First Data Merchant Services Corp. v. SecurityMetrics, Inc.

672 F. App'x 229
CourtCourt of Appeals for the Fourth Circuit
DecidedDecember 1, 2016
Docket15-2301, 15-2364
StatusUnpublished
Cited by6 cases

This text of 672 F. App'x 229 (First Data Merchant Services Corp. v. SecurityMetrics, Inc.) is published on Counsel Stack Legal Research, covering Court of Appeals for the Fourth Circuit primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
First Data Merchant Services Corp. v. SecurityMetrics, Inc., 672 F. App'x 229 (4th Cir. 2016).

Opinion

Unpublished opinions are not binding precedent in this circuit.

DUNCAN, Circuit Judge:

First Data Merchant Services Corporation and First Data Corporation (collectively, “First Data”) and SecurityMetrics, Inc. (“SecurityMetrics”), business partners turned adversaries, bring this appeal and cross-appeal challenging two orders of the district court. Throughout this protracted litigation, the parties have asserted numerous claims against each other, but only four are at issue here. SecurityMetrics appeals three counterclaims on which the district court granted First Data summary judgment on December 30, 2014 (the “December Order”). First Data cross-appeals the district court’s denial of attorneys’ fees in an order dated September 22, 2015 (the “September Order”). For the reasons discussed below, we affirm both orders.

I.

A.

First Data and SecurityMetrics are both companies in the Payment Card Industry (“PCI”). The PCI includes three types of primary service providers. Issuers supply payment cards to consumers and collect amounts due; acquirers clear and settle payment card transactions on behalf of merchants; and processors facilitate the communication and settlement of payment. Some PCI providers outsource certain functions to third-party vendors. First Data performs both acquirer and processor functions. SecurityMetrics is a third-party vendor.

The PCI Security Standards Council, an independent body created by the five major payment card brands, 1 issues a set of security standards, called the PCI Data Security Standard (“PCI Standard” or “PCI DSS”) to help protect against credit card theft and fraud. The PCI Standard is universal but the payment card brands each have different requirements for demonstrating or validating compliance with the standard. Level 4 merchants—the category at issue here—have the lowest individual transaction volume and are required to submit annual self-assessment questionnaires to demonstrate compliance.

Any merchant that accepts credit payments must adhere to the PCI Standard. Acquirers, like First Data, must ensure that their merchants comply with the PCI Standard and can impose noncomplianee penalties and fees on merchants. Acquirers often rely on third-party vendors, such as SecurityMetrics, to validate their merchants’ compliance.

B.

From 2008 until 2012 the parties worked together pursuant to a series of contracts. Under the terms of the agreements, First Data listed SecurityMetrics as its pre *232 ferred data compliance vendor in all communications with First Data’s Level 4 merchants. First Data charged merchants a PCI compliance fee and then paid Securi-tyMetrics for its compliance services on behalf of the merchants. SecurityMetrics provided First Data with a weekly data feed and access to SecurityMetrics’s system so that First Data could track the compliance status of its merchants.

This arrangement continued without issue until First Data decided to offer its own compliance service in 2012. 2 In preparation for the launch of its service, First Data ordered SecurityMetrics to cease communication with its Level 4 merchants effective June 1, 2012. In response, Securi-tyMetrics alleged First Data had breached their contract and stopped sending its weekly data feed.

C.

In May 2012, First Data filed suit against SecurityMetrics in the United States District Court for the District of Utah (the “Utah litigation”) alleging breach of contract and other tortious conduct. The parties settled the Utah litigation pursuant to a document titled “Terms of Settlement.” Under the Terms of Settlement, the parties agreed to a few basic provisions that were to be memorialized in a confidential final settlement agreement that would include “mutual non-disparagement provisions.” J.A. 217. First Data agreed to pay SecurityMetrics $5,000,000 and dismiss the Utah litigation -with prejudice, and SecurityMetrics was granted the “use of Merchant Data for the purpose of selling its products and services.” Id.

A final settlement agreement never materialized, Less than three months after signing the Terms of Settlement, First Data filed the underlying action against SecurityMetrics in the United States District Court for the District of Maryland. First Data alleged nine counts of post-settlement misconduct against SecurityMe-trics. 3 SecurityMetrics answered and asserted fifteen counterclaims. 4 The parties filed cross-motions for summary judgment, *233 and the district court held a hearing on the motions and issued the December Order. In the December Order, the district court denied SecurityMetrics’s motion for summary judgment but granted First Data’s motion for summary judgment as to Counts 4 through 15 of SecurityMetrics’s counterclaims.

The district court scheduled a trial as to the remaining claims. On the eve of trial, the parties narrowed the claims down to the sole issue of the meaning of the term “Merchant Data” in the Terms of Settlement. Following a two-day bench trial, the district court ruled in favor of SecurityMe-trics.

After the trial, First Data filed a motion for attorneys’ fees in relation to Securi-tyMetrics’s Utah Truth in Advertising Act (“UTIAA”) claim (Count 8) on which the district court had granted First Data summary judgment in the December Order. The UTIAA provides that “[t]he court shall award attorneys’ fees to the prevailing party” in a UTIAA action. Utah Code § 13-11a-4(2)(c). The district court denied this motion in the September Order finding that, although First Data did prevail as to the UTIAA claim itself, it was not a “prevailing party” at trial and with respect to the litigation as a whole.

D.

On appeal, the parties do not contest the district court’s ruling at trial as to the meaning of the term Merchant Data. Rather, the claims at issue before us originate from the pretrial December Order. Securi-tyMetries appeals three of its counterclaims that the district court dismissed.

First, SecurityMetrics alleges First Data’s advertisements violated the Lan-ham Act. Certain First Data promotional materials stated its merchants would have to pay First Data’s compliance fee regardless of whether the merchant also used a third-party compliance vendor. SecurityM-etrics claims this is a false statement because First Data actually provided refunds to merchants who used third-party compliance vendors. Finding the statements were literally true, the district court granted First Data summary judgment on this claim.

Second, SecurityMetrics contends First Data tortiously interfered with its business relations by making disparaging comments to merchants about SecurityMetrics. The district court also granted First Data summary judgment as to this claim because it found that SecurityMetrics had not offered any admissible evidence to establish causation.

Third, SecurityMetrics challenges the district court’s ruling as to its antitrust claims.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Cite This Page — Counsel Stack

Bluebook (online)
672 F. App'x 229, Counsel Stack Legal Research, https://law.counselstack.com/opinion/first-data-merchant-services-corp-v-securitymetrics-inc-ca4-2016.