 4–5 (describing issue as “whether amounts that represent consequential damages can even be owed by Arby’s under Section 10(B)”).)

63. This argument misapprehends the language and structure of the merchant agreement. Recall that section 10(B) requires Arby’s to reimburse BAMS for card organization penalties that are “directly related to . . . Card transactions.” Penalties fitting that description need not involve a breach of another provision in the agreement, and it would be nonsensical to characterize them as consequential damages. They are simply amounts that Arby’s has promised to pay.

64. Recall also that section 10(B) requires Arby’s to pay penalties “based on” its failure to comply with card organization rules or its “breach of Section 13 (Information Security).” Perhaps the assessments at issue could be viewed as consequential damages from a breach of section 13, including its requirement to comply with PCI Data Security Standards. (See Merchant Agrmt. § 13(A).) Even if that were true, though, it would not be grounds for summary judgment because the merchant agreement exempts “a breach of a party’s obligations in Section 13” from the limitation on consequential damages. (Merchant Agrmt. § 23.) Arby’s overlooks this language.

65. The upshot is that the assessments either cannot be viewed as consequential damages (because they do not stem from a breach of the agreement) or are the kind of consequential damages that BAMS may recover (because the agreement expressly says so). 7 As a result, the limitation on consequential damages does not apply and does not entitle Arby’s to summary judgment as to the claim for breach of section 10(B).

66. Section 21’s Notice Requirement. Finally, Arby’s relies on the notice requirement in section 21 of the merchant agreement. According to section 21, the right to be indemnified is “subject to the condition that [BAMS] must notify [Arby’s] as soon as practicable after” its general counsel “has actual knowledge of claims triggering” the duty to indemnify. (Merchant Agrmt. § 21.) Arby’s contends that BAMS did not give the required notice, thus extinguishing any duty to indemnify. (See Arby’s Br. in Supp. 14–16.) On that basis, Arby’s moves for summary judgment as to the claim for breach of section 21.

67. This dispute has more to do with the content of the notice than the timing. BAMS gave notice of the assessments by Visa and Mastercard shortly after they were made and asserted that Arby’s was responsible for payment. (See, e.g., App. Exs. W, Z.) According to Arby’s, that wasn’t enough; it contends that BAMS was required to state expressly that the assessments triggered a duty to indemnify under section 21. (See Arby’s Reply Br. 6–7.) But the merchant agreement requires only that BAMS “must notify” Arby’s within a certain time. It does not state that the notice must refer

7 In this respect, the merchant agreement is significantly different from the contracts at issue

in cases cited by Arby’s. See, e.g., Spec’s Fam. Partners, Ltd. v. First Data Merch. Servs. LLC, 777 Fed. App’x 785, 788–89 (6th Cir. 2019) (unpublished) (concluding that merchant was not required to indemnify acquirer due to limitation on consequential damages that had no exemption for breach of contractual data security obligations).

to section 21 or use the word indemnification. 8 The Court cannot say, as a matter of law, that BAMS failed to give adequate notice under section 21. Summary judgment is therefore not appropriate.

68. BAMS offers alternative arguments to show that Arby’s had a duty to indemnify even if the notice was deficient. (See BAMS Opp’n 15–16.) The Court need not and does not address these arguments.

IV.

CONCLUSION

69. For these reasons, the Court DENIES the cross-motions for summary judgment. The Court also DENIES as moot the motion of Arby’s for leave to file a supplemental brief.

SO ORDERED, this the 30th day of June, 2021.

/s/ Adam M. Conrad

Adam M. Conrad

Special Superior Court Judge for Complex Business Cases

8 This contrasts with the provision governing notices of a dispute, which does require identification of the specific provision that was allegedly breached. (See Merchant Agrmt. § 25 (“Each party will notify the other party hereto in writing of any dispute, describing in detail the Agreement provision(s) at issue, the exact nature of the alleged breach and the dollar amount of the perceived injury, if any.”).)